3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
Size 12.3MB
Sample260930-kf1pjasfpg
SHA256 3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc
MD5 78e9f77f442575408d7227f4bad51a00
SHA1 a6a923e82a911ab2cd5f11d19093406a2678aafe
SHA512 c40878bc3659832e7b2aadd9a6b3fcaa7942693a6f9f44ab42c0533939fd3fc795f325cb86b2aa8d5c61057b065eed151b697ae826ee8cc96b7b19fafb7aaa7e
SSDEEP 196608:C1YK/XkarAIR/WzyUzldGgLZsF+Iejgv3wSH9xTsDMOyoKfNkp8HLNemRJXzfJ4d:CuWkIE1Ox+iHfsQOJ2HLNeqz4
TLSH
T188D67C327751D53BC6035873552D96BF0168BB708BB588CBEB481A2C6BB46D2E235F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3592	elevation_service.exe
2680	elevation_service.exe
4312	OSE.EXE
4152	PerceptionSimulationService.exe
1116	perfhost.exe
2108	ReFsDedupSvc.exe
1372	SensorDataService.exe
4324	ssh-agent.exe
6052	AgentService.exe
1816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dc68144631e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\locator.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093ac-128.dat	upx
behavioral2/files/0x0001000000009442-129.dat	upx
behavioral2/files/0x0001000000009952-130.dat	upx
behavioral2/files/0x0001000000009cfe-133.dat	upx
behavioral2/files/0x0001000000009b92-134.dat	upx
behavioral2/files/0x0001000000009cd6-132.dat	upx
behavioral2/files/0x000100000001b99a-131.dat	upx
behavioral2/files/0x000100000001b99a-385.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c1d95adb650dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000854a0a6ab650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da2d67adb650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000025087adb650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009894db6ab650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4728	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	3592	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6052	AgentService.exe
Token: 33	1816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1816	SearchIndexer.exe
Token: SeDebugPrivilege	3592	elevation_service.exe
Token: SeDebugPrivilege	2680	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 5836	1816	SearchIndexer.exe	100
PID 1816 wrote to memory of 5224	1816	SearchIndexer.exe	101
PID 1816 wrote to memory of 5072	1816	SearchIndexer.exe	102
PID 1816 wrote to memory of 5296	1816	SearchIndexer.exe	103
PID 1816 wrote to memory of 2956	1816	SearchIndexer.exe	105
PID 1816 wrote to memory of 1612	1816	SearchIndexer.exe	106
PID 1816 wrote to memory of 1524	1816	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
"C:\Users\Admin\AppData\Local\Temp\3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1372

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2f4c7c9166ebf7b95a1134b782f2a0bac4c93ee374a0c379560b5f4c0678769f
MD5 a73a73a7f8bfa45a3921823645915ce6
SHA1 cfc126d1c4ab4abd56f344b4b926feec0f66bfdb
SHA512 cf7fc002f13127d14e7dd951a4f99ec26785f288c1fb89a3a8b072266a7ba1ac167c50fd81fca11b16279578a5aa93344e6758515881d118bd580690b6742f9d
SSDEEP 49152:qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMfJ4klKXnB:c3q6mjBrfJ4k
TLSH
T1B9D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 f575fbd880ffff9f621a1d0c876c14bbf6b3ee6936bf6c755ea594345b37093c
MD5 5c123e403d15a687e678d9d745d504ad
SHA1 07f5c5b3c9969adc1ee560ec1743a609baeed0c7
SHA512 a5df5f50e99f8b942e09f3d8e43359d8f07bcb3ea5474ef3f104a7f54a9d1c0df071073646c0ecb0f39f7d802fe5351627fa6177260509d7a0a31fcee7f0e67a
SSDEEP 24576:qXY7DvczAgzTBt3byAUHWreGf+jY+JqRp5fl9NJn:ZvclltLyvH88YzRp5/NJn
TLSH
T1D125022563E004F9EC6B923CCDB28512EA73B8454BB4E79B03E485655F233D92E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 24b98c0bdb09638886fc08b50de44cf57b8c1c1c1614bf03a2790ce0df11b299
MD5 762ea25fe07c6296de91ac7bc5b77478
SHA1 be020987d33b4e37cc0ec370b62e117267ab982f
SHA512 df9b93ee4e3feb5ef5424ff32e8759a25e1139daa5531e9bbe5aff3e174b47f6656897675ea28810a0dd7f28d171da41ef713d586d58ec68da648e065530c81b
SSDEEP 24576:lXY7DvczAgzTBt3byAUHWreGf+jY+JqRp5fl9NJ8fJ4yL/tNCJPXUQrP5:0vclltLyvH88YzRp5/NJ8fJ4klKXnB
TLSH
T1E075126963E004F9ED6B823C8DA1C101EA32BC854BB5E79B07E095656F733C92E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7c0099edc2a51fdaf2245db313da5b6099fc859366ad99cef9563de2ffd8eb64
MD5 ab89d693a54c28c83e2663c5b22c8336
SHA1 68d91ff29b1df32790c8bbe8c0302ce5c1190d20
SHA512 33ed0a396d2d7f01cb4ac14e7106fab40e0bb5b2712833a059d30880bf4fdf6b4ef853d8107474841f5ffa36a09b383e52a21c4638e07c6bbbad5c15d2186f3c
SSDEEP 24576:G0Le5ji0hmxhrMZfJ4yL/tNCJPXUQrPk:GPji0AzofJ4klKXnc
TLSH
T1E235AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5e3acb04689390f7ba7da7a34703fe1c553716e16e96cebb24eaf3a649828b5d
MD5 98719214c158655886faaf31fcd9f63e
SHA1 7be8d74ab305bc2a74921a2086f9938fa585561f
SHA512 67991acf7d211ce9a9aa7fb4700f2566ca59319c2769a9ebf75990086077192de00f09797716deba8ec6db46dee93e9bdc5ff1dc71785c9341fac09fb57c2c3e
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyubfJ4yL/tNCJPXUQrPy:j/ezSC6vUzPv+HjyMfJ4klKXn6
TLSH
T1CC756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 568b808eebcc30109b37311c5edd31472c9e77c73db1884a7af313d2026f7bbe
MD5 8881e783474a249587183996497709a2
SHA1 21c640851d6243454b7f074d446902b632bfc427
SHA512 adc1ea28d4af7ea066631c805bfe50a08d56568c2af65c198498b4f999d39e1a30266f0c6500da8f75a001772cdcad7150616d15ae36b72673e3b9b793b7d386
SSDEEP 24576:JVbqPb88hv/l+BefJ4yL/tNCJPXUQrPx:JVO88hXl+IfJ4klKXn5
TLSH
T130559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 259a6844414d4cdce33b77f12ec84ff8075da0d4a4f2100544d8c3c74ed519a8
MD5 bc5e5441b431ec916a41eb6f3d80f62d
SHA1 f6841d34f7ac7a35c4751e1c6292b1fb37e7d74f
SHA512 51adb757a37430bbfe306c0a48dea3e3e89ab9fe0718ede44f2cea409b7757817486c210cd86a43b2951bb12f290e49deedcc002aae16ea896eb33084f38cead
SSDEEP 12288:FGFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:FGFfJ4yL/tNCJPXUQrPS
TLSH
T175C423E751849486DF6687F82A8CF001C304BEC5562FA2F6DE82B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9ba9d2a79a431093038b7f04a20110a5342564bf01f945f2ea2996dabe75f413
MD5 b403b7ab0b97c16dd9ba60b24e71f915
SHA1 7dd5019eba310ea8939dd816acd70a908c87a763
SHA512 f023efd84d0905b4852c29ac7c81b3448eb897e5f1a7713c3eb25ff69b94520f17b636bf5190b366276389b6dd7ff0625632798888dd6703eccf3d4ac0d659f8
SSDEEP 12288:HeBNUbTVO86UGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:HJIUGfJ4yL/tNCJPXUQrPU
TLSH
T1B005C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3c7cd2a12453f97e0f67851453d691392f3305d978b3ad7a7d238f6e01819745
MD5 c442a4fa74c37f52bf986ae40a0e0617
SHA1 8f6a4471b2c9f43433dc9c5268a174fd44581825
SHA512 87c187f360dc9721c4ef85ed9fb6b0b2e669cad99a2d2478ec1f570da6f62a530c98f19408229e46c970524fc159251597d913b200f9fd39cd67c277616a7599
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THM:0QvGAdlCEL8c/WRNw5CLfJ4k
TLSH
T12D266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 96cb03c7e70228179f12e7438bf8253660c69358e5c843798aba396312da777c
MD5 c7947efa8f37942bd56afda6dec81c1a
SHA1 bf3c74ebda59262998b736d721271db63d77116f
SHA512 f21b942c28cc399c0103bc5c2daf99c4df45297ac2bd3ffea76521cc243cbb8cf1ff82d58e11a52246237f91a94842fd4f56288a94bd547148ff55b992f2e8d1
SSDEEP 12288:DAwSfxL/2Dc3mDLLmt0LDQewsAjYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWf:8fewsAjYfJ4yL/tNCJPXUQrPd
TLSH
T14415E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f07cdd7eb1c8fb04e4ed7421ddfa40a23ecb0823728f18e92036be1e4bc438ee
MD5 354ecee5722ee91a70843eebfc75caf4
SHA1 09678821c3dba653c39e3accefcf70c85650f1e6
SHA512 7f429497c48b8d9498e2b5fb0302c01d279eed02743a01722aafe3cd92cf4b070511161334d1b6ff319a12bda0419233a5542645d989a20603322e7c162a8476
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHwfJ4:QUEtQevvqc2W1cpV20I32w
TLSH
T103474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 84c4e3e7ca3c7afc8ac5278bbdad8e6081080daf74983dc44b7fe5a9737b3293
MD5 c5a9bdcade043a845d0511afd32a16ac
SHA1 9078b933d92e73d8014638461022e10db21e7155
SHA512 bf7ed5202c4889488ae6cb1d080f1b29230962ca07256f06dfc6ede8f547598b97d2b8edf101c490276f1cf8bc2d4602f28749591cb591398e4dbdbab3297df8
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/z4fJ4klKXn1:hoqtVjnmPfJ4k
TLSH
T168D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e522ce816e0ec585844ea4796644455312faa0dcde50f4170503190e28387366
MD5 11654ebfcee99f39379fabf945e68fa8
SHA1 fb4217dbbd2c17355ce6a076a152f3f6aa63dc49
SHA512 c9765950d3fda1a2990c8c9a3d13a8e093ea9d4de8a633053f7f4fc9ce24dc9a49826ba002155990a4c7262c7642007cc10e5fcffdabc0c2149e6dc7e18aca46
SSDEEP 24576:JAhGL6IFoiwtA5l7S53vfJ4yL/tNCJPXUQrP5:JAM5Foiq5/fJ4klKXnB
TLSH
T12A359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 aa38329834a6a42b416c29b38b0944492aabb439f1fe2477c14c23b793d77adf
MD5 10d1163050d37fc47e498044ea8b1f9d
SHA1 cacc1cd6718f6032e8de393d3f828242fc192876
SHA512 53a991cef7991f7cbe40a0749198e67b80dade918cf169ac9b80f6304a12fd31fe193395834075db680e2a559e4f28d9f450675635fd29767919beececed97cc
SSDEEP 12288:Imw5HEjsChNEBFgl0WDm+CSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTn:lwuROWdfJ4yL/tNCJPXUQrPr
TLSH
T13205F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 eee3c6caaa898d86864c55f8c2152691dec5ab36e069ca37b9729c676dd1ae1d
MD5 56f0366ddc2c7a1be6aafa670dca7d2d
SHA1 79bd344155898f51eaa64bb9c37a40dc61e43d75
SHA512 1088568af6efab58326122a6051579821b1d834960c3a20dca959966bda4d5976e31f1847bb28fb2bc123b12e0ce77292cec2e347aa0e04994f4994a564fd2a1
SSDEEP 12288:CyZ1IyIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:bZuhfJ4yL/tNCJPXUQrPM
TLSH
T11BE4129B32D460F9DAA782BC89D4D101D3317C92273A83CF5A5155963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b52664b0c0f3bd578dbbf7a27f2dc2e7094bdcee1e8d0d3bf8c12a755be46356
MD5 7e9ff9d8ee84cbcd81106421394b4c63
SHA1 94f00db24758594ee0771d71c3c440276667d6b8
SHA512 928e802f0b39cfbce3eab2e2c7740cf81a7e828f186cc2ff2dcd625347048da7b17affe35d011b1f7cbe8d46ae3bf452f33bc6b51dd3cc4c03e3cf2925718b39
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ub:fQRQyi36YOcPDLvw2gAf+PN3qfJ4k
TLSH
T1DD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 325702da7bdc8191cd77b77d46b70f9bd2522bf9c13813fb078fbd5e8400ac29
MD5 cc07920b0342f58f5e9e1275f4927254
SHA1 8a4aa20dfd69e30a8747c0791fb85ed3b4995bdc
SHA512 dc710b7b82873d5c37be1e4e1b64df7f6deacc426a8b023b55479f85e809f2e7d4ecd848bd8e18e3860a04f299bd4a5eea84e39cdef5f24245250fe2e6d8e190
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ub:/QRQyi36YOcPDLvw2gAf+PN3qfJ4k
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9e8a58b8b801b879dfe3185677ec5ebb09a17c092f1bc62ff87e3710222c876f
MD5 31194226cf3a228202827f5102048e15
SHA1 ee672e2dbcc8abf9e022469a08f8a5b5c5f7b134
SHA512 276a598b88e9eab427534b8a757af47b6f70d016d63cc4c13e3b5104051eaaaecdee7c275a631eaa3159c7e92b7714563a8c406dd5fb8325c19f9a7d0ada829f
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0xfJ4yL/tNCJPXUx:q68Qg55nhkeWu7PNU3/ofJ4klKXnW
TLSH
T1DCB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 681bbb84164f14c9c957add297dc451f49aad359d2ecb84fadc14e8d763b43ac
MD5 fe593460f48147f391c9ada768be3d9a
SHA1 716e80607db21a4e1b2753dc76a3a8cb10c64e2d
SHA512 9c091c6ef7cc8fc6af4eee21f2d88f6b757eb243b679d4ab3e4b58e5231ac0b599070aa630f91dba30ca780a85b780811cf6d04258d3f30ee0c69add0cd89322
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99h:zy5112gYy5azzVvU69nLKnhZFfJ4k
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 10c0bd033b2c2d5b3daab79d124e797e6441d69da78cf7802896e21d30285e6e
MD5 761f6d36d1a8f0eec8d4e3ae6b62ae60
SHA1 3d0ccedcf8b3d2e5a60d7d3c2602c2ed30350de5
SHA512 1c234f14d9fa591133d993f1111499d5624dc3f9d84bde667edc36ba26c383bc66f1370be9e70bcbc227388f93bcf2b041e9da60ec6ef68d34aa2d8c55f19c9f
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3fJ4klKXnz:Hu6JmIxd2d3fJ4k
TLSH
T178D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e962a74b7a7190f039d6050ac79b4ce2b46842240735cebf3a54582fb28a6900
MD5 2953f76152d362e535669027141856b7
SHA1 8fbf82c1e7ca745321deba152a5e3736b3b8a63b
SHA512 257c70b2c294d524dd83691aa4be8bdea6a4becd40cc4d850584e1b9a7953593fdeaeb7a73f972f6cfa8397aed3b491d7b0ce2de2fd6298db655e5964890da39
SSDEEP 49152:01hpsNoJpF1A67U44CwH7R4xmfJ4klKXn0:0mifPqRPfJ4k
TLSH
T14BB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d8b00a8c20b25d3fadb54c49f0ed72fa700e1439c92d0b26cf7a43c76faf2fdc
MD5 0d545785db169b8f0098373e0409dc90
SHA1 152121d4c38639660b0d5de042c1e4ba2b0cece1
SHA512 11c20fb3a5e279ddda322034a076781e0d8d4707e0d40c6d3fc1f08458c132b595690a7fd7be53ccabae1c88fcd56a3afca329c78f5a21a1a3817e80bc18c4b1
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqhfJ4klKXnS:Z5dKqi61hfJ4k
TLSH
T10FC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 822dfc98130cae45fec3b4b8a3aaccf61dde6429b905440b7c360a0b19637d14
MD5 af155f90c6fbb599d8072dde2624b99d
SHA1 d11da8923f92232fff9391593750d7912095f7a0
SHA512 36c8f151b1283361dcded6179daf5435d6e70bd8b183de2110985aa80bec37cf69252dfcc79043647e2095dcc940cc151beb399613519d3f00a5c958c96fd2f8
SSDEEP 49152:FhtSn8EApI0figjgiDn0AP5wCfJ4klKXn+:0X2iWphjfJ4k
TLSH
T16595BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 45ca51f620d5c0150f5aaceb04d58c8d0dfb22c7298a6bd9605cb6e0726e31d6
MD5 252e9203c78f2025c363829d1ac571f4
SHA1 2f388120e3a5a6b23c48bbf04a10225eae3aa18c
SHA512 9f1aac8c1347751bf92cef4e9f92c1c5ffd910b3282fc05a91d51360bd3422e6c94759727daee029e3ec8c8e5e4208c9ac716736f5be66d51d391b2ad62fb299
SSDEEP 12288:btfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:btfJ4yL/tNCJPXUQrPC
TLSH
T101C423AB60D5948ADE5587F81688F001C3047ECA672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f69f3cdec8c18e099a1c381633bd7c74d0b300f584e817ac1dc0b0a72c8fa022
MD5 9d1a94da15bfbff2900470c60914c066
SHA1 802205eff3c2f6593fe13b821d4f7a4e95e3849f
SHA512 609e03be32f9d8bb35b4bd3238be4a01e6c69e4cd792a872060ddd63374501b0f6883609fc08b9d24c49c0d57d497e2c973ff32713de55b8b8794456dee68d17
SSDEEP 12288:YEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:YEfJ4yL/tNCJPXUQrPC
TLSH
T190C423AB60D59486DE1587F81648F001C7047EC6672F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8263f9a8df2a041dca2cb4389ba93a7baea3b3c6476dcd935a1dc7338eab42a4
MD5 a862f4cae5db68718c194dfc8b665d2b
SHA1 e5e8e8c0b205d9a4e99dc5da7e9954490b6aa935
SHA512 c408d6865c6079456ac9b03201bf2b10967704c09770987ee20046f7220fa295d3856ea93ab37705590321bbae4f2daa99f64dc1d52f3389a91a81150067b509
SSDEEP 12288:/ufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:/ufJ4yL/tNCJPXUQrP6
TLSH
T1F1C423AB60D5948ADE5587F81648E001C3047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 bfda00ee1269285d90f313850107c7c9fa947555760c6dba2e09d2d8415c821c
MD5 90199806e43d4b36b135a77f7d62a57c
SHA1 2d42a97ad170ac0abf179effa224162c64dfb5ae
SHA512 b76a11812f232ce9db35871b2f815f7724a2e53ea7f9634c9ba274af99dc3b0a42b1e70ff000fdd33406af7c60ad94d371e73921397cb43b40494ab5b5ab5da3
SSDEEP 12288:lVPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:vfJ4yL/tNCJPXUQrPt
TLSH
T1A1D42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c592065e6ee46ba342b69214e07709a18b180b31eeb4dd6e86bb1bb74f63a550
MD5 4e81c2d28ea1dda466c5115285f45513
SHA1 e1bd07a3100c8a1fa2688f9a5af35056e84a170b
SHA512 17040bc5b9eee69367ab01faf23e942e17c5aaa89fe6f73df81f5eb25a87588f0f1d34f265e11d7758440f27bc02640d85eb879513fd9d9058c636e8c94dc157
SSDEEP 12288:AnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:AnfJ4yL/tNCJPXUQrP8
TLSH
T19DC423AB60D5948ADE1587F81648E001C7047ECA772F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6d89840e868fab6963e3d4a0cb90a8a5664180f65157ca2466d091c45a867e46
MD5 edec3d8319c721072e3e8cc80be475ca
SHA1 1fd572604fd671ce01b126d200b299dee14bd0d9
SHA512 0ff58347e3208aa4da70158cc6dc05c44a0c96df05d3927e8605cc679f9cafb909e49c949dd1c52892dde143bd0c26a6c4a8a9eaafc992993db797f87c31c701
SSDEEP 12288:NgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:NgfJ4yL/tNCJPXUQrP8
TLSH
T1B6C423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9eb640584f74beb0c16f282de3461f8ec5173802aaa612381006e2c4b59034b2
MD5 c3ce3c42cb32b228f98873996bdccd83
SHA1 ceabaced9f8d12788d63ab376df610d25d9acb8b
SHA512 baf15bf4a80459cb9fc151266550606ad2b840c01641dc7f2818b1d12663ad59d08777334c7b4b6d2f789de8cbe3659dfe9003bb7a5699306150975b433dde4e
SSDEEP 12288:z8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:z8fJ4yL/tNCJPXUQrPE
TLSH
T13DC423AB6095948ADE5587F81748E000C7047ECA672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 378ad71193bbbec49a6a5fed3868dd9fd64af9ff47b7cfec336b43b0310340c3
MD5 ef806479b7d2534ddd772e3fbc56b398
SHA1 039ab5e3fb66f9f5c33a25b0126b05eb1fb2722e
SHA512 4b99b08e9acfd50affe3dfd82fadbc2a7a263feb0293e222bcd14b4a7791ffc8305b0fbaf7bd19868c5265a0f2b77453643511054701731a606b916ffaf77d45
SSDEEP 12288:tiZwbDzzFEoS2cPvykfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:wZM3zFVSOkfJ4yL/tNCJPXUQrPP
TLSH
T1AC0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f2e3b413fa012b2d45e88d3be7a57dbde080631c033ef3c861f55284a06a757f
MD5 fbf4c43f914782112b9335b4534641ec
SHA1 693370750aca267643395d86af6bbaed76ecab9c
SHA512 3d5cde47e1da5b46ae0e58139aa27359f0b26104c99856be5ee14c12affe1a00d1e3ab3fb757abbe27ce779ec84547378195ef5d6d66deaefe030604bbafba51
SSDEEP 12288:/RfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:/RfJ4yL/tNCJPXUQrPW
TLSH
T16FC423AB60D5948ADE5587F81748E000C7047ECA772F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5815ec408d88ce370a146a81e177f65fdb9fd2cac606323138ca0bff3edd4829
MD5 7c9c683629c51a4bfe7371b404a61c4d
SHA1 ca02db6e3337e4f3f8a080f2fe3772bdc495af82
SHA512 b80573b6bd7a821978bfac787e44c5f0be1479739624419a778516aecbffc9ba8676e659b76882617610f4d3801da659339de7beca13e628ed4ac707c0d1012a
SSDEEP 12288:a1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:a1fJ4yL/tNCJPXUQrPj
TLSH
T13AC423AB60D5948ADE1587F81748E001C7047ECA772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e0772b86fc65588a8e097af9262e966a9534ee3c3deaf1f8dd32a6ab39b07a4b
MD5 cd177bcddb223621e4700ba5e34fe58a
SHA1 d0b434258a32a4596e669a0736e5604c17e5f416
SHA512 a44f8348fecb07aa00c79ffad59961929205ef0514e9a30182f2614a8b2a88071b54b2e37b85f9307e7bed58178444b982b251b54b1fad44be896e781413833e
SSDEEP 12288:lyPz5L8IfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:szyIfJ4yL/tNCJPXUQrPK
TLSH
T171F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e979290955fcec311000239bf7dfeda3f975dc258f239ef6451e383a86fc2d3c
MD5 98f65608412cbaf2df9ae8533e91245f
SHA1 7c55d5c698ef1ddb6b6c19dee0bf398de41bfbc9
SHA512 2cbae70c388434e11b1519fbdfdebde7b59f9a47c413154847f8c1a8d4a76f68bad55916071c60fda8e5294024010526ecf03f6bd8c57910ca323711da48738f
SSDEEP 12288:IRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:IRfJ4yL/tNCJPXUQrP5
TLSH
T1BBC423AB60D5948ADE1587F81748E001C7047ECA672F62E7EF43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b213dbf211020f4066a2c1d27882a562f45a9635c66e6970cc14f615cf155590
MD5 44c2286e1a3f86cd5f58ba2a502a0290
SHA1 959a01dd4f2b3fc0d5b538583531009e01d314d6
SHA512 278a2c6cd6b39e82f6a36e468a319abc247fe3c5ecc3a509127af6dd97c8f2cbf30846fed9dc45270aea9adcf47bcf19f2c5f562f01a885b4776dd078ed043bf
SSDEEP 12288:mRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:mRfJ4yL/tNCJPXUQrP5
TLSH
T1B5C423AB60D5948ADE1587F81748E001C7047ECA672F62E7EF43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ec89342a4265ac3ec8abb3ef0593d420b416f5bc6c7c054632846a17fa9a55d1
MD5 bf45c7c5954aedf867074165a5131ba1
SHA1 3dccfbf9953f6365ecc851722f772bd4ef03034b
SHA512 8330e8ea3f4ced9d3bdc6c6f7125906a44ed2cec4c483135e6d6b4b22e71f07ca34cb1a422896f2eb985789e74a84d9dfa6302e32dde03e92c905e3938ca89ae
SSDEEP 12288:DyPz5L8IfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:uzyIfJ4yL/tNCJPXUQrPo
TLSH
T1ADF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c43a3ef13eb594968b5cf85100b5e2c75612995f8c52700a8c5c7b9f10b7ee0d
MD5 6506401d5d294583cb104594b87339f2
SHA1 b5945cbfa65e1c638a2ca42d1d8953a64f1258a0
SHA512 d7f248dfe5ae3ee959aa6a58ae1731da691e1fdb2d8cedaea35e0ada38ee5d5f8395ed7d3e72fdaedfa538444a98b5a01b31f071bc40825e8c8f3d95bae92507
SSDEEP 12288:dCd91WYoaLHF3z0z04PDvh+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTt:IT8aLl3z0zD+fJ4yL/tNCJPXUQrPJ
TLSH
T1600501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e1bbb464650b312b19ae84abd46962be848d772aa9df50719157e165b627f6b2
MD5 d85e3ef77a00960901b2da6d46345cd1
SHA1 37408a79e2131a677f615b03ec4830976ff4178f
SHA512 8015e002c4c96bb4220b163314f3c75678b18db23e61092fb884cf5dc52c1ad6c12e0547f3cf0c2f4a9fd831aa0181c8aa2d23334852c7c9ca591953773f8032
SSDEEP 12288:bi4e7+RdTfgwCHKy7GLbbdIvTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGY:b3rd9CHKy7GZKfJ4yL/tNCJPXUQrP7
TLSH
T1BC25CF91F3E410E8F0B7CA798D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 632abc9d30fda0ee43800a51ab1d4f7844ee142df5f0cb47d7eff45729ab9147
MD5 b5418afb31b3152b3ce3fac1f7d3b38d
SHA1 1881d59d6e1272d0e7e2636caf9938f0d2f84dcf
SHA512 19bf5fb0071e46d62a180bdadc8292687e8646de2b850af063a87f30588e9f0a4734d8e9272621fa3065885eb9bdb1fdb4c5630c0113e036b473bc1f3766164a
SSDEEP 12288:HOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:HOfJ4yL/tNCJPXUQrPV
TLSH
T186C423AB60D5948ADE1587F81648F001C7047ECA672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 cc1d1f256cbeebf051ff86c6127e8b014f51f055b323cf225b6afac8b834b59a
MD5 5c3003b4ced0dbbaa8b69e3d3c7c6c92
SHA1 87490cbad695e02a25d968158fbe28031a7ab33f
SHA512 6c29ab3d4e77dd77944e56a0c5b687163a96953e809d489bd4f770681b5834fff926dc1bc474e213b431f2a102d03581c00e252b3b2f93c6a8c68900104a58ca
SSDEEP 12288:EofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:EofJ4yL/tNCJPXUQrPJ
TLSH
T18AC423AB60D5949ADE1587F81688E001C3047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f8d373c266170709e7ca1f3cc2498ec0fcd8227f16cb7f828ac67f17f890a579
MD5 5e9c9077d525178458a03e45d6791817
SHA1 7b71510f3298a25a2773b905a513237ab56e24d7
SHA512 e3726a2d9bbb32ec515e3eef4ceac216f12eac66db0e65e434500001937ad4c93e3bad74f75ce81fb5b6396c793ea920b37dde9764bc796c9f719591d04153d0
SSDEEP 12288:/TfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:/TfJ4yL/tNCJPXUQrPJ
TLSH
T1B8C423AB6095948ADE5587F81748E000C7047ECA772F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 864ecbae019902f4d41a69fc711d52018f9ebc64060d182678b06fe8be9b1275
MD5 54da4c6432b2717bf74daaeb5810e61e
SHA1 0a1f3c757bc4715ba190034d4a0810e93b42a91f
SHA512 ebfe5bfdc21ae466a0867e86fe75686d30dc6137bdcdfddcfbcdd3fee9edf2683793fc4550a900bc5aa5898a2c0abdbb5070d64e279e9a392bd2995c8bbde6e1
SSDEEP 12288:zRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:zRfJ4yL/tNCJPXUQrPJ
TLSH
T180C423AB60D5948ADE1587F81648E000C7047ECA772F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f59842d684cfda4d5ef5d908c5eabe665009a17df615786c180d47726bf57962
MD5 7b8e435ca3d19afc996d423f970e817c
SHA1 3a2cd6a2e366cfa600c9caee29fffc9c7e59f12f
SHA512 b0142361c1e5cae9e4fac4e4924441f5dfbced43092ae9ce1c900bb90ea0f0c89fd7a1de8ad8162a2a9916a7f7111cf8df44fdd90878d43b23aa4d3a93f9ea52
SSDEEP 49152:KYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ifJ4klKXnY:1ySzPKfJ4k
TLSH
T11B066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 129690f4a9f4e39094f6fa61eb1b97ce92725190eb3a86390f88640d4afd0f9d
MD5 cc460fe637de945f2eef276b06ee21a6
SHA1 d5faded0467ebfa43bd7cba4b564f9ce6264f586
SHA512 15b93d86cd4a42a62221fb3bda9cd203722630b249f7070593d467b82c5fb4c728127649cf88e78206ca71028dc7c314d9deae5ab4afde610ab57a93cc439b09
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYUfJ4yL/tNCJPXUQrPd:v47JUQjqirIhCnDHUPfF/SfJ4klKXnV
TLSH
T10C65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 28e53c43662751963c7d7279adfbbb91cb336fc827e6c30ff3950f33d7a3f091
MD5 0e6ad944a6de2062d8e7abb450d79007
SHA1 358d0b05ffe582b7869ee7dc05ad1e172dccc0c5
SHA512 a3119ccd2b7aab5fb3da175beef5bd2d04831355ec7ba7be7aa5539a7b2fdea204b6b67176401eb480babf337ee22edabc514a033afc4db31de5b4f56e11df42
SSDEEP 12288:RpsfhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:ChfJ4yL/tNCJPXUQrPv
TLSH
T145E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6905DE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d537618604662a14bc2edf8a1439c9bbc1b638087d42485315868cd1fc8bdea2
MD5 c44e3826696478d7880dd49bd9e37830
SHA1 db9c1e1916fd775ce6d21fdbb0adb7ad345d63cc
SHA512 4b2cecc54a940999a391d02a749b2c7dd96b8a4b3549907d3f124b39e2b3029b746dd6bffaeb476e0520b3db306dff806fa63645afeb56739a4d5d1d62d5fd3e
SSDEEP 12288:r51f9U3fBXvtB/gxreSQfjXJ0rH4IyS6c6DC8MvbYJ7qdX4PK011cGBw9p:r51VUPBf/IxKD0WmkKm7KX4C0TcG
TLSH
T1D0452840B66ADB4FC66940321E37D1CCAB707D45EE44AF0373C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 547KB
SHA256 2f9c44e2dc1fb8c4d65a9b6849ea8af42333adfca4c8d67af9786fe00f47994f
MD5 9e3b8d12ad1087f33000c7a8b872128d
SHA1 8c1049540fd85ed2c8aafc1ede201a5071e3cd9a
SHA512 e5783e2e43ac9bd15982db1a328cb9e056977914abd592181fd668105c1d714486f2c78b60034bf11512734fc47b733bed0fd835a8158ea46d681eaf485a649f
SSDEEP 1536:BpVAE3Pa3Xu2m5tanroVj77iUUREXXeWomarNSufXKey23+3b3hgw7QE2EVR6uGv:B/AE3i3evW8BOaeWSlA3b3xQE9o/q8OO
TLSH
T139C40800A636E78FC0BB5033023A5BCC7BB8AC17BB456F1277854979DC26655B5BA3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ea5160d253b6a55713ff82298c9c7aa99a88edf6e8d41c03503c1a4aad1ae1d2
MD5 5ef42c5f0a98e1a99ecaa299a80dcfc3
SHA1 9fbe6d4b89d0e830ab827f1640b2d979a9dd9d03
SHA512 bba1f3c14b97ddd25c3f0500cc58abf47cd28787f6b9a54d74850a8d2ef719313f1b1145c1cf90821959b03c6cadfb6c8155e18cc50c11183e1def311a861bd4
SSDEEP 12288:4M7kfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:ZkfJ4yL/tNCJPXUQrPl
TLSH
T13BD423A751D89846ED7587F8164CE000D309BED51B2AA2E7EE02B4857FFC98A1DBC353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a99851eac00ef1358cddca490e7c47beb77420eddc12325fb128b732ea2aff88
MD5 29bf8ad21af9ec20cfa420377282d390
SHA1 251bf0e6d6641a77d25cbf4c5ed1f2ae290ac56a
SHA512 951e50480f394b9cf0437cfd97c3cb805083066a5a2fd4fa5d9e5cd98257b7fd4606e0b56583bd773b24fff48520c619afaaed3a0d0d13c74277b279ac5ac715
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYbfJ4yL/tNCJPXUQrPZ:2gb4mBIBhGFUfJ4klKXnx
TLSH
T14865AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 16e6c542cd324359834418fa29e655e32cb6ce6a6955ecd17fdfe70bd29fa30d
MD5 6fdb4d289f604cea0a53dcdac66404fe
SHA1 f2aa567776acfc0fbd90ef679b0e31724adebb26
SHA512 f38451147a0fa17f81c0f2369720b96d28f1e02583c30b7c6e93bf23d734816a24b3ee2a1b2af13f4c87a35228b46bad6d0e4c826b2de3d1b270698b3d9fc262
SSDEEP 12288:E6GlrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9b:jGVTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1DE05229A21F520A9D57EA735097161227CB1B4556FB968FF08E09279EF603E2323CF1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4a7c44ca71c0fc421db23ab4f4151622bb82355321352dfa60dfb3e1aeb364c6
MD5 fff38e2fe629777737de8183a8970b89
SHA1 4602124881031f38b74b0ef9e55331cdbff68998
SHA512 ec82827e37f34a84227a88eb6e11d307cd95367c6198676a8bf7ea61895d9af87376485719b63908f9a0d8090c5e4c0e7cb71d004e34e594604a9060e03fa802
SSDEEP 24576:EG88u8FpJqH1vzria7/mkfJ4yL/tNCJPXUQrPf:37ZFPqVya7/zfJ4klKXnH
TLSH
T18535026676E101F1D477D1388A868663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 8f252d942bb43ed6ad4ab9cbda0eeac6bb34b81e56415648684b50c0ebc0523d
MD5 bf4092cb4876b7a827343246c26f6d57
SHA1 6a12c386ea8871cb6d9ab24ff9d308e0bd4b1b04
SHA512 8a61208dcac54300a27c379972c2d9dc11bbba584aaafbd381849bb95ccdfaa959906bec068fd76bc6966455b6ab13b7e12cc1c6ee61405c947c4a93db902cf3
SSDEEP 12288:XHvUrBFrEjwaQZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:XPUr+NQZfJ4yL/tNCJPXUQrPI
TLSH
T15A05F16F22E818E5E676E17C89858209E771B8921312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cc27cc1a9b8277ed6c3dab880b245293c871d59344da9cac50842925e29fdd30
MD5 b381042c929e0dd7b6abdb8f5ec8ebf2
SHA1 04552b6cd9c0bd9109045b2f58965263062d50cf
SHA512 6492b4169fb754e12819a4211d08e452e43fa4cb1ad0f789ff303112c68c631ee7ac60b573f14eea0993cfd2a2fc1f220a259006392fb854838509ada489b196
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJfJ4klKXnm:lG05lO43bwfJ4k
TLSH
T158D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 51117ab7e7f3f3b80d1525c94c475b2bdc37a599fd731db68b97ef27512516fa
MD5 0c604babb0105091d7ba662b7d9350da
SHA1 aacb6e4e0eadf4ff345c073957974cfbe08e8f01
SHA512 97e84b0d40a1afac867b19fc057c81ca94091814354969f479a962caf1523f88c6c751716dc43acb7c7d8cbfff9a3d93d246be62f471af2c28510cbf43f73b63
SSDEEP 24576:Cfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnifJ4yL/tNCJPXUQrPB:Ka5POZ3lJt2pasx2+mofJ4klKXnJ
TLSH
T13D65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9236d5b9cef6fb7852c741c762b0abcd5b9a101c467bcef1a48f8f4016f5258a
MD5 6f251058b1bd1749fbfa9760c8361abb
SHA1 23d700f993bfb790fbfae9ab4d33e8c9fbbe779d
SHA512 f7f666fa52090b80e7c525682fd08f97553e704aaae79d20aba43214be1bff528ab6eb92338f5dab1bb69bb31394328522c2c56356a38107f31496621bbb0002
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk9fJ4yL/tNCJPXUQrPf:LNc/zEOVHF6fJ4klKXnn
TLSH
T164858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 b4ae3012b761591f3370eb08abe565e6b87857a0eeac323ae9a30eda1eb0b904
MD5 6d40f3ddc047ffa37fe6893a5a7408af
SHA1 24de2e54e35e44a38c8c383b89c0896aa02afb3f
SHA512 5379020de0c2efa2a12476d0af72025f462839f75e49bc75b602d78218b8d086876f4d86b9f9131db0039d7308fb5da0a4a74eb6a87c91a3130aceebb877aaae
SSDEEP 24576:J6DILTBt3byAUHWreGf+jY+JqRp5fl9NJn:J6DILltLyvH88YzRp5/NJn
TLSH
T1B425015D23BA10F6D07BE13D86930102E5B2B0619B6659DF09E4C1BA9EA3FC9793CF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 182f9909b62bc40d82e906336772d93ca6c2736a10888bf8c2c9af35cf661ee5
MD5 c7f9cbd759537bc748deb46516668093
SHA1 9835a1f703fea653c3ec643499d654632f4ed69a
SHA512 1d9e0baedd6cb73f554afbdb2fcadf55f77de540394d67a0ea7e4f0de8983b7597f70fdd1d476189b7a0332f40d446f280614dc990771857ce3a2b698d90f5ec
SSDEEP 24576:ptyRTBt3byAUHWreGf+jY+JqRp5fl9NJn:ptWltLyvH88YzRp5/NJn
TLSH
T12715224153E410A5F9BE27384A7242619D71FC106F7696EF18E0E22EAF327D27A34B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 330c872d28bfc9244c27187d3f6329567931041a42f78bf37b31c23b042aae13
MD5 d033201ce93cc6d437f6218645c8b313
SHA1 4df8cd26bbdc6566cefd85bca8d457583f193efa
SHA512 7fee808c295022d03f59fd8ca225b7f9a234c2ef655b9b59abb84e731cb4d1508b45e51e2d403e47b7b84d3d6500a5eb0e97ce49ce4056e9bea90180ffbd63f3
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmUTBt3byAUHWreGf+jY+JqRp5fl9NJn:ZTMwBtOmUltLyvH88YzRp5/NJn
TLSH
T15C75B06EA6F806E4E1FEC6748D238512EA727451073293CF5290C13F5E67AD89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 73d578f1b7f96655409365f01b3257ccd85c7dfb05428ac94bf2685539b84152
MD5 0efa6205f7a26b9432161a5d743fcafa
SHA1 762a8ed98ebd81e447b4eba81d67488aa34a7837
SHA512 756a4e41ef2fbf3a71bc118126fae336a32c01a3db06b048caa746782a6fe4a9c4a79a19d587fd8ba872fb283c9dbf8ee97b9beaead33222bec925e857415863
SSDEEP 12288:ygrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9NHV:yuTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T19D0523C241F400A6F57E7B350A7662126CB1E8466FFA59EB2CA05245FEB13D33279B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 535bb6f2371292cf7e944fa4c63b971a12f9862661e36a427c39d52ad66ef0f3
MD5 3c7d553520b56b72a995d71c85a5f57e
SHA1 09f9c25c95994ce2a8dc56b260c5f79a4cc1623d
SHA512 da8d9708c59a72fc50cd7805691a7ba198d88866008c1b68f94455502dd2e317e1b7d809c339eae152fa427b36de964ec0a38b997f82892def17bbebb5ecbb9d
SSDEEP 24576:q6Uqjp2TBt3byAUHWreGf+jY+JqRp5fl9NJn:q6UHltLyvH88YzRp5/NJn
TLSH
T16315238A52E410F9E47E57349971422284B1FC661BB659EF34D4827EDF31BC2623EF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-81-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1116-86-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1116-307-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1116-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1372-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-342-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-339-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1372-341-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/1372-337-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-114-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1372-120-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1816-343-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1816-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1816-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1816-168-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2108-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2108-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2108-371-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2108-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2108-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2108-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2680-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2680-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2680-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2680-46-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3592-26-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3592-33-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3592-150-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3592-27-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3592-34-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4152-304-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4152-78-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4152-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4152-68-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4312-228-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4312-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4312-63-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4312-56-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4324-145-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4324-137-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4324-338-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4728-6-0x0000000004BC0000-0x0000000004C45000-memory.dmp

Download

memory/4728-18-0x0000000005300000-0x0000000005367000-memory.dmp

Download

memory/4728-3-0x0000000004BC0000-0x0000000004C45000-memory.dmp

Download

memory/4728-0-0x0000000004A10000-0x0000000004BC0000-memory.dmp

Download

memory/4728-8-0x0000000000400000-0x000000000278B000-memory.dmp

Download

memory/4728-13-0x0000000005300000-0x0000000005367000-memory.dmp

Download

memory/4728-164-0x0000000000400000-0x000000000278B000-memory.dmp

Download

memory/4728-77-0x0000000000400000-0x000000000278B000-memory.dmp

Download

memory/5296-362-0x000001E5C1200000-0x000001E5C1383000-memory.dmp

Download

memory/5296-438-0x000001E5C1200000-0x000001E5C1383000-memory.dmp

Download

memory/6052-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6052-160-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6052-158-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6052-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download