3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
Size 1.5MB
Sample260925-k778paxyey
SHA256 3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690
MD5 e8d33e3ede726eb83c77c5a29762cefc
SHA1 caa797213ca4919d2f0dc52ba0168d85a819eb6d
SHA512 eebda56b855c04842d08f655ff75bc0273ca08ce78439f7d08ea2b228bf902dbfa347d38bcb37a5f5153a974c8748e5ec91da8e9a7171c7876ba2192ecf0a2b5
SSDEEP 24576:EifBe8EA3Zy4ABxP4ItCPX7qQTu5x2z/eO0zp2N3vhJuz7UIgn:rUp4A7PVCf/TuP4/eHt6fDq9g
TLSH
T1E675DF2AE69801ADE177D17CDE638413F572784A07B269DF0390EA655F33AE09E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5476	elevation_service.exe
4552	maintenanceservice.exe
2908	OSE.EXE
4340	PerceptionSimulationService.exe
4500	perfhost.exe
476	ReFsDedupSvc.exe
5280	SensorDataService.exe
4820	ssh-agent.exe
3056	AgentService.exe
5892	SearchIndexer.exe
5940	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c963f92e4b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b02177bece4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d59ea78ce4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002846cbece4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cebb07bce4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e64307ace4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a405bbece4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aeda047ace4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8ebda7ace4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
2908	OSE.EXE
2908	OSE.EXE
2908	OSE.EXE
2908	OSE.EXE
2908	OSE.EXE
2908	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5072	3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
Token: SeTakeOwnershipPrivilege	5476	elevation_service.exe
Token: SeBackupPrivilege	476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	476	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3056	AgentService.exe
Token: 33	5892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5892	SearchIndexer.exe
Token: SeDebugPrivilege	5476	elevation_service.exe
Token: SeDebugPrivilege	2908	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 4924	5892	SearchIndexer.exe	104
PID 5892 wrote to memory of 1860	5892	SearchIndexer.exe	105
PID 5892 wrote to memory of 5068	5892	SearchIndexer.exe	106
PID 5892 wrote to memory of 5764	5892	SearchIndexer.exe	107
PID 5892 wrote to memory of 3732	5892	SearchIndexer.exe	110
PID 5892 wrote to memory of 3720	5892	SearchIndexer.exe	111
PID 5892 wrote to memory of 5844	5892	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe
"C:\Users\Admin\AppData\Local\Temp\3d502113501803d8344be6372dd38e44df6cd4075406ef48700a14c2d23c9690.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4500

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:476

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b23e77d5fe83707ec41eb446751fda76a21bbced055353131df46051e19748d1
MD5 dfbaef5426c1d409051bab88448731d7
SHA1 2bf932e3cc20e835d1dc54a610d7f25660c97aa3
SHA512 93578c10ae9a3115d91467bcd8c0bc86189c06fd211afd8470267baf69f1e5780dd7eded880c2fac22a6f1fa1449e6e8de356657e83650b7a6c3fa61fff47c25
SSDEEP 49152:gb+632BuPkFKRrdE6oh2stBhuXjfS4LWxnZTuP4/eHt6fDq9g:K3q6DjBaug/eIfD2g
TLSH
T1FCD58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 3.3MB
SHA256 2996b6e3a3100972637e57dcb2e7a21587d8ff03c356479108f868406a0f34c9
MD5 f0b3ca9596cb6f061adbd13c2f310036
SHA1 19204b31bb51574b5bd8fee95eff8cd06b34cb3b
SHA512 8a65621e54ddb4316f4cab9aeb456a27f41d124d15cef7a73cb8f1883863b7d27971f3607a18221939b82620466f3d1d5c57c703b3022dfb35b576074c535de1
SSDEEP 49152:Fb+632BuPkFKRrdE6ohpstBhuXjfS4LWxnZTuP4/eHt6fDq9gWTuP4/eHt6fDq9g:b3q62jBaug/eIfD2gWug/eIfD2g
TLSH
T133F5AE03F29A00E9E06AD578D7069133E9A2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 9013853f6e05902904bed7e700e280a884190cdf9fc0ad0ae2d94b19d238a31c
MD5 9528786d592a06f24d5aff0cb8b2a072
SHA1 a78d4031aa9ddb7a8a8d84471b57784b3eb1a403
SHA512 2349a458542a608acaa40d8865debce3c03ff129aa806236947b9c875caf385c6c4ee9a5a99e0fc3a00d23fd21a72b1cb0efb45cbc56cb83b3f5d35a08ef43e3
SSDEEP 24576:aXYfDtczAOQTu5x2z/eO0zp2N3vhJuz7UIgn:BtcCTuP4/eHt6fDq9g
TLSH
T15355012863D508F9EE77827CC9618511EA73BC8647A0FB8F03A49A255F332E45E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 6bb053bc6301cb82b3f2b1ea5c3b00b511a2701b90c57127f6ab3dbedd17ef0d
MD5 982458b515721d80b3b099c8391ac3a9
SHA1 2d205b033d78e73186636cc9a99154342817b46d
SHA512 4d916d78347f1c47587d0488bbdf06c724032caa5b9c2630837ed9a2305777d809e3df32acc3bf4779d69b6ff4bdb7aa32751420814842d4bbab858fabee5443
SSDEEP 24576:H0Le5ji0hmxirMjQTu5x2z/eO0zp2N3vhJuz7UIgn:HPji0AcpTuP4/eHt6fDq9g
TLSH
T1C575AF16F6748335D073C0B9C5D2A69AED7130865B308ACB4286D77C7E67BE6863A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a7913fd2a16a3d6d726596963a71efefdfeb2e0bb2db63bbf4781a595f74005c
MD5 7ea789c06222b7d7990114ec13b80c69
SHA1 2eed87f10b0fdba1c353a6d249bbc042a96e4064
SHA512 4a4bb1451a472c95f277840bb7fc5f416fa721b7890a5f6d9d28bc4c5a60d3d550a5b8dd6188c38d6c63ca180323bccc49247996cdf5df3113d8c065e90ad524
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyuhQTu5x2z/eO0zp2N3vhJuz7UIgn:n/ezSC6vUzPvxHjyVTuP4/eHt6fDq9g
TLSH
T135755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3D277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d2f0070026b26c750683e5b41f2c4dae185e4963fbace8c068dd59c9a62d573c
MD5 ccc57277965d8b738383d6c94c83b726
SHA1 fef578f25c13f6498df0ae1625fd1f3db3ae36ea
SHA512 5f331e143ed6a972199a121d61cab003e5f1f088e24d86c3f77d827d91c853953f1470c03225059156a5e00374c8e1cf196433a819862e0bf7ea7fc70c197a76
SSDEEP 24576:4VbqPb88hv/l+66QTu5x2z/eO0zp2N3vhJuz7UIgn:4VO88hXl+wTuP4/eHt6fDq9g
TLSH
T142559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E777E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 271ae51c90f8f80944e5c2ada7b4e53ec0c65433ff088a8f24ee1425b485d846
MD5 037a0378db1b6bbfddf683782a03b52d
SHA1 8d4ab2aa34c3c7f7689b6d946802fbed0ad650cb
SHA512 1a8b64609e423ed8478bd4758dd16e7bd0adf1cdbb08e473f489e8f40814122291a360beff377da5e9ed486d722537ee0d35b6dc310f993187f739b1d88b0b71
SSDEEP 12288:ERvnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:ERfQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1AC3523E2428654C6FF774A74F6244232F8B2ED8B7AF53D5EE3207B4894394F08A5711A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 2e256dca6852e4930e72d2df261344da7cd7c112eb56ec399e835ba7d38bc7f5
MD5 2284af886dd2cb297ea1a20923b59d73
SHA1 9716b470cfe69e58b8f0cfc39815ca891849b46c
SHA512 b6ec7caba3b7cadc58ec783001b2e66eddc3e6d2d003af3b7fcc16f80efa2c62fd389d8dccff26d5cddc1bf36a42df3ad516336e8a70d17734f84bf7166161d0
SSDEEP 12288:ceBNUbTVO86UUnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mJ:cJIUiQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1A455C07BEE28FCD2C67A4DB857518200E77278714F62A3CBD165830EDE235E05E7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cf30fce9e5cccd22c9581ba1d3a5f34bef05d56da49f2fd32c9da36d732f06b8
MD5 31214b4a7673ee2113ba29a893ef1cde
SHA1 acd928a8b4dcaee77e7cb4f37d1b85667dd3cbff
SHA512 1229203ab2257524eb6516564b19a93df97a41f18c50376547a53b87508e18ec7f5af99139090489e5795d46f58bf2e589336ca0c03b68812c36a7383a3b7580
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:xQvGAdlCEL8c/yRNw5Ciug/eIfD2g
TLSH
T148267C656BF880F5E0B7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 fc8ed99fdd6859e82140432897fd7dc4df318eb7b7579efa5bc384e88741c745
MD5 8abff2603090496e531c54641cefab25
SHA1 537484c6ed8860ec2c5a2662fb98b9cd6cf80872
SHA512 e0977b6480f8d4bd4e5880898f40f11c431748b1d02f1c04ed64a7e1aa84b7ccbb4128f3eca8e1d28920721f0f380dab55c9c895f45500002a1f2d0d5de6ce46
SSDEEP 24576:udewsAjIQTu5x2z/eO0zp2N3vhJuz7UIgn:Glj5TuP4/eHt6fDq9g
TLSH
T10C65E031FA75E436C77B0DB21B35C712647DB9204FA129C3E3A89E8D58342E22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 52acb8744c0c733ab4ed078b5c0f80becfe11599c74c61036460c03968f2acb9
MD5 6ce069e869fb9ca73ee7bd61f5758607
SHA1 8a9cad0d8866cf00affa206d9da43be0b5b8afe8
SHA512 47c79818bc1729022037d568a5641dc642eb234b6d03468fc03957e961f631b74c041b56ae522279b80ed1a6e9b752c95b96ad92cdb849573b9b2f12b682150c
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf/eMD2:YUEtQevvqc2W1cpV2EI32fW1
TLSH
T19D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b98f13e59f7eb9cf618c21561be9378ae0fe759bc0976bdb3b928cc0b4a44a6e
MD5 90f4bb633f582ecce4c18b67e2698d07
SHA1 0fbeadcef3d7d5211c85fcc37ef4cbd729a41b28
SHA512 d270f36e662ae31178785446508a09e4ef2d55a3714f3250ce6abf9417c754b47976e3eeac5437c66bb93ce4a9c85f57f5c98b8da72178079e78cfaad8295183
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/zZTuP4/eHt6fDq9g:4oq2Vjnm+ug/eIfD2g
TLSH
T1C1D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fbe55f89d5c67e1a8c5b6adf20b238f4fb87cc7ca397fec3475a3717b349a65f
MD5 4aafee17dbd4ed8ee828ee21db6f4048
SHA1 bb4efefc54aa6f969f6d36f93d1f2fa026c0b1be
SHA512 723be813a7441cb2f0bb7889d81a68950f7f06c81c950881dcdba72d1c2ec1cf52ee1ac30fe53cb793009316999534e1b40cdb2e940b561a8d94a67904a0e031
SSDEEP 24576:wAhGLJIFoiwtA5l7S53FQTu5x2z/eO0zp2N3vhJuz7UIgn:wAMyFoiq5uTuP4/eHt6fDq9g
TLSH
T15C35AE81E7F945D4F5B3AAB899758171EA76BCAA5E31D20F2160D20F0E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 c3649b6c72672a89f10bf573a2ab82d3799f4eea342786084d4d95b017dbb3fa
MD5 a42824604e6ec5e3bc6228902a7abf5e
SHA1 461b638bbc48117ead0f37de6334ccaaa7b19c16
SHA512 624b7dafa106167a68c7b28930145d314e418302ac72ff946d6ab919a5b73c6e2aae87741d067f1ac3ae762fcb721997f940667ff424ed6c8d828ab1d5b02f9c
SSDEEP 24576:AwuoOW8QTu5x2z/eO0zp2N3vhJuz7UIgn:AwDOqTuP4/eHt6fDq9g
TLSH
T1C155F14662A50CF9EA778638C557C132F7F2BC062A61DB1F1360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 afa9816e3a5a2169f71dda748beed5dfaf46f0a3db31fe1ee19f9a1db8aa9cad
MD5 cdf14b535edd90b13ce2fa4c7ca2fa03
SHA1 6b7177cef68fc2b693a258f34947cacdc6dfaa29
SHA512 0abf7fcc617fe79e537729df6165bca863f54ef71b023727b252844a91d7e3d8a654cf3514a607d798ab8d7f5a942a9518f55fad734cf9935e18ae5c96535502
SSDEEP 12288:IBZ1IyCnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:2ZuLQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1BE4512A613D520FAE773427CD9604611E7B2BC9727B227CF632057595E37AE10E3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3ba813fa9efad904f9b180fd29c0161a54cfdd0aa3f55777b986aa6adc261c14
MD5 19047c2e58ee2143aa95ae216eaa44f9
SHA1 808ae9a05a0ac8bba9b1581bb769307e8a3668b9
SHA512 0c075e1c634bdc68655834046d83f1f5c1c9c6f793782b24bdd137d50838b34fd3207034e6f3593a9b811d9c492065c99d05aabad4a691d0a9d827e372780f92
SSDEEP 98304:oQRQyi36YOcPQLvw2gAf+PN37ug/eIfD2g:/QyiKayX+PNN/eMD2
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9e5d8cf5e38b672e9ac7cc86ac69f1f3a060b5af787e9d971b5cad2ad3a35da0
MD5 c8b38eb81965be1810258833cd63dab4
SHA1 f6ed6ebbc977dad6020017f8b0b21c2f94a0e906
SHA512 4a938037c0c1cf1c4916ad7c698d9d2d748d6ae4985df773dd8b82178799190f4cbfb8f0889ef7384512ca74c9e79e3a9c5305c958ee3dc8257fc26508d33c71
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN37ug/eIfD2g:3QyiKayX+PNN/eMD2
TLSH
T10C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0ba4bb02654e424676c25cb91bf98eec1e9b9603927f5659e6c5c9fed3c97e10
MD5 3d9ed9944e34965e8f88efc9be1058ff
SHA1 fb848f5a77d50d83242787dcef3f1f6d0064eca4
SHA512 4a4bb5e46e6a467d4b7e4871ea715d27e309007e39e6186aac70b75f59c088d2dfdbf272fa756f2785f03cc1da571ff4f697bf3d0d3ffc9853a33f3b45a29fd6
SSDEEP 49152:868Qg55nhheWu7PNU3/pTuP4/eHt6fDq9g:2thWRc/hug/eIfD2g
TLSH
T18BB55A33B2F20099C45DE1769F4A873196E27C758FE1E7DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8245b6f84dfeaf5bcfee76ce3a08e2d05391e63921fb63fbaa448dbfba54a5d2
MD5 6832f15251d248f5ef103e73f28829fb
SHA1 2a5e11e3062f41dd52a88fd39802043e68f5225c
SHA512 4b4a43da44fac303b4fd4593c5c3cc045f0f69e88b66055356fd93697a6a6cdec92757854ef4b08f3d65ebd9d0ff1011e10e2f85b71b546e63ab4749ceb832e3
SSDEEP 98304:Ty5112gYy5azzVvL69nLKnhZcug/eIfD2g:uLIHmWhW/eMD2
TLSH
T177167B13F29900E8D05DD1B9874A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f7aa6449dfa6ea88fd6e8aa846ba6ecf3add9e65ee6bf51456f567346b4d6fe3
MD5 57908d5b5581b53977e1144eaf837896
SHA1 f4ee95a9cc18d9c850912f872e13426e75663543
SHA512 8a8c6c915956b924c782290c751dfe4c2b6d761f267f999143a333dba1f63c49e38703883ce584de096d5ba0a2d21b80515fb6398fb6ea0874ff0e7791e5a095
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmTuP4/eHt6fDq9g:xu6JmVxd2dmug/eIfD2g
TLSH
T1AAD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39060a6e647b7f53dc3ff2c21ab40735da9d56cf59f8dc74e3d9375203d09ad5
MD5 0634d11ca450f2335c2bb1be959236c3
SHA1 0310fcf8cac37d2a9cf5076c9cdc040aa8c9d619
SHA512 e1c4639f000b79cff16a184e7f6a77afbbd893fab6f693c6ff1397b243da6ff35ab55434ffc39b4a5407ae3d19e6964a6489dfa1d0125cdf16ad054028e4b0a0
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xzTuP4/eHt6fDq9g:cmifPbR+ug/eIfD2g
TLSH
T159B5BE13F2D900E8D06ED17887569232EA72BC460B35B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6ed9ad20e4346f387044dc9d4102172e8620c2313e326f4851bc249e8c4b70bc
MD5 032479c343e34e5634982cfca576f252
SHA1 b1e2bf3291017c23d40f65aeea2b066fb5bb4fe9
SHA512 f4643cb44ea0b41a74c6c0fd10ad9a090861f8132bda6be189bb4ed8afe4a4f60a2d8cd697926c8473d710281dbb50a9e147991a28d0c5961e7395cd8d51c14a
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHq8TuP4/eHt6fDq9g:V5dKTi61wug/eIfD2g
TLSH
T16FC5AE13F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e356655fc9c5105519fe87c0eabcb5d8c2910bcac5bdf13753d51a8bc9c23881
MD5 12071cbac35716e8f8735f8eab582d11
SHA1 5d607332834c38d2b0a5ac9bb95f2e1bfded64da
SHA512 5fc6efa1514492cb17ea204ee378f47f2bcee5f7b772702f51e31cead5491031c9e484c3f4da3e0847bfa9e022395d7678827c8af76970f92fabeb38864fdfd9
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5w3TuP4/eHt6fDq9g:UX2iyphKug/eIfD2g
TLSH
T1FA95BE13F2D900E8D06ED178C7568632E962BC160B35BAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 3445c0951f2ec0f6994195d752b71c8f611b51026e2f444763c670c5ddbbcf1f
MD5 072130edb11610f6ab44bd42e4d01f34
SHA1 7fdd0f8fc29b42811d6b101c3c3b18648937a63d
SHA512 ec77cb99201d4c574e5e59d3039b4b0b0c9b54d47e54f015364edb0e427852796562b44a8c28039ffae8957c174b4bf276b579f278bc32baf9d405e3cccd8b37
SSDEEP 12288:+HnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:+HQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1DD3523E2458749CAFF334AB4E6244231F8B2ED8FBBF2395EB3157605A4399F00A57119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 c16946a2ecbd80ef9b1aa8b842154b74c9abd269cb734a2d992b299f4eda8d72
MD5 827fc6a68d96231f28f74f3f56dd2506
SHA1 c1e4fd0f91d44794bdf6b2c2e23d173bf00facaa
SHA512 18e817adcfb23b8804ab1f1d81d9a059642d6fc5016bf92b2cfb5425ef22c999c7bc511877c0186748633fbdc0587fe91144262329c89e3c46428b95315c4c73
SSDEEP 12288:uOnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:u0QTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1103523E24587498AFF3346B4E2244231F8B1EE8FBBF23D5EB315B605A4399F00A57119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 2a160af1e74d6492d4bde8e78260f9fadc2af218a9019cc60376bd435b6a9f57
MD5 f82ae5f86cdc9c9afa4928b04db7e132
SHA1 8a215867aa45b9bd887844511b4e610dcf4ba583
SHA512 fbc5ce2769dcd671ce8d0ee6283277d605c27fe885d6c3dab9d8b1a111ec40960e7ea705dc1449fef401d2ecf54b1fcbbaf9c534251d75b6503c5c8702f70ea2
SSDEEP 12288:2snQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:2qQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1003523E24587498AFF334AB4E2244231F8B1ED8FBBF2395EF315B604A4399F01A57159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 6f0e514b608f8c695588a31565ce10a296878873106a587a57930e17886c6aee
MD5 fec76cbaba2eeb18d7aacc5a4af7cd9d
SHA1 7b17c94ac14ca981539e084ab3c4d673a5d50803
SHA512 92c5fc1044fc5d446b27dd6677f265c036354f51c29473118f47caad536de152aca4a46f2d94402438f3752b62524eff59b71b2f24633f67b20684187202ae4d
SSDEEP 12288:ZVlnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:ZQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T11E3523A2029744C6EF33C6B4D6244231F5F2FD8BBBF23A9FA3106A095C356F05A26315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 a21e8390719c0a78ec1b5e06f813a6a318fcaee579a57aae8ab16d68e6ccaea1
MD5 afffdea4053d7bd2a5a7eaaf105c5cf2
SHA1 5c563319befdc9820078c9a26c473e001962beb2
SHA512 3e0ecdcf5ea6ea1b032102adb471dd2a7a105f363f1d66490cb377f1f0a479d70c683863d5c0948a209efc768347a5568ea3da7cd07d153a7e2e6c1e23386e6c
SSDEEP 12288:2NnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:29QTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1E23523E24587498AFF3346B4E6244231F8B1ED8FBBF2395EF3157604A4399F00A5B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 50b1a57ceeef8eeeb83b05bee02808c072548cd6128e988425de762e55a5932f
MD5 e113e068af937ab14b6d721c74481722
SHA1 6f4b5799a4fba7cb762dce8686065fcdb53d6715
SHA512 2e68a83cba11db2128ca233084613984c2b371201d13dd9ccf6a4ea9fceb00e7ea1912ceef07ce6f60314e2c9f1ebd4e8e8294359f841959118150b81db9a630
SSDEEP 12288:kKnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:kQQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1B93523E2458749CAFF3346B4E6244231F8B1EE8FBBF2395EB315B605A4399F00A57119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 6dd814419fb004e0ac5ef79af31d41ad333f80bd8a2a688f6ba5240db5e59604
MD5 ca9ea2885c48506fec757ca8a4e04666
SHA1 5dd3331e616cd23abf9cc44c21c00d2ec860e023
SHA512 cd3a38bf9e9cc0312ca8ef9288ee72c3ee0ad67684fd71ef9bc4e8f99aef39f85e21d82e7fda55c3595dae0ada1499e9eaaa1bbaeb024fb8f484b678101d5a1d
SSDEEP 12288:R2nQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:RsQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1103523E24587498AFF3346B4E2244231F8B1EE8FBBF2395EF315B605A4399F01A57119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.3MB
SHA256 864938bb84334f9adf661d4ddc780e7dc7bfee3328e3af000fc8b3f30caff538
MD5 0086a0902df55e0abd978aeba63c4265
SHA1 e19ea6443b72ef67cf6d387c79191515f97219ff
SHA512 3871898c1d974d6f82caa54b27de12c2824d6d10776f292bbb7ce3bd2f63b0acea00eee062b147ee0d636b2769523ee4cc93c84f13e4a4accb9248acc12c8c4b
SSDEEP 24576:XZMSzFVSOUQTu5x2z/eO0zp2N3vhJuz7UIgn:XZMSzfhTuP4/eHt6fDq9g
TLSH
T1B85502A5B3911CF9ED73823DC9148912E5B2BC5A1BB0CA1F13A436265F333A11D3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 ead4b7677af63d447ebf581efd1f219e304fe1eab99255a4c14818aba85ddfbd
MD5 82113eebc3aeb88a9ed0d5ce277faef9
SHA1 a22c53bad18bac70699cc8ebd8fdb3847a457f18
SHA512 45e0ef12bdfec79d2ab844a6762b532f0d78bac787aef6b2bc792a2d77ff4828a819c764531e1f192c31b65ade0de8c29ef336d311d3269dab47383308eb14bc
SSDEEP 12288:lLnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:lbQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1C83523E24587498AFF3346B4E6244231F8B1EE8FBBF2395EF3157604A4399F00A5B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 44db454a50647358901573193b8dd5ff23fcee71a97d0875a001f7e90ec33a11
MD5 e010ae007dc7436a728e0e1e4fa8c5c3
SHA1 63772a996897847d698394616de96b3950d812af
SHA512 869a18898f555df7453329708209f69fd6576f05b04963b3caa2c48af84b3ad25c97c942b88e834ffa00d79a099ce6bd478cade4012d85415471841305e5bddd
SSDEEP 12288:LfnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:LvQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1A93523E24587498AFF3346B4E6244231F8B1EE8FBBF2395EF315B605A4395F00A57119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 f4f3538efc929c4014a62f8bcb7837f85c9760f30b50b32e7443962e1ef710f5
MD5 b07f9a6c6f4b2ec32f0c0a2ef15ae53a
SHA1 16af3d5b8fdf60be7b92498be6cc502f37765a75
SHA512 ec7cbb84dbbb2fb59bedae71f71110182c2d9306fecc4a213a0a61142e0b6216067e508816ef38bf5f0993e6744f1970a2db6835a2b93d9a6d5c0ea603dae593
SSDEEP 12288:/yPz5L8CnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtu:yzyYQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T16345025762A220F9D6378238C9210612F7B2BC775BB05EAF536057762E376E05E3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 a163f2be633c7492638615ed85cea1b65c6faeb5b064cef62759e1690f653d5e
MD5 0b34e74abc1fd11b5e06dd85001f2376
SHA1 87909843b1e7fbc4dea957af36fe6c1d994297c1
SHA512 ca3def11c8f4c761a7e2d34a2448654e2124adf15f1d07e733499c5b9d774fd519de8cf31ff3e3cfd2def3d553d08eacbd466c7e16aed3bf167e807fcb0a3b37
SSDEEP 12288:1LnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:1bQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1B33523E24587498AFF3346B4E6244231F8B1EE8FBBF2395EF3157604A4399F00A5B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 0b5adddb04cd57f374b27a1d89aab145696fed41687cafdc0b0a58f370aff762
MD5 15882fc50d66fe7fbb6152f7025cced7
SHA1 222526ab4c4cf2ddd44e4b72ae9fe2bb389858f9
SHA512 5a0eff3915a0d2070ef0d56cda1f0c98a7c927f63c655854d7a8a3a7d75febbd751d1d3b77051b2ac1750e08bc4fec0573a0afa810ced43a453111a25e3dd649
SSDEEP 12288:xLnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:xbQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T11C3523E24587498AFF3346B4E6244231F8B1EE8FBAF2395EF3157604A4399F00A5B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 42f42131f5b991e5712776875af267eac4850fdb3132625833d727dd44aa4b87
MD5 eb23f681315d736f58f770ae6a8e9a9d
SHA1 deea3d7e475c28b05f9eee9296d6cf6112ab9ada
SHA512 d21986065fec26a5781510b20bbe34ca248eee0bbd61bed334c8471f75f841d2e408076927d72fa0b26c21a2b302fa45c04a314f1f162fdf42b83407c215a43a
SSDEEP 12288:ZyPz5L8CnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtu:YzyYQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1EF45025762A220F9D6378238C9210612F7B2BC7757B05EAF536057762E376E05E3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.3MB
SHA256 f5777c95a758be28d21ac0dfe18e31aa6f383ae74a0ccff248da3517370d0679
MD5 ec69f6177f6fa755fe1ff909afb9a34e
SHA1 85546cd79f2a27368c756ff1da0d9ecfd3a0ab9f
SHA512 55fab595857a78d80f5a9b4adff6f997c10541e2bc1bcc6de4d0d3b11641abe91236602995e10782ba9a11130ac1d775dcc5cc4595836b2e8aa0e44003e0ff58
SSDEEP 24576:+THaLl3z0zDaQTu5x2z/eO0zp2N3vhJuz7UIgn:+T6LljSTuP4/eHt6fDq9g
TLSH
T1255502A5B3901CF8ED77823EC9254912E5B2BC5B1BB0CA1F13A436665F333A01D2E759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 90da9419f00ccc95ad0b44362cb13efffdea3bd79dee493251fb3834a13cbfc4
MD5 1aa6aae40829041c6466d827bde3bd38
SHA1 de3d342d6b75a72cd62d5e730804caa9a61cdd54
SHA512 9c965da47461a731701818a1bda53ffed8c7f8b6911ef551c77dd83016a0371ff80d5fe9709e9c154dc6cb163c0768401b3019fba79300d57f0b753275bda5ee
SSDEEP 24576:Y37d9CHKy7GZ2QTu5x2z/eO0zp2N3vhJuz7UIgn:i7d9CHKyahTuP4/eHt6fDq9g
TLSH
T1BC75CF90F3E414E8F1B78A35C9754511DAB67C9A1B71DE8F03A4261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 eeb5b44f50131efeb32dd83d647c269a83b88ba9b5906faba0f61a19ca2f68eb
MD5 4d4eb446d18ee12a99ad493ffd46e277
SHA1 7b8d5db50b7dd79acae1d01c294e438a80f1cb82
SHA512 5ea044304e9876d0eb7da5c08067767e56fe74cf4efefb8c20f749b4007f4c132515dc78a46a320e9b8591c4e38c6e77a91ee857f856cefdea4d9ed9d77ae836
SSDEEP 12288:jMnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:jKQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1073523E24587498AFF3346B4E2244231F8B1ED8FBBF2395EF3157604A4399F00A5B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 30d1cabcf91d1afa0c554aa80cec8a5e0c1b89e445289b6c6e21680382e23d51
MD5 ba0cdf68369de5280f5d1d3e1a1b998e
SHA1 4d4fbdbe7734babc80c3fe666f9551da260ad160
SHA512 552295bae41fddf17ef632dcc1dd93466b87249358acbfa1d634dd72d97fdbd9493be34e0768bbafeab6751851a2a0eff7c16cfcd8ade633d209fae792a6e832
SSDEEP 12288:YinQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:Y4QTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1103523E2458749DAFF3346B4E2244231F8B1EE8FBAF23D5EB315B60598399F00A57119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 0fc8c30f1e292b4d93bc2785f1d826b9d7181acbd868d29bc2060a8e8a1c8135
MD5 ce5a8215d74c4ec99ff734bbe5154e90
SHA1 1303633b177960283650bb1fd77031d5e7fdb6f0
SHA512 98ea4d69956842f7f722ec3067758d51b586682d115f2885e3a69994b8143cb242ce02a2a20966948be7aa8a2024e06dcd0e3de5ff301ea953da6d9b6c397c98
SSDEEP 12288:bZnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:b5QTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1A73523E24587498AFF3346B4E2244231F8B1EE8FBBF2395EF3157604A4399F0165B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 c2707a7e06059a61e0c3312a96c36ef3474f1f13b64bd86dcbbbe33458cf90f2
MD5 a009800c38b060c64cd3f916d8aed50e
SHA1 4430dc6bb89a364db35d9e9da0c460237e6e19e7
SHA512 876d8945ee2d00bca38b7b09f4a911c8f409813873a1a996f81f1ab4836221c8d3988fc7d35590f242600e91958e3a8a7eb63c567c68b79fb52df80b216de1b5
SSDEEP 12288:VLnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:VbQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1E93523E24587498AFF3346B4E6244231F8B1EE8FBBF2395EF3157604A4399F00A5B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 e8f20abc42435bf0f1b0eac43db36a6e174e8e92d9ba81fbbd31a6dceca3fd24
MD5 49e44626a971328fb12a9a369a1e8b4c
SHA1 454506adaac24f54b651f8b4338fcd6594f70479
SHA512 1f0476b0cf8e512f3d94e274ee3c2192474da12ea80ec528e3ed03104fd73ff825977f19fb44f6cc97f573676410fc0d0d021eb03ccce8fead791af63b605fcb
SSDEEP 12288:7MnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:7KQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1FC3523E24587498AFF3346B4E6244231F8B1ED8FBBF2395EF3157604A8399F00A57159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 c783f7bb0109f3b21ba1a17ffa2da63d3ab9e84b65564135a3fe62de3174801c
MD5 0d1eda6446e74b2c3c87579e7ce0ce6b
SHA1 de47dbbe103aa4664b291ccf12f6616840719df4
SHA512 653ef7eb914ddd81d605590be3fccc40dbc63ad17a77d547a0788ed6b59fe780d1d1da5e26145e873b445e7c271181f356d38fb35c8999f74933a52b5da2ddc4
SSDEEP 12288:6znQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:6TQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T11E3523E2458749CAFF3346B4E6244231F8B1EE8FBAF2395EF315B60594399F00657119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.5MB
SHA256 1e733218083be61389f391b39338cf2587d30087ff76bb6debc850e5c4d89c0d
MD5 ec4ec610e996873889760491d4b10eb4
SHA1 47abd4d0a1ba26ab1d1f7c2317cb2d8f1329d5a3
SHA512 186aa9c748bfacd53680de6443a1e8f6f461f90d8a8e4a6f65aed20b2569191557fbd006485d5cd0a50b1e4f39e97e8f3354104fe41a7ab58f7f6acbaf0e87d1
SSDEEP 24576:Lfwvok9RX6wkyAI/QTu5x2z/eO0zp2N3vhJuz7UIgn:tMnYIYTuP4/eHt6fDq9g
TLSH
T1F475DF29EBDC04E5E177923C99B34606F6B1B8591B71C6CF125A53AD0E37EE05E3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5f3b98acf267d00d8eba2956d20158bd65c892360c8bb07543c6098ac55dccff
MD5 46dd46855b2132c81683c178f069081b
SHA1 57de01544733bf6d6d20030fa1226ba3ac2c38fc
SHA512 a2d94bfcdf52565c88b18f27c9a2c335e7b118d596cc7408519244eb3bdfebe3937cd53a0915bb0957accf8dedc5b1e7194113b6d5afe7c654c9c912bbb65bfa
SSDEEP 49152:hYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XTuP4/eHt6fDj:JySzPbug/eIfD2g
TLSH
T123066C96A1A801D5C1B9C1B98F1BCC17FAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c710b8523ec5d3a3b0292eeeae24e903b880c0cf3cb8d80b4fc77bfa7f216a3f
MD5 8b2443ed31df80ae614e201920bf5e07
SHA1 89da22ac8d2b9cd384f7fde1d139ffb4a3bc3f55
SHA512 e21322a7952dd399754082e9dd57c911f9ba93db424aa509df5eb3bba9c68f2f0ef7b232bc20823080df22f4460df2b5b960b7c4fee0dae978693f91306bc041
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYkQTu5x2z/eO0zp2N3vhJuz7UIgn:t47JUQj1irIhCnDHUPfF/nTuP4/eHt63
TLSH
T1AB65AE1EA3EC01D5E1BA927885154A1AEA71782E1F31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 6184547882b1110be35803af4d9d058e49ef9e352c3d16337eacc23aacdeaf05
MD5 4f09f192340a2c4ad12631f936c1b2b0
SHA1 8818ad32f722d50c2a7c6ebee155184e5522d114
SHA512 72b9dbd10d4539f6d9784c41049fedcbd2bfa4219d7abdc415fc7ec9f4f578c0b94a5a101f0fc925a122233fea377dc40d98d23d81885a7471e9c29772b2c524
SSDEEP 12288:WNsfbnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:fLQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T15B45F05AC29802D8D66E5278C7144611F373BC6A97E1A7CB63D0F53E1F366E05EEA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7ea08303115d1d043e492b23004bd23510d9becdea5f67148dc6cd5a08409264
MD5 74c0b00cd6f57d6369ae2d2cf3fc904c
SHA1 64ce93298c504affdb36ee9ce16f3ee6dd76465f
SHA512 b8a4f6c5fbdd1bbc6bf4f1b7fd58b775c36c33515fbaf6fe6ef29dc1104f29633b2a1d26bdba4ed731e2429f4e57929bba75b062ccf172ed9109046dfa756ea9
SSDEEP 24576:TkMW6UPTcAbySgFqkAiCr1Zv26thSdlZZYmJ:K6ULNIqWCi8kdlZOk
TLSH
T16F4528007626CB4FC6A940365E76D6CCAB707D05EE046F0773C9873F9476A59BAE22C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 025698082a4dbb9bf1bc69a0bffc2c4b444eefd6cec7bc4cee0fc0dc2c4a0864
MD5 71da814f6c0142d031650cfc70f5dc7c
SHA1 710e27b14ceb9b74cccc7432daaf0b4897127015
SHA512 67eb49b4a69ff64854e5100a83b40168e943a17ce07a144efc55f50bf76ca417d1130932b4127e2affdce1fe8e038366ab0cdd5a053653459e44ebfb2778160d
SSDEEP 24576:bX49WPmynZIauU4D21p4FpSqidp7n/73PGM:bMWPmynxp447n/7R
TLSH
T1DC55F70065B7EB4FC97E803B023686CDBB786C06B7493F0573458978986795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 e3fbc51e7faed1e2fef40e81e066d1dc89eadf9d22898fd46d711d5944c97b61
MD5 c282f9466b556b15040824208f3d9f3d
SHA1 6d2eb095b19a91e6259533c15c305ad72ed9164d
SHA512 4c40701e9ae1d1d136bb05b3c2967f94f860e977478916bfca1d943d96c1014703614fc0bce6a27fd66bd5e211a9592de018ffedfa14b8647032e9ac21900da7
SSDEEP 12288:dF7DnQa8JTX6iRrK/x2bnPsCeO0zGEz2N3vuRaIqCUw2RqAp+28z7mxS8qtgn:LDQTu5x2z/eO0zp2N3vhJuz7UIgn
TLSH
T1023523A2428A498AFF3746B4E1284231F476FD8B6FE139DFF3107645A4359F04E7621A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f590df5afcb3f2253126c8dfdbdf358a8e80dfa8027518d3003482b1b0adac16
MD5 f6f08d32560c5149293dcc7b24befb5d
SHA1 887b0357bd745f7f4ff6b68c34f5440a70d2b674
SHA512 2dd3bec9eb54e274e274289ae0762e3bc164ba04ac27cc3672ef7d69c704f94f36b1089f9440b616ec9cc27f96da7bc188926725f743d509ed506323a4e17db1
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYhQTu5x2z/eO0zp2N3vhJuz7UIgn:Ngb4mBIBhGFtTuP4/eHt6fDq9g
TLSH
T10165AE1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 5e5ce3f1f14faabc55962cab085230661eb8a7aa528b5095c25923cf0913bd27
MD5 b88154d9cd20117156529877afa99aa7
SHA1 fe894c12a0360e81fe10d9498a5c838efe1658d7
SHA512 4e4908aff1f5c10af0620f4efa89081a207ae1f3dc6514a26a97a4771d211998d02760b88a5a1282c091a247b86d1af1a75639a7da70490cae63342b8d82297a
SSDEEP 24576:qG88u8FpJqH1bzria7/mUQTu5x2z/eO0zp2N3vhJuz7UIgn:R7ZFPqVea7/6TuP4/eHt6fDq9g
TLSH
T1C375F16566E101F1D477D1388A464663F6B2B82613A4FFDF07A88B551F33AE00B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 5317b24b46d8556a437131f8526a267e1e837744f401fb0147607ada402a43f0
MD5 52db01f83563b35844b33543421c398a
SHA1 bd1dca59dda4d67ccf165c42cff6e9455954071f
SHA512 8dd5343d5b0cad96df81c49733e4661c2bebfec03db430a2f596dd5a5526786fd1a4d68f9c69d948d094321268d2eb75f40326fbf0024b98cb03f019a89dfb7b
SSDEEP 24576:APUr+NQgQTu5x2z/eO0zp2N3vhJuz7UIgn:AJQhTuP4/eHt6fDq9g
TLSH
T13155F16F22E918E5E776E17CC5418319F772B8521752A6CF02A0817E4E37EE4AD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ee6bc71ab1297ded6125f5b216a35308aa5b7b458f1830f4b80659f164852cec
MD5 26edeb0a764eb95569a883dd311abb1e
SHA1 47056a6f7274a5fa76fb0cf2179c27cac2113233
SHA512 33979f667c56caf06ddae337c32c66088e1f0cb268b0da6745483d0d72db7931407464796a718efba62d3433a4df42f3c9251cd6cc5c4992584a42faea20b651
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRTuP4/eHt6fDq9g:4G05lO43bEug/eIfD2g
TLSH
T1A3D5CF6E62EC11F9D1BBC17CDA86460BEBB23815033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a3f06016d972cbc574eb37cc541806194e2c3329d32c14d5eb0e68291dd3288b
MD5 6e3363f8035de40da44e2152a5fa9260
SHA1 5cf87338fbfdc947ac8dd262319dc3b4d8a26aa5
SHA512 e01fa5d6d2be5eb77bb22161ffc2208c58ed446f0ef0fb3240dd47e6b136e3cf3a44b763188d674e0806bea0f1f9a753f6459d79fe233ce1c1ae37a42b1b3e3b
SSDEEP 24576:wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuQTu5x2z/eO0zp2N3vhJuz7UIgn:Ia5POZ3+Jt2pasx2+mpTuP4/eHt6fDqi
TLSH
T16565AE5EA2E801D5E679D17CC583461AF5B1342653329ACF122182BE3F37EF89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8e8ef5a55bd5e0d694bd253a0144d54a4f9a53dde822cdd7a8f0562066f636b4
MD5 f16ddb1145a5cf29176af4d901c6a23b
SHA1 c958f410e699c402a77c01162f0c7a1468831d6b
SHA512 2efa65346f80069ca9be9a25db123980cc13f8dfa63b6cad88ae4febe7ee7231392db9ba2f35c2be066bf248fed78d22836cecd05419539e5cb8d7c3e4b370d6
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkcQTu5x2z/eO0zp2N3vhJuz7UIgn:UNc/zEOVHFaTuP4/eHt6fDq9g
TLSH
T1E0858C6623E901E4F5BBE1BE89779546FA71786513308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d9e2584add667c9bd08982166bf35a384a1a7ae6960984930ab13ee874d35898
MD5 f9709f07f5cf651136765a63ec1567ab
SHA1 65548d924b916c6483a9f7cb112b9bde7d1bce44
SHA512 cbe24205d762afe9faa7a857d5e822edae6e78487c2ff1c2d5419e051cfec004b606899db0b4e3c7ed0c0990b907057d15966d892ae8e2848bd3376a94363b8a
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmhQTu5x2z/eO0zp2N3vhJuz7UIgn:n8MwBtOmSTuP4/eHt6fDq9g
TLSH
T1E855AF6EA6B846E4D1FAC6B4CD238512FA727851173253CF5390C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 ee10f401865d48a1ed44a30a00eb996c6b4f750695803365ece27a2b098ab908
MD5 01a5091a27925c8f2fe136be256a7a85
SHA1 c8f566252e1d26854541f454c059f5e8ce0df955
SHA512 53f918fcef149c0c5d88ac1500572b7fbcbb5c474f77868029b0696fddf4f5be67944e2176c98fc00782295c2a8b97db40f4a7a9378b3ea3b3e12d615a78a2c3
SSDEEP 24576:uD3FHshBIYQgAnQTu5x2z/eO0zp2N3vhJuz7UIgn:uDVHeBIAAQTuP4/eHt6fDq9g
TLSH
T13365E17ED69D04E4E57BC1BCD6638602E67178AD037269CB1294C1B95F3BEE02D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-81-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/476-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/476-321-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/476-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/476-87-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/476-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-226-0x0000000140000000-0x00000001401D6000-memory.dmp

Download

memory/2908-48-0x0000000140000000-0x00000001401D6000-memory.dmp

Download

memory/2908-49-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2908-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3056-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3056-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3056-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3056-120-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3056-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4340-59-0x0000000140000000-0x00000001401D2000-memory.dmp

Download

memory/4340-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4340-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4340-297-0x0000000140000000-0x00000001401D2000-memory.dmp

Download

memory/4500-73-0x00000000007C0000-0x0000000000826000-memory.dmp

Download

memory/4500-302-0x0000000000400000-0x000000000059E000-memory.dmp

Download

memory/4500-71-0x0000000000400000-0x000000000059E000-memory.dmp

Download

memory/4500-77-0x00000000007C0000-0x0000000000826000-memory.dmp

Download

memory/4552-32-0x0000000140000000-0x00000001401DC000-memory.dmp

Download

memory/4552-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4552-33-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4552-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4552-46-0x0000000140000000-0x00000001401DC000-memory.dmp

Download

memory/4820-305-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/4820-113-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/4820-114-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4820-107-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5072-29-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/5072-9-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/5072-0-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/5072-2-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/5280-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5280-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5280-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5280-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5280-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5280-307-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5476-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5476-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5476-14-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5476-22-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5476-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5892-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5892-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5892-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5892-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5940-334-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5940-328-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5940-386-0x0000000140000000-0x0000000140362000-memory.dmp

Download

memory/5940-336-0x0000000140000000-0x0000000140362000-memory.dmp

Download