52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
Size 1.7MB
Sample260930-hl48sshc87
SHA256 52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9
MD5 77f06261d2ad5b4e726445eba2b4a6c8
SHA1 e3fc6ac83a1906e27a1cc17414259c526cc72af8
SHA512 f7d833e1c1c7ecc3abf4406912fafbae86014bbf11f962e26eacd65201ce28c41988f316d1edfb38f501dac9d6800af4e951ce9b0ebe816036a7ee195c974891
SSDEEP 49152:RZivu9n2mf5SfJ4klKXn/h0PWj37y63bTgv/S2:WvYf5SfJ4kmrj37n3YS2
TLSH
T1D285F0203F829836C2B309B90B9DF271075E6D5C0A61865357F4FEABFFEC1626D20656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4320	elevation_service.exe
5916	elevation_service.exe
3940	maintenanceservice.exe
2520	OSE.EXE
5640	perfhost.exe
5456	ReFsDedupSvc.exe
2400	SensorDataService.exe
6072	ssh-agent.exe
2456	AgentService.exe
3160	SearchIndexer.exe
4748	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 52 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	PerceptionSimulationService.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\locator.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a66d683225f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\alg.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	PerceptionSimulationService.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2880-0-0x0000000000400000-0x00000000007CF000-memory.dmp	upx
behavioral2/memory/2880-59-0x0000000000400000-0x00000000007CF000-memory.dmp	upx
behavioral2/files/0x000100000000934e-331.dat	upx
behavioral2/files/0x00010000000093e6-334.dat	upx
behavioral2/memory/2880-335-0x0000000000400000-0x00000000007CF000-memory.dmp	upx
behavioral2/files/0x0001000000009953-336.dat	upx
behavioral2/files/0x000100000000b976-340.dat	upx
behavioral2/files/0x0001000000009b93-341.dat	upx
behavioral2/files/0x0001000000009cff-339.dat	upx
behavioral2/files/0x0001000000009cd7-338.dat	upx
behavioral2/files/0x000100000000a1d5-347.dat	upx
behavioral2/files/0x000100000000a2c2-349.dat	upx
behavioral2/files/0x0001000000009397-348.dat	upx
behavioral2/files/0x000100000000a0cf-346.dat	upx
behavioral2/files/0x000100000000ba3f-345.dat	upx
behavioral2/files/0x0001000000006215-343.dat	upx
behavioral2/memory/4748-426-0x0000000140000000-0x0000000140189000-memory.dmp	upx
behavioral2/memory/4748-445-0x0000000140000000-0x0000000140189000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	PerceptionSimulationService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081ccb50ea850dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016fe010fa850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004235574ea850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f76ef0da850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a98d290fa850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea5df60da850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
5916	elevation_service.exe
5916	elevation_service.exe
5916	elevation_service.exe
5916	elevation_service.exe
5916	elevation_service.exe
5916	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2880	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
Token: SeAssignPrimaryTokenPrivilege	2456	AgentService.exe
Token: 33	3160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4320	elevation_service.exe
Token: SeDebugPrivilege	5916	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3732	3160	SearchIndexer.exe	99
PID 3160 wrote to memory of 4908	3160	SearchIndexer.exe	100
PID 3160 wrote to memory of 1608	3160	SearchIndexer.exe	101
PID 3160 wrote to memory of 3240	3160	SearchIndexer.exe	102
PID 3160 wrote to memory of 1464	3160	SearchIndexer.exe	105
PID 3160 wrote to memory of 4116	3160	SearchIndexer.exe	106
PID 3160 wrote to memory of 5856	3160	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
"C:\Users\Admin\AppData\Local\Temp\52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6072

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1584 1592 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1676 1648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1676 1648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1584 1592 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7de5b1d8e58181947d1d1f64f03848dc97132412bc30b19294a8ff19f39f07f3
MD5 34518b991d1c857ad079ed3f7c98e890
SHA1 105975aeefb09b14c17109a5e636a91032a5bfde
SHA512 a876d51a002f5ecdb498825e633ee072d0f03bcacbd24ea858a7504c24ac4b6a05daf85cef034aaa2c8daee45e0cf82ac794287c19eada608c3cf330786cb75a
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmfJ4klKXnl:q3q6mjB5fJ4k
TLSH
T13DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 0a2b4e728ae7465c60144e8984aa84cb12af4d6c80f1d81004d314a07520c8b6
MD5 dc6b0ca0bb1e242160610325c294af3f
SHA1 2d09a777feb3ea8026051a44b1d72fccac4ec2d5
SHA512 710c9e1339202b31684511fe49422e5ef57161ddaa5f22de404c9cc62e185b6aa2f2bd89ba688b1b6af50430ed5ee69a49b021f88b1a75cfd24639369e209861
SSDEEP 12288:t1XLsswWkxy2lRq2czA1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:DXYfDtczA1fJ4yL/tNCJPXUQrPv
TLSH
T11205F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9ce75bcc9d90e307967d8a9176f35a20973324d3b8acd2fed9664097bacf24d6
MD5 0cfe468e9d5b3a4a3a0a18c61dc5ac17
SHA1 f7ff50905c4540cfff85825b0f7645b4258834c0
SHA512 d05e2d06233ae608de09491ce9d514e0c98ff74a915aadae8e88932f5536df98f3c77c729fb22c8a8d00d4b745907e6606b92ba6eea1af00606e338ae803b5cc
SSDEEP 24576:W0Le5ji0hmxhrMefJ4yL/tNCJPXUQrPR:WPji0AzffJ4klKXnp
TLSH
T1A635AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 100e789f0d0f9addbe06d4869ef64172183f184d0b5253ab1381f49e3b4dc7ec
MD5 ce01bba045b608b2e6b3fc0936f03659
SHA1 50e30fdc6a2bbe9b24b78c8c2389bd9f8fccf5f0
SHA512 efb083f77deb8312dcb7aac60cfba4f6f36fced532da3f63c4a1a4198dae0cafbfbebfdea390e40dff90d6dba8b059e1d6b0fd33dbe6a4828e18b4e6cb93d618
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWj6q8wyucfJ4yL/tNCJPXUQrPC:V/ezSC6vUzPv+HjyLfJ4klKXnK
TLSH
T176756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d4dbc4360f676345d4c6e25af5875e2b4bcb8a43bea3f2692f0ad383c2b828da
MD5 9b43cf4a3849bd3430d4cdeef5d6f20a
SHA1 1b33cf87a7b948e3f6fc618ff7318f0c571c42bd
SHA512 84aa5fa26b2defbf8f977353699fbae98074e9b535f9f82ee564ec0790d559d06caa0911e788ff9779f6c2698cf0616541f5cc5d872d1f77892d530671ecd05d
SSDEEP 24576:ZVbqPb88hv/l+BJfJ4yL/tNCJPXUQrPC:ZVO88hXl+/fJ4klKXna
TLSH
T1F955AE66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4b452d44d0b380364d0e1b3e9f2e0c916784de5aeeaf3d305aefa24e8d011b27
MD5 6f5fc5b38caa2bd8f09b8bd236b1e445
SHA1 63754498bbd8519b499e9864ad3f600f61f41e95
SHA512 cbb4176e447a5284604d1a4c684815adc785a5606db7ec65e79f0c8b5ba823dda9c225e9337e14bb6181f92fc013831768cf0b1590f18694ea03dc18ada5826f
SSDEEP 12288:uGCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:uGCfJ4yL/tNCJPXUQrPK
TLSH
T17CC423E751849086DF6687F82A88F001C704BEC5562FA2F6DE82B8C53FFC91A559C353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 978a1f32ec854d4c338f2acaf09c8ad5fb73a2c9b2ad155676e8735af4a2ea5a
MD5 162c090056adfb493d8d1c65befb83b0
SHA1 682442d9d4a93281185c971cee02c9404011e435
SHA512 4eba30ac20c6f0c63dc2e029e1cb53664e00b7408e57b5f5bd4eda32428ecef2b566e02bfa0906f10312de0eb69a64b7b9115ef01686a0858421d7c76d91ff87
SSDEEP 12288:yeBNUbTVO86UBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:yJIUBfJ4yL/tNCJPXUQrPV
TLSH
T1D405C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275E51D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 218e08627f525d0f24a5e7eb2ca41ec645f3f3d480eeee955ca88d48592eb645
MD5 8f025ff8570bba6fa5c907d7939f0736
SHA1 00986d12df29b70ec088035665b235456c9ed32a
SHA512 82e54d219bf98affa51617f4a2e8945025847a9f4a82826fb781fec4cc704798ea7bd0b294e59a44e713d567ff09ddf972763a5ed2c5447eb4f5b3d39802ae4b
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH2:VQvGAdlCEL8c/WRNw5CsfJ4k
TLSH
T161266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 af5b2ed8ee9a0a33f46e9429c3ea29dd2de0beb2bedc95e792d70c1db82fa9f4
MD5 a8729eae5fdff528a3baebdf5cf009d9
SHA1 cee9d123490ab9fc32c9e953e3dc1127ab7b0b00
SHA512 ef2723d0c6e32700f0da2db319d8bfba578a8311f5e4e2edb67bd3dae1ca28ea0d96c811868eb613bedfc1b54069b5ff21397f2f4200c98888c8aead8c20464a
SSDEEP 12288:fAwSfxL/2Dc3mDLLmt0LDQewsAjvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWS:ofewsAjvfJ4yL/tNCJPXUQrPM
TLSH
T1B315E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e66107a74da7f3b51bd925826c741bfa5882087600fb798782dceefbf865dd12
MD5 03306eb0e85e45ae4727bb6e99b38d76
SHA1 ec7962aff40078105b0d674a014b6ec069ccd03c
SHA512 9552498b383e11c0522d9e63a436d4244d3d8b2ba5ca9d0d5a1817d43b19a1e318b0613888c6885bb07984aa932b472b84633c6045ad7fa4317be11b3401f0f1
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3fJ4:gUEtQevvqc2W1cpV20I323
TLSH
T12E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cab25875eff5c5bd08afd9395df113abc2b538348c4dc9fa4e7862a9184fe109
MD5 a43a2804af4c4b825e200587e3ea3c48
SHA1 fe1457845f151a4ec2d8d33c9fa83c0b5619d6f4
SHA512 8ea99c27c46d76d9429e4dcfa87179c8bcb01f87470318df9f13f87a176e359805a1c557d0ea14f4860f824eb129ca2092409afe3d80305f5bf8354ae9bfa027
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zPfJ4klKXnC:+oqtVjnmofJ4k
TLSH
T144D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9b9d608d1977a2e193693412846f2d1941e7de0dfe196f1f0ce630e16a098eb7
MD5 622d7731ab3ec5d6cd279f2c7077c2fc
SHA1 faf4764d8a24fee46ed9ea39ee7f5c51c649da4e
SHA512 fba1a0d0b5974dc81da74a5fb6fe33ce20d8b71bef8f19ff393dbf8be69e27088d13227724ebbb5e4a7191f519ae7fe8ded1d76832e8774d6a06c3aa282a52ae
SSDEEP 24576:xAhGL6IFoiwtA5l7S53IfJ4yL/tNCJPXUQrPU:xAM5Foiq54fJ4klKXnM
TLSH
T17B359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 11c96d3f4e317b731ae1d168ae9436b95de7d960a46d312077de10660031411a
MD5 46b329d6978adb099bb3a10d39c084ae
SHA1 61e48bf02121b279896d5f354c235114ce9d70f2
SHA512 a171bb363adf382a2b0d1cebbca847fd76dae755d32d42a444bdd8ca0e96429e23971618198b1433ad9b795a1bb5a70972411298455314805eeed17b793bed32
SSDEEP 12288:Pmw5HEjsChNEBFgl0WDm+C8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTf:uwuROWrfJ4yL/tNCJPXUQrPL
TLSH
T11805F14A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e391046b97067ebfaafecede0775b62719012f47fe5bb9924a1654520998603a
MD5 436228d3e7a7eb5836af7837e06da687
SHA1 0bf16a8bbc2861aaaaf208be3d2603029431183b
SHA512 f46925c36de48b92d08dae70a95fd3e84db4e7cc7e358c23514a46166f6a8a12d85bf24fd5b0ce8ce5b19b4d93338ffd66c6654612791b8668d024345e49b09c
SSDEEP 12288:QyZ1Iy/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:1Zu2fJ4yL/tNCJPXUQrPJ
TLSH
T170E4129B32D460F9DAA782BC89D4E101D3317C92273A43CF5A5195963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 01e2252d074095d1daac6972d9e30996486201fd3bb576ce8197aeed45dcee8d
MD5 becb0f15e06124d09ecac546df0b945e
SHA1 a7b6baf6255f724b2058df4b54a164df42c142a4
SHA512 5cdd62f486a7963c54bdd451062fa4ea349211d3d769e23f63e67cc27b340d1c784fc85d49361f1d573ab3e17ab914d454cfc62a4df708cd9562010364dea54c
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uf:RQRQyi36YOcPDLvw2gAf+PN3NfJ4k
TLSH
T1CB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e75f5a88f46c93176d9a757e4de774b8f54bed394ee662f9986933180778e3dd
MD5 42ae95e15f94e33ab2ca93c49a7ba6ca
SHA1 2fb11a6db3bcf2da52c19422c9582f2c1bede4ca
SHA512 e6801cb6f7f3801ade924aac804b3730f707f2653a2553fe6b46d042f8872b3981989796cb24c05a2261c83c8fd0235943fa09525e85bf5f404f6b70831a6973
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UJ:KQRQyi36YOcPDLvw2gAf+PN3NfJ4k
TLSH
T1A1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1c23556ba65c9575d3d2ae4ba720bd88ce9665e64d3a495d11f4520d9901bf32
MD5 656a2f91ca835384970b49d6730ce5b4
SHA1 a08ee7f08acade3b8a018a861480a6d5a873387f
SHA512 f60ac95df89b866917d9c82b06670c58f817c6e0d5d67aeb851bd1ccc551c098c686eeb60e2a854c850c2655fe53c40019a97f65feae23c0320e3581fa549597
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0mfJ4yL/tNCJPXUH:R68Qg55nhkeWu7PNU3/ffJ4klKXnI
TLSH
T129B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f7b0f48ad4a437ce21da8fd05cbbd84278a49001cfc9db7bee22615f8eb18c8e
MD5 d7cb50b4a76d5bd8062fed33b3c7d4d5
SHA1 df3b868ac865d9d312c3dce2ceb6d13a0bda1a41
SHA512 a5d3c2289d1af0460fa0b55161155fa1c30d9c55de5b98b2809f174318b26d77e489c268be59594050c9b883595b2eafed0b7161f86c77a2772203b548dfc533
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99S:Ey5112gYy5azzVvU69nLKnhZCfJ4k
TLSH
T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 08e0f46dd6c790c5830ef6cf155497f2b1eac66889c3b6252da8af10f0ba36ef
MD5 f0aed836a83d4f6d7bbacd9ce6a37570
SHA1 afea5b9bb186a8b74c496dfe11c72d9ec48a9678
SHA512 59cd2345f782d2b1a3a24dc2a1d61a9b3ffb7ef594645ca8c90a4d4e93e0d412f2ff3c4f41a3134579feafb76485f350c09cd00323c6f1aba91dabcbbf454e86
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllfJ4klKXna:Hu6JmIxd2dlfJ4k
TLSH
T176D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fe00f7cb2c61d074edc7e706ec3f676657952bf7973af88f74dd89d7507c1796
MD5 26fa97eb9ab793299a76abe2eaff7826
SHA1 362094a4855da706ae46e4614ec1f236e7112fa7
SHA512 1a897e5b2792d2def62e4fc7214e197c38f062180bdc49e67cd47c745ff92b5b05036f7cccd92ffc4db9a29a611fefa2093d9ba2429c3b82ab52eda34b1a5990
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4xhfJ4klKXni:wmifPqRofJ4k
TLSH
T13DB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 19fe9e8f17d2ba7c4148dc02bea7db9cbd4d4236e23bc4c6a0d1335608b83fbc
MD5 1726467ccd9431510e815280dbc73812
SHA1 00348300d55e3ad95e90a5eb40f4a02cb89c98ec
SHA512 c95478562ff9c76f779e66b833414a0bb8afaf972608268d3a54568d9c4e1f15e7c21c40536e85a28027c9620404f0efaa12658972762818973f32d46384bcef
SSDEEP 49152:CSuZQIY0Be2KkRVtOnks6NMHq2fJ4klKXnq:c5dKqi612fJ4k
TLSH
T12FC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7f3bce34ddf62d6d86d09193041b443187ee79e3121038a267312721bea6a447
MD5 0d03568eeebd0942cad99971166230cf
SHA1 5d77b27894ae60163d909a56ef1bd7ec7612d738
SHA512 c3ad3b46da27a61356a7300ac3e21d6f91cee2282e203f3537dce0653ac9a899d5e20d55ea299811cf5d096e8b09fa2bc75a055a924bc47a2850004287211213
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5w1fJ4klKXnF:dX2iWph0fJ4k
TLSH
T19B95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0275b9c82a26cc900feaf13b4543a2f6881d0595c0188bc70e1595da62c9a25d
MD5 0acab9068d7df3afe32e4859918ebe45
SHA1 7fd301ae54ad173b1b92e36b771e6235a93517ed
SHA512 363c015c30eb3ee7819ea080d7ecd5bc43bbd39cd8ed53fe4a8417831c4be5970a129f613e441c22eb9ba01a755cd00460ff5ba964c3c65447941ee22e9ac844
SSDEEP 12288:Y6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:Y6fJ4yL/tNCJPXUQrP6
TLSH
T109C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 bc48e249d74859f9d421a0fa8299e4624f0c4214739203d97b8e67b0e78c776b
MD5 030f6075a531602a91fd44741621feec
SHA1 6fc02a193c7f180ff9a634bf1cc277bf59dd2786
SHA512 12ff098c2d9905b5c54cbfafe5f10422f3310bed1531f3aa0e12f8f91ffdd8c6314d7b6471c7787247ba075355af0c520761643638aa72d3e797f1502c100c15
SSDEEP 12288:yTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:yTfJ4yL/tNCJPXUQrP6
TLSH
T16FC423AB60D59486DE1587F81688F001C7047EC6672F62F7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 40bb30ffaa120a0ee721776731d54ae3f4c80a2eb2eba976b56c5fb63e92648c
MD5 8e6a9f78b24f42ef2ca5f71eb8b1d8e2
SHA1 1c95d854ad83f1abf9316a9b040ea8940032b1db
SHA512 9fcebb975de7f0c48544cc0f12d5e94b551b6e03ce0d13860ae8d7197c75c225b72c1c24b686c56e9178b5de1d05ceaad84cf4191eda3f81902b82b513f8258c
SSDEEP 12288:h5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:h5fJ4yL/tNCJPXUQrPA
TLSH
T142C423AB60D5948ADE5587F81688F000C7047EC6672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 53b7097a52b7c10680ab13541b60dfb1ff34ed5f31119e2f9255896c79b9c274
MD5 caafdf10b033284dec14f1d1730eb562
SHA1 c58ec07b5ceaddcd32e264aba260ac9ff0a93116
SHA512 7ccc34a9b5d3535cc0e673c8ff99b5f4b33edc2c96f14da75bb7c5afc5885f22d4fbe49382e8b6461207e387438db63dfdf8c5a756a01f1815676ac0ba165a7e
SSDEEP 12288:xVofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:cfJ4yL/tNCJPXUQrPP
TLSH
T123D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 059e1a1d94993557922dc0755f1c5088eebe84f030028b7d01cd4c69292ca6fb
MD5 2e995fe0207f8cdb2b82491fe4c0f866
SHA1 4edc7177fee1be62d3a6e19d7b8ce4b20590c0e8
SHA512 fe1966a5a675861ad35b7acc58801636444bd7795fe58f857f36a091b289ff9099e83a71995ad034fd11ea8569295ba545ea3b2e57b9e2fe661c580a148e794a
SSDEEP 12288:EwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:EwfJ4yL/tNCJPXUQrPv
TLSH
T167C423AB60D5948ADE1587F81A88E001C7047EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 8a14db39f11581f49917ad5615b4b831ec0565670c117a43bb158f73d1242143
MD5 e38b72fe51172bda023f2eaa959da509
SHA1 e18f06b4835762eab5e4055856f8f95fad8903d4
SHA512 25bfe49d6b9498edc28ff554b756faa4901aef4d528a8b5ee05cd3e81aae06d18f0f2bc0b784036221d92fed103474d14b9eeb7578f4444e542301edbdf934ad
SSDEEP 12288:5HfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:5HfJ4yL/tNCJPXUQrP/
TLSH
T10FC423AB60D5948ADE1587F81A88F001C7047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6750644734312625f67ff55c676c06acaa93c3a75df4c0f8d2f388262b3a94d7
MD5 04b12498aef04a648c6e50909b0ff199
SHA1 cab3b04f0f21b0c9e84030bcd32f1d467650a0a6
SHA512 ee33f9367c20c1a70424cb71ee23eb93e2edb4c2a8c6a7252d82ba8c7aa827dd42e6e6c897a526066deb4967db1c63bcd57ffa8a61712949fbb095c1dc8b6636
SSDEEP 12288:FbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:FbfJ4yL/tNCJPXUQrPB
TLSH
T1B8C423AB6095948ADE5587F81B48F000C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 fba489b72da667911161de3e9a29b9cbe4086064bb8be244763de988162e3d8c
MD5 7c0ffa419506372801cf30d33c9588e5
SHA1 ceb69c55ac5383489e5ec3c185d15e8e56131dc5
SHA512 931d8d821d08582955a0319eafcb8a2c201bd2362d7912300ed21c53b307c6f84cb519ba15ecdeb91db400a1049c4bb826d7eba68e701e0d7abeb419f6f3c951
SSDEEP 12288:6iZwbDzzFEoS2cPvyzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:dZM3zFVSOzfJ4yL/tNCJPXUQrPT
TLSH
T1B90501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e9ecec3de973a3fdba38a0ae4df5afb634af6bdd1385ba8eff86f9a3628f3526
MD5 9f4a8f46199ca2089bbf36c7a80f5a17
SHA1 78ab222c2ebdd9f6ce082213fca872eedce1b894
SHA512 f287d7436363df70a940a6932d2e820ef27de45fccfee69f88fe29b075f0da291271cce19b291552dce6cb3fe3d5c4a616f66bfecfdf67c85c560667d661825e
SSDEEP 12288:5GfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:5GfJ4yL/tNCJPXUQrPe
TLSH
T1C3C423AB60D5948ADE5587F81788E000C7047EC6672F62F7EF42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d4127372c780911bc3d5ebd177992be23d9f7617d1067624498a35135ee363d6
MD5 ab164f531a98e4deec8ecf193323133f
SHA1 386fe36a2b0f0abad629e6734006e32d5a692ee0
SHA512 6605eb6f7a3c1a902b1049ac0bdb4036b5213e302bdefb1c7d08b1bfc085cfb1e70607fe2ebc698b6d71eb0046398df7f5431a6bc5b782ea9b9119cf19dffa61
SSDEEP 12288:FSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:FSfJ4yL/tNCJPXUQrPK
TLSH
T1F7C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0d757ec01de005e97eff6a3f65fc92739b95fc4e08eb416296b1dacc05994a55
MD5 7470bab8f32a9e222823406e5452ec7e
SHA1 c09172f6f99509fc0530796232eb2e3075ae4fd8
SHA512 7ac55c74057caa7b01497a1a6d5ac0fdbec228afce8a6cbf7c6ae41623634a32722d5d7dea7eea43f2fdd7c9937d11245bae9cedbbfc332cb9383753c6f81588
SSDEEP 12288:byPz5L8/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:Wzy/fJ4yL/tNCJPXUQrPv
TLSH
T198F4125732A130F9D53782788990A502F331BCB207258BEF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 5671713e7732099d354ce0b82f5f639d8c8751c4dc14aafa8d0e4b81995ef00f
MD5 f1fac4d5ff386972294a0116ae127c23
SHA1 c119f288b8145aa60fcb757743d83c849f75b078
SHA512 e798f48132f6a4cc8582a256f4e57386a056c681196572a7070c4fcb72206365f73c590b8705869e50cca8aa40be2d8605dcc81b9daa267b3ea82bf40163bf40
SSDEEP 12288:fGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:fGfJ4yL/tNCJPXUQrPV
TLSH
T149C423AB60D5948ADE1587F81748E000C7047ECA672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c08b211091763996a1ecae0684a437850d32653446660ae0facd6f2d441e19d7
MD5 a3de21eae035670e2de5e4031ed93858
SHA1 39a1cf117d3d78240f8b4a17ff7bc4b330ef09e5
SHA512 6c714a2d00efdf6e231d0d5a44d4c481414808c934a064b88465f3516bd47636d81a7492d2ecca5893be5f43a8e2121252a2af03be7fe3fd72fa05026cb2d01d
SSDEEP 12288:5GfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:5GfJ4yL/tNCJPXUQrPA
TLSH
T119C423AB60D5948ADE1587F81648E001C7087ECA672F62F7EF42B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 584cd982cda4239563c7af2fb541f80754a186a58726daa4a1c7ebdaaa1cd9ab
MD5 4360cfbdc309bfc74f3ceefc5e29cd1e
SHA1 d3abd5a87f0f43ca969c53ad64ea9e7331abc995
SHA512 0fe98cc111d9dd76d8fa4b06c9d30e1789917c44d92eff03444c5beb41a78fc30983c2479c8452c83431fd3a9babbc3c4d14d80608b853cf40ad5a7536f33ffe
SSDEEP 12288:CyPz5L8/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:fzy/fJ4yL/tNCJPXUQrP0
TLSH
T17AF4125732A130F9D53682788990A502F331BCB207258BEF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b4b6361d4a35245ebc7e0c098b6042d70d16c16a17409813beb46e9d11362db5
MD5 ff4ef5e0a0c897d0129b56325dac5177
SHA1 2402c5979baa287ce729fb35b3b186f4cc19a67a
SHA512 b2ae7fbf9e6fe336d6744a3891006eef028a112c6142f200f9f5becbfcff2ae4677186e731fbbf061d472d4ffa9b6e5fa9acfa62765d05cbe4087655e57e63c6
SSDEEP 12288:8Cd91WYoaLHF3z0z04PDvhpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTv:lT8aLl3z0zDpfJ4yL/tNCJPXUQrP7
TLSH
T1AB0501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 be21035aad711c14d3ab80f4bac3dc8c15f95fd54be3a466df9565068d04ef99
MD5 2d14caad571a4bfdd2a28a4cae2c1845
SHA1 33666ffa258f51698a75fac1ebf008ba4782b6ed
SHA512 c0b6c3bac35576ca585dd8ead1a9e6d66346720346a8d3ff839058653cd331f0b397758a54c549ecdc27e5a047e28704590dbfec07586043df153011ca27411b
SSDEEP 12288:ri4e7+RdTfgwCHKy7GLbbdIvEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGf:r3rd9CHKy7GZtfJ4yL/tNCJPXUQrPw
TLSH
T1DB25CF91F3E410E8F0B7CA758D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9e1a6006cce187b663ace51a157e3ca6d636973201c4e6cec98ee569e6e8ac43
MD5 4c261937d106a9c4c07d3a3b3cf106e9
SHA1 f33134be8f2c4116da0a49bc2f60ce8a8c52652c
SHA512 3e8bab41513dd2666c2a9ee9f57eec85204afcc0814eafa35d5e67c4f370802b31c4b5eeb1d5e5a61bd151566c6bf935d8035aa4f2ac8b57872c793ad5086569
SSDEEP 12288:KZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:KZfJ4yL/tNCJPXUQrPD
TLSH
T1FDC423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 aeb0ffcc4890523779fb4081d6b052253c5ccce43e3a046a96f86c3718178d1c
MD5 9234280691108fc4f903527fb5fd24ca
SHA1 b3f11a5ca4a0ff9accc2848b48fad4fc2c42cca7
SHA512 0a33d21f23a2331ba8420078651935c1ed0457e905b056bf5c97257725ce99bf125ba897781abc8d151607008de84d8d3468896dcf7537567b896fda685f0a7d
SSDEEP 12288:0ffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:0ffJ4yL/tNCJPXUQrPD
TLSH
T119C423EB60D5949ADE1587F81688E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3f23e2981e6d6fd2e26658dea95954f361c88600c202606ef9333a3e64e49d41
MD5 470d941fe885de905bec63043c471805
SHA1 c61804e3b5d9b266786e6693161637c86d1def53
SHA512 6dc8826cff5919356a648a85d05a7c1a29d46473ae292c8061098731a56a09e35195c2e2ce565af46c3f5e1890090489f65f99905335b3e270902b737c8a5e40
SSDEEP 49152:4MnYIXvR0PWj37y63bTgv/SXfJ4klKXnE:jJRrj37n3YSXfJ4k
TLSH
T118850129EBC808E5D1B7823C99A78206F7B178591B71C2CF129A52AD0F37FD46D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 698dc88cc09fa1e682dfd73369f7e763c5521ebfb53678ec0e5f90da488b2570
MD5 12ef9ba583b849538cf53ddba43aa172
SHA1 f880cd30f005a1b2563d19221dfe971c7e064565
SHA512 4fd4cf9112d51025a75ba494ccc21f781a9eb294d1b5b4df9659b27777252a64daa8c11af083ab0e2eea8062dc7df9507d059b1c5944ac516805022dccafe9a1
SSDEEP 49152:8YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VfJ4klKXnJ:zySzPtfJ4k
TLSH
T15E066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eae697277e9e497877f0c465c577ae465e72b4c975d2a14558a76b318659e21b
MD5 e13139d0f3639ba5b06a23ca78a0daa1
SHA1 15453b651e47a57d77d9208d042c7233f2582be0
SHA512 ad22f58f70c3bb285a8411e088ee7d97527a5371f16a3855608d615b971cbed2c7f21da30079247d80b74c9ca335995ce1b445932b56f6e003b634f12f4ddee0
SSDEEP 24576:u47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYDfJ4yL/tNCJPXUQrPI:u47JUQjqirIhCnDHUPfF/lfJ4klKXnA
TLSH
T1FC65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 84f08a833920c4f7229783412dfab06da8047a601be996c523d90603e898cbe6
MD5 72bf1e465e2a0172040630bafa9c4083
SHA1 09bbc50cc66e6bb2ceaef8cf212c74bb29ef1ed0
SHA512 d4985643e6bc1f1e5f2a6433f16d6f02c250e4e711509386cce6c5c9e88a52abb485f182d556ad040256b128145a0b591565e8454aacd7c0c1388aa9ee224b46
SSDEEP 12288:Mpsf2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:N2fJ4yL/tNCJPXUQrPp
TLSH
T142E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d847e107f470596d01ab4a0cf20ac36585f3ecea176f830cccc6108025eb9ada
MD5 a2bb2a9b660d962f4883adc7b66a2189
SHA1 acc5a096da0142414d92d5a5d24cbccd26a2d4b8
SHA512 ffae71003dc5aee1b91f7eecbd174f157a42cc13e3d87ac2eaa815b199c70176142801390762421016578c91e105a29cc2f2170aec7dba79d55bdabb7a4589ce
SSDEEP 12288:nLG8U3fKbtIhnUsuQyH8xyOUUbemwfxPb0bHc8ISbDb:nLrUPUtmpXehfx4TcjSbn
TLSH
T18E3518107666CB4FC66D84325E33D6CCAB703D11EE056F0773C98B3E9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2608d7e14081e3697755832e11f8d1eb305cc48cf5655fea56eca933c2c98386
MD5 57fd0ef9db7329ed9ab686c9a42a0cc9
SHA1 7501b64d96c17c8224e5f6d4e27b4d3e770cfa7d
SHA512 13bd733b669f66330c8b991e2965ab6c8560995a05a139389c478430a80e42e528defb2ea68fba5b6520c375bca298b50f34628095fa4a601e6ce9f998a364fd
SSDEEP 6144:EVy4XaYwnTLf8N8USIn2QF4YEn/yA8yNtMxEyNtMxjSPDbxLf206ZtFg+KoOmKTn:mkPtUSIn2d/yFpg6dNHFuE
TLSH
T1AE65F9419137E68FD1BA6032172A5B4C77A4EC07B70A5F27B389453AD86BB51B0B93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 fcbe2050c00af41cb767c35ec2addc76bcbd5d5594b82091b47957ee972d92be
MD5 c86a36bd1b7132a3dc87f73d9c2f0305
SHA1 a713cffaf0fc88e4e7b94f510c0ee093028f9868
SHA512 0725a73ce9a45f1309123c667d259f86f41ad9fea360b0cdfb201537354a897dcfb1e982eff39ef2fffbe3113c5fdfc9bb62212a899ad5f62fa53f76a26c69ef
SSDEEP 12288:DM7+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:I+fJ4yL/tNCJPXUQrPe
TLSH
T17AD423A751C89446ED7687F8164CE000D309BED51B2BA2E7EE42B4853FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6d77426be48bf82e844cb799fb46dcbbb8f5fcdf054bba21415688d84c14e8e1
MD5 f3c18a397fafba5f16a381ee01f41b20
SHA1 0a2d6bb503f9a6f3d8583f336bcb78e9d2d3d1de
SHA512 9626bf7183333f77571e0e56da243cf320117de88fbc0880b316a99dae71a1a20316d9e0e3170fa1301c9fd963ffda1f8110437b1d0d72f348ef9f7a800454c9
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYcfJ4yL/tNCJPXUQrPr:mgb4mBIBhGFDfJ4klKXnT
TLSH
T19A65AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 7c0e9147fc002d8b724d2a6a2a4bce439d406ecb45898da95783b9a37eb561c2
MD5 aff9a471867252950ddefff3df6daaff
SHA1 dad24ff1916d4b8e97e45f6ee8f788ac1c0c3059
SHA512 36fab9d0a54acfa7cdf1cadd8ccaf24bd9af93b30f6df64d1558358ecf73ad3741f6ddeff548cb9bca4ead5832e9ec7a8113db4500c661e69fa5ed583a46188d
SSDEEP 12288:NsG9KH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm+v:iG9eR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T17005236C62D538E8CBF54E7A129681533BF13A9003A495EF03E7A1B8CF157E170BAD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4f6eda7f3fbcd3ba6ffc2845bee2510e8352c9fccd2d0913b0396859409add2c
MD5 3de1949b1cdfaea0f83c1d2955222be5
SHA1 d8c0cf8be24ec6e1a2ef4e27112783475e9bab36
SHA512 52a449c7e0f64ca19897881f7d96c3914d165eb782f146de04ec62bc924f450aba97e17d5958f8236f2a1f3eb0b632fcebb4057f15bb0139553f3c81ce81a0ee
SSDEEP 24576:OG88u8FpJqH1vzria7/mzfJ4yL/tNCJPXUQrPT:F7ZFPqVya7/kfJ4klKXn7
TLSH
T12935026676E001F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 816932105a26015423eaa3057ee3280e27ae2a40c34c5de018760fd98f8af03b
MD5 05ef02fc27a3d4d17d57fc5fe99cad2e
SHA1 1e24ff038fcee81e4346e1556ff2a33eabd690cd
SHA512 02a4b3a77742b0460cb2c20f9b860b3b8d19a38a4dcc2e9fd83c9b5e9dce272cf363040bdee888ad747342ffb8f64e50baed81a3fcdc71af6187ff169439b32c
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHfJ4klKXnF:+G05lO43bKfJ4k
TLSH
T1D1D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 185d4a5158c401d5bafc4dcbec2e56b9f1e37ff786801c3f4a0756bd9fb7252a
MD5 da765789774a5388b56a1109c06e835e
SHA1 049262940c42261daad7f2d87aaf44ef302ac239
SHA512 554e44f349d9680205ace4fea28ab40eb4b4b07b65931140e9c51f8aa235a690e38e84596d3c2b9252eac6de9ff71a2ad5b47b16a7b6e9a65a903b04d6346745
SSDEEP 24576:bfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnVfJ4yL/tNCJPXUQrP5:Da5POZ3lJt2pasx2+mffJ4klKXnh
TLSH
T16A65BF5EA6FC00D5D579D17CC583861AE5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 feb5e2e930769e702b5f52b69028ddbf06aa25ca244bf7b14fc230e0e60f694d
MD5 d621379f1a8d5e32d95e9bd8ef28a0d7
SHA1 d644b0dc40692ca66157c426d206f8ceeb7384c2
SHA512 3b978ef2947bd34b22ffa417db92854a9de37b0f8aae903ba1a67103309f02f4c6b9354b92d2c7c6eacd0ed0c3db415e722bc117d31ca9a31025202fb8040683
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkLfJ4yL/tNCJPXUQrPT:iNc/zEOVHFEfJ4klKXnb
TLSH
T175858B2623E901E4F5BBE1BE89679546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 bddafbf97edb5eaa33dbe4edbac7c86da67ca5fd042777811cb5536ea871efe4
MD5 6d508224deb85df69419d6a9c1826afd
SHA1 031586933ab246033990422ec0b887ebe3a56143
SHA512 d236b0e6e8487e8d4690209c088998843b183a59fc3bb621896d331d92f86dd9776d20d29c4ede0a7b7295fcb1ee5c35817c311a4fd85fcc7fa196b8746a8f6a
SSDEEP 24576:P6DIFeR4MiPP/+XA8GSV7y6ggxbDngv/S2:P6DIk0PWj37y63bTgv/S2
TLSH
T10925025C63AA20F5C2B7803E92834102D7B2B5A087A255DF07D9C5BD8FA3FD9B479E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 e80b9a18f63e2e6ac08c2bf75f7ee67db4c9f5e19995a52ada11a1e39f264240
MD5 1f3049f151104cf9b13d779bde7355e6
SHA1 4017ec5bb99d687b8b46b89bafc5dd20751917e6
SHA512 50e6dc74b70d4595b284f4e000f4ed9e6ec64b6acb95f01833e5100263fca2a56407c2daf971b332dd94b496e8319a9a643506cc60ade17b86b55fdbad251105
SSDEEP 24576:vtyVeR4MiPP/+XA8GSV7y6ggxbDngv/S2:vtp0PWj37y63bTgv/S2
TLSH
T158152248A3C438E5DBF50A7957A782915F71BC101BA192CF23E2E26E4F36BD174B1B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 d1d68c2eb0510e0bee0cac644795f58aa659dffaaa48b5769f9ee277a2759228
MD5 a6385992b519dbe247b04574d758d12f
SHA1 4d843c060e09514ae83af01aaf0f9888507d02b2
SHA512 eb70fb26f610a92e38ac95cc59ac05eec3eb6972713e012c2cce087056d6e8e51991f8664cd86240d726093c2ee13989e7196b376ffaad32428e29a1db13080d
SSDEEP 12288:X+HKH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm+v:uHeR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T11D0523ACA6853CA9CFF10D7E238A424217B13A9407F595D723EB91B8CF157D270F6982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 e476f575f6da02894a51e2ad871fb4fea26e79ab3d2a3335b3e343e50c9dd04c
MD5 67c37383749ffb8dec62ce493fa55545
SHA1 1e65233c95a3fc8f9e17f8af31611826dfcf2fe1
SHA512 7c8d7073bf99b78f17808c1cd109e9593c13f8cb1eb10d6dc349b0c8660fdfa18870e9b4ec4c9559b46df85cc566e7af6786270fa5690179a95da6afa2586bd1
SSDEEP 24576:EngtLoTfaidZpeR4MiPP/+XA8GSV7y6ggxbDngv/S2:ugCTrZg0PWj37y63bTgv/S2
TLSH
T14F65AE1D73EA19CAE2B2D639D9621493D633B4311772C6CF2548C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 3f1f3516683d1b15cd79e40aedff58250df814efcf1acdeb948ca279cc6ea059
MD5 73bc1312abf63848a1a350d3bf6f0a4f
SHA1 ebb7340290b800a1618263e8b294bd72e0b3a053
SHA512 33a45d93e4ae80afa961861b221485a2aa64371c8d3e43ff150407776223c350970adf8d683fba17954af923b144b03402eb4237240f2227733d600366940cc1
SSDEEP 49152:dgb4mBIBhGFDfJ4klKXnTD0PWj37y63bTgv/S2:dt0fJ4k0rj37n3YS2
TLSH
T1C3A5D01E22EC01F5E1F6D3B89DAA4407D6B278160732D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 796725911c1bb2c20a3e40eff55c6268322cf1428336dd9265de1d59a4bef59b
MD5 59e5560b143ace0ab2791993ae8588a4
SHA1 3de032bfdafcd3b924570f3ea8122e83e4b48383
SHA512 da23c8b13ce728b39e8869a8a9bb4b757437f044c5a603e59c90e5ca96ad642d366711e59c7a44365e03324424ab49c3a716366fc67c97a57c3c46ec3529110f
SSDEEP 24576:yTkNvNnaFeYhJNtmZBmleR4MiPP/+XA8GSV7y6ggxbDngv/S2:yTMwBtOmE0PWj37y63bTgv/S2
TLSH
T12175C06EB6F805E4D1FECAB58E238512EA727451073293CB5390C13E4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 996KB
SHA256 bbc3a4742d34be0ddfc91e2208b3aca98d1a730f6fa1aed5a1867d3f88e111a3
MD5 bebc6c0e26671d15d4bba54396198292
SHA1 b5cf48026612e84b6c443765a43c42d83b282b08
SHA512 302957e5a820c3e98c1943ec351e561017aac85ff26c595405a84c0c0dec132c5cee813477475318696b1761712330ff62e99aa4cc9ce4a81db4e7ac29643a82
SSDEEP 24576:kPUr+NQKeR4MiPP/+XA8GSV7y6ggxbDngv/S2:kJQz0PWj37y63bTgv/S2
TLSH
T10A25F16E62D82CE5E7B6A17D86868709E77178520351D2CF03E1817E4F27BD8BC3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 a87ed5d96a8b35d06599b643580681e0d15d3c2eb0850e44118e1c97c6ac6ae2
MD5 afcd8653ad2528a13df4114e44287922
SHA1 feea5f775321bfbb56d66ae95f20827905cf6abe
SHA512 689b233d054f9a7790ea0ba14a65c4e6ede160be5976264bce846d05942136308bca565b0bd3eb558e3f91559708bf4d6891f581cbf3d71a8844397bf644035b
SSDEEP 49152:7DVHeBIAAafJ4klKXnYH0PWj37y63bTgv/S2:UfJ4kTrj37n3YS2
TLSH
T1E485027DE69814E4D9BAC2BC96538602E77138E9033266CB03D581B95F6BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 053b14d9fb37a7f8c332814b72b12168d0cfe316ae40b89550efbdf8cd013edc
MD5 5d9f98cafe09c54c4aabe2930ac6e2f7
SHA1 034514eab9085f6cc0f4b5b1daa187bc52982fe8
SHA512 7e54e3aedb25e8c249245846cfa9de4d5c1152c3e6237d4944415f29f9476e628c0390e98baf3788606b15eecb17f481b3bde878973f89680701973b37785ecb
SSDEEP 24576:pJnJPbzB4SReR4MiPP/+XA8GSV7y6ggxbDngv/S2:pJnJv6S40PWj37y63bTgv/S2
TLSH
T19F35E13CD2A820E8D4B7C2B4425A1756FF71386C2B2569C71AB9D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 bb68b2de0327939133f04a7efb18ec3e106b881d8e4531a64408144cec16b9c6
MD5 3af737608755cf4258fdbc5c924f5c40
SHA1 7c4678c20066db1820f2b136163c663b28104f96
SHA512 8bab1ff8eaeddc56395c80b13902832ffba42036081de9a27afbf8a40372cea01105710b13f460f09e4c38bb39680e9d690a2ce446033a2fae0cda425fcda732
SSDEEP 12288:J7KH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm+v:J7eR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T14C05239CA6853CA9CBF10D7A238B82421BE16B8407F595C363AF618CCF197D770F6592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 318f6748ebcb8710e11f6fb00e32682e8390b9c3e1cb17b21ccc2b4eef4a18f5
MD5 73ba0476c01283d829fef21d650d9930
SHA1 1c57d76fa56431f757d88eef26b06bdd33273288
SHA512 f77c03ad699766c4059634af66fb736fc742755a107840a9326d40ae27f47d7be0f4f441de93b0b017e11f0b611e39abd069ea1b35a06095aedac42e62abec36
SSDEEP 24576:46UqjpNeR4MiPP/+XA8GSV7y6ggxbDngv/S2:46UP0PWj37y63bTgv/S2
TLSH
T1B215229C62C438F9C6B50938A696822247B17D6103F595DF33DA92BD8F32BD1A07BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2400-125-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2400-406-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2400-404-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2400-132-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2400-126-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2400-389-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-151-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2456-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2456-159-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2456-161-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2456-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2520-303-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2520-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2520-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2520-81-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2880-13-0x0000000003470000-0x00000000034D7000-memory.dmp

Download

memory/2880-6-0x0000000002850000-0x00000000028D5000-memory.dmp

Download

memory/2880-1-0x0000000002850000-0x00000000028D5000-memory.dmp

Download

memory/2880-7-0x0000000002850000-0x00000000028D5000-memory.dmp

Download

memory/2880-59-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/2880-20-0x0000000003470000-0x00000000034D7000-memory.dmp

Download

memory/2880-0-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/2880-335-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/3160-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3160-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3160-168-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3160-407-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3940-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3940-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3940-61-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3940-78-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3940-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4320-28-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4320-36-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4320-137-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4320-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4748-437-0x00000000013F0000-0x0000000001473000-memory.dmp

Download

memory/4748-445-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4748-433-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4748-427-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4748-441-0x00000000013F0000-0x0000000001473000-memory.dmp

Download

memory/4748-426-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5456-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5456-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5456-421-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5456-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5456-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5456-419-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5640-101-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/5640-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5640-97-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/5640-95-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5916-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5916-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5916-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5916-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5916-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6072-403-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6072-140-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/6072-146-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/6072-138-0x0000000140000000-0x000000014013E000-memory.dmp

Download