9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
Size 2.0MB
Sample260930-gp615ayva1
SHA256 9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b
MD5 ae4bf61b353bf368c35f4c8f0c88d4a9
SHA1 93cc0b4e092b7fdc3be095a580a5cc0593d44bf5
SHA512 64d897601fe93209c4e0b8a6d99919e5031083b9119248223ff716f639cfc4d81ad6c101c3d6682ad7e577e1ce33f664548543e7051b1e1d0c2dc0a58c1f65d4
SSDEEP 49152:aaWecIr1wdryNtegltLyvH88YzRp5/NJwfJ4klKXn0:a1ecIr1wdCtzrGvwb5/rwfJ4k
TLSH
T1C5A501117692D036D6B251B05A2C9B36547EBE700F6248DBB7C05E696EA02E33B34F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5460	elevation_service.exe
3868	maintenanceservice.exe
260	OSE.EXE
5792	PerceptionSimulationService.exe
4340	perfhost.exe
1224	ReFsDedupSvc.exe
3376	SensorDataService.exe
1680	ssh-agent.exe
2888	AgentService.exe
2696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	OSE.EXE
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3afa75b7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\locator.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093af-113.dat	upx
behavioral2/files/0x0001000000009337-112.dat	upx
behavioral2/files/0x0001000000009952-116.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	OSE.EXE
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098d8e5f4a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4f2c1f7a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b1902faa050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a7655f4a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060e5cef5a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b165136a150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
260	OSE.EXE
260	OSE.EXE
260	OSE.EXE
260	OSE.EXE
260	OSE.EXE
260	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	436	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
Token: SeTakeOwnershipPrivilege	5460	elevation_service.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2888	AgentService.exe
Token: 33	2696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2696	SearchIndexer.exe
Token: SeDebugPrivilege	5460	elevation_service.exe
Token: SeDebugPrivilege	260	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3588	2696	SearchIndexer.exe	99
PID 2696 wrote to memory of 4720	2696	SearchIndexer.exe	100
PID 2696 wrote to memory of 3952	2696	SearchIndexer.exe	101
PID 2696 wrote to memory of 2216	2696	SearchIndexer.exe	102
PID 2696 wrote to memory of 5328	2696	SearchIndexer.exe	106
PID 2696 wrote to memory of 4384	2696	SearchIndexer.exe	107
PID 2696 wrote to memory of 4872	2696	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
"C:\Users\Admin\AppData\Local\Temp\9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6b83bfbae2eb97c515b28e7903e1e819a426f6aa7dbef00ce6b4101a75fbba55
MD5 6920a9ff3f24deb55bbd4a6cad5ae6e4
SHA1 5aaddc94f34685cecee28e41e80a42aa61949207
SHA512 fcfeddf8dd696f0fdb37cbb3b3df0a3865ba1e873ab314a253d1f8dbdb9bd70abf2bee31e9334737160115c5f1848f42df0bfa4f617a1ce01bf10119e7a9e3db
SSDEEP 49152:Wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjfJ4klKXn+:I3q6mjBIfJ4k
TLSH
T1B3D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4cfa1d027e5d25dca4c9b10b5b16813d913a186e0c112cf6ea12b5c62f4785c7
MD5 23b4856dd8433e04f2f5522b616fc4f4
SHA1 182f36ec1b3a2ee62686251ce8b2e1fe088e1d4e
SHA512 492758697d8c7da1a77473b08ac0ec44995d018e62145f80d6757625d4f9ff24f297f82b6c3598f63719b104b0d56f077207f3da3b492b2a3c42d4e479fb258b
SSDEEP 12288:q1XLsswWkxy2lRq2czA0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:gXYfDtczA0fJ4yL/tNCJPXUQrPM
TLSH
T1EB05F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7c19f483e13841c18d52753285429c23ebf9e4bae5a95827fdae3c062c5820ed
MD5 fb3b3140af79746e570155dbbc01a3ab
SHA1 9d304924e2cc2c37f20d60f833f7ddd85194c820
SHA512 6cec49579637bd1760fb5df69d99f9cbc50495be44c1888739903158999977259a8dfcd38e1206aac602b0f339de95c21cd51a2c471574086edc6effcb9791b0
SSDEEP 24576:i0Le5ji0hmxhrMWfJ4yL/tNCJPXUQrPx:iPji0AzbfJ4klKXnJ
TLSH
T10135AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 331ca3df0062b716e2723c5b4ea2d788ce2196ef1b546440961276767b68599d
MD5 16b25f21fdbfc0514924f0c14ba4e0e7
SHA1 3c4d167a5126f1798d5189eae5bfb5b20f989dcb
SHA512 861680e892d47b9fe0437f600c8e7f3a27dd7b7635af6f54f86f6e73c2297ae278d4cfc00d500c56c1991f41ad8bd58660c0fce8c708f645fba7d2fc2d605d72
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWj6q8wyuYfJ4yL/tNCJPXUQrPF:F/ezSC6vUzPv+HjyHfJ4klKXnt
TLSH
T116756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4326dfe938a620a2d6c127289583992f9635267e9d44cfc8e38484802dd6c9d1
MD5 7083b13feea090c443cbfdc6bfa06994
SHA1 f243332ee0425bfd4538569bd2d68c6400c1f4e0
SHA512 d7b6f8378fc7163a2c36f2f1512dadff7a627ab02abf90ec697746e4b07932a4ba6095676cb5de4cbcdeeea4efa417cf19a2269eb03ca2b93eccc893a041f037
SSDEEP 24576:lVbqPb88hv/l+BZfJ4yL/tNCJPXUQrP7:lVO88hXl+7fJ4klKXnz
TLSH
T128559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 583f83de51c4627307c853a45617f3178214c4cd6b62c3329818291caefe146f
MD5 b6db1b7a9700eac46f29d6af469bc733
SHA1 f36cebd67f7a11b56bbd5b5c3f3c580568d01c71
SHA512 9c6c15f247a62e96754148a89a0be3edaa65f8870bebf4bd884f5bd23b5b48514fd6ef2a7f60b0216ff515130733170ef8a0d7965892f18383fe39a08f5ec2e3
SSDEEP 12288:0GqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:0GqfJ4yL/tNCJPXUQrP2
TLSH
T1EEC423E751849486DF6687F82A88F001C704BEC5562FA2E7CE82BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fa22ec377258598775b343eb4910c1f6da6cc641168ec903e729be5e9ba2d49c
MD5 faf7a1a4e9850eb735e3cd83638d1822
SHA1 0f9979a1d2d8f4970b4992700f5fa57401e67c58
SHA512 adf9ed4736384cb143c794146258340183c2baf7efc77118ba7ffe4bca65ceea6dc2ef61b973b32877eed0ff4ce2506d0263bbad0c613427a8aa8563a419f1e8
SSDEEP 12288:SeBNUbTVO86URfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:SJIURfJ4yL/tNCJPXUQrPS
TLSH
T11005C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3919339b47c743628d2f818d3fe1ecb95704faeaae8d1a592ed9e9176646e551
MD5 fa9346393008c09829210df01e80a355
SHA1 52b2bf470e0d4cf9eb3842b801165b90560f30b6
SHA512 d16335f9813d432b62d7dca524fea1c1400ab68583e48df7ede1691c9dde5d75cd4e17aee85e2ddc8ded600d7587ce3f3edb743889e304175a30b7b8ecc61096
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:iQvGAdlCEL8c/WRNw5CIfJ4k
TLSH
T1FD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3162c339969f588004a37ac59d0d2fdc7f8625b5c932862d24dfbbac2d4ce727
MD5 f0c314dee68c4849717cda3f8dc5bb56
SHA1 169b3ad4b993a8617aa3a7839fc60d4dbc99e6aa
SHA512 6a2a566bd574ef8e3c8f960ed03d46303bb7748c3e44a91495591453dac6e9dd1cd84b886d980cc7b05aceb1e645a5cc112f45b7c1bc406287ed51e1566332ae
SSDEEP 12288:GAwSfxL/2Dc3mDLLmt0LDQewsAjLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWX:bfewsAjLfJ4yL/tNCJPXUQrPJ
TLSH
T10815E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e902b1eb6e8e8dc16ad61698d953818de304be1e27d45f562e4cab43557d4391
MD5 b5b240a190d8659e7c4238f7e38bf741
SHA1 be875399f206395871d7feebbc5defc6e0957fcb
SHA512 8c20f85591bbc30d6b880e774f36d5779f16051bed9dd35b5b0aca6a15609876089557bcf9810d27af89a49777dd0948eeef0b7e819018181fb6ce22c2e5e7fc
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHTfJ4:3UEtQevvqc2W1cpV20I32T
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7c647daf535b61524fde0473eb1368b84fb79c44283a50d755fdea18ebb4c21
MD5 dbccd2291f48c42fe9e5158baa1f7237
SHA1 20626a7eda69e035b517e0c8c963e8f6dd28ba32
SHA512 462a1b2dcd423e0580cfe64a479e59f6aaacd4a96ab8772767c2d500458fcd08eb77b0c2796114c89351edd3c7e9c4ae53ff05b73ac44bd893a9fdf4b28c9cf7
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zrfJ4klKXn8:AoqtVjnmUfJ4k
TLSH
T180D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7ddf51869a876e20083fd153276e7ea6bc7e296acf1b3f1d63b4fa8ef6cf3068
MD5 bcff1062bf571c755b3cefeb58a8c10b
SHA1 ac2cce011bcaf7e4aeef28b18c66e743a5b31ce6
SHA512 52066e11dbf63516f51d5c3e8dc4df2e2e9e3485908742405384e99a2d40fa2a5f3b3aef462d1eeeb379e28f182a410e8abee889a6e02caecab5c337abd10da1
SSDEEP 24576:NAhGL6IFoiwtA5l7S530fJ4yL/tNCJPXUQrPu:NAM5Foiq5EfJ4klKXn2
TLSH
T153359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 eac56c76307608d83a97f3cd88f77e5e5517b91549fd33c95235c9e0c8b0dee3
MD5 565366aa686f07725a25ae68903e4aeb
SHA1 64f6b0bf42c14bf3f3973389bf99813417dec28d
SHA512 4eecbd0875a2def7716fa3f6bacae9c18706b071a5400b166e191729d18a468ad47f5c2a65da57fde222d7cbb24189c839bc152c7b6ce5b85cf5cc01c43ea9fb
SSDEEP 12288:2mw5HEjsChNEBFgl0WDm+CZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTe:vwuROWKfJ4yL/tNCJPXUQrPS
TLSH
T12A05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 03c181279f50d28483cf70d6ceb1fc4bdd0bd3840b8787c331b36054325d4a14
MD5 3533fa2b5153e65b4305fe7612b9850a
SHA1 dbaba35e24b1cc5da4a1964d04187d5ff8b60b00
SHA512 93ef09140941c57c8e2620ba57a7c59dd6508c963db0785f7d2d4253d745807e7f75d7ee20dab05b14ab858246060a05ad3de327e44f3a8f1158f388756c3bc9
SSDEEP 12288:3yZ1Iy7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:iZuOfJ4yL/tNCJPXUQrPG
TLSH
T1C3E4129B32D460F9DAA782BC89D4E101D3317892273A83CF5A5155963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e7405e2d6c2dbd48bec294baf56928230cc3b7af1eb693961c9949fdccca8fea
MD5 6df1e903056c4aad45849898cc6ae8ba
SHA1 d24e0b288052fdcd0f2ff17fa7b619a8f910c9cf
SHA512 3d7e5b1d9dee89ee021bffac5e58d7f1dd595f2a0224ba8e52ff60558849a6104bd4ddfd146208c0fcabc3919ed72e182141d59b5a855a2a98017f333810282e
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UB:lQRQyi36YOcPDLvw2gAf+PN3dfJ4k
TLSH
T197667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e837ec82c2dd216309e8d699f9017b666ba94c13090c44638274279dca49db34
MD5 0e2dba000a260e2aa99d555390f91658
SHA1 38608a14ac102597af0160fa2e22e3a71165081f
SHA512 08d8a2118443c692d2c12db4027789cfdcc95bc193d78c3efcbc95ca19af7d0afb63ba55ddf8ac41dddaec64ddd035de174a9ea2d0288101353f8e711ab86467
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UR:dQRQyi36YOcPDLvw2gAf+PN3dfJ4k
TLSH
T145667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a74c4fcc8f5756e4555e651e67cdd90ad5f22a647d584b1a080104a1756b8b0
MD5 d59a5e2f184453cc52ea52a694ec7e97
SHA1 8d487c2447553a9487c0a5a69136c7c1e8625cac
SHA512 a5ca6f5a77fabd0eb8c5703676472369e0320840546373e503ee9d566530bacd0136199208d56210294a754101c1c2b5c55abe18c4cb07f53b0f0c96f8b0927f
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0efJ4yL/tNCJPXUY:M68Qg55nhkeWu7PNU3/bfJ4klKXnX
TLSH
T154B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 552b82b87869e66a9ebf223111b5fabbebfecb02de6c425dc69bca4f4b536f65
MD5 ba977eb5c922e78bda1907715fe04099
SHA1 4f39364c9634ae9072cb1f1780d4c0d0b254a0b3
SHA512 5b1696bebf2cad6e541a9be9cadf64a7ef2ce70ff1420a11d4c7b84d735f9ad29a5aca89ddd1f12bc3862c6c56da632316e6c1571c53798e2e05a567ca73761b
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99s:Yy5112gYy5azzVvU69nLKnhZqfJ4k
TLSH
T132167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f6ed5189f9eb597e60b7d8a6d17d689fae7d6a61544820cca5d6855950160c8
MD5 175d898c2b519c6e77afe82a534679b7
SHA1 54a0c093a9fee5d9c75e37bd3fead4c17b930c98
SHA512 1c140b315b2e3ed95d298ca827ce76c55d6d58675ae681eabb2097186704d9798f0bdcfd285ca3b3331bceae0c333ecca0b3c5987a1c998cdd0feb5d493b71ed
SSDEEP 49152:QB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glVfJ4klKXnD:Ku6JmIxd2dVfJ4k
TLSH
T13AD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6d261dd1368d9ad2e945e3980c99e027dd9ef9face05c3a7baef37773d7c81f9
MD5 d22392e61ea845b46cc1510a07b47ed9
SHA1 7b1fa9b26bbb8334e2b4eeea6643e184808786f1
SHA512 164a2fbdee37b0a3412b49c643731747265bb1e7822080eb92a4cf967630fae896f2dd926570ce647e8403180900d3507f4c6f7df868be2d3471646ab7edb562
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4xxfJ4klKXnu:QmifPqRUfJ4k
TLSH
T15FB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9331b86dc5b6b855f31a32503c001dbf8082a885b693fcd0410da2c515f8cc6a
MD5 1bf28f11f3a3979b73647470d19f3576
SHA1 bae306b93310abfba7317cec74782224783203cd
SHA512 7535c2b376995e7fe57e23eefbb8cf7fd1d51ae122721d5d2ce3b9598d26fbe17e5458fad2e64a639c8fb3811d313520ca9f66227a46812d5214930baf3dc065
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqOfJ4klKXnG:A5dKqi61OfJ4k
TLSH
T169C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b374a1035da3f5ee30760b71e1e826af12e458f0038cc8fd9447f34e1d9a2f4d
MD5 7b87ce31ec0fd3d352f1993b05fc143b
SHA1 c70d5cb35473aa4a442a819b8599e88dedf0b9e7
SHA512 e1ef9013349a60409161f042974077e812dd4e009144554c4f0dcc4d7c56dc7a2c3448620d98492654007db6df9df63fef49b91f52e625f8ba7add16fa52e88a
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wFfJ4klKXno:bX2iWphwfJ4k
TLSH
T1CB95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f344d450abb5d0b51d1c32e2d59204d8e6185986f87328bc7f4bd242c28dd414
MD5 9f4b9388185f35e4a105f30718fa4344
SHA1 81fd35385affebab3a878054a2f1521d95ecba50
SHA512 da505b49003372adc51e017931c711a7ff8c26e6f6e31897691795c9886cd1089774dae246834d2fad63144bf9bd54852cb968c3fc7cb8a43ea9fe84e0677180
SSDEEP 12288:OCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:OCfJ4yL/tNCJPXUQrPM
TLSH
T1AFC423AB60D5948ADE1587F81688F001C7087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8d129ddb4e7bbc4c2e3e88986803c577439c0b4caca94911b7383bc7451049bf
MD5 d004ddf7b2e426f06edf6d5e4a8f523d
SHA1 e11b2f031d2aca5b3b52e41b9019c8c4417fd537
SHA512 4da24c09ea1f354bcdaf6e5164cc753ac089bc07ae4c416b82001305ed8105f76e91fbfd9eedf79013ab03e95acbb90c9865ca2b149ae918828f53fa4bfd8cfd
SSDEEP 12288:oPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:oPfJ4yL/tNCJPXUQrPh
TLSH
T1DCC423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 bf878126f8745de94c80c216c6ba55df68b5b3a84b722213cd6e2360c4b6ede6
MD5 69efef0d2afb58c2d76e2cb7082ecf39
SHA1 c16c3a204e16431429f4a223563e96f38cb731f4
SHA512 eccf0cca6fec5326aaf2ccddb6482d2f7c6105cef14aafdd1f2a5b4ccb080b7001c99c909e2465da5d5eca14953421388579e3600275c16151d0fe24ef8b5b30
SSDEEP 12288:2pfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:2pfJ4yL/tNCJPXUQrPh
TLSH
T184C423AB20D5948ADE5587F81688F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1f6c2d4bc4028b74e59982a7501e832add652d51337eb216f33e625ff32ca4e6
MD5 90b420cdac21b63dfd5a592e4e110b00
SHA1 53a98a344a8e0c88afd1c65d1260192c2fb25f69
SHA512 f2244ee3314c06c4c5bbdf18bed9855327cbe1cacc11c1fbf0155bb1a80568c0644b030d657acf5507f87d396c3ed37a870ac23b825aef4048fea096fa710709
SSDEEP 12288:YVUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:5fJ4yL/tNCJPXUQrP+
TLSH
T1B2D42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4e4e9fda49bb5fe1e83de4a29a0962045dab3e7a9f2394830bf762e0c21acee0
MD5 26f565e2b1d64170e954b257a51b246a
SHA1 d1d9867d7face48ac556966c6cb9c3e1e86a8839
SHA512 3087effdb93792232f77aab90e72b8bd5ad2abce9cdb6ff47f23521dd19588a9bf3814b4a278102559c53bd9b0754b58cbd71d8c1b91ddf8cf638a6e82f06d82
SSDEEP 12288:scfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:scfJ4yL/tNCJPXUQrPh
TLSH
T176C423AB20D5948ADE1587F81688F001C7047ECA672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 57ed7646c0ad4df2f76aacf3d4a6a1ff9501ca28c7a29929e55ecc063363291d
MD5 cde78aa06d5bd3f0a70b69349499f470
SHA1 ca38ec6aea96dad0613bd9e8e700cf894c7d945a
SHA512 42c0dc3a7b4ac392c4b6ac3b1b36b3f0f9af87e5af49a48276630d6fe3336819f07b66719f58592e50cd91ec6e45330394ca0453cc3be875ed6724f50179ac4e
SSDEEP 12288:MDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:MDfJ4yL/tNCJPXUQrPu
TLSH
T1D6C423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5defbf9fbf964de55e979033f94048819e000d338331a9b3c7a66c4c12880c74
MD5 33522578117be71bb81e7fe504a1102f
SHA1 553520ddc508f85ce4228308044606c018d8f83d
SHA512 6479038313d9974a1e5942c23c4cff4a4c4d10b1847628bbd1068e5e393399db0fa6ddeb900d2d0fee10faf93f268321ee5fe01fb41c7ba728a8895c32948fd5
SSDEEP 12288:U3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:U3fJ4yL/tNCJPXUQrP2
TLSH
T1FEC423AB60D5948ADE5587F81748F000C7047ECA672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 411822971e4129763ae30cb6b4c59ff3bbacf9639cb8c3dc533e31c9578570ff
MD5 e4efaf3c5c993fb84790fad335f0cf19
SHA1 c35437ab55748c596f31ab7ebda3c9875f13ca02
SHA512 83481956461b1e84794c13f757b5e5b7e4c713389c0a57a029d37fd87156087e505288d17c6f333d7d1b5617a49aaae8113313b75c02c655b53f59267630d217
SSDEEP 12288:hiZwbDzzFEoS2cPvyvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:kZM3zFVSOvfJ4yL/tNCJPXUQrPw
TLSH
T1EE0501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 acb6584c70a389e0e83d5a120936064262c0a77e911faccca451c366333a6ac5
MD5 01fef437bea9c15e708460197fcdf6fb
SHA1 b8e6f6f5f2cdfc7240f4fff6a405acdd94e905d0
SHA512 f5cb90643bb245c40696a415af3057760263ba8ff0505168e3b46bbd0e96e6231d524e9f4191d1101f3ddfe70e147fcc60b8e006688190d28c5864756887a417
SSDEEP 12288:8+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:8+fJ4yL/tNCJPXUQrPe
TLSH
T114C423AB60D5948ADE1587F81748E001C7087ECA672F62E7EE43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a6889a5d42603baaef02e223a6e50ccd11185f7b7277f91ff315c3fd75426c94
MD5 b9d886ee9d654797f4e93d7baa05c8cf
SHA1 fb14971e960c261603881eac5b5fe1812e1820ab
SHA512 90368ac42696c7aa958b32a7dc4ed8180c34b3cf6a573b15336fcfab57e183278f85220ea3af08f953c7014aabdec9668d26fd904135e71fafe9010feb18e2bd
SSDEEP 12288:safJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:safJ4yL/tNCJPXUQrPe
TLSH
T17DC423AB60D5948ADE1587F81748F001C7087ECA672F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e761e3ff32ee39fabe95de562577eccc2a5182008a4dc2b0e4952f84ba0e07bc
MD5 01f554793e876d9793dffa96e894d2fc
SHA1 a70dd09daf857c2c5afc4b1d678af5d971923efa
SHA512 94cad6d424a8bade667ec6d0b5c9cb8c4f0cd98936e4e062100a8cad850f037c46e648d35ce42d2070a80450b25155ec0b48cc1356d2d4dbe702e318f6cc2e02
SSDEEP 12288:oyPz5L87fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:pzy7fJ4yL/tNCJPXUQrPV
TLSH
T15DF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 61c660ed82eba91f1f8c877a7c83e7738b8d66402a25d8616a4decd3146f846e
MD5 255ecd96b09f9f0f0293c582efcd831e
SHA1 2c3446f734734944af43e06634066f52d0001b78
SHA512 d18be6ac934d08a823433d0202da7c5224221748084082018babb1cba397a5d2bd8f3927a85ff91532a1bc32b962080633eb9b7193efd2d59ffacd8a5fad0ffb
SSDEEP 12288:a+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:a+fJ4yL/tNCJPXUQrPb
TLSH
T15DC423EB60D5948ADE1587F81788E001C7087ECA672F62E7EE42B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 77eaf3b97db71f6081bef111e961d8607d50c91eba81e2a87a83a072a023dfe2
MD5 3cfc020ca6f3cc4056495e5671ec5078
SHA1 daa0b5f22e147714012fc2f5490db971c56d59dc
SHA512 2d55bff7776bd4e154a7a5470f08bbf2de9a2c11019acffebfdc17bbb680eab6f5a2114e9378eb15ea244608444cb67d4fb5804a68ee5cc983c88517610b0436
SSDEEP 12288:j+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:j+fJ4yL/tNCJPXUQrPb
TLSH
T16BC423EB60D5948ADE1587F81788E001C7087ECA672F62E7EE43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3228c8fbb9346a8e18ca5c6db7234957a36416350beb1e53110ad9452f9f2ce3
MD5 8bb4d36cbe9bea7c35023d2b9a0c9fda
SHA1 b1a0b1cc0f42dd1d41dde54fa82158bef2a2209d
SHA512 b1a221138206a1ff726b06ee3614088b9f96c78b804167a795e6a350bc9e6302478b19abfd9b25658ca40e898492ec3a98fad60fc905a016dc06a12a698e4ff6
SSDEEP 12288:xyPz5L87fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:gzy7fJ4yL/tNCJPXUQrPH
TLSH
T18CF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1d3a5194aa5cc1e403b874bf3fc926b2298fe4c593bb97f7ba06bb94017a5575
MD5 5185f59da6a57001db326856056bacdf
SHA1 4c919ad3086e533244220167b2d85aea71e669d2
SHA512 c6abd43616be2c6ad9e1707533ccc38fc196226d1c8a7d0a47c41bf5e9b57701b0d2990b46dcee74f0261d5cc4a40e0c80e12499e5b3b67e00f46e68670e9a5f
SSDEEP 12288:fCd91WYoaLHF3z0z04PDvh5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTv:KT8aLl3z0zD5fJ4yL/tNCJPXUQrPj
TLSH
T16B0501A5B39018F8EC67827ECD549502D3B27C9A0B70C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0cc79597f179dd59e3f970ee03d8bbe97ea490b78ce2cc3c8830d411a7c7e9f5
MD5 f1888840fe5cf4603accfa28b16ac7b9
SHA1 a3566f68baccbb4bd9927c0d9763f59d553f0e25
SHA512 baf62061b5f4304620e38b770284f003b4c6f72a17b063fbcb8f58604add71f7146ad21a28e1540a8b4d902ced5077fb3cf55ea3bee00711cd44d39cc807b5ec
SSDEEP 12288:Qi4e7+RdTfgwCHKy7GLbbdIvgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGl:Q3rd9CHKy7GZ9fJ4yL/tNCJPXUQrPq
TLSH
T1DB25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 34871f733b7ed68d5890a0f13171da685ad5651f64ebce44f0498a7ceef39aa7
MD5 1084875983f9fe1ec3dc9efd35632fe4
SHA1 adff009f8bc9762b13ec5ae88fe4fca819b242ac
SHA512 1edf60a65b2b3dbea59e08e4fd3a3e1cc595953d61b75bc9ac65ca858de1be3d515dc5591b3dd9e355efff32ad3e1ee978436fd2f05e3ee07f299bfaa428fded
SSDEEP 12288:8JfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:8JfJ4yL/tNCJPXUQrPI
TLSH
T151C423AB60D5948ADE1587F81648F001C7047ECA672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 300729fcd7fd1eac9b61d1711dbfd6950a936c5bcb412b3d0e9ddecc4507eb66
MD5 4c6bc3268c8f47cc66b7b3c8a4aa0bad
SHA1 55de65893ecfc8053eae8aed44d974ad7bdead7c
SHA512 bd81d6a940af3595aec45a28786c10e0fb0edf70aa9c187d63c9bc13f93fbd9436a927a21cb829feabb41346ce9db0937355c22bf093619d5c49603a926f51b8
SSDEEP 12288:8bfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:8bfJ4yL/tNCJPXUQrP8
TLSH
T18EC423AB20D5949ADE1587F81688E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f44614cba39e1bf3706adbac689ab2465459107fb1696399cc174f4050fb05b3
MD5 aa29d0f7c994255be09a18430ba665bc
SHA1 4a82eacc5e98d3dc74366786a5b0555a4243a7be
SHA512 0bf45241c5e01bf23d79769e15ae543603ccd4149e118020f135b1ccf2536641b970da6953a8b5ea1350395330ee7ee85d3b439d51d13b872de8b88c94d98e8e
SSDEEP 12288:ngfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8S:ngfJ4yL/tNCJPXUQrP8
TLSH
T130C423EB20D5948ADE5587F81748E001C7047ECA672F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bfb73afc40bd2baf7c53a9f953a43f3e33a4b3ebb7f1f4dde295b3bb524f60af
MD5 cbfcf2148bde634b0561e64816aeb084
SHA1 58ab4b2af89d4d7d80fe2cc970a80b734287f6af
SHA512 f49121ee00fb7a24f0c0c371b86e5797ba728fd2be69b5880d390f4af24a2621fdc2a697f1a15412c309049697274e360d4f038abd0eaa9b1d10f2ce551b771d
SSDEEP 12288:8+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8S:8+fJ4yL/tNCJPXUQrP8
TLSH
T104C423AB20D5948ADE1587F81748F001C7087ECA672F62E7EE43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8e7e5de325e0b52feb76450742e7af68adf8215e6ccb839b11a86557dccb4bfc
MD5 bc1d9ddc894e7cbfc0a060b96fa9f5ba
SHA1 699aaabdbcc6bbea529a5c5c58b22f826588e2e9
SHA512 77b243a48d7ad316f5e45485e1fee4334f320da91349f25c0aed9692a87f53d2b681ba8ea193b50b1b499d90811357e63bd98f1ee232a9e969c173dcce4b7106
SSDEEP 12288:wJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:wJfJ4yL/tNCJPXUQrPl
TLSH
T1CBC423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 339ead0ead381ed4b2fe805ce207dc34f6efc5e8ba3135a4444676a75050cb09
MD5 e304ffc3cf5b04feeaa6542e56ec9bd5
SHA1 f2920736cd154948f06c8dc87a76394978c524ef
SHA512 94397e1c714d5be929be5f3fb4b4f7af4e3c621ede47473fe6202d38f402aa7bbb8a1b8e695393ba404beef037df768d8933821c31b527bc3e32bdf480f1b139
SSDEEP 24576:Zfwvzk9RX6wkyAIvfJ4yL/tNCJPXUQrPF:YMnYIvfJ4klKXnN
TLSH
T14835D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2c10600323b490c3a640aa549fcb80633878b3d6aac9e91bbe66a9a18d5e3463
MD5 29be1deffbfcac77826ffd4dd70d20d8
SHA1 7372b29558dfb62bf12d165ed88f8357a05e320c
SHA512 c28cfa2ae2cc4cec3981b97c05bfecce73be89f691d6fe081b5cba4ccb9059113e6e90e2bd6c16d4586b78bbe5bbaacf0a9e80029951685bc1933a7131226e01
SSDEEP 49152:3YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lfJ4klKXnD:aySzP9fJ4k
TLSH
T17E066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9213e82147d9627961cb07adc748ae47619aac76025ec7d19b30b8664d52b51b
MD5 c4586a2d10dca3841ceb761ffba1b759
SHA1 9e2a3f5bb6adc2a73af5c33e25eb618398a7c1c5
SHA512 f47b5f032bef212e5dce179bf68260eddf7852f2db54b43868473b91f772b3b2e658cd27adb38f1ccdabd848f61b7392c280fd763598b7fdac73fe1c16535a80
SSDEEP 24576:i47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYffJ4yL/tNCJPXUQrP+:i47JUQjqirIhCnDHUPfF/VfJ4klKXnG
TLSH
T1CF65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 15292ad98fd9ea288f4a7a33502756906360fd8398ec02fc1a4b42f8f6e77c73
MD5 ecfb97e52eecdfbf0a0e99d17db4d017
SHA1 35a855391a3b54afc36ae1cee8d286c0ab3e9ad1
SHA512 4299b84a63770647f5440b410bc27f3d2feb9d6a7aafc2b2c45c6269b00d84c20c7602a10c5299d9647b69f74756c6b9b86a19e925884a8669a75d86029a8358
SSDEEP 12288:hpsfOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:yOfJ4yL/tNCJPXUQrPe
TLSH
T102E4015AD29841D8C46E92B8C7449201F3237CA593E2D3CB97C0F87E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 00aa62a93d59c0c36dbfd848b23366fc83d91f83aeff45c44f3e3c06952adbdc
MD5 1d482ee8d033a976cb9504bcae723933
SHA1 072c6ec7e666b956284ce26bfaeaf3f38b083f96
SHA512 b1fb0fd2461c67cecbd135708dfa5dc1dafdcc371b0d4ae9b5129c77e38ed0659ad3d75c5d14ee22a2500ec315955699c18acb9da1cf008eacb2070085e74c03
SSDEEP 12288:J4b9jXIU3fe3TTdX9wzhdLM2g7BdGHTfraRKcjd:J4bV4UPe3Tx9wDLRg7GTraRKad
TLSH
T1DD3507007666CB4FC66D40321E32D6CCAB707D51EE44AF0373C98B3F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 cffabae4988760383d0695182284049a054bcb4dc0a8b3acc710552e81eea2fa
MD5 8022d4186c3acdd7b8769db7c297e856
SHA1 5a1dc030ca52d7aae66d2db68336e568ac1dd5d1
SHA512 50a1cea1ac31939a10a1c76f8aaf23fdced12ba74e756fd326a55a6793053ccfe233402d4b518bb3bc62f07c1647b114e951e8f863fd19c4b10bb39f9f8e4433
SSDEEP 6144:jrrvwCkV6oFvTOWoHPAljMYhJVu+ozKF1GRcFSVsG9UEpSV1G9P2RYz+KO8hZYuV:jrrvwCycOJVupzKF1Ga1c1+QvaL6l
TLSH
T1E47519815136E78FC1BB503207265B8C67B4EC16B7096F27B3C9857ADC2AA51A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c19a3a5f7366e90e5d43f48d8994477690b7f25790ee9b585d0068c4638aeac1
MD5 f864cb0b98f9f865eaac502881426c21
SHA1 009821185dc3caf45da5be31e44816b7f941dd47
SHA512 fb5f7689ca93d522de7c43b3973fda0f711f83e0d50ab8f4869c096b8f56ccc24ebce885dd8e7309d1c546208ea54809c371a787b4b9e916d3f66912b5603b94
SSDEEP 12288:hM77fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:67fJ4yL/tNCJPXUQrP9
TLSH
T162D423A761D89846ED7587F8164CE000D309BED55B1BA2E7EE02B4813FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 36bf7f7a41fcbdb49d2fbfba3da7b21a04840c076846603025b0f9d45e308f39
MD5 a02375984e5f03a72ada4b889345b743
SHA1 a982d6bb1a5ce288170b739958e7444f89ffe6bf
SHA512 e035cb61b2ed3117765680305cbe50c6b1e1c590f49ed17bc7b3d0b6eead7722a32aa0484aa0f52b7d10c7babe5be0ac5cc754af54d344353f9191d646caf693
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYYfJ4yL/tNCJPXUQrPS:Qgb4mBIBhGFffJ4klKXna
TLSH
T1A765AF1E22EC02F5E0F9D3B89DAA4417D6B278160732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 582fa275aaf5b86117b47334a2cc5b3ed7e59c10ca816aebbffc64ff367df715
MD5 eb008ec7697afc101360cd08ce53563d
SHA1 58dbf3a107a2efcee1b6bd471aec349b5f25b19e
SHA512 d4088412b2bcb52e44054ea9c0e7e6a0e705c031c4c399beaf9fd1375b6f6d8ca3e7879625816b4fea39a7f757143405b3813635ad9fd838539ed47f5ed49ec8
SSDEEP 12288:E6GCrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9b:jGQTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T10C05229A21F520A9D47EA73509716122B8B1B4556F7968FF08E09279EF703E2323DF1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0b586ed81f707c4e16461eb5ae0793d1006b34525d33fbf2d8490df7a0d2eca4
MD5 f7cccd447c1738910ec1995e5cdb6764
SHA1 73d25479d65bbfcca2b062eacb6796dbeb0d221a
SHA512 6c2401da163dff5ab9042326dd0f98876e13a6fd74a55a86f655f05b1f2c1a251622ac23a1e4188672081e69ce19ef089649dca3797ae9da1d6ebbf38ea1c779
SSDEEP 24576:FG88u8FpJqH1vzria7/mvfJ4yL/tNCJPXUQrPK:o7ZFPqVya7/AfJ4klKXnC
TLSH
T1E035026676E001F1D47BD1388A858663F771B8150375FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 82adfe72ab7d8ee73bb8e07281bd06da7a3aafa767e06f5530f1ec3eced50bcc
MD5 fa7aa1e08d4aad2e566661551100cb3a
SHA1 7fc9992f60122658949316d003341ce833cba1f3
SHA512 22114443e041ce7563892106f48e65bfb9cf58a48956fc03eb3699ab07370ff1be59e7637c3de8fbf1d3461b6aeeb861d116a9aa60997c499f908e1eaae3a22b
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWfJ4klKXnm:gG05lO43b3fJ4k
TLSH
T1DAD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 efaed89e5edc9ef331a43ecac4fe0f73341d9c37973564444dc735398696d504
MD5 59a2fbe447dc8e2e596048de621643a1
SHA1 4d54efc39d1dc75b66798b78bfadbb1eb37b9a56
SHA512 774f9bc899466e3ea2e9df3e98647d609f414301714c057cac310bf64080813eed0e63cb319f394f514bd5ae8b4d1eaca7c232894c078500c6cb261dd49a4349
SSDEEP 24576:Rfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnlfJ4yL/tNCJPXUQrPo:xa5POZ3lJt2pasx2+mbfJ4klKXnw
TLSH
T11465BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0b8d9f7874d00ba3ced7a0b4a7e040fff7dcea4c984b06abbc167c44a2c7cef0
MD5 666e0e0648422e5b4ff89d13cb3f47a9
SHA1 108fce8ec17a6bee81a245f6233523308045b9ef
SHA512 cf4bb2beae05d1cb10f3bc2f3187ae13bd87a115edf26a1c55017c8519fb3787c668c0a933d10cf9fbf201008581234723f8954df4d8b8dd7b060a8b6ef61b66
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkqfJ4yL/tNCJPXUQrPy:gNc/zEOVHFhfJ4klKXnK
TLSH
T157858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 1aa4e1fbcf32a0231863f0846522cfd77aa299383df220686f490b6d7a65c7d6
MD5 49bde565611fafb9e11f2213a6543f91
SHA1 625d526991a3600f0d32c6c3b1f636c4d5b35f84
SHA512 2f09cb62e0244f0102bc861a1548834793e7f0a07d3c657f151f7f16df376b2b41ec58fe2ad1e87bcdf938bf3e70d5a770a8263456e8c7eb90a7bb35554bd5a5
SSDEEP 24576:J6DIjTBt3byAUHWreGf+jY+JqRp5fl9NJn:J6DIjltLyvH88YzRp5/NJn
TLSH
T10E25015D23BA10F6E07BE13D86930102E5B2F4619B6259DF09A4C1B99EA3FC9793CF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 25973665d56d199a456e067fefb17e704f16c6aa9a521ba429ff80d056c1cdad
MD5 14f1d1a5ab7f216b880669790a338426
SHA1 99e9de01d6ec339238e7c915be21508f505342de
SHA512 3e1f55f388826afe31ab1f7741d0cc40181a42a7c23def4cec789f9c94efc15663e2f04141582e643a6f3dbcbc2194c51f8887dc1cb1e9841be3830a357ecf43
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmuTBt3byAUHWreGf+jY+JqRp5fl9NJn:ZTMwBtOmultLyvH88YzRp5/NJn
TLSH
T1F675B06EA6F805E4E1FEC6748D238512EA727461073293CF5290C13F5E67AD89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 9a907960a3243a77e7ea9ea1fdfaa77ceecdf2b728b6873e9f0119d8d70afbe9
MD5 4b9e8e45e27c57818650c012432f4d7a
SHA1 925bb2307db7c10477fdaf30589d1d29b0d28851
SHA512 20dc6410541c35e3ff5ad5821f8319e884610eb74b6078ac24cc31ad96d91b50b7e66b7abb12804df4ea727b09c49ac4a4d1823ccfb8c30e53ce4f2e39083236
SSDEEP 12288:uHvUrBFrEjwaQGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:uPUr+NQGfJ4yL/tNCJPXUQrPw
TLSH
T11205F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 338b0a308d209d36481131270d0badcb1bbf6f11281824ea141e6838ea824364
MD5 f0506f238af02176d0d0bb2cd33d915e
SHA1 66963825e0a23b49a1f004e24c8e43c3409ae89e
SHA512 df77bbc5b001d2f90085c3536136a9cd22cf2859464fa7a4534e2b2f2dbc13278689b973ad9b0237091f5a95e142827a798c249408509000a0c57474e0bd5722
SSDEEP 12288:pQcMxWDXN1Dp/fshBItT1IQgAifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+G+:VD3FHshBIYQgAifJ4yL/tNCJPXUQrPm
TLSH
T14225E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0C1B62F6BEE42D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-71-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/260-64-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/260-72-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/260-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/260-306-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/436-14-0x0000000003440000-0x00000000034A7000-memory.dmp

Download

memory/436-119-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/436-8-0x0000000002750000-0x00000000027D5000-memory.dmp

Download

memory/436-19-0x0000000003440000-0x00000000034A7000-memory.dmp

Download

memory/436-0-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/436-63-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/436-1-0x0000000002750000-0x00000000027D5000-memory.dmp

Download

memory/436-21-0x0000000003440000-0x00000000034A7000-memory.dmp

Download

memory/436-6-0x0000000002430000-0x00000000025CA000-memory.dmp

Download

memory/1224-349-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1224-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1224-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1224-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1224-105-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1224-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1680-141-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1680-142-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1680-332-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1680-135-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2216-339-0x000001C731820000-0x000001C731EA0000-memory.dmp

Download

memory/2216-414-0x000001C731820000-0x000001C731EA0000-memory.dmp

Download

memory/2696-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2696-162-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2696-336-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2696-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2888-155-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2888-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2888-153-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2888-147-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2888-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3376-124-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3376-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3376-333-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3376-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3376-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3376-130-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3868-47-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3868-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3868-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3868-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3868-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3868-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4340-94-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/4340-89-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/4340-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4340-329-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5460-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5460-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5460-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5460-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5792-328-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5792-76-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5792-78-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5792-85-0x0000000000800000-0x0000000000860000-memory.dmp

Download