d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
Size 1.8MB
Sample260903-lt5fbagd85
SHA256 d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f
MD5 bc832899fafc47345e1bc72521a24364
SHA1 6ef221838198e88a9265fca4832320f826659747
SHA512 dcbb8e4c9bf11a544a98e47258a013f897cf78d55b6b7cdf3863dc6669c9a7cc4af8a2fc5333e54f61ae2b84b08c3af81f8d5f07a61e123277addaf9c7409c56
SSDEEP 49152:yKe7OVje7ve/HxQYwlWa7S4mlKoXESnE4:yKeqk7vePm2Kwf
TLSH
T1C295231575D090F2E5F75F309DB09BA06FBEFC2049258D1F23906B1A2E30A51D636B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5504	elevation_service.exe
4400	elevation_service.exe
800	maintenanceservice.exe
4384	OSE.EXE
1508	PerceptionSimulationService.exe
2712	perfhost.exe
5988	ReFsDedupSvc.exe
3208	SensorDataService.exe
2000	ssh-agent.exe
2248	AgentService.exe
256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a62f19ffe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_es.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_it.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_pt-BR.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_vi.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\psuser_64.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\GoogleUpdateCore.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_bg.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_da.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ms.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_zh-TW.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_bn.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ja.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\GoogleUpdate.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\psmachine.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_fil.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_sr.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ro.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_sk.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_is.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_kn.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ml.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_sl.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_uk.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\GoogleCrashHandler64.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_fi.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_id.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_mr.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\GoogleUpdateBroker.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_am.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_gu.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_pl.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_te.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_th.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ur.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_zh-CN.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_en-GB.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_lt.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_sw.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\GoogleCrashHandler.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\GoogleUpdateComRegisterShell64.exe	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_el.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_de.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdate.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\psmachine_64.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ar.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ru.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ta.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File opened for modification	C:\Windows\SystemTemp\GUTE42E.tmp	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_es-419.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_fa.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_hu.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_pt-PT.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_ko.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_nl.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\psuser.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_et.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_fr.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_no.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_sv.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_tr.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
File created	C:\Windows\SystemTemp\GUME42D.tmp\goopdateres_en.dll	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002dd65df5893bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb110cb3893bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000739ef3b6893bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000136867b3893bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4340	d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
Token: SeAssignPrimaryTokenPrivilege	2248	AgentService.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: 33	256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	256	SearchIndexer.exe
Token: SeDebugPrivilege	5504	elevation_service.exe
Token: SeDebugPrivilege	4400	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 1696	256	SearchIndexer.exe	99
PID 256 wrote to memory of 1084	256	SearchIndexer.exe	100
PID 256 wrote to memory of 5880	256	SearchIndexer.exe	101
PID 256 wrote to memory of 5560	256	SearchIndexer.exe	102
PID 256 wrote to memory of 2732	256	SearchIndexer.exe	104
PID 256 wrote to memory of 3288	256	SearchIndexer.exe	105
PID 256 wrote to memory of 4592	256	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe
"C:\Users\Admin\AppData\Local\Temp\d696808de123d66c1275a25ebb13746afb4c309825024e676106bfa894cdc53f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2820 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2820 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fb1de55727f117d57f06bc27eb525c06e95f4283ef3e86b7452cc785a308c110
MD5 790031ff790fa58343d406b98090019a
SHA1 cecf76f925b9b712b6ea1356902c977bf166a1c1
SHA512 c37e8789687827322d1fc467d8953cf8a70eaf71d06002af628863da3bcc75fea54d59fdfc6604c75e891a9d3f63da480efa6abc7142f8be309bfebc09b65561
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXlKoXESnE4:43q6HjBlwf
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cbfd50d344a3e4cf2fc64913ee1c6b3277ca3d54fbc9813b08709440b62b5ae9
MD5 69ef709252ffe4c9515eb6e037047ec0
SHA1 4107d7dca4d84af7a7a820ea3d653a6f374d70da
SHA512 ac9c4b1cccaed25a042b52f9e2c09aecfc73d7a1b46479c7724a86c8a5b718818937603844ce94a3d168dd24270943631faa374ea1faca91a7d0d0e106bed750
SSDEEP 24576:cXYfDtczAN++GlKoRKycuCflElLrq7R5u:btcBlKoXESnE4
TLSH
T12D05F12877E449F9EC6B8238CCA28511E633BC5447A4E79B03B096661F333D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 32c315451b3ecaafa2becfc0b0f5cab44b83a0bcd8ffd6be668df8bda3a26f0d
MD5 7c4f8a5316273597d9fd6730362c766f
SHA1 8fb05e09c2e70f3f33e28b90cb02ddcc5dd49906
SHA512 c70e49f20e57cc593f02ccc7a69cbba3689ce1a3d76c56f9599fce99e33ccff885c205748386a2e6c7d4eb8774d9ce3c481594c8ad8093b212d49b806cd4de5e
SSDEEP 24576:+0Le5ji0hmxirMA++GlKoRKycuCflElLrq7R5u:+Pji0AcklKoXESnE4
TLSH
T1B235AE26F5B48371D073C0B9C5D2A69AE97230855B308ACB4286D77C3F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 667d7fdccf701a4590dc4e8afcf453b49d4ecec725fd4a9ec4fe7b286e2ceb22
MD5 14f9eacea67592c2d2bb65f47daac7d6
SHA1 cb40b4733fb4a0ad01a4dcc20404f5c061d3b52f
SHA512 3a2d0e23424164bd355f3ae8b277ee91a2856271b3f31189be35fa9c08bc5de2c09b0928ee0b92a829e56f9db882bd30855808bdef56cf5932af62b091cd6229
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyuC++GlKoRKycuCflElLrq7R5u://ezSC6vUzPvxHjyYlKoXESnE4
TLSH
T105755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 64267a50e01ce0e1d2c8681f3fd1fdfff251d6aa3b0660f9d61c618a8be4ce5f
MD5 87fe5ee7c096c6c5e31273b897468f07
SHA1 56453407197b07f54f7b6cba085c3f685d56e628
SHA512 95457ed4d50f342e315881ffb4fdc1a6b9d08149d6c9d8ab9b1c6662587b40b1d806e1057895d6bb1a70170d799327a8a6f6589c06199eaa3dceae29b707e52d
SSDEEP 24576:vVbqPb88hv/l+6Z++GlKoRKycuCflElLrq7R5u:vVO88hXl+jlKoXESnE4
TLSH
T190559E66F5B48331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b6d49cc6108fac8cf90300431a0b63109c20797f993411cd921af59810442215
MD5 45830f526096da1d4ec87674605570d4
SHA1 86bb9f3af56e8973f0fd8c5d307c2bf423c0ef84
SHA512 32de2099cfb9ce0ec1836464862633a1d2fb68404fc3568a520b3441e27e98c941bff9e089cdb2ba78fed398faa8b5f3ff4ccf3ec0074d9ee03e413f4297ba77
SSDEEP 12288:URs+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:URs++GlKoRKycuCflElLrq7R5u
TLSH
T1F7C4236968E4D5E3FDEE0730BDD85B61625BED48858D592B813073977C3C2A2C2F602D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 010fee5754d05b3ec0cafa1d9f06952763398d093f215f5b824b8f0331497511
MD5 84b7e0c89fc093d325d0f58446f8184f
SHA1 750ee107d48e0a77566e78d160e469fb31532b0b
SHA512 2cf1fa83cc38af922c19e5905b85e1258683091ce4e3c45b7cd60d010e799858af4d87af192bfbb4745d71cd5b5098d6b438a117a54e90c7938b7a78646d41b4
SSDEEP 12288:ueBNUbTVO86Uh+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:uJIUh++GlKoRKycuCflElLrq7R5u
TLSH
T1DD05CF3BAD68FCE2C67E4D785A918700E77278304B52A3CBD174820EDE275E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 49a1820b6ecde891bdc911fd1e13793ae0ae0124d6766dd1d01d7c1446d74c68
MD5 dab2f21584896778f691d1c6c96260c6
SHA1 a9a45e5b502360eb1aedee5a3937ae0353a67101
SHA512 b6fe765bee5247d0bfd24c4db53186ad5aa0a58afff40219b1d587f8e4ab8a06ac72e035cda5e4249890c60a9b22e67308948a18600fe00421e0a0b9fbffeb27
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:GQvGAdlCEL8c/yRNw5CKwf
TLSH
T1E2266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 05f90ab53551826c4ecec994d5f69ca8696ab1b8c304104bf7bd1fac28ed4c67
MD5 efbceebaf59c70917747164eb3bfb149
SHA1 cbf1cc93a14c6ad433a71e507eab3e1224ee9e1c
SHA512 0928e16a662dcf0340a88dab3dab880832eb249ccc529a99fa2ed15479160422813fa5e364b5c32e24ea7fc301370d592dc1c8558ed1241ccb997506362922e0
SSDEEP 12288:OAwSfxL/2Dc34DLLmt0LDQewsAj7+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7y:zdewsAj7++GlKoRKycuCflElLrq7R5u
TLSH
T16015E031FEB4E432C6BF0DB21B75C716143DB9204B551AC3E3B89A9E59342D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bef7365cd1ce01be10ce293831dec6efe0778758f283421c300a4cef0706415c
MD5 6766ca4ae3014ece5d09950e45fb4674
SHA1 f2b50ccaa78127513018bb07fd61ccdf189b5d5f
SHA512 9b3feea789ff9c95dd771c635f97c9f9b9c096505282daf655d5cb04b8a61266a917a37cea2933b798d58ca2ab544a7ac9dfe16c48e31d04ca1f56f754ad11e1
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHza:jUEtQevvqc2W1cpV2EI32
TLSH
T1E9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ecc58c04964a6e64da667c833efc18024b1110dfb289d764d48265fdd666514e
MD5 ed32c0980e96d30ae08dfa67107b130c
SHA1 1ecea5a08323b41f50108dc81408f21f2f484422
SHA512 2087c43be3c093dc89d87ea10e9e8f3025ed0ce0d094209ae1031c0349529f935cb1787631f95256e5f5f39eb917814f67195bd414d52dd59b602d11af73a63c
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zUlKoXESnE4:eoq2Vjnm2wf
TLSH
T1E3D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f628545c999e7842bb7aafd87e49e136e2d10bd3dd0373f3a46c57624d2005c0
MD5 3d6561b67778ed4b7f28569a2e304823
SHA1 6f8479e6431e4a8a6a981e05e7935d6be64eae36
SHA512 18d9ae02721766e15e4f6ebf1da8e9560997c5ccb977a841b814cd8498b7d858300b5b96b5e3068025a796aa11572814aa1304cb98d89a123bc7ee9668220b14
SSDEEP 24576:HAhGLJIFoiwtA5l7S53W++GlKoRKycuCflElLrq7R5u:HAMyFoiq5VlKoXESnE4
TLSH
T189359D80EBF955D4F5B3AB7899B68171EA76BCA95E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 85924bcf2fd1e28bda27f1bedbd6a9707c3c1d6fd22798c7fd9b82f35ca3b8a3
MD5 f5d929a2751a9c5c397cb54961c6ddbc
SHA1 37b6e8e40ede2c439eccb4def4da0b283e04d514
SHA512 40840a369b2f7aec3bcefcd56794b0de20abf771497c7087300424dca224a6321c305edfb0e4c573b325a596c0519eac634994bdef5aa1e1fa107b6b806e1dfc
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+Ci+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:BwuoOWP++GlKoRKycuCflElLrq7R5u
TLSH
T16305F14976E41CF9E9A78238C5978532F7B3BC052A25D71F0360C65B6F37361AE2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 938675e7a2100e8f0291fcfc02e42a7f5d21d64a3b6ed96a0fc182093441814e
MD5 cf438bd5d082dbb223c5bf066495c301
SHA1 383140c361995fa1e038b50e0f31aa44a2e88e28
SHA512 64afb48a0f789ef18a73ea148f60553f72214cfa5e175cb68269bfcc5e7290d4a7ad5a9b63c934c1ae129dc6f600eb0a41c6924999bb9b3f387ecc417588e524
SSDEEP 12288:iBZ1IyL+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:MZuI++GlKoRKycuCflElLrq7R5u
TLSH
T1AFE4125936E460F6E9AB4338DDE44B01E377B855537A43CF023052AA2F366D25E3A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bd143cf0b6f44fa1a98b3d5bc522ddfee4002a774e4c1d679098ba668b246d4c
MD5 0545fb62518859f76d1d7df717915be4
SHA1 1c9849bed47c608d4d32f97a05a97f836f5b6674
SHA512 a37eb3aaf194c595cf80d25837a38876832cb994a2a4885b2c0a657918956975afe6af78473b06274bb6e896a11f63df65de0a7a531d67f53fb573b5808ab618
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:dQRQyi36YOcPQLvw2gAf+PN35wf
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e52f407bde2bc9139998a5a42fa6ed5e0b23e4b72629f88b35ebce30a4025a73
MD5 6cf3297b7956ac9326962b093f8419dc
SHA1 388fe006f511dd642582cc71fdb25543c7b2f010
SHA512 73d273c6842efa2ad348f4ad6a4245054a5eaae51a3ba6b2677d26434dd1a836ba569fdacefe91841c9fd88d9a5563d1440e59c155bdaeec07ce85132f5d2377
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:lQRQyi36YOcPQLvw2gAf+PN35wf
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 642ef52c9de47cfd597054dff343017a08b8b5ea231e1797ce045e4616e86504
MD5 c02dd78984bd60a70495393dd71a370d
SHA1 854152e30be12745efa771c98bc9e654e02881fb
SHA512 a204e862ec3950de34410cad291322fa186dc49efbd7b8af0037a091e7f7fefd24f4f39209c4cc44c03a84200449b9f962861bcd04deaaf1f3375947f679c0a1
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL04++GlKoRKycuCfS:l68Qg55nhheWu7PNU3/klKoXESnE4
TLSH
T139B54933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6e2db85139f603415ae0a313ba9356e7dc9e6de65abec8f5ee20f75a368e1913
MD5 6350e0c0f8dbf29ab05fb2c2b6b95917
SHA1 34b4c1fe0edbe3d83587d8c67cc303ca519dbe85
SHA512 ca559bd2e5657cf078e671c78fa6f705cc95c044e87b0cc2aa20db189392c906f57c0027a974e31455fc0daf93bf95678baf11e92dfd7115ebf78f73a0453879
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:jy5112gYy5azzVvL69nLKnhZIwf
TLSH
T194167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a71cf66d15e36a575a6c9b1cc383b89df2a448349eff0b06144aad1d0de90ee9
MD5 def1d0d38229cf642173ae9221de1fdb
SHA1 5fcfda20c9d0f668146125df49ab69f862e52b7e
SHA512 10792022be9a84c29ef9fd9f00527e8995d9b70704b25cf7b76987e29c3992968a130a9c6130b1b0c8d89a0b7365f9f740f79a570f8831544634d6e615f6450f
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGlKoXESnE4:1u6JmVxd2dBwf
TLSH
T1D7D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bd47365a2f4e45a4a35be95488fd81d90d572df0d6ff00d6107f6901aa03b4cf
MD5 ede041f772f1d34e4f6ff84fcea6337c
SHA1 9084bf0c9e22d09e12c4373a463788f8bdf9d986
SHA512 6663eeab2cfcaf9cb6028956e5c7ab01d02f82a592444e2ab4a96fa0fb39661f9d98f2f91e8c0e2889bdcbfdb522af686e91a3d45e4298bd8cb54229862d6e63
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xqlKoXESnE4:QmifPbR2wf
TLSH
T166B5BE13F2D801E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bae2437e87c0411e0d842eea659bad8330b1ff0de03c9dca8033501b5f7f2607
MD5 32c5f02c44c42394e4163442c47b65cf
SHA1 3d74142841e31489390989b7dae04d4187e8aba5
SHA512 f305bcb5762994bf716e9e748c6ef252c9c7cf3a6a3d9beaa88e223c6ed222932c705f274f74eda32fbd341e552d34a4c5a7102cd59cefd8133d45f576bfc1bc
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqnlKoXESnE4:85dKTi61swf
TLSH
T158C5BE13F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 69a4034507d98601a5b7ff375140e3599154a4a0fab274e38539c6a5ae5d4527
MD5 e4a0e0fff2c3b5fd61c61e027326bf3b
SHA1 376d7f6974920537314d7fdd9ea5f2f0fee40d02
SHA512 32cdcc4b9fef4ec771ed29c15a5a643ea6092f318ac84231bc168eb8a4b307cd9b8fd9b16f6eca25fb0f9a4df5a715f332f1f92dab0d897526d50ed4916430b6
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5wWlKoXESnE4:jX2iyphCwf
TLSH
T1B595BE13F2D901E8D05ED178C7468632EA62BC150B39AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f7074f5c1e977739b86cd4c47ac0409ccbd9e2035b6864f8c3da6008799988e2
MD5 fccb898325caf6dc3cccb89d5e761c1f
SHA1 17dda48470fd322c523e4e286897886ae5910bd5
SHA512 0bb6cb9d6cdc345f3fdfed9d193df358d9bb9c8f4052b9ede2059d3d710015e5dfb341dec91186c09451efa1595872557587530c0b99c1d59da70fc5c1e10030
SSDEEP 12288:gU+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:gU++GlKoRKycuCflElLrq7R5u
TLSH
T164C4236978E8C5E3FC9D4730E9D44B51A25FEE4C868E512F923072537E3D2A253A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0c468aef9a1df19c83190a3fc169a994813654dfad30432d3944bbe7029ef8b7
MD5 1afeea7b204fecaba0a311cd8e596350
SHA1 e70cf516a60f65583c5f6e6d6cc5d6a8125d2792
SHA512 013baf72089265131dfd4abae27f0e60ce137d3b872a4a3b38468191c78a9a5511471780a3b6208cfdbc382927baf3e332d92254c7b7308bb8409686cef423b2
SSDEEP 12288:7n+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:7n++GlKoRKycuCflElLrq7R5u
TLSH
T162C4236978E8C5E3FC9D4730E9D44B61A25FEE4C868E512F923072537E3D2A253A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8b0027c03673226a0e14dd1af3c91a4257a2f096f0fda335e78b7e40b3a38637
MD5 de4bad5f8f1e8a733a278def5f97c208
SHA1 b8156bee9731224ae6b9363fa4367a239bab57ff
SHA512 1deef09cf53023bdfdced29dcdbbe5900c642405b5f363bf10f59d5066fa7d4b4d89cf1371d97735e4914e70dc63cd094dce0a175105918b08c9abee346b3414
SSDEEP 12288:3J+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:3J++GlKoRKycuCflElLrq7R5u
TLSH
T19AC4236878E8C5E3FC9D4730E9D44B61A65FEE4C868E512F923072537E3D2A643A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ebd2908dcdae9e43bbc2d9d66f2c208bc74d119824a1b211e4a96e2a50fc5080
MD5 12a1ff11651e523f23708a1f78572df8
SHA1 0dcbfac1fb2fd8a8414848e72c6ab0247f13d571
SHA512 ecb3b1f55602e0e0b6736261cae7e0fdada3134e828054b1856ab235891ebd19a25d00228a28dbee93bb78ebeba3a25d2731b606d205182ba3f84b759b0faf82
SSDEEP 12288:fV2+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:s++GlKoRKycuCflElLrq7R5u
TLSH
T11ED4235539E881E3ECAE8330DDD54721F27BFD48872A532F922032572E393E196B566C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e88a660b19f73dae2f60eaf542d2ca696167f1fbac91f12f88bc3f76e117152c
MD5 7568d0f3cb86579437ed40772ed986c0
SHA1 96b5b94b305bb1aee9763708e1ad0961d4764a5c
SHA512 a85e8e8c706774de79c57b1fb35e0547531aae7168fdc7fabe7b248a9db689cb5646495b0034007f10fdab849d1c509f4267d29b517e62541437d0877a858966
SSDEEP 12288:fO+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:fO++GlKoRKycuCflElLrq7R5u
TLSH
T1E6C42368B8E885E3FC9D4730E9D44B61A55FEE4C868E112F923072537E3D2A243B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c174e0924b85b6a10f91c845a41faf7c7b3aacce609c31c292f5b7fe41bafe2c
MD5 567659c341b117ed88c382c0188f5f21
SHA1 7eeb25d6bef5f84ef4aa18b0068bc5f5b685de25
SHA512 8608707074930592f6b695696ba83a0c874c935fdd24cd0cb6b176baf24599fd420ce913e989283c8e37187a46863c79e13a161808f5a6e82f4a2566330288b3
SSDEEP 12288:hD+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:hD++GlKoRKycuCflElLrq7R5u
TLSH
T1CAC4236978E885E3FC9E4730EDD44B61A15FEE4C868E512F923072537E3D2A253A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 af1a8a7417a78f250d3a98eeba48dff911f7fe01cb31c50720edfd884cbab8c8
MD5 32ac493d1fb40225f78d2ef849d48d51
SHA1 58f27ffc75e2682a97d6fb5a24a0c2852bc08b7a
SHA512 8aa2f6f36c3135054d05e88f442eebbf50f984ffd58a5f4dd413c51429e13c4188735e372f598e7f736b1db1770d3a2b28118ae1aaf4e423ed03209638c02f20
SSDEEP 12288:y/+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:y/++GlKoRKycuCflElLrq7R5u
TLSH
T1F5C4236978E4C5E3FC9E4730E9D44B61A25FEE4C868E512F923072537E3D2A253A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 49145b644d89585fa1cfc41e10fac51887eb2208852b1c346bd1d51fc8c9bf18
MD5 12fb8747d036faa74977b62ec5285e17
SHA1 1cb5403dd6f21b3262441ab174aab764a2e6c14d
SHA512 bd6188aa2655b84921a9da0bdcf53a422138b28c7dbf0737aa362461bab52ef29e75cffcc98e6354601d42e56ab757da6ba5b676926310dd5024185d90af8c29
SSDEEP 24576:AZMSzFVSOH++GlKoRKycuCflElLrq7R5u:AZMSzfslKoXESnE4
TLSH
T1750501A5B39018F5ECA7823ECD558912D2B2BC590760C61F03B432676F373A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 998ce37c8e0e7ba44f961dfad163b208488f7add1520a5b2182b84b376e23bfd
MD5 8ce0db4a6c1d5d36424af77fdf85140c
SHA1 72862db38f071c823983717f8167ab822890e8e3
SHA512 172713e52db1f2e519564b5dea0be130704ce287c37413aaa00c56d877fe104882c47bf68ee68556589006313777dff5fd30459f00c19d0c293f317d064e7fc4
SSDEEP 12288:KY+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:KY++GlKoRKycuCflElLrq7R5u
TLSH
T11CC4236978E8C5E3FC9D4730E9C44B61A65FEE4C868E522F913072537E3D2A243A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1d6a40379aa523ca970623d722f0c24f03b47785f98265caa369db1aa10cfdfc
MD5 7daf112b9dee2e621cb83d1ecf8ed908
SHA1 88a63894b861de4a661e7e6553e2ff261d2c6c61
SHA512 2ffff46c856891fb2c2fd2bbbec6fa6547b306ba583462665f15778b9a41d44bd8bfa9d2cf30cf78d174f060779f53631b8a496ab5fe7ba4f081158614f38ecb
SSDEEP 12288:Q8+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:Q8++GlKoRKycuCflElLrq7R5u
TLSH
T1E0C4236978E4C5E3FC9E4330E9D44B61A65FEE4C968E522F913072537E3D2A243A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5242e8b0ecea04b86f0eb62ccb71b569cd939a41630f20d27cf14459fb8a20cc
MD5 054b5cf9c64f166110c4c89b32e0adcf
SHA1 9cd6baba8f3bcefcf5454e4c1a5b36ee8d560892
SHA512 1d1e10feff97ea8d85876343a926219ea5381df45318162bd12bdc44ae176c034f9d8c0e93113ddd7fef9baffc0c1ae3094682e2bb61251eba70bf436c705256
SSDEEP 12288:pyPz5L8L+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:IzyL++GlKoRKycuCflElLrq7R5u
TLSH
T12EF4025B76E530F9E87A8234C8A11A12F376BC3547248A6F536013772E372E19E7A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 093adca1e3cffc8c77083108d4170807057b6bfe4dac65f01fdad2b774e516c6
MD5 d06c1706dceb47bea36e4172908fbf79
SHA1 e04f0cb75b5ccf85da53a37cc54544bf3db0aeb8
SHA512 0df9f6b6429e4f8b2d074fedb1d1d9d45bf53f3556d4d66f28c00d49f83788c4489b47313038ef53a2fd30384384ced92965ef07d4ec48f15f10b381fa5fd3ad
SSDEEP 12288:eY+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:eY++GlKoRKycuCflElLrq7R5u
TLSH
T111C4236978E885E3FC9D4730E9C44B61A55FEE4C868E522F913072537E3D2A643A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e5adc25900b1c4bd87a9636abf6d9287815c0cc3b43eae48f15ca9aa1a7c0706
MD5 11c7025b4be748530c495f30646048b3
SHA1 3f871d831ba53f419d758e1104a9a14ce9d41cc6
SHA512 b910ba8cadd4635bed66dee9fd34258cd4e1cb530a2adc549056828b99f56db946228bd0c99f0ba8fd94701b64fe7a7136b95b62675905ebf2651003d5494b71
SSDEEP 12288:sY+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:sY++GlKoRKycuCflElLrq7R5u
TLSH
T1E4C4236978E885E3FC9E4730E9C44B61A55FEE4C868E512F913072537E3D2A643B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 dded11041539f4cc6ec82fa1cf4ec6b2448bc203c304d5797bdf828aacc762f2
MD5 d01ee4e8d0335dc173e5b378b8e20ddb
SHA1 d8d9756a6698ed67883048f8755ff862ebcb8809
SHA512 ad5aa3b8e8ec9965940b0cd06443190c59064757c4ef3f32a21d1411d0a9566bf7407d4a1656f28f0f5203d95e9eceb8df341ced953efb9d1a778394771b7cd9
SSDEEP 12288:SyPz5L8L+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:PzyL++GlKoRKycuCflElLrq7R5u
TLSH
T1EAF4025B76E530F9E87A8234C8A11A12F376BC3547248A6F536013772E372E19E7A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a321c1a5c92502cbf16f0b2cefd6df30952f1fda5db717a7f26ece0969e599e9
MD5 09c34d3f6709b24fe2ec047ea763ec04
SHA1 1c877b30a6cb62235b01e222d321a62e2a0d167b
SHA512 80164d525224aabd481f3253d025cbccefff1130db3a991388782b53f048e4159c169e3e69d036f5f5d8d5eb0989c53cc94c8256135ec74cde255f5e96749762
SSDEEP 24576:rTHaLl3z0zD5++GlKoRKycuCflElLrq7R5u:rT6LljRlKoXESnE4
TLSH
T1980501A4B39058F9EC67823ECD558A12D2B2BC590764C61F03B432675F373A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 37c575561d05efc6e497249395ef04dea9a89ecc7dc7418dcf4994b8733c4fd7
MD5 8351a4470e43d67e1f7a7e482d581bac
SHA1 4ffe2d2aba2e63d0ae6840a9d7b0d8c58eae169a
SHA512 5bb76e374356f83bfbccd3f76a9c50830582c7999ad3cdffbf0a90c5e6073ed07e3822ebfa4baacfff4e56259dec2f68b4b604a7436c2a4d19ba2b3d872857de
SSDEEP 24576:/37d9CHKy7GZV++GlKoRKycuCflElLrq7R5u:P7d9CHKyaslKoXESnE4
TLSH
T15C25CF90F3E414E9F0B78A35CD764611DAB6BC591B21DA8F03A4265A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 84385f6ed79becc297082d430f91901d9611407f112f050f1d37af28a05f30e4
MD5 3175217fc9a33fe885853a5f9991a0aa
SHA1 b51d82f59e839bd1e9c7dd1ffdf3e50826f728db
SHA512 f8174de0f9a28c134dcc375e556ea12aedfef74a9e67fa7857b4ff542281cfa109c11f56767cc51e75c5b057ad7c948bc0bc1b0fd2dcce848eb80d6d761ecbbc
SSDEEP 12288:Ep+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:Ep++GlKoRKycuCflElLrq7R5u
TLSH
T145C42368B8E885E3FC9D4730E9D44B61A55FEE4C868E512F923072537E3D2A643B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 10bf93f9507a1209401f7c440c2b4a42562d9d03055070078edce67364a32b3a
MD5 a8fb4d806cbf70615c9e30a37d9a291c
SHA1 38db2dbb15ffcdf48dd1300564dbf8dd68c384b2
SHA512 8f471580fb787d626a860b9ee87d1bf24201d4755f5227d0158372b27c12f095620304760500bf9fa60e1a570af7d1d59f5940363b548e5eba834eea04a37b03
SSDEEP 12288:Kr+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:Kr++GlKoRKycuCflElLrq7R5u
TLSH
T1BBC4236878E485E3FC9E4731E9D44B61A65FEE4C868E522F923071537E3D2A243B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 8b75227a2b6bb68c164b73681548233ddabe0f85d0ae2fe4e30edf1a6b4534c2
MD5 8a52068d0d6575a3e2f4170a9256bae9
SHA1 77d371eb7cddda0db6989043b523660a30acee91
SHA512 6f91c0f5097868d93117e38a5c8380ce7a055d8801532dfa50fa239326a6cc1ff0d1915a029d259ead2776772b6162ffc6b780cede91f5e657738f4920087a9c
SSDEEP 12288:9a+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:9a++GlKoRKycuCflElLrq7R5u
TLSH
T161C4236978E885E3FC9D4730E9C44B61A55FEE4C868E522F913072537E3D2A643BA07C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 e2da505928f807b5bc585de9a0e132071e2d7bc55c78de8082477eaf6be985c1
MD5 32b5e58dc08219e7b186affcd571419d
SHA1 878f8d26989ed138a6685d2e2b471ead35293c95
SHA512 462691a3dd4d0e197ca1db553a5e40f4acf3e5a4ba9f66aabc6da5f0c673b3bcbfb55cb9f454fcf2655c861dc0e8051c18e196857d0aa9b40d941b34bef0e593
SSDEEP 12288:kY+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:kY++GlKoRKycuCflElLrq7R5u
TLSH
T135C4236978E885E3FC9D4730E9C44B61A65FEE4C868E522F913072537E3D2A643B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 468533f53411e7f8df702362c27e63d0f1fe561cb3842fa54f538d096868030a
MD5 c4a7a26febed750c0be723979e641710
SHA1 9c2d9f94ca9bcccc25db55be67f88c12a7dd61af
SHA512 b03a9412d381d12ae434fa20ca6499b744f013c1dfb25bc9727dc4dc1b8e74e31cab0ecbc338959ac3801893fe979a57084261654127a8b0b3883e575c3c4442
SSDEEP 12288:2p+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:2p++GlKoRKycuCflElLrq7R5u
TLSH
T142C4236978E885E3FC9D4730E9D44B61A25FEE4C868E512F923072537E3D2A643B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 22411e3645b2903da1cd4b25bd2b4e1a0673646a805ed25a406abd9354006049
MD5 ea84913bc6b579671ab4e9f2b51afd8d
SHA1 9e650f2ceb0b77a207dd20cea9d37d3b26ff7739
SHA512 d648891767ed4e9d3c138de3ebadc45deaf8ce733be97611e141b8388f80e0ea8fbfe1763c96eada88ad11e36f39efd3a204b01c1c25c20929be289003cdd21d
SSDEEP 12288:gw+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:gw++GlKoRKycuCflElLrq7R5u
TLSH
T154C4236878E485E3FC9D4730EDC44B61A65FEE4C868E522F923072537E3D2A742A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 bb9841341bf60e567b21b306a55480745457586e2b719321aa8f857f29c48b45
MD5 0650f86a23b194bea471c939c76b4dcc
SHA1 25db14bfdba25d316580ab14b1cc319a4bde6362
SHA512 827501b5d8fd9d39bef8e888649aa64442728d89c2314cb48208e3bbc35f29d8a7dfdbeb607777e51c163651718c4d96d3d2ce1e7475eb2279b6e22c647764f9
SSDEEP 12288:6O+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:6O++GlKoRKycuCflElLrq7R5u
TLSH
T1BFC4236978E885E3FC9D4730E9D44B61A65FEE4C868E512F913072537E3D2A243B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 1eecbacb06f7101eedfb0703605e78aa35572aee9cd6570f1de97a1258151ca0
MD5 d7cf316acdf0d3034490e33f6496f427
SHA1 08756b5b2861a8449d999e95e4b113613a57de07
SHA512 37e7a43b89d638fbe9a23317e34d26e0cb8cbfc4188025f957914e0d4fd5fde65508a421fe34f9bf03d6ebcd033b8caae7ad8082882cd3f807e1dd7a8e04c74d
SSDEEP 12288:0x+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:0x++GlKoRKycuCflElLrq7R5u
TLSH
T1D8C4236878E485E3FC9D4731E9C44B61A65FEE4C868E522F923072537E3D2A743A607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 e523e7c320ebd75f4f7268249bd42744f7b2a1a4bf38ee151f71f86eb54ce860
MD5 d6868c92871acf42f585ef41ed4f4953
SHA1 439070fa5968e403d128d1ac5e2e2f4e9c162da4
SHA512 1c9ac45268f8d8dc2dc80d0c146333232623b64e890d878f022b6534c956a8e867ee30532091de480ff00085b2574905336217bef9623e0ce719dc53b78248a4
SSDEEP 12288:bO+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:bO++GlKoRKycuCflElLrq7R5u
TLSH
T1AAC42368B8E885E3FC9D4730E9D44B61A65FEE4C868E512F913072537E3D2A643B607C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f073e8ffa1de5fd08eb520163cf0c846ad8c47d7b993eaa37b38f640bf39c3e9
MD5 b8b3615b912000ec6dccb73326c8d64e
SHA1 7600aa48f4bce0318c3a0d9d5e182d2de0252114
SHA512 1c04fdcad24eaf2d2c052c6ea51cc8e03beedb8013dc7929143f59354bbe34653004341ebd1a033404fbaea5d67ac8f86ed685ae4abdea23be508c3b60ae3fa0
SSDEEP 24576:qfwvok9RX6wkyAIM++GlKoRKycuCflElLrq7R5u:2MnYIblKoXESnE4
TLSH
T1E835CF29EBD844E5E1B7923C99F74606F2B278581B31C2CF025653AE1E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3dd992ae947677649995962b2b9f1f1ad9b679c5fa94a8127e42db6a11e3ed6a
MD5 a13ed83402e74a8e31cd8dd9059585c4
SHA1 ed9ea2380fabecf7c20911040a7cdf83171eeb54
SHA512 d74b0255185cf77b1291c0c7ce8d7a6544b728e4664a8257a33004fe7399038314431fb73247f2f1f7a495cead5ddfac3d7088d0ea47a356c10b5ae6839928c7
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02lKoXESnE4:PySzPZwf
TLSH
T165066C96A1A841D5C1B9C1B98F0BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 87be3627bb26be941b5dbd2a33096ac0d39ac43650de26a949b90ab0dbba674d
MD5 ebd4374824b567a84de977fcd64d1c42
SHA1 7d2f78642abf7b247719603c1d983e630ec749a4
SHA512 7458577895d6d9d8f5d323266455458ef70f748e91dd3d5cf702807c58206c16f8f6e6437eb99c84941d01b9aa67906e79313c0ff56a2c52bbddb59819f55888
SSDEEP 24576:947Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYX++GlKoRKycuCflElLrq7R5u:947JUQj1irIhCnDHUPfF/GlKoXESnE4
TLSH
T1B865AE1EA3EC01E5E1BA923885554A5AEA71782D1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 77faaec010df7dcab10a510f3218701b706d607005340211264dc70ce909da37
MD5 29f83a4e8aee706232cc6ac03283e4c9
SHA1 2f38d7e0c5a56682b06d0c4fefcaee3b61be97f7
SHA512 3e8cb13de8c41965712f2468c3ed5d9d51b5841eb22f29c3db178be7df43de851a418a50ca3fc40aec5a9e1dfe4602530650bd17ba03532b70e4d7eb00711bc0
SSDEEP 12288:CNsfI+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:bI++GlKoRKycuCflElLrq7R5u
TLSH
T13CE40119E29842E9D46E5235CB954A41B337BC2483E5D3CB52D0F13E2F3A2D19EEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4f5a3a9cbb58f5327af56b4a7a43243d30a46856d6942575c4e67bc02931222b
MD5 cbc59a7c6a21aec08a188a6cc607c35b
SHA1 22c458258b6b2c2bdb5e0c5dae32f956c4d6c5d3
SHA512 7943dcc0315f63854e582a9bc02ee4bae85637f150576037fa97e46550ca2b9c06f7ab076558872f0f276e49d506f4161d82113c6ab72f894ae13c5fcc83887a
SSDEEP 24576:/eZ5UPv3WMn9OHynz+OrqMmnOuAH1xjz/tYBMCeH5uBj00I2:e5UHWMngHynz+OrqMmnOuAHnz/tSZeH0
TLSH
T1F2553840762BC79FC6A940325E32D6CCA7707D01FE456F0773C8873F8476669BAA6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6aba26222caba6a45ef7b30d446a46e4eb48c5a0ceacbf5f97516c0648f51a75
MD5 5f6e2e2f593685c9ce42f425e732be54
SHA1 e8dfeb0706af369e4bf26387a23bde82a534d1f9
SHA512 c2dabdcad5d85c454536fceeff07180c6f620849b1cce6b53d425b17ccb39a60dee3186619dcbb037b48d608718070cac8c3ce4961a401b429c3d8863be9a389
SSDEEP 12288:c3fZQE/CHJxMvPI9S81/wryUuTnf4op84u9O8:c3fWoyjYA9EryUEQo84UO8
TLSH
T181552941A4BBE35FC9EE50374632C68DAB745C02B7853B0573448A3C9877A7EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 78c4cc40a430fdac1da0a713b4984604f40a75f1d75447eaaec8965cda5305b5
MD5 1fc905cf240090ca5b55b18837ab49d8
SHA1 be215d3b246bd1d76bae8f931d221f9c48b26aab
SHA512 1f88e7638d157b918f46a99fb777787934452bba24530c14f5a5a6e8549471e63e623ffe845df33c38dec3a9e426f05fe9a037c4682c8547e32c8e827a35d8e7
SSDEEP 12288:0F7g+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:Ig++GlKoRKycuCflElLrq7R5u
TLSH
T117D4236574E8D9E3FCBD0730A9D88731721FFD5C8B49819BA12072977D382D28AB612D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 11cf46cbf94bc166925918aeadd5fa6596a642974a5bfbe23fb645695769c624
MD5 83a1cc6aef9c1e55177c237207c7e4e4
SHA1 021c4e7fc3bd1fd41945dd0b46cbea85fe0dfe05
SHA512 f5215081eb885407b3a56acbf349e585f9f49117141644745af5acf7996dd4172b3a3a31ef698b01d97a5d0bd9f739ccef148fb82313f8306ebeada4e3dc380d
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYC++GlKoRKycuCflElLrq7R5u:wgb4mBIBhGFAlKoXESnE4
TLSH
T108659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bbbd272dabf645f9daca68c54925aff6205bd11842e08c7af8bfc717594b6f37
MD5 1fd3cd1a46ef821c86691b58d1b4f941
SHA1 068e7455cb09ac246a690ba5de27102f844f390f
SHA512 3189f9d72c3ffa76381d61f095d0737e956b1aefb81c25cff88081e18abe6d0802cc72ee7530a346439585897cd9bbe9967e917ebd7e8de2f63a8b893c3af025
SSDEEP 24576:oG88u8FpJqH1bzria7/mH++GlKoRKycuCflElLrq7R5u:L7ZFPqVea7/plKoXESnE4
TLSH
T1A735F16576E001F1D87BD13889864663F6B2B8250364EBDF07A88B521F237E54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6a641273b4e28b3ca8df68bd2a7fa7ed61c420f85afb49998f42be61d56b5638
MD5 9bbb5612cbaed9a42f0795f28ae02bb4
SHA1 36bb162aa5cbab02d1cf729e802a55d69923c943
SHA512 01bcf45d8d5cc81a159ff02c34e2bcd541a8c7c96082db6b39545a83c2a85b98b8c9c104037aea3d36fed324490edf1afb6eb8ce3cc12ab6f703ddb0c8d8367f
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjclKoXESnE4:CG05lO43bAwf
TLSH
T166D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c18c6aec6e9d63c4a98a88e271ddc065b9744f9dfa7d9626c55cd145705f633d
MD5 d0bd09228521bd5716c979400452b875
SHA1 55ba1b439c4532a75608dc61580187f4fbd889a2
SHA512 c93a382a409bed813b4ab6f1ecdbcbfe917a6df3399935a82304da9c2de82c216dad2bee39b501f096f8d2ee483b9ebc2fce246c2d300cd009e9c0358a78a1e7
SSDEEP 24576:Mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnt++GlKoRKycuCflElLrq7R5u:Ua5POZ3+Jt2pasx2+mklKoXESnE4
TLSH
T1E465AF5EA6FC01D5D5B9D17CC583461AF5B2342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 982bb0693ae5bd80429c09fafa88dc6295a0d5e3f9935a49b5d6e4373b65bb1f
MD5 a90b9e57a4a1f8321a04ea199faaad92
SHA1 5dce91e143e19471e9a178cd85e2915f64757e88
SHA512 068c2874c41bc52f2f89c0e4205db87c2b3f8b6ea1f0d68739ee6c136b51c9fb4b70e29d43c709845fde73cb7a800f573112bd0cb330fa46be5f66b85981de08
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7Fkv++GlKoRKycuCflElLrq7R5u:zNc/zEOVHFJlKoXESnE4
TLSH
T19C858C2622E901E4F5BBE1BE89779546FA717869133486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5265e956c25c67df0df937f3141949fb55c01b7fef2c4337d061e7d5057cc195
MD5 856d3d5c62a4a70de9fdef6427a9db1d
SHA1 5adaafd76b1235e9ae64c67bafa923982e478b61
SHA512 de0cbb95b37f00c9bd58ac223f254d97b8023eb4fcda22dfae667e9970fc4e50bb7e260bb0ae3cde15f1bb3162299bf3c3c78798e9809449a5aaceb52a713c67
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmx++GlKoRKycuCflElLrq7R5u:n8MwBtOmalKoXESnE4
TLSH
T1D855AF6EBAF846E4D1FEC674CD238512E6727461073292CB5290C13F1E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2cce57b0e6a241b518091384e5f316601473e39eb4d4477bdaa5fc302099d635
MD5 e8dafc77fea11508137de29d2a037a12
SHA1 5c727b165b73efdc984eed73748eeaf7b38f9b5c
SHA512 3f32157281e6bd6ca766db0f79148b23423a2198905d00e67fc4d72e44a3d53911edbdec5dc8e5ab37275335740f180c60d78b6826eb96c781fcd00862357334
SSDEEP 12288:PHvUrBFrEjwaQT+I9CLKg1lKoKEKycazLTVS7flE04FLntZq7R5wE0:PPUr+NQT++GlKoRKycuCflElLrq7R5u
TLSH
T1D005E22F25EC18E5F67AA13D89864719F772B855031292CF02A0817E5F37AE8BD3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 8815f253b3f2dfd565a13b7cc341113eca4a1c14e207f566624ddd00eb8e8a64
MD5 f81a102328e10fbb635ad59ff670274c
SHA1 79868f72debaebb930408f9db9d7b65cb1c01788
SHA512 07511f4c946347274e594a0e71e56db6a0863822cc0006618734f741ef97dfc2ec970c6603562cdbdc15a67c1d14d4645da4f1fee272d102351c5d24c8dcaec7
SSDEEP 24576:ZD3FHshBIYQgA0++GlKoRKycuCflElLrq7R5u:ZDVHeBIAADlKoXESnE4
TLSH
T1F925E17DE69C04E5E47BC27CDA938A06E77278AC032255DB029091B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-215-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/256-438-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/256-208-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/256-209-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/800-186-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/800-105-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/800-223-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/800-106-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/800-112-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1508-361-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1508-135-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1508-129-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1508-127-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2000-175-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2000-437-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2000-184-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2000-177-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2248-205-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2248-190-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2248-203-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2248-191-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2248-197-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2712-376-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2712-139-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2712-145-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2712-140-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3208-380-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-162-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-169-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3208-436-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-163-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3208-434-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4340-383-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/4340-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/4340-8-0x0000000000BB0000-0x0000000000C17000-memory.dmp

Download

memory/4340-149-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/4340-1-0x0000000000BB0000-0x0000000000C17000-memory.dmp

Download

memory/4384-117-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4384-116-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4384-335-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4384-123-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4400-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4400-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4400-93-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4400-207-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5504-81-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5504-88-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5504-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5504-174-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5504-87-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5988-157-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5988-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-150-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-449-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5988-451-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-151-0x00000000007F0000-0x0000000000850000-memory.dmp

Download