deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
Size 1.3MB
Sample260925-ks3dwsce74
SHA256 deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624
MD5 fcada1d7b11e5038332cbcf6523e0b81
SHA1 c4b23bce2cd92f574f66d658d179009d6fb27942
SHA512 70fe7fe8e083b7fe93e5abab735800250b83923089984a8d8ab4695acf18660cbdd095448319c39372225ea6e259464eb864630a9aef2aedbff64fad4fcf6ccf
SSDEEP 12288:AERy9YBDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A6dDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17155025B73A820FAD0774279C9A19509F73378764B208A9F17A0567E6F732D08E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5200	elevation_service.exe
3580	elevation_service.exe
2480	maintenanceservice.exe
2012	OSE.EXE
4628	PerceptionSimulationService.exe
2324	perfhost.exe
1336	ReFsDedupSvc.exe
2336	SensorDataService.exe
5620	ssh-agent.exe
4920	AgentService.exe
1440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
File opened for modification	C:\Windows\system32\dllhost.exe	deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a09b305227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2fb5853cb4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002e955451cb4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001eb4624fcb4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000052f8050cb4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d407593cb4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5200	elevation_service.exe
5200	elevation_service.exe
5200	elevation_service.exe
5200	elevation_service.exe
5200	elevation_service.exe
5200	elevation_service.exe
5200	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4700	deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
Token: SeTakeOwnershipPrivilege	5200	elevation_service.exe
Token: SeBackupPrivilege	1336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1336	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4920	AgentService.exe
Token: 33	1440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1440	SearchIndexer.exe
Token: SeDebugPrivilege	5200	elevation_service.exe
Token: SeDebugPrivilege	3580	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2420	1440	SearchIndexer.exe	101
PID 1440 wrote to memory of 3212	1440	SearchIndexer.exe	102
PID 1440 wrote to memory of 1260	1440	SearchIndexer.exe	103
PID 1440 wrote to memory of 4664	1440	SearchIndexer.exe	104
PID 1440 wrote to memory of 5256	1440	SearchIndexer.exe	110
PID 1440 wrote to memory of 4592	1440	SearchIndexer.exe	111
PID 1440 wrote to memory of 2704	1440	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe
"C:\Users\Admin\AppData\Local\Temp\deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0472dfdfe27ea1cf9539d14026c0b7e2ad7c19aafc05d5d7eea2658b9d498131
MD5 c8edc1f42285e7f765e460b07c370a55
SHA1 97103ad6e6fb0df23774577623091c7d50f0cb28
SHA512 3c696ce065a295f955f952a25741caed6709db00dc9fb0ac7be3c48f799502ef01fbde6a2e1f1d7627cbdf54d4e978c162c65cee26bce641a2866dfd3bb2c435
SSDEEP 49152:tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwDmg27RnWGj:z3q6sjBzD527BWG
TLSH
T138D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e7943d3d870fed8c7150c367ce9fe006ab8103da9128996ce1d0fc4fcc72ea04
MD5 3cc5e29d35651b66c1828ab745b5c879
SHA1 2a551e145a329b7f5fa97f0104f83931716f64ca
SHA512 f83e2fe6efc4df34ec89fb19299142d313ad380bff59d838729f79caf52988a0392f64eb39de9723c718bfc378670e071e8b1572b59906300369e92a29f4b7cf
SSDEEP 24576:aXYfDtczAzsqjnhMgeiCl7G0nehbGZpbD:BtcKDmg27RnWGj
TLSH
T158650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b8b1c3570f5aeace91bcb62e912fef15dfa3c8d85d14fca2f70c99e933eec7ef
MD5 3d6c9d952df7bd376192d26e500b2a51
SHA1 04efc858056d8834ceda50836b62d76f8423fe59
SHA512 23ac8d8526b853108bc0e0bfd672bb77bf657ed9326c15ba1f2ce51d60cd88cbe9b9c95aeeab6e4a785ac4fa95f4ba5c7995be7b8cb139fa11e8be41e9452118
SSDEEP 24576:K0Le5ji0hmxxrMcsqjnhMgeiCl7G0nehbGZpbD:KPji0AjdDmg27RnWGj
TLSH
T1F4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 31fd23a38d08db691d1e4046c8551a1e17aa5c0a9460ef2af4f4dc0cab97402b
MD5 6b131f19482be01f5d904c9d6f17691e
SHA1 96e1286e831ae72532a35dedffe1aae0fd28952c
SHA512 73872b908e13d5d19c9939ce004369db29307bc6bf0638597af24a78626006ce99bbb457838c87944820c27d9423b71cbd77d020b988ce8c04d0505ea1d85334
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyu2sqjnhMgeiCl7G0nehbGZpbD:j/ezSC6vUzPveHjyxDmg27RnWGj
TLSH
T18C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 097ddd39177994ed289016a07d9e92fe3f0c36d2a2e51cd79872f2b9ac8c1887
MD5 6e831b6bb0f3ab8284eb5a396366d3a0
SHA1 38a0f57c8410f100fbd6c1f9fcf5ab1d1f1c9763
SHA512 4293ffe92b66c2aeb011f3aaab6dfd918dc41d35ebef87ce00165ba139b7ce554db4184a9423e664885f688a3eb66234a24490166feb914b092cb67dce9b3989
SSDEEP 24576:nVbqPb88hv/l+Y/sqjnhMgeiCl7G0nehbGZpbD:nVO88hXl+iDmg27RnWGj
TLSH
T1AD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 66b6f5021f0bd28199d98bf5741165fb96260dd02f02ebcebe616fbef006b640
MD5 68660df1bff8307a998fae96ef9880c0
SHA1 ab917c99447cba9e43eb89473ca3866dd8f56b8f
SHA512 0800f1ada7afd100d6c9bfaf5263281b54d0bfdd0361294d2d44ff86e5e2cfd770c2c4848c76a27f86f6a9fbdf6b2f372dd0da92e30e6427cd1ee43ee589b9a3
SSDEEP 12288:xLoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xLosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ff2973996072ad8eda9f3c759d50f5f4dde5d57a9f22418764dae192558e313f
MD5 0e7f2d80f08b2868fd17a8088d62be00
SHA1 b471c8e006794728153febd1a9ee2f81be90e45c
SHA512 8c9479084f65d7ce69cdcbc683ba6e12acbb2725ac3ceb6b3afbbbf0b4e1a536f8770a2a474b73daeb5bcb6e564d08a921e6076099ff2f4ccb1ef5d38f7cd7f5
SSDEEP 12288:PeBNUbTVO86UnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:PJIUnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16165CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 31774ded4fcca17e08297406a0a0b638753b94af2a9497c660dc8e4e748e7763
MD5 e952f6b9512d73e376f281e95e4fc78f
SHA1 241be398cf4d3a3568cf4ef726905c74ee84c8e6
SHA512 0dffecbfdd14c523f163fc5472fa3a4e39923480b4c8541ee6b002cfe12f5a7a708ff133f36f0543a81e3f394cbd0c597b6614c2361c476cfbabaaf3eb70eca9
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THK:XQvGAdlCEL8c/DRNw5CqD527BWG
TLSH
T133266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 43c6c2f20d5c5e4980580a1bf58d4c97018b3ed8ddfe4abb1b0e5b574690502e
MD5 0a244b56fff3c2552a8e10c1fc91651b
SHA1 7eac373f670e7ad412c6569853ef380bd5c4784f
SHA512 72bea2ad68ac8db01d58222ddf35e58be7af4350880db6616af8c38c09a6b1b208d4188d14a2f9294a406e12b157d335841ffa6ca44c17679d70bfc2f0e84cfd
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:j0ewsAjJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e68db9d3d7f26a6f639169d393646f76415332ea113275c315899513cd1e915d
MD5 17e35fd3f69e57045d790a594a8c0aeb
SHA1 9ad5451d6806f87d353af2f8f9a7d0efb254f943
SHA512 a7d1a881aa709055a3dacb12a6abd9386c5e2e46ac75f6b4fe9caef5d747a285e78f1641c310b0aca1a2df48cc8989b630529f2bc47b7c6d7b07624e528fb3f0
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1VQBWG:NUEtQevvqc2W1cpV2tI32AB
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4d39d54c2195e28736cb5f3bfd692046ba172445d33184dbfd387497cc914eeb
MD5 89db7691b6555c53c798c3e456a931ca
SHA1 75530f34b37782cdc63f954653f283c0bf0363bd
SHA512 9ea30be4346765f06f00d191a1dac493162a20c34f7bfac9cfe42a13f5e45fc3313bc7538b43ee39db791ea602a51b3f55ee07ff2d60cf2c43e452738a3b0631
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/ztDmg27RnWGj:loquVjnmuD527BWG
TLSH
T14BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7014af62683825c5e0174ebf5e4f15fbf46eeff0fca839a747213a80b8711e2c
MD5 0f7372e5647b15a8ed7b5617dd6856e1
SHA1 b331fbec608ce0717f83babba6f87bb88af0344b
SHA512 f9cd828cc02e9fbe8c84def4f88d9a781b97f1c68b81d62b7aadbf85b3ff1c7ac81ea7f50a7e9c168d1f279c14e736860b41f428b5d9c2cd2f9d0c31a1a886ac
SSDEEP 24576:yAhGL3IFoiwtA5l7S536sqjnhMgeiCl7G0nehbGZpbD:yAMUFoiq5eDmg27RnWGj
TLSH
T1D0359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 fe8e514f8a3326b40f01b6ba54b1e4a8ddf2390696f16f8a4fe11a420ca38816
MD5 b6ab0bd9053379a6e50bf8b21957f72c
SHA1 37427682f7302f3608fc903d59ccf1127f399978
SHA512 25e58a4bd41e1eb6020f42f57c3a5b33081fb8d429dadf9def9cc555c9cb282b769d3591ce7c0d4f65e737e7c71ed670efe3595a38f58a4e36efd1835e0f7a62
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:qwu4OWtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B165F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9f21fd21dc699e0cb1a7fdf971913278fa9218e1ef975c055705ce1a40eef184
MD5 6d77ae1cb7d03fe3d8a4b0092bddff26
SHA1 4ccc3ac9a39ae95680c8efc89a16090fb81f5169
SHA512 997a3fa4f8dea4cd35aef90911a2e4e3f8168a61cf6636cba05671de9dc0b0343929744495690408400485faef9ceff2f738a162e95f3c7067c49507ef2cfea1
SSDEEP 12288:heZ1Iy5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0ZuEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C35512AE239820FAE163417CC5E5D609EB337C62673003CF166659AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 175f0e0cb53e9e78388b40c243bdf77927d70f6641aed7102bbaed10721124a1
MD5 281457caf2fae615dfff6e5c303a48e4
SHA1 948f562b0e113f32c8ca4987b0a5b35606d06bb9
SHA512 5398b2572f1a4a4e2d6b3fdd65cb253235516960a8899f510b95187e22847e0e8331eac284ebea81e599b90d8952c6a962da63fcd46432e77619890c6407c0d0
SSDEEP 98304:FQRQyi36YOcPbLvw2gAf+PN3PD527BWG:8QyiKa/X+PNfVQBWG
TLSH
T150667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6cb08bd6d1d2cae2c8092ca40d6a07e6ecfc7ee8cc353b18a53da6dbbf963bb2
MD5 825de3359dcd9e8bf93a8cec6732b93d
SHA1 4dde797b74754913268c5c1fdc4ce0044bb525b1
SHA512 256b120735c799e9732683bc208df6ad7ad06f93ed1976219a9d39d20f0662cfe4bea4eba74a311038797077658cf0d5a1ced936c0713e356ccb56fc3d06f92c
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN3PD527BWG:3QyiKa/X+PNfVQBWG
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 83ade7bbb64f3cd442479cb5c6f27eca3218fa1f63ffb4a4f3c24b9edb840784
MD5 c549cdc4edbfc2b8c9cc0d5272b1d564
SHA1 663492c092287030cbbcb19a51d0e0e756f9302c
SHA512 0c979233b9a8da1a33c3a654d66f5126133832a7ddbc5d66d70ee05142af1ffff02bd2074585bc134d5961ebde778e574e58254b5292c5cf2dc5deb27784c1e8
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0UsqjnhMgeiCl7Ge:D68Qg55nhceWu7PNU3/dDmg27RnWGj
TLSH
T1A5B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3f764b11a04c6883f6bce36518bf9d1c7ccf73bcd0a77492cd797d2b7f66f3a7
MD5 b8506e02ca72c4c77dc95880ebddccfc
SHA1 99544f9d0f65ae3061386cfde4d0bc2074e4ba35
SHA512 0b79229d3f08a0170c6af75010a5914af83cc7ba59fa3eddb3c38b346443f9781dede92b33ee425e2012022912a2c6cf4f4b38d4d310dbe84ab8c30cae3ce8cf
SSDEEP 98304:by5112gYy5azzVvt69nLKnhZUD527BWG:2LIHEWh2VQBWG
TLSH
T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f1d298c272cccfc3d7f2cda84903f7d0878d08e9d9e9ac5446610a3cc3068efe
MD5 5c62d713124b5e33b08e30de1fe98400
SHA1 cff5cfc89a8cf8f0eb5fb68c5cf1d9241b67ab78
SHA512 54f0c05b9621a86b792285b0e189298ab4dbbf66a0b4638476aad618e8b4b7d91be75e0a093521d6357305f80d24d85b7cb8cc42c92f6a5dcde28f30735c7b1b
SSDEEP 49152:bB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl6Dmg27RnWGj:Nu6Jmdxd2d6D527BWG
TLSH
T13DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 73da86e4e0aaf91ca27a051b456bf69479f95dffa0317a4a92fdc44b9753ff89
MD5 638004adbb394ab108ff96c545a706ca
SHA1 582ed908750dca5660d79971d462cfd94638faf7
SHA512 eb51b27f39b84069888346ab6eec490db529674becf66109184dcec433ccda4a10c622f3bd9dd0ae09c715904429f553a3a3d708a90bd797c2934928ebba0c2b
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xbDmg27RnWGj:5mifPWRuD527BWG
TLSH
T117B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3b7ab8f3810f989b56536c0f0411822b554f88c2d074c6dac4d47159e5da9a5b
MD5 ce22e432c6ca727245207e0d48696fe8
SHA1 383fe01275063d39ad31d769395f82539cb68657
SHA512 c3955b683ca6bc5594c9a49dc2b829ae2cc10a3834a1c3c91980108ddd869efa839fdffdf2e7d0dd2db12eb4d29cfd93bf44323e8b0f0f080a97e21e8251b840
SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHqgDmg27RnWGj:y5dKii61gD527BWG
TLSH
T14CC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b3fe5910e8dce458ffdf4d98e0cd5247a22c4b8119ec0fed0a29ce7ff3254cc3
MD5 90ff6f95e9000f5377edf14028f62ba5
SHA1 99cabbab6285f4b8edfab648ac44560e2a19fe69
SHA512 853315c2260de81150bc882731fb9c1228eb74b78ee8e7a40dc1f756ad2555bc3c9c51b125253556b2e94d22c03d8b17d60a998135e321ae1ac238cb44eacbe7
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5w3Dmg27RnWGj:hX2imphSD527BWG
TLSH
T13595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 199318e50ee67e78135e29b8316f421b77c318ea699a65cf4b91b253147c0332
MD5 b017e6872ba79926ae8c16a689135174
SHA1 34afb07a0c11406bbd06883e7fe39ecf365b7929
SHA512 eb0de3a14e5dc33f1881799fc97a4b9690071c73e71320abde06c559fc606209b09f2c8c0ea90f3c38252b6d3c3f836d19d3f835fb0d31e5b0b76c0401b7e022
SSDEEP 12288:JQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A577CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c601fc9b4705ee81eef2c6cec17c8ff311a8ec1a425816242f7ef48ccae7997c
MD5 e20311fcdf5f37fdb0cbd050b3f77a0a
SHA1 8bcbe93ce02f3c63e3e047070a5b827854d7f1c9
SHA512 7a8c4ec18f9729d0a6ecc80213e04ab8a966f8904fad1846f70ff9b57cb505a21bb12e61a8e4ac2825c4e5c816cfbcc93dec8286d575dedb1a51d807ccf6a4c0
SSDEEP 12288:PFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3d3554df8584be94458e5a201d807721504eb5728e0b516535925c91269fb9b0
MD5 ed07dd8c24ae21a79cf74f70297db82e
SHA1 1761b709756cb75b6c1fee20e7a24b24c99e16cb
SHA512 16609804cadc102e7c985dd23d9ebb2ddf7d0ab32d3747bd58f0e6be998bca9c9163d173a470ac589de57229ae97d2127b0cc87ac90cf6e4146e9b900cf466ad
SSDEEP 12288:7PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BF965C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a1a4df5ae75680ae4d854ba6ac51bc53954994f7b739dc5602404c1b38a2cfcf
MD5 8b74b43e4dadfb28476249ec23c3a90c
SHA1 1aa5fbc09ed38f51694435a6bd8271d6a31d4a92
SHA512 50432c902757f804af94c1b8d1fa1f9f5c04a61270c4484e33d4df26e1a9465e71935f16fe4a3e1d091d8e495855af3645ae9faeb2b2ef9477a7d135187c1ab9
SSDEEP 12288:1VaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15945236F675C00C6D83285B4C2F5E11DE8277D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a8a6dc890eefcd8bba90778c27a5c1b4c7194a944e4bc671cd32988e55dc9169
MD5 bca687baac4ada9cf809464643b8baff
SHA1 e4d453cc1cee2007b5a284f6e618952ab308205d
SHA512 c7401cc98edab81f1c8407109064a0cc1b5d30f6444b45683aa815d8244f500b730abdd584e658744bc88975cd72000df14c3e27f5f4971cec94f659061bdcd6
SSDEEP 12288:lSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52648B5C3E5F14EAC073E5BE92004937A9B7CB9FBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6978fbed37cc73b8ad3f53b1ba0f526c057fba3929a6b9d23c61d1978cfdb7e6
MD5 b7174e36461fa990728127c112af0230
SHA1 ae0a898f728464fa855e933954332c3c9412a658
SHA512 26dcda9fd3991f11748f6acde140c0457ddf83ef3f60836d31def12ea09f6c934051a9e11d098cf7fc03eb05d8aa473347c045ac2aa36bdde17d6ff2add597c5
SSDEEP 12288:NRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD4523BF965C41CAE52644B5C3E5F10EAC073E6BE92004937A977CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 491a15d61c9304a2edd66ef5cd67818c56279f468963c4f7199b125fb77072ee
MD5 3343e17768cce81697bb2ba8c589bd04
SHA1 c12686a8f7aebaa67c5b441032d795bb8c8ecff7
SHA512 5200611697ca9fab8cae58606fb6a2fc48b62c2cfe0b1a2a853946df51296e6d19609983b96e038f9ace608741e524093208d99370e9c7f56216e14f41b151ec
SSDEEP 12288:79Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:79sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BF965C41CAE62644B5C3E5F11DAC073E6BE92004937A67BCB9F7B14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 15acec53e4160ee6716824940a4ccfdd7e8c10585feb6ba4630791582250ed9e
MD5 d14ca015d0fff12a983857c79500867c
SHA1 d50ce029981782f8371c1800d00c42d991af92e0
SHA512 4f88fe4393eb65bf563d784891766a445164ccd64b149d8bf3f4528839697ec71a51abc819cbcf699eced2c600cf951cb4437b14bc635c9d3efb7c55f2c74355
SSDEEP 24576:/ZMRzFVSOlsqjnhMgeiCl7G0nehbGZpbD:/ZMRzfVDmg27RnWGj
TLSH
T1886501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8db1d0d5c870cdf14d48179da58805aff8c6a30a76bdb4769116c90c97cfb769
MD5 b9ef726f44be32feb5b32a1438537c4e
SHA1 ea764f0188ec34a6a4635451683eefe6737d0875
SHA512 ce05eb6f88cf9a344d04b44654cef4c3e9928c9d7f81f59dd56df535581ae2182c1fa1c6b6c4922c4d98beb2850a22af1e1bb62314a9c89be79fb5844a1059bb
SSDEEP 12288:z0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BF965C51CAE62604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b217f71fa142773c4ce1bccb8c264239975d26b0beca94a3c7d8d1b1be7d46c0
MD5 340028e8cde386a17988134803e587ee
SHA1 6c017894a6dfdaaa03b29942da00282f3839e1c7
SHA512 e449ed253d9c079691f7bee060cea5dffc653f5f4f4b93f848898105cc8de45cf3d3cff10be9d0cf920848dd103ca51ff0b42a885dc0d7ce6d6c101092009f39
SSDEEP 12288:dYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F24523BF965C41CAE62604B5C3E5F14DAC173E6BE92004837A6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2dbce30d36a0eccb403f17443c4fb8ab0c347ec7e8146e6dd86d7e6c99bf87e9
MD5 d2c94b19f5c27365ce1db1590a03413c
SHA1 7771b21ef5841b09d1385ff8fd2c081cc44a851b
SHA512 d83ce8f011a671e1cbddf1bb81d0feaf268f953e0e9a2eaf7948e736e536c2a73a61b6fa9b67d00d48300626d4a623bbfcfdf024594e5f740d60eca9c59319ca
SSDEEP 12288:EyPz5L85Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dzy5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E755125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a6bacde47b00397280a260cb280530d8cd975f491a4474d2d5f62701850c0ffd
MD5 53f0a2464aa47ae4229e8b0de6babd04
SHA1 43561036892e1ed82811fa8a00333f93f56e7077
SHA512 f2318d7c924a34331c7fa906ab0b489da8cffa26845082335d14ab00e66dc62333d9246f65fe73674eeb13b3aaf84e52dcf1b1c6226d85fcf71cb7d861993e79
SSDEEP 12288:40Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:40sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BF965C51CAE62604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 04a351dea9e2611a063190c040e8b574a12be2fa61e1c4b53ad14d221b5b60ba
MD5 af14d7ebf668ffce1001979862c39bc0
SHA1 640f541121b5ad5254916cea0ab26fb813887cdf
SHA512 d32cf70f94f9b8207b12177c678aef653c59d68eeabf8de3f12e708331695c3ecf3582fc158be8eef614e43ecb5063d360caa1340168052c97e239c8e41b918e
SSDEEP 12288:E0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BF965C51CAE52604B5C3E5F14DAC073E6BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e8bdbb47c03b52d6cfd5ff6698a764c4afecf5f961a0e3729d9953fc5ad6d049
MD5 73da60e37943ef73681e33c606631508
SHA1 5ba7a2a4bbb8d4e2b1ea699df9108b13fa585ebe
SHA512 12cf1c8addefa89de2ed420d3f569d6e05fb16fd95d9fa3c1aa30c15d42d17d76b9d039862d9a2c6ba0503954093044d13c070f791ab6f2e90ebfd4420c9539d
SSDEEP 12288:QyPz5L85Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzy5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10855125B73A530F9D1378138C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 66e7d6e8c17750c241d072df3c5fbaaf5dbf5e5b6c897073a32e2798e1ed05d8
MD5 5d73590dceea0373a61cf1ea4d59a807
SHA1 c3bd23a970083071c9658b4cc53be943ee571cbf
SHA512 bdd0d0d4185df566f2498ee653b18ef4e39bf6a18af52f1ce5b5c76d3060f415965f55629c57291c6830d62185cf633d0af79a84106ee45e8fafd51dfc2e28d3
SSDEEP 24576:QTDaLl3z0zDfsqjnhMgeiCl7G0nehbGZpbD:QTuLlj6Dmg27RnWGj
TLSH
T16D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5b330d9515af0d650fa1862c62f9b03d228cf49108ada13bf0aca8ae997e3a91
MD5 0959d9645197d37ad8c02154baca41e2
SHA1 d79b6f3a494fbf55fef10c50203c472b09887385
SHA512 9031a4c59df1d06953ba277077c098fd197bf2d44e495a0ba92c45bcd91d3f95452d24f48ef596048ea9ec5c47a2f14ddbbda9ac8a43c4b395bce472e7ae758f
SSDEEP 24576:23vd9CHKy7GZ7sqjnhMgeiCl7G0nehbGZpbD:Yvd9CHKyaVDmg27RnWGj
TLSH
T11B75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5dbf4a00ee9003c6471601a70377e570f757613845771a21d1a8d2e183ce54a4
MD5 49a841ddaad5c89bed118dc45209a0ee
SHA1 4ff6bdeac685a0c92dab045c19529a49bca10fc3
SHA512 6a96df579fcf2889d85765e6293bbf4087a1648001052977fd8354b0dbc792f3f1ba42b679c344327c156aa3ea6ff4ca92acd9896a7d98c5584ae519f09da7ab
SSDEEP 12288:JvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BF965C41CAE52608B5C3E5F14DAC073E6BE92004937A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9591d9ec520a43dfc62fc2ef0c2c038d4d4a29abdd31f6146b09553eb9c43655
MD5 755c00f4faa5f332152b2c3767ed4be4
SHA1 0e2ed4b20e48019ffddaff17ee878f9e11a7de5f
SHA512 8b41e5758c609a713ebd44529e2d1547d4d1be12b4880077b2ecbcb4dab736ee666659716c8aaa5835c062753ed66c3fd3b768a9b3df627ff1f7944ae2157921
SSDEEP 12288:OZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE965C41DBE52644F5C3E9E10DAC073E6BE92004937B977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6d7dacd8dc8998e71822862ecd45fc1a2c294393b144deeaf94de35b9d94aade
MD5 e571655bae3ef3154800826d5d335e3f
SHA1 e0492d3f760e570b10e9088c9de4143503b18e2a
SHA512 e86eae3e430df292e17f102c319360996d1c415f0978b25a553342651047a71b98bf32d82ffec462e7b764dfee4e37c0bf775be4bd5ac37dd03a41e2d021d434
SSDEEP 12288:uuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fe08ffc957e2d9d84cd872966fee7f4cbe778f369d23f7193f664b8d1eacc14b
MD5 ecc58d46078472abec7e781e22f9d95a
SHA1 347b88f3355fedf491da930e44a3c58b99bfe10c
SHA512 65756ac71d18ff559bc843fd157e0ba978208c49870613e5ce6781fab6e883102cc069bbd5d8244a4d55b090918cdbfebe0789f4384fdd0383ceb9e8cbda5eed
SSDEEP 12288:60Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:60sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E84523BF965C51CAE62604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 258ef8e63234b16f822075161a579536c8fcebb56e7d94de8d3fd68e08a5799a
MD5 ecef7b2abda4dfd3f523b44673039158
SHA1 bd5d5debebf3381067362508c76848298217902b
SHA512 4573baea113ce9f6bc323cc823f05f2c43fadfdd3b60ca0ef906a10e7867649c837493d43fe77b83dcc4a9d5d7bd204044a90b4bf981b5fd83da52ce270003e1
SSDEEP 12288:AvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BF965C41CAE52608B5C3E5F14DAC073E6BE92004937A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b5f887097dcf1011183e4de9532e49b07c52f58502d8dddd9211854cfcad5d7a
MD5 0522f123ebd2d5946a970f787a0502db
SHA1 7e1a969e056b8e48eaec78f2839ee398f4188104
SHA512 408fefa087aff7a0ad1ace28f384487dd6902667d4db441766b47dfc91387299380dc1dd3ed2bdb3ed307625260da24b2f46b6597a192f1270e21bc879eb2fbb
SSDEEP 12288:AsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE965C41CAE62644F5C3E5E11EAC073E6BE92004837A577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fc8a546f04785d76c65481d204cfcfa7d482f41ea836474840134b9a631ee94d
MD5 5ee8b7fa59890f17e64601849ebf0eb6
SHA1 1af1129108dc437f1b3b7a44fd4e9dafc17f387f
SHA512 a3b697f18e29452e55c76ce0e5f2f933d436471ceee600081347395f800ce34f6f05e6e7a7c003cb0271abc6e89616e24c830905dfbc708536e86ce0fca3df3a
SSDEEP 12288:wSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BF955C41CAE52608B5C3E5F14EAC073E6BE92004837A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7891d600749cb88c23309c5af593026c35491673200b60c8318fc80ff1413e79
MD5 347d6976f649848fd8b30d9561a93b5c
SHA1 5397e9dd456fa1f561ec6821467c909471035329
SHA512 94894b05e733e7c9c9b515a4e9ed231381066130bc10b55a02a0c6db58658898dc50f3ac29b01cc27b4fa64e6ffbeede510a60936919ae34e7e530aaa93c6601
SSDEEP 24576:LfwvUk9RX6wkyAIIsqjnhMgeiCl7G0nehbGZpbD:BMnYI0Dmg27RnWGj
TLSH
T16885D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0a03bf844d5a364da371af4d2bf0327332e066bd73ece4ff4f57ac6e6f695255
MD5 9a1d451b61ccec8a2227dba5fa3f7da6
SHA1 fdfaf2bed78eaaeac81a736d4aba857e25b1a015
SHA512 37c55da5dc8fc9bdfc2842f5e41ab3225f668d89fae83ea86bd57684408a78ca8b4495a146358a0c82fe6f317926d8396da1f5faf5880a29833679cb8ff41e74
SSDEEP 49152:sYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XDmg27RnWGj:LySzPvD527BWG
TLSH
T16A066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7d4c030c02e010aa74a19b74001cd897065a9bd1cf984525d3700b3164431fe3
MD5 63197c49004eac3c54c42294a10c76c8
SHA1 c4e78a522126799e781e1528adf07fd18c52272e
SHA512 82d5d74ac4c962be853bb3007f9c34e8b83d1580a76107b4c090befa400e7a98ddfabdc432ac381f552ac73e920e2a5ab658d69d85834c03f377c73c39bd414c
SSDEEP 24576:e47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYVsqjnhMgeiCl7G0nehbGZpbD:e47JUQjTirIhCnDHUPfF/HDmg27RnWGj
TLSH
T19565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ea1730d9d52f966a62a6ef2dc123f9b52a323094a6993d607f2c7b2d0bd508f9
MD5 52438e3363d5249ea6ad81cc6ffa7cbb
SHA1 37881f8a535ea90a2ccdb5002d22a23236739f49
SHA512 8ac77185f44e5339d7bf0bf2b21197a3085a279aa26f22c848b802f5192362c4746a750ab8fa73a1f74cfb3f4ba10864c36359d981dc3fd64c34991f9328838b
SSDEEP 12288:obsfEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 29a3c51b94e47065e14f1b1aefddb115eaac4549e21bc890f19d9f6e732ffdaa
MD5 f378aae5a25fbb3efb0e9c997544f816
SHA1 fc5cd168d4edea5db15283ff8a9eb31e75c9331e
SHA512 78670b81da8a2ae6fb650110c968d06735657df0f17cdb9ca7b3fe64489f27a064396bb54a2eb6326bc8c5a322d418d9d2e121e3abe5247971ef44bf52f18a2c
SSDEEP 12288:wvobQPaU3fegs0/5ta2HKSIhkiVVwX/uHoPhLCO8R8WJeO+qwWEhKPCR:wvobDUPfvHMOGIJLCBR8WcCwWUeCR
TLSH
T1B8450740762ADB4FC6A940325E36D6CCA7707D02EE04AF1773C9873F947A659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 d34db374ce922b80b78d67d8c2a35e99b646956ca2639e496a5fb5df8ffe7a46
MD5 b0b66efbdf2c5d396711fd344366fee4
SHA1 7d1d71add552e0b80ae601138473f95918c42a20
SHA512 fcee0dd15a90b43c60c3f8178dcd3c0693a5eb8ad1900422c7e38b475f2d43d93585e3a9f594d0f0778abe3e6eb7f5a01161e61a71c92a6d9998acfe741568de
SSDEEP 12288:sWsuxRA9KOpGQgp08aZ0LXb6Lm+g1EfzjLeXW0qyD5ABjpeVezb0RNflu:sWsuCLQvK3y+g1Efz/+W0qD1eVKbQ9u
TLSH
T14A550800A5B7EB4FC97A9037063286CDBB745C06F7453F0573468938986AA5FB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 464856840fad9eb77fb9fc1467884f1f4ea22f42286d9cdb8d00bf8e3e751982
MD5 fe3f478f551f4ae453468e514cd27bb0
SHA1 5ab395dbeffb4020a95df438321909a49eb71a98
SHA512 97c1635f98beea298e23a9e8a6c6174e520ad4a368fde4eb7669fcc2b11f2abf0d5502cab7cb0abe9a09b9cec49391a4bb43221c1e933a2e375f0bf99a523dff
SSDEEP 12288:e078Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F45237B935C518AF93605B482EAE12D681B7E669F1004C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 eec8ba85c2e994b59b4371dc4d0e788a07ed7521eadad75c2989dc1d1b6eb6ed
MD5 cc6a9ab3a147660608b766c0573f3779
SHA1 7e6f474cc34094c3f72e4425d24b308c1751c74f
SHA512 4293c7d98fa2c99f0d3d29c8c91d91e2b394b97f4c528dbb767378a8d61365ed3e1545fe2910537707a6d01c145bc75f1186ca9c6e82057c7774d97163b616f2
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bY2sqjnhMgeiCl7G0nehbGZpbD:xgb4mBIBhGFJDmg27RnWGj
TLSH
T1C0659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f6149f41d01997d4a7b0c60a2dc6172aa9f15c265fda87b87403b24d69d4dd4e
MD5 678378b92e395e6173088fc77e2ed9de
SHA1 ba7257a405cc262ddfe4d7842385af7890cc9ac1
SHA512 0220734442246d3ad01ccc2a26bf86c6b186f4fe64a6fba944bd4e23798e8551b4fc022830741eff2b1c8f1b301450296cd933564f0b2d09810235b4d976f511
SSDEEP 24576:+G88u8FpJqH1bzria7/mlsqjnhMgeiCl7G0nehbGZpbD:V7ZFPqVea7/iDmg27RnWGj
TLSH
T12D85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c84efd9127269a91e56d9be249954527d5b34fd70d2bd644de367c685751b91e
MD5 bfa2e35990ab4a457998a3120bf2d4b6
SHA1 3404623850531bab0b4b218967cd77a44aa9071e
SHA512 57f96061063615b70d571c058a1c0f2f76324021ca011f78fb6b58d13bd6abe68f158afc581eda1a29788d0ab5cdccf8d57bd41c03742120ac272bbfef436cf0
SSDEEP 12288:jHvUrBFrEjwaQBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:jPUr+NQBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A265F12F22AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 eccb5740912780367935028632ab01ea9e37cec2e981f2a2f8f3624699d9778d
MD5 33aa84e8b31e00e947636955f444d8d2
SHA1 2cf6d52e109d806feff498d24817c385279a5b10
SHA512 6bf6d66a0f80914ec61576448fac8828b9a8384da645b5d1c565f130048618c863be55b12aaa307a1dd7a38623a491662102b323119d365dae4dd68213e4473d
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlDmg27RnWGj:RG05lO43b8D527BWG
TLSH
T1FBD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95f060fb4f3faff98022c0d188c451d08ce6ff2b0671112e897b0381a6c12ed8
MD5 082f388d520d3a59373abc21ab4942b0
SHA1 450b06a7411d7f47924c46003136a875d264101a
SHA512 43dbf4fe23b46b57a0aae464eab0b3df64084d682496b7b2fd8b21ca10df8c6b995711f8a02e4f595ea8c8c829b02d97343b0f73b34bbd7e36b0fdd09675ed9f
SSDEEP 24576:/fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnTsqjnhMgeiCl7G0nehbGZpbD:Ha5POZ3BJt2pasx2+mdDmg27RnWGj
TLSH
T1C365BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 96b0f9b642e8f3c1dbaab03b1556d0b86c3fabe806206346084cb7cf877dfbf3
MD5 50d255d09af4dd9a54a4072db7ed5aa7
SHA1 2f1ebbf4f21495d830f6f0cd48875c75908e9514
SHA512 8ea78fe783cf450acf0ff9e8eb5e16aeb949b3b38fde5e50c1bb198326c5ed65c712ccd834607f0b4610451742cba31d3d907b31e09bde2aa89ef91e20b8f6f9
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkNsqjnhMgeiCl7G0nehbGZpbD:BNc/zEOVHFCDmg27RnWGj
TLSH
T14C857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fcc3c50202f3830b36d4cd03c051ff5dba1ad82f3a205372744345bf5c39cf46
MD5 89614f3ae9f1a734d6ac81393925f515
SHA1 6a49b6fbdffc7678ac977c0b2f28719788e86fa9
SHA512 9c2ef512c9173daf9ca9bf433b08aba17e546e531c0824197247f44117479c31035a15490c6d935870803391e9c3b72dd416d21b78a96eca3f875c866e7ca67c
SSDEEP 24576:JTkNvNnaFeYhJNtmZBmasqjnhMgeiCl7G0nehbGZpbD:JTMwBtOmuDmg27RnWGj
TLSH
T15C55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 406a4c54538d51479262fd6abe6a83c6cdcb3dcde4734a52ba0cf6c86bcf00ac
MD5 b8d8f099d9940c6e01a913fff6df7b7f
SHA1 272d0c464e26ef165df8bde43749299e07c9714e
SHA512 2055861e511ed7259f1b66ec5fad671cceb08ec5349d244dacf9a6e70f4ecb0372317282fa68d8826feb20271d3f84404776800779443a3d15b181d4d64aabe5
SSDEEP 24576:uD3FHshBIYQgAwsqjnhMgeiCl7G0nehbGZpbD:uDVHeBIAAsDmg27RnWGj
TLSH
T1C775E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1336-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1336-325-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1336-86-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1336-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1336-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1440-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1440-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1440-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1440-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2012-269-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2012-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2012-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2012-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2324-303-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2324-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2336-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2336-311-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2336-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2336-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2336-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2336-105-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2480-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2480-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2480-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2480-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2480-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2480-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3580-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3580-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3580-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3580-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3580-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4628-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4628-72-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4628-78-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4628-283-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4700-8-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/4700-7-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/4700-1-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/4700-13-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/4700-15-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4700-0-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4920-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4920-125-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4920-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-133-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4920-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5200-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5200-26-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5200-18-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5200-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5620-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5620-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5620-112-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5620-118-0x00000000008C0000-0x0000000000920000-memory.dmp

Download