87d2c858f9b7bdf93e9ed83644127ee9597df5edbec7072adbff79ce04e4f48d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CorkDork.exe
Size 4.5MB
Sample260925-v645rasdph
SHA256 87d2c858f9b7bdf93e9ed83644127ee9597df5edbec7072adbff79ce04e4f48d
MD5 d622d8c02e4da46bbb6e4c3c6b413b02
SHA1 28501cb09a00ed905b572b733b832ef7632faf62
SHA512 b46a5f9ba5f772bbcd6dc635016c550cb43eb4d86c706f226d2c03579fecc732cf52d8af795e888f954cb982b2c6ed070007894f13c63e8ec2caccbfe4eab33e
SSDEEP 49152:wa1CZHN6Js6n0ejMhChyMaNzynymvbb2zGNCE/q4TEJTgoIB8Zw+AHw2Mmq9SASt:GMn/jkkym2gHB+0w2Md9SVN55
TLSH
T11E265B557A4A586DC04AC47082478A335A3138DB1B36BAFF41C4A6353FB9BF06F3D668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2036	elevation_service.exe
4664	elevation_service.exe
4592	maintenanceservice.exe
1520	OSE.EXE
3516	PerceptionSimulationService.exe
4832	perfhost.exe
5644	ReFsDedupSvc.exe
4996	SensorDataService.exe
3852	ssh-agent.exe
5108	AgentService.exe
1932	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	CorkDork.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\vssvc.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\AgentService.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\vds.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\msdtc.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d8910c973a35217a.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	CorkDork.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	CorkDork.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	CorkDork.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	CorkDork.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	CorkDork.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CorkDork.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CorkDork.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6e7d489144ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d300acc144ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cab10f89144ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9f5ff8a144ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007956018a144ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
4056	CorkDork.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4056	CorkDork.exe
Token: SeAssignPrimaryTokenPrivilege	5108	AgentService.exe
Token: 33	1932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1932	SearchIndexer.exe
Token: SeBackupPrivilege	5644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5644	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4056	CorkDork.exe
Token: SeDebugPrivilege	4056	CorkDork.exe
Token: SeDebugPrivilege	4056	CorkDork.exe
Token: SeDebugPrivilege	4056	CorkDork.exe
Token: SeDebugPrivilege	2036	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1304	1932	SearchIndexer.exe	101
PID 1932 wrote to memory of 4292	1932	SearchIndexer.exe	102
PID 1932 wrote to memory of 4884	1932	SearchIndexer.exe	103
PID 1932 wrote to memory of 1208	1932	SearchIndexer.exe	104
PID 1932 wrote to memory of 4596	1932	SearchIndexer.exe	108
PID 1932 wrote to memory of 1840	1932	SearchIndexer.exe	109
PID 1932 wrote to memory of 3384	1932	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\CorkDork.exe
"C:\Users\Admin\AppData\Local\Temp\CorkDork.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 58b1f346ac2a995dae5cbfc8eb85944ddac1fc3bf025a07f76c0d17672c8ef55
MD5 1dd459c5327740a71244a28c0ae0e30e
SHA1 c879736025716e9fa58d6d6a45d5ebaaedc181d4
SHA512 a8b8a7aa8d654166808c60634e1d18d2bb4fea1594cbdf2e62ff2c60b8223505439dac14569cbb7981db5f63a2c59b6e3df855c719dba11f799badf6567e3fc4
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUq9SASScpfB5X:Y3q6sjB09SVN55
TLSH
T1ABD58D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 db727d6c939d1e4074508e726bd2fa64dd348b8544cf412142e636d0b1f08bc7
MD5 63e4f0147fffa09a0e53ea8d18cfd157
SHA1 df6ff94834d68318254474bbbf0bb824cf93b3ea
SHA512 8ca066752d131db7673aad37416202fb43fcb7561c7698edb648343ea476fc5afb45cde3ec2af7477dbe100acdd9f9095dc5a1e997403e7a73be35bfafe09eea
SSDEEP 24576:/XYfDtczAZrqUQSAlkSB+pfAOQ+7jXjra:KtcWq9SASScpfB5X
TLSH
T16165016867D408F9EC578238CDA28411EA73B89547A0F7DB03E48A650F337D95D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fab8f0a6d8feefe4953e01b9df5f2ee732946ec0e93072e668c034092d5e8cb6
MD5 6c1b7a80eb955dcc38d2988bad57d0cf
SHA1 d261600a8d138dc80a3ce4ce88e4a6828d18cf52
SHA512 a0b69ede7dc947b338f8c6d143ebe0c05bd74eead4b52886ad94fc19c23afe31d77050084e42ce414abad46411542e86069005c697c591f42b1e7de78799c60d
SSDEEP 24576:q0Le5ji0hmx/rM2rqUQSAlkSB+pfAOQ+7jXjra:qPji0A9Pq9SASScpfB5X
TLSH
T14185AE65F6748331D073C0B9C5D2A69AED7130861B308ACB4286D77C6F67BE6893A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6e4d4c4ada508fa3cbbfb5da4f57795b4b45143a391740325a0e4ea60399c7b1
MD5 d3e667240d2025c8aff4ec0823b00e7d
SHA1 077b7de1053051dfce86c1a791cd5b6c3cee79cb
SHA512 0e261398819f488ab4d07b0c89c9adb890cb8cef73afd22a05fe386a51339b818cd1c4aa9a9298af8761c189b8df9702f0304e6df4c65e321087ef377e5f01ca
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyukrqUQSAlkSB+pfAOQ+7jXjra:k/ezSC6vUzPveHjybq9SASScpfB5X
TLSH
T18A756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4f1e020f77387b4a74ce9646a9c723d11eff26ca0d82d26348b30941fd0bdde8
MD5 916f2a931a2c59ff6f470221810ef753
SHA1 3a036904547450db6a23f4f6f93d74006e52571b
SHA512 d68a70d740a2ca38cc5791d27fdff552eb605b5ce59eda50dc841c9dd42b7b2e603c12de36a67eecd0f9ff77281fb209a19fe3f096068191cfd317e50c8a997c
SSDEEP 24576:wVbqPb88hv/l+YtrqUQSAlkSB+pfAOQ+7jXjra:wVO88hXl+uq9SASScpfB5X
TLSH
T1F3559E66F5748331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c4506818bc944dc6e424fc424e1ce71b7b8e179eb6826ead594490897792212
MD5 43934fd250e8ac6ada3c396036a2b28a
SHA1 fb5190a660399ba87ab7fcc15f79d31501122b6b
SHA512 e40f902b6c3dbfc4e250fbaef4c3f3dcf1edf0cd47fbb57b3ed166fc56c41d6869f9ac5460d82810c3c2c98ffc8bd5191eb145380a343c6e40b62423829fb3a5
SSDEEP 12288:thQweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:tharqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1E14523E44A5434F1E68706319E4E44E0DA78EED909D27B99CF90EBC08E30A97DC5D633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 436d1c9f9984ddc14f1f754acd937331f0058660d3aa65c045c2845c48b4e73c
MD5 f6c6c5431a25065c339dc48c0e5a7899
SHA1 560063d6d7271b3f6d1ef7274fb1483686f90919
SHA512 80c6559f951b4ac418d475ea7c392dc990991e1ffdea85dcaa9a8b4b6848ef9fc8b6bb3aacf9bad37560051c78d37cf0e67e9740468f12bd2f5d4d4f1a997804
SSDEEP 12288:EeBNUbTVO86UlweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:EJIUlrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14F65CF7BAE28FCE2C27A4D785A918640D77278704F62A3CBD265C30ECE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a7bcf46ab4e7f3032dcfbdb1d18ee16afd8c21650d7486b91f4497060efa535e
MD5 b2fbe9b843944c35f1eebd189d9e7080
SHA1 f6fcdc440b848c8f941cd76760d9a58322caba44
SHA512 5474705d604e036da401e9ea4e93ebb81b96dfd9b1d9e860d5da10cc7d3308a4a793a99d7a14f2ae9503ae8c85e1093e6bd23e7096f8d84ea8bc4faab32096fb
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THj:OQvGAdlCEL8c/DRNw5Ct9SVN55
TLSH
T1B9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 bae35578863791043a6a6d85f4791b58cf37f94069d6623aedf19489d240d23a
MD5 86af17634a2bac3253911cc81c2bf017
SHA1 3424e30a67cd5f1ca9f8495e09489ce91d070d5a
SHA512 231a9e646298fe2a46caac3c5722b57508fea253629d4de9891b95457ea64d10acd3a78569cd3c675a3ef9d2f2362bf28ebea49fbc7e107f9d87315bff59603b
SSDEEP 12288:AAwSfxL/2Dc3HDLLmt0LDQewsAj3weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP6:V+ewsAjrrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1EA75E071FE74E432C6BB0DB21B26C715547CB9604B912AC3E3E88E9D49302D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 13a24835fbc58524376511eda48149f70f20114235f19e9d9547a4c6ca586b1c
MD5 7eeb4a148da3cd74187c1c4ba1c4f7aa
SHA1 a1da9241e70f39a6513d18ecd84bbdc80edeb992
SHA512 14dc0de2e3cd30ec8a40ff6064a32f648a8f89ab444c381b0f940a5229902515224210bfc9114be7be4ed0eb6cf270388d3d9ee63f36bae3f0f27cef1c2a00c0
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVVL5:CUEtQevvqc2W1cpV2tI321
TLSH
T143474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8532ce524a2ff03092d1bae49aaf62d8e52615f7198342cb0065a1f523b48bc6
MD5 5604aa6c2ff8c9727ad3c9951f56411f
SHA1 a72b2f1f6b6ad1af8c6a3259dc35d79623bf935b
SHA512 5bf9483fd632a0c4294ede0f47cc32536d758e885d06359bfca7796c9b8262bacc6df58242cc28f902a6e568288261e1f6c501c05a7b859dc9109c02ab3401b1
SSDEEP 49152:JCbRquA/m2yL5zifFiV+XenmE3/z/q9SASScpfB5X:GoqHVjnmZ9SVN55
TLSH
T10CD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6e6d92804b1beadb0c16165152d6abfa8c0b3a0d834933ad8826880934e23ca7
MD5 3109793a27da533f28939a5a05f30113
SHA1 79921af0b256c84f3188de40d09070e522875db8
SHA512 ee3741bd1b126f1244669c602fa77f7306e498d21b3e50060e24765f7176aa57f6fc82ee0ccab37f8e96612aa9b39fa171c282b05f455bacfaa3e78d7a6c6c5c
SSDEEP 24576:9AhGL3IFoiwtA5l7S53grqUQSAlkSB+pfAOQ+7jXjra:9AMUFoiq5Sq9SASScpfB5X
TLSH
T1B4359D80E7F955D4F5B3AA789DB68170EA76BCAA5E31D20F2250D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8b699a2e20af8ff79f06fe99a4729b7a02c6d21ae6b8fd0e7a253296d6383922
MD5 c143286ed9370d9c06825ec6e7072662
SHA1 6922605ec96c04ac61ae8ef42278432b5fe63897
SHA512 14f8749d638a7337ee44d1208570cb201c52ce729f40094eaaf2d2f89eb6fdc61ee3be1cacf97e677d72bbc97bf069e08407be95c59754ac006d40a137ed6870
SSDEEP 12288:umw5HEjsChNTBFgl0WDm+CeweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcJ:nwuaOW3rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14765F18576A41CF9E9A74239CA57C031E7F2BC122A61DB1F4760C65B5F33362AC2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 03a7f5e2b92a23eff0e7cdd56b139773a87b8d5d862b385389176b5ace6528b0
MD5 918afb1dc9db2249cf6af0f6383d2ebe
SHA1 e1fc2dcf10327b4f70e8a12086021369da2cea92
SHA512 d2a4c9ed46bd50b64d204853a9444887a501cc74a002b02c7e9d5a353793d4d1b72d447e0cf27c75febef80657277a1dd7c9ff26c374b08cfbb2bc2659c7cb7a
SSDEEP 12288:1AZ1IynweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:+ZuOrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1875512A927A430F5E1830239CDA94580D7B1B8A627B253CF4B6487954F32AD79C3DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 11c17a28e66cacefdbd7bfa63dfea2cd413ef8e91b8d8eed2d0080e9043930fd
MD5 262d7ab6c75f75a7d67cf34f3cb4458a
SHA1 94712bd2cfe439320dbabea312fdab6e29247dda
SHA512 f580ad1e9a87901430a477e261ae43d506665da9d550551450c4972160d3bb6b246ae82e295c0a16e4255a74737d770e04492f25277ca44ee9f2c6209cbb9a8d
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:DQRQyi36YOcPbLvw2gAf+PN3o9SVN55
TLSH
T155667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 53ec3341d5eddb830ea6a695f60ac935c9a8ba4c19e77e1d5be09a3c302352b4
MD5 b06c0eb981991a3ca9190f67ce514383
SHA1 bd2413c877ba134e7990a195c0f56d5cca15251b
SHA512 00090e121457c89e03953fc25ff8cd698cce00fcf6739e4964b8415fcaa436df6fc0faae595b9b1738d255a762909a40106937403ac0b261fa5e827ac2d5712a
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:SQRQyi36YOcPbLvw2gAf+PN3o9SVN55
TLSH
T1AB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b4380905672949e076a7374d9fbd1370d61aea79fe3d402c7230ace9dec93c3e
MD5 48c5a3a2d5a74b4e7e997cd70ff69462
SHA1 e5a92cec8d6fafab75a47bd77bc697dd61a095f0
SHA512 27dad0d1800950a444c63a0cbeee0179e1ad950ac7945ab83bd5771b801ec88d8be46088852bf9113fe0e36db1899a2767beef1906d50961bfca328cd73c63c6
SSDEEP 49152:e68Qg55nhceWu7PNU3/Pq9SASScpfB5X:sthLRc/i9SVN55
TLSH
T19FB54933B2F600A9C44DE1769F4A872196E17C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47a0e779bde4aa34bcc495f0ef241fa9137a058544a95bf1b1a61b91aa384dc3
MD5 b38522b543bc0d3ff5e597c0d57de47c
SHA1 5fc75e0ad9abdf3be62df864bc54f1fca88a5429
SHA512 e2ca1b92cb5cf6d046d76892977d513ab8441913dc4180c0eb6a2fca6590393bef3ccd7cf541f56020135c7e302d5106160b4a5db9994494ffcdac12c71e7882
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk999:4y5112gYy5azzVvt69nLKnhZb9SVN55
TLSH
T1AB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4551a610e119b4c58eccd6c00b36419059e8a1fa160fa54afd40f40c3f99afcd
MD5 2f376f1d1a548a8eb673434476a63c02
SHA1 f1e12fee05c9c788cd288dd287abf00e3c5aea57
SHA512 dc7b7d9249a0d7403042cf3bd7e8730b891218d9ca07aeb8a1114c77bb1a5952a4ae860aa43bda364957824c6885d3ac96f14df19c0691c7786d5020656a1e1e
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glpq9SASScpfB5X:eu6Jmdxd2dQ9SVN55
TLSH
T1E3D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 865454b0602d4a0c7f31da7937220611e69972136e68fa6bc1348402c9ea7edb
MD5 424cb5a8898c1e6b4e31ab8d3375cfe5
SHA1 31ab5ef7fee124ed666e15471662f4e0e75bae02
SHA512 8a25aea3f45838640f231f87b5057e5e593bca8f064ffa45c49264074fc118bf55b4b59bd3ce6963fc2b72e2a51eed00e0b2553d40bd9249e195662de04ce7bd
SSDEEP 49152:i1hpsNoJpF1A63U44CwH7R4x1q9SASScpfB5X:imifPWRZ9SVN55
TLSH
T1ADB5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 28d25dabfd1f09cd1912cee6a66e5c076c6c96ab1114b24f5179c497a1954770
MD5 4b2540c4955e76482dc0982f470f2b71
SHA1 e81823bdd313b16f859823e3d5d9972074cc7fc3
SHA512 344d5ac40488ba6cbc0084cedecd799d06c7cddddb03568afee464d39b8c27e446bb9e440381f4d4c42cc4586380e4c8d8bceed152dd896e8c6f459dec407450
SSDEEP 49152:2SuZQIY0Be2KcRVtOnks6NMHqkq9SASScpfB5X:Y5dKii61/9SVN55
TLSH
T1D5C5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f779b325b998f02aecd466619aaae3704ed141eb483e3c727acd821b53503ca6
MD5 7971a1707982bd02d852fe9ef6abe447
SHA1 9cec4e4731f49d848a91caff2cfc259458c26877
SHA512 89ef9bdf5622c29f4e56104d9124e74b4764490110d7ee4eb5160175fdc7dd67cf80d8b24a30662f4fb36df841141764a20e535e4c2831b15e25459206fad0f0
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5w5q9SASScpfB5X:2X2imphF9SVN55
TLSH
T19A95BE13F2D900E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5142278db7b6f718bca0c3067eebdb79c3e948ecc730e20fae6bfb1299eb1f92
MD5 29ce51bc8d49363d0d5bad0cf499aa31
SHA1 ec50b75a20c1fbe22d9b6bbb8cfd6da41bce9f50
SHA512 3c1dee2999c883fe23669ac0565f7bc6ca72134559355faacafd064641d08478555ab7462796774fe9c22ad38b7f6391dd56d07742c3c7a7b087d0c590ac4af5
SSDEEP 12288:howeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:hSrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T16B4523E4595525F1D5420631DE0A40D0D97CAEDB2AE337EEDF849A408F30ADBAC4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fa6b1a5491c9c171975b20833c4a865fe8e479059624791e50401ba04c82a855
MD5 12452cad7ecebc940c72743adcdb02bf
SHA1 b6d2234e7b64855c75d43ec3c9494ed103e524e7
SHA512 edf3f75e6e85b3d7946d9d80bfe600a6f86fe67c6ffd30ac2268df889b89d38a38f50b50e50e1205b48c4cfcac69fe02e56258538cce80dd4f4ca09a8d0e9ca0
SSDEEP 12288:YTweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:YfrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1094523E4595529E1D5460631DE0A40D0D97CAEDB2AE337EEDF84CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d7a92cebd334484d110a153f6954ae03d78203d97e6403af4491cdfc3353f5f1
MD5 eca8b7af7e35da9a920d576210caf501
SHA1 0e2d9fcce56cbce0ae5ff2bd9f253258852e35df
SHA512 5fdd4018430789f04aad100a0e773f5a06be24c38b3e8cac4f3392a4fa93a64b333e2b200e6ed1a4163ff61078948b3079ab2685de50d155f5548d86045028f4
SSDEEP 12288:UdweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:UdrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1134523E4595529E1D4460631DE0A00E0D97CAEDB2AE337EEDF859A408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 dbbb62906e9d4f62fa7feae140d951a402abad3cc873ac33953aea353ed12246
MD5 cac302d843e52f52905abc270813f8f0
SHA1 4abfbdc0625c2df366c0798db85bcce23c394d42
SHA512 12a59f9322d89115e6bf88687b44a77d2b33a3b7445fab5f95de0491a30ae9ad579f69004ecfe8c992c4f041d7bb527387b62ff7c38c1b15ed4f5208e048597c
SSDEEP 12288:hViweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:UrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T18B4523E51B6925E1D4874235CE1A40D0D6B8BDDA5BB267EF8B404A854F30BD6AC2CF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bdd313406c7156f689a1389453e43e5bfc8c9c59d7657cbbd29dc569702f879d
MD5 979adadcb6b86786957fbc65efd7d21c
SHA1 1f0a606a0d19fe3384f454a467529055d6bb1c31
SHA512 de42be3298e98ec780fd1930fe0982fed419656fd022a80439ec4383a0d3a8ff101566c559c046aa3a9f50cd2225ed3e0dd89341fdbff5e572c01e4c05b48ec0
SSDEEP 12288:TKweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:TIrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T12D4523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 307ba334c844b65fe34a0ddc8f113fbe23f69ead8a4e0af3dbadbf9647dfad2a
MD5 723b0291d96907e50261717e3b6c5214
SHA1 3dc63e4a788e6dc7e1939fe23754b48cd8dbf0d8
SHA512 e90387a445a3cf1cbf36c67fe971404e7b4a84b8be3b7cd7c213e4140d798035e2494683f2915545b8bef977eb5cd36ae1bae9b4a3f4481192434ab19ef2f1b6
SSDEEP 12288:DvweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:DDrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1EF4523E4595529E1D5460631DE0A40E0D97CAEDB2AE337EEDF84CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0f0d9e212e765bceb97af98cd5439e8a3b9c158a0fb68dda053189cef89e1246
MD5 4d0d7d195808da3a2efb547573526aa5
SHA1 4fb5c9ead358036f2eca140147daaa8d1daf9282
SHA512 621c6ab0c0366bfa4c53297eaaabc6b956abaf60d97e965b9b6898be87993431409e3c3eff6278adc132532eea0932a1eb3f22c6443935ae754100dfcb05ee7f
SSDEEP 12288:l7weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:lnrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1504523E4595529E1D5470231DE0A44E0C97CAEDB2AE337EEDF85C6808F30A9B9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b962ffa8052efd53397485e505f268aee1bdc0e2fb299349a89b16d80e8f6d0e
MD5 edb3fea63ae5e5f1761c8425f2dd3929
SHA1 e1f6efa10314d779dad065298ad4f94ca4028fca
SHA512 44017c12300efad4c2ce2bbfb432ce4fe0c6999f700233b9f1c915105b001c23585293e4b06ff1325a23902cb5c772c10aeb201473b25ace74ddd6a7fecb83ab
SSDEEP 24576:BZM3zFVSO/rqUQSAlkSB+pfAOQ+7jXjra:BZM3zfnq9SASScpfB5X
TLSH
T1786501A4B39018F4EC67823ECD158855D6B2BC5A0BB0C65F07E436664F337A25C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6054de98da9aefdb92e7b397043180e22028c06f16ff3a9f1af63abbcdd47262
MD5 986258e4c3df75516179b8f29900908a
SHA1 dfe246cb35f2880b0ec67ef765536867d3e446e8
SHA512 5727954978ef6539d559b19bff2e1a12b283a4c3ea26712eb8edb9e2f0d3d2d29975882f244765b4c02e53678f6f176d014274d7c329b9b9d2b91445ba44c9aa
SSDEEP 12288:z8weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:zerqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1FB4523E4595525E1D5460631DE0A40E0C97CAEDB2AE337EEDF89CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f38f9e4eefa455579db66b50cd967ebdd20f6649f5d1705a49ed2a0b5433f15c
MD5 b1da4b88ea7ba40f586a1e9a48075333
SHA1 3d34191b56dbd62de283df818bd43c7286a17432
SHA512 5d0d8c6a844ebcef9a1b863b74a3ed48771748b13d055ac0581509e318ac402526bdfd12efad62ef8aa1dbf3326dd3e3b503b63aaff77af581684fa6b150259f
SSDEEP 12288:2AweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:2qrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T16A4523E4595525E1D5460631DE0A44E0C97CAEDB2AE337DEDF89CA808F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4082dc41d3f2195d017d73a34439bccc0ce522aeb7ae9252c08a5e03f31cdd0f
MD5 a89de617f644dc86ff81f0165eeef1fb
SHA1 5ac1a608004e8aa686d6228b904bc43026295f56
SHA512 160fc8ded11c1617b330e395b9559f189c5527036805a06d13462f1303358c7aee541474d703fdf26d6ac9918b867981c20445e4ee76c90cdb296a300b1078f3
SSDEEP 12288:JyPz5L8nweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:ozy7rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B055019767A130F9D0678234CD560980F7B5B8760B619BAF57A047B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0604c703b934c1e53fcb2a5fe034b585f59ed5a2fcd057e008c265f2023b375f
MD5 4dd401211e329ee54b8df95517e72121
SHA1 901467e7846e7a6bcc50df74f29a323dda82fb65
SHA512 744d9960d96dfbc43af0211cbd57c9f94bf9bbe87a40177b36a5074eb149569e886cf837a6b62d6b1b5e773d26b765f749e8064020784753c4fe11f3bb9eea75
SSDEEP 12288:G8weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:GerqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14F4523E4595525E1D5460631DE0A40E0C97CAEDB2AE337DEDF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3f34f91a963ffd283e8c89c4c35e88d5880e1fe7122eb3bdede7539ee8f4ecbf
MD5 9d12b672eb8e5c2d2338d8bc7f226d18
SHA1 00746112e95093700aa508f8814578589190885c
SHA512 a970f060930edcbfbbf53cecd05b837a9746982d4384e0f629d64602d120984bbf870d22425e790b25da5345b5d43237553747f912a4f16ece7cd5597c00a536
SSDEEP 12288:I8weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:IerqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1FE4523E4595525E1D5460631DE0A04E0C97CAEDB2AE337DEDF898A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 08c50cd135d410674a2e15f0dbff50820b8b5c96edb682b58d306ea4f9108b87
MD5 64fc1e48a8ffe5f99b9e436f94936f3b
SHA1 1c1e69aa9fbb8805f3336824d97e339c88a6184f
SHA512 bcc216ebcadd7827faeb802d8aed1e2a159afe83c3771a4105bc6d4d54c079c5bdbc34074025ace3120e45242056866ad7a1a67b8ebb7cebc5a1b85fbfadf3d0
SSDEEP 12288:vyPz5L8nweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:Czy7rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11155019767A130F9D0678234CD560980F775B8760B619BAF57A047B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 38ee28d66456ece0af5c19da45d8bb498143889694d12112e9c4bb0016b4c54c
MD5 9cc94b286f4c38bc3c14875ae6b3802a
SHA1 decc16a62c7eadc234c2fdae494e738626917c11
SHA512 c4e8df1d0f122601f11187411c101e0df9976611cf80b41b1637378d73aa03e4af3d055eb1ce91f55b727b4dce6a6f85c833a5f3dba40909108d0ebb962f2f51
SSDEEP 24576:2TNaLl3z0zDNrqUQSAlkSB+pfAOQ+7jXjra:2TALljmq9SASScpfB5X
TLSH
T16F6501A4B35018F8EC67823ECD168955D6B2BC5A0BB0C65F07E436664F333A15C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5f76e58745c6ea8ee876eef9f7ff5bb89ef532ed815effc7b86802dbdbae1758
MD5 d0c162c7f7ddee02cffe2f9ce5a74c4c
SHA1 cf071c4121aefa0eb0f0f83b7f69b132dba8a94b
SHA512 5a9963162d1b4b97fff08b433dc9b6f65fb0ca10c698ed7753df599958c39c50fefd13b31a7e55e6505db58df0d202b0623f62f308d3990ae5e2837aede45703
SSDEEP 24576:63Fd9CHKy7GZxrqUQSAlkSB+pfAOQ+7jXjra:cFd9CHKyanq9SASScpfB5X
TLSH
T17F75CE90F3E410E8F0B78A358D664511DAB67C9A1B71DA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cbd8ab13cbdd9d746fdd85cc7c8faa9d281613347cb5f8f1b70ca4f2fb524849
MD5 17701b481e053c48c30c0a6b64b6b97a
SHA1 881cad5154f82dbba104929ffa109687798986d6
SHA512 1e604a9bb896cf99f9fee7ba99f13d4672fdfdb619b269d549973a4d3ebc9edff3cb83affe742e8ef472ed7bbb42bbed3f85f0ea9b6aee91053bb90f3fda190b
SSDEEP 12288:h9weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:h9rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1E04523E4595925E1D5460631DE0E00E0D97CAEDB2AE337EEDF858A408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b8c6a864de90c1d66dd649af6ed4687d62fa597bf05b8136a58c49d3d42f6986
MD5 89041ed249bb758be2b14ca1a457e098
SHA1 90fcff0f268b0bf5d4d6fdbee40f92549dcdd99c
SHA512 f32b9ba12c6cb0520cd9a9f1244991cdda68568da9a733a15a8ac1c3d64523daebc4dba43a223f80753892490dd46b33cc55d2d1f07b4d16cd6106566d0b9cc1
SSDEEP 12288:dHweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:dbrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1754523E4595525F1E44602719E0E44D0DA7CAEDB2AE337EEDF858A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 adab22e8156883cfaeeb804ad24dee46750752cd168625993ceabaef59c19801
MD5 b586a3a7e2afd5ca67df319c95039dfd
SHA1 a57e805e17fd47030b4dffc37b2e4d6589354075
SHA512 5156c587472efb2d93179f2e57d6e62a7d3def6d7b08960cc45140a1ec65166a5e3c0e806c0e7755a9974372d47c7b45e3e50c6eaf22efe56a28a43ad4023d8b
SSDEEP 12288:emweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:eMrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T15E4523E4595529E1D5460631DE0E40E0C97CAEDB2AE337EEDF858A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 02561607052f8baf83753410785cbb3663d559615da5dbf9a627028e22a954e8
MD5 b5efe3dde35532c1de1571a94e858002
SHA1 1812ba17356647333f0ab99587634ea1012abc65
SHA512 45d88081d6d1e9fa2f1285ce00bd35827e2a09ef369983b8ba7c8656ec350e12ceda20e8b59f2c6287736256353268c258732960196ae723c0492c213eadd730
SSDEEP 12288:e8weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:eerqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1A24523E4595525E1D5460631DE0A04E0C97CAEDB2AE337DEDF898A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 64da78a1e4616acd53febc88bc8199acb69a2d3521edac638a1f1535c0b003f6
MD5 c68291988820c2e9ac273ba6222a7825
SHA1 49cb9e5fddbe295aa05afec9767ee3cb508b813e
SHA512 1e5be3d47ce028e0a01621e2ac5522b58451c0e0132eb34ebe88a12daf77b103c07b6b7a2f1ec0027e0df097c07302222ad23fe9175f10769e6bd13247822d8c
SSDEEP 12288:z9weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:z9rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11D4523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 212faed4dbd585a81e92eb6804cbe1148635b6f774449509c7db14385481c6c7
MD5 38b0bd817cf42afac4f9de47a896f601
SHA1 600d0d899936160e7020884e816dfbeacbba4f6a
SHA512 64c53d6e9bd9b8fd4bfc513db5a41fb856a6b53b1ffdb289b686c51f84b1f7c8560c679235abd16fa6c338f0b3132f838d71d1758685f3fd69eabf1e54250dde
SSDEEP 12288:okweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:omrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1C74523E4595525E1D5420671DE0A44E0C97CAEDB2AE337EEDF85CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7d8a86ad020971ff5efd8aaa8979e6ec3641bdbb3775bcc76e08e531cb13ff4f
MD5 03203d37aa7b3a8475fecccc4355d687
SHA1 74f3f09c0b6a771d9f7ba35b170e9a70ee2d420d
SHA512 ea171f077b71e3a913ebbc2c06af4551d1045df09d64f8625d734c8b85234d538e5d12e9e99b36d010d78bae21b5c0581e18446d0080da36ed9e6dcad6c52152
SSDEEP 12288:BKweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:BIrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1694523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 529635198afd424e21db725522924e55fbfe6c614e693b4e2ebd77476f12f2d4
MD5 cda00627b65dc7bb1fde010542591882
SHA1 f4dcc688add623854d02b921bd2c1f3d89cabc0f
SHA512 ed7782824b28d54955f00556cded6b925178b81c06d278135a518d2b4efdd0f26c23715f19847457a90830a20aa5f44ca3fdfe0793f1911e0df5f2d3764c35d1
SSDEEP 24576:NfwvKk9RX6wkyAI6rqUQSAlkSB+pfAOQ+7jXjra:RMnYIgq9SASScpfB5X
TLSH
T1F085DF29EBDC04E1E1B7923C8DA7464AF6B178691B31C6CF029A53AD0E33ED45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 39bdf90e0d9e1b0cce93ee0c30a7015be9be64eab4fff93dfcecfb05f988a102
MD5 94662d1ca2c952ef3ad5b5fb7cb95bd0
SHA1 49e1291650e8d968ce32ac830af83f33fd4a3a1f
SHA512 59f1f128a02c1eb250cfd3d1776f388dc38ff96c97ea0a4c5c5cc30178d75c7fb6fa2014396e1c5f024339950391f92a1b7678e123e652410147ed2f754d6066
SSDEEP 49152:dYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Zq9SASScpfB5X:wySzPI9SVN55
TLSH
T18F066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 69db10561b90ede1d1e44adbec7dca670c2408e342a67e1a836abb26c5a18a1e
MD5 6ebb80e84fe7a951baa0d222a717414b
SHA1 3d257bf705060dbddfc88173429c6fcaf6a860ff
SHA512 205121a269a193c6a455aff2b1978e8f9bb4b9bf88df3de45cb710a2e3f9951f87207a6a1b1d15449a8bb72b202aa3df337be56daec219852723d0220aea328f
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYPrqUQSAlkSB+pfAOQ+7jXjra:W47JUQjTirIhCnDHUPfF/pq9SASScpfX
TLSH
T12C65AE1DA3EC01E5E1BA827889154A5AEA71742E1F31DACF1270837D5F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9646f390d1bf18f01807597d5e4ba790de3961e47eb0f2539c8e0d6f0e5d83d9
MD5 c7da66c96ee81c9934d0e5cc906d0e38
SHA1 0241450afb79d33864f1ea7825e48861499c9f5b
SHA512 ddea376439f01816e7c7f6731096a2606695cccf772710d8c94c4cbb7eed0dc25e2e69097baf04bfa8e73a177c185e358ddd1135ee0f7b51cc2d6d8134510e67
SSDEEP 12288:wZsfMweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:NOrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11355F059D29812E8C05E5235CB464A80F7377C6647E2A3CB57C0FA7E0F356919CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 7defb02ea89dd76f0695eb06c238cd60ddedfad8eec34ea7f0c27db61536005c
MD5 539bdf61c09452b4c03b4693cdd0f4e2
SHA1 13a0e8460936303a3d97af4930b9a4a2594f802f
SHA512 87e0af29a3d2a28b67d36e2b38aeb09c67ca4f1257ee83519ec428e047f0b41fd332716b6d1b3ab8a83ccc74147fa14ed31660efa2a849f45f3bd4f60a244d41
SSDEEP 12288:vceCaBqlyDetb0mQVQQt5GOfv7P85B07aRM3ucZfHvVlSk8l:vSait057P5LP8I7aRM3u0v2k
TLSH
T1C75539107666CB4FC6A940325E33C5CCAB707D45FE456F0373C98B3F9576A58BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e608689d575f7af7d38867f048fdb81316e5fdf1571c1981e7438d569c2355a9
MD5 7307a38cd2b269ae5d7218131878b732
SHA1 50d1a946f4c1a42f85ab6224bf935cd64d0888ff
SHA512 65177f44d8f15a808476fdbde8b037df89dcb9219fe75bef322899c57fce1752ad8a3aa77fb4f96f858c55e99777630cfabe1332a1c14837735d89752231658b
SSDEEP 12288:lUjy+X8HbVDfjgTcZRq9FPOr4dbeqvJyRvtTUYX:lUjTcbx1Y9FPOr6pvIjF
TLSH
T11C751A406136E78FC1FB503203365A8DABB4EC16B7096F22B38D4579D86AB45B1F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6009aad7de8ce26bb538dbf1375cdafdd1ae2a7c71c1f8257fc93680c3e6ff5c
MD5 03822fb8e0bb803d205930dac26158df
SHA1 a4a68aad079a4cd467905469a282505207573085
SHA512 66240d7b5c4f863f8826bfea140b207ea1f729b86909b6c85e7a375748545a514d48ddb67b9988fff1c10096e9abd1aa8d59a656962f84a93384798a78652e4d
SSDEEP 12288:5p70weDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:nWrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1664523E5475829E1E49606309E0E40B0DA3DBEAA1F9166DBDB4497808E30ED7DC7DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 87734da072ff696bf060205a58fa7564fbd95587a4d438614ec88f5aa711959b
MD5 eb6d2a87d63ee4ebf30763791efbaa89
SHA1 54d962f20d8c2d9f00e009961983d07826b4c1e6
SHA512 ed92e62a50dee3cf73059bb83ec9203d147aa828503ea350680b2913e6d789457e0bcd1b54e9c3021b446bcfd13554ec1682ebc3f9aef1f90be182aef9ecb326
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYkrqUQSAlkSB+pfAOQ+7jXjra:dgb4mBIBhGFzq9SASScpfB5X
TLSH
T14B65AF1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 dc2439b7365a1aec018a2c0737bf9818d3f97975bf548a225bf67b9daf0e795f
MD5 7161f68ab87da6187de1cc0414dfb888
SHA1 334ab3acb7f527fd02bacf14dc6f80f8f4e035e4
SHA512 b9610549aed319a38dc1cd763c0e8b71e0737d9f0e249883f79379c23d8c60fd1ac1c229876c0e064e7c69c027e3fc13c84ef348acb0c5a36db4d9ec1f0f939a
SSDEEP 24576:JG88u8FpJqH1pzria7/m/rqUQSAlkSB+pfAOQ+7jXjra:c7ZFPqVga7/uq9SASScpfB5X
TLSH
T16785F16566E101F1D47BD1388E4646A3F6B1B8250364FBDF0BA88B510F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f7d529ec0e7ee2bad8d7b551c52a0979582fae2d1814d6f689f2ce33a55a4111
MD5 23b77262524619a8c43f956d713d4be3
SHA1 e53dfe1666b1d052db565207cd480740be97bd9b
SHA512 e383b97b695eb681d47215e01a6d69781f6b4f994823ffe2327357f9cbe91872409ebd1faf63d0fb0124fc7cbccd25f3dd5e98bed59766c619d0c21400a73d2b
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXq9SASScpfB5X:UG05lO43bz9SVN55
TLSH
T15ED5CF6A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 374cc8ab9ebe4beae503c1f01d029a800fcc832440f6078a905f5c117a7a633f
MD5 89ad4b5cd71897cbf9058949fc57a490
SHA1 b3d17e84f8d6832419dc9fde713234165c022a4f
SHA512 a49edacc9a47d823a0cbaf515939d4f3506534e0299bf8e098257ab4634e262392a5cfb37bed2a3fd42049a76bcec09282f0fd4ce7b6925ddd28c75d1cec564b
SSDEEP 24576:/fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5rqUQSAlkSB+pfAOQ+7jXjra:Ha5POZ3BJt2pasx2+mPq9SASScpfB5X
TLSH
T1E965BF5EA6FC01D5D5B9D17DC583861AE5B1342613329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cbecbcea282d0f4516800983d10a06c40b0928e96ff112770594789cc0f86edf
MD5 d0b5b97fca24f7829763939a1d844835
SHA1 37814fc82bf067cc55b7ce726c92effe4eb00ca1
SHA512 a0b173eaf44d140caaf23fd2be8bf021f21bb29516228fe5428dc3bce77d80846fcb7899dc2f8c5fcc35ea81d0de6dbec674d61f32bc3ee3cebe2394be8c48d3
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkXrqUQSAlkSB+pfAOQ+7jXjra:UNc/zEOVHFOq9SASScpfB5X
TLSH
T136858C6623E901E4F1BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 623c8f802c16bec4bc03ae7386c6383467ac31c740292f2303d2c880bb189476
MD5 179667686c0d302b65d4e7667afda546
SHA1 8e9b44f3f397804944b60677f6df8f26c90c973e
SHA512 6f0b2b142fb77ebf3c1facf898c917a102fae2be1a9219786b5149b3aef4d03fa1267778d2fad979456823bd600f81081ec53ce473540f4c732f09798385f2c5
SSDEEP 24576:KTkNvNnaFeYhJNtmZBm1rqUQSAlkSB+pfAOQ+7jXjra:KTMwBtOmlq9SASScpfB5X
TLSH
T14955AF6EBAB806E4D1FEC6B5CD238512EA727461073253CB9390C13E4E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bd3591cf357f780c51b3d4158755a2a8ab304504d4886cb7714c2c723342c81e
MD5 2f4fc4254ed33a4e1a282f22dc83ec44
SHA1 311c7052ca8e5a300ce10e46ef387b56f579a92b
SHA512 dd29401b74c4101b503259316a38189465a07baeae2e3cfa956d6206064cd0951d0f2cb9fb111053197b84a659c9d3a98f0e8a9b1c63c5df0613cbaaaac13b80
SSDEEP 12288:1HvUrBFrEjwaQfweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:1PUr+NQTrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1F765F26F26AC18E5E676A17D89464659F771B8620712A2CF03D0817E4F33ED8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 afd4c820ac434f4abb0ebbee20d10ad22e50e00341d8e4445b9903b49927bff8
MD5 c866387b33ea1cea55cc85ded9fec357
SHA1 0a6b47324499dc2086dbbbf2feeb4af64740dcf4
SHA512 c2b7ffc43504ac55ac84baee09cfb9541eb8d4373b6525d8206a03021fc1568a850438aa05bbd18b8165835fc734c1fb35c2d2c3d2df3f69d125b8d48903f9aa
SSDEEP 24576:CD3FHshBIYQgAyrqUQSAlkSB+pfAOQ+7jXjra:CDVHeBIAA4q9SASScpfB5X
TLSH
T1A875E07DEA9C04E4E47BC2BCDA538906E77138A9032266DB06D481B55F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-57-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1520-297-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1520-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1520-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1932-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1932-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1932-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1932-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2036-25-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2036-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2036-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2036-17-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3516-68-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3516-70-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3516-76-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3516-312-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3852-316-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/3852-124-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3852-116-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/3852-118-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4056-80-0x0000000140000000-0x0000000140486000-memory.dmp

Download

memory/4056-1-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4056-0-0x0000000140000000-0x0000000140486000-memory.dmp

Download

memory/4056-7-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4056-8-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4592-41-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4592-42-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-55-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4592-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4664-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4664-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4664-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4664-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4664-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4832-87-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4832-313-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4832-81-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4832-82-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4884-400-0x0000016322590000-0x0000016322C10000-memory.dmp

Download

memory/4884-331-0x0000016322590000-0x0000016322C10000-memory.dmp

Download

memory/4996-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4996-317-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4996-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4996-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4996-111-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5108-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5108-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5108-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5108-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5108-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5644-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5644-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5644-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5644-93-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5644-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5644-333-0x00000000007F0000-0x0000000000850000-memory.dmp

Download