Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
- Size 1.8MB
- Sample261002-j8tk9adf92
- SHA256 a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c
- MD5 888196ca73a1bd8b1f019d6d8bf8443f
- SHA1 82ddeceec36f07625890793a704d86e044dd4643
- SHA512 d2df3f86fd2d461a7620ab48f8e6e4a8cc0a67e5af42f44ad6113ec28c042b074ad09b1d1e4166718228c796e49e9254b7cb8b398344741cc4a4a1fa9c1d31b5
- SSDEEP 24576:1el3++0DvfeUYqcZQCGm4YagXe4i7ojhsP5Lgrk1TWb4AN5:E3ovfe41Yde30jaNf1TWbdz
- TLSH T19485E111F840E432D19201B0E6A5CBF3592CADA1EB1558C7F3D0BDB67A349E1A73DB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4852 elevation_service.exe 4168 elevation_service.exe 5800 maintenanceservice.exe 3504 OSE.EXE 264 PerceptionSimulationService.exe 1384 perfhost.exe 5744 ReFsDedupSvc.exe 5560 SensorDataService.exe 3444 ssh-agent.exe 4196 AgentService.exe 1068 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process \??\F:\ elevation_service.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\locator.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\TieringEngineService.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\SysWow64\perfhost.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\SensorDataService.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\snmptrap.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\dllhost.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\SearchIndexer.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\da9a8727b68fd3f0.bin elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\system32\wbengine.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068eece034752dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066bc7f3f4752dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb253d044752dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cea752044752dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000824be2044752dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000761cb4064752dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4852 elevation_service.exe 4168 elevation_service.exe 4168 elevation_service.exe 4168 elevation_service.exe 4168 elevation_service.exe 4168 elevation_service.exe 4168 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4504 a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe Token: SeAssignPrimaryTokenPrivilege 4196 AgentService.exe Token: SeBackupPrivilege 5744 ReFsDedupSvc.exe Token: SeRestorePrivilege 5744 ReFsDedupSvc.exe Token: SeBackupPrivilege 5744 ReFsDedupSvc.exe Token: SeRestorePrivilege 5744 ReFsDedupSvc.exe Token: SeBackupPrivilege 5744 ReFsDedupSvc.exe Token: SeRestorePrivilege 5744 ReFsDedupSvc.exe Token: SeBackupPrivilege 5744 ReFsDedupSvc.exe Token: SeRestorePrivilege 5744 ReFsDedupSvc.exe Token: SeBackupPrivilege 5744 ReFsDedupSvc.exe Token: SeRestorePrivilege 5744 ReFsDedupSvc.exe Token: 33 1068 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1068 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1068 SearchIndexer.exe Token: SeDebugPrivilege 4852 elevation_service.exe Token: SeDebugPrivilege 4168 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1068 wrote to memory of 5500 1068 SearchIndexer.exe 100 PID 1068 wrote to memory of 5816 1068 SearchIndexer.exe 101 PID 1068 wrote to memory of 4300 1068 SearchIndexer.exe 102 PID 1068 wrote to memory of 3796 1068 SearchIndexer.exe 103 PID 1068 wrote to memory of 2532 1068 SearchIndexer.exe 105 PID 1068 wrote to memory of 2168 1068 SearchIndexer.exe 106 PID 1068 wrote to memory of 2360 1068 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe"C:\Users\Admin\AppData\Local\Temp\a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5800
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3504
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:264
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5744
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5560
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3444
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5500
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5816
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4300
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3796
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2532
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2168
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2360
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d32b962dea5b89467a56c63a50eb2122a27408d8dd913c8aacf3f040efea9861
- MD5 e5d28f6d1b62d4025a2ce1e455f711b0
- SHA1 1e80dffcbcce0cf8ed941471db1ca3a45a1c35c9
- SHA512 b1de15b8bfd243a94997f40bfa94471470d2d6815395b69d3c397a474d53fa6417989e689795b5e8713ec079fd803537686d99e1b51bd5bcaf7b1ad0fc39a83e
- SSDEEP 49152:0b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnTe30jaNf1TWbdz:u3q60jBGU023W
- TLSH T1B3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 efae34d8eaff159445397d85ee9be1393c047df7db92a01c5d991574fb27f4c6
- MD5 f2dc5cc997c38308e106354dd69598f2
- SHA1 9eb5d7d538095ee0d3afafc7afcf4213e63a0e06
- SHA512 9daaf5e2c00b75493af7cfcd42630104dc2e923e51acf949387af20ef9f14b7ad610a270bd84930ffa6768e17a35b985366480e14d140df05533f42dc3c81d62
- SSDEEP 24576:EXYfDtczATgXe4i7ojhsP5Lgrk1TWb4AN5:jtcte30jaNf1TWbdz
- TLSH T13385F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 552564ed0934f3546c19ca07684910655bcc6c27220d7352668d6c64cce2a28a
- MD5 dc19895435e3575bacfdde99f56a3be9
- SHA1 52e463f87705efe81b3161097f6f830ce7a0b32d
- SHA512 cf60ea69372846ddfbd3e84cdab58c0f91392f8f45cf134c11ed5c59441b885b026057c1b7535852a2fc5597e54b4f8266ef1ce83372fc374031abf4ccfa531d
- SSDEEP 24576:50Le5ji0hmxnrMUgXe4i7ojhsP5Lgrk1TWb4AN5:5Pji0Ax4e30jaNf1TWbdz
- TLSH T10595AE26F6748775D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 0f01bfc5748fb8225a468bb3d815d244494c58a597f48a9b86432193038ee23c
- MD5 1367f4b53c0a095af19f3497e5f39ae5
- SHA1 6e1e409105fcf3607940a0fd8fe5760e2b0e7780
- SHA512 48874b5d0cfa524ccd996a6986b83542376ba1bb189b7936ef000216c8373b20802f7d68a47f03dee68f7043f65dc5a95c4ac8314c7f6911552e0e46f46828d3
- SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWr6q8wyuagXe4i7ojhsP5Lgrk1TWb4AN5:O/ezSC6vUzPviHjyMe30jaNf1TWbdz
- TLSH T1F0756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 5625c8afe2216ed86aa5b7bc3af55113c13c83a585599f5fd3c2591055693d28
- MD5 37cbc57efe23d3cc53d3fcb6d20c06e0
- SHA1 2eded175e0c55f71751c75e310a0963632e969a9
- SHA512 5e8f68101ce983deb4660215f5c1c23b0827f10a9a6dea7803e5f33dd2ae00452f0cca6225188f2f195fcdf3efaac90913a2d4e1e6813fd75d41b511404b4c23
- SSDEEP 24576:cVbqPb88hv/l+bfgXe4i7ojhsP5Lgrk1TWb4AN5:cVO88hXl+ie30jaNf1TWbdz
- TLSH T161559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB0246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 e22a23c03f02e537cac931e7b4e3f7d443ff0d196348601fd3d5f44c909c43d7
- MD5 a047f840b0414612703ba8c4a9068cb1
- SHA1 f5d64e5f8d7eb6af1b4bc77f2ac58ed9a4669848
- SHA512 d529d1ef7a448b6005dd61aaaf818d8197fb21e3443e5046889244e676e6bec6997d7b7854c624ef483bec804d9bcac7f61c71a329b3925543a88e901742db2d
- SSDEEP 12288:4xz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4xwgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1896523A29F5449C6F38BC3F4A0F7CB91E5E11EC071444E6B47E0BE9318BC899DAD8469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 9e0e5961834fbb79697375983498fbbff8b3fbb42f07dba082956274b68aeba2
- MD5 56d9430299cf1407bb81378fc6473569
- SHA1 178fb42d4af7d8e5b27091f436d23aab43de7135
- SHA512 f760ae0153169b645cecacc759b115a9cca68125bddc0198b9f19589d2ab8cb5802f978474075be3fc260e0ae03fcfbe3bf82ecb3129ceb934264071bf1d62aa
- SSDEEP 12288:ReBNUbTVO86Ue0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RJIUXgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1EE85CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 b6879867ced8f499b13f518c4e89523b23fd468262321e38fd95b90183ed6961
- MD5 3860b4416f163007ce6f1fd2f39331d4
- SHA1 c5b4c65e21f950e9ab25968abe318f002acbe8b6
- SHA512 2daa6abb2fcea1531e67173766c2f3d0dc5de176c5670f6ab11b2f54b8fec6292ef660bb36e4307dbeeca66a39dff227c642aaed2a48cb2188cf72c29030dd39
- SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THy:6QvGAdlCEL8c/RRNw5CNU023W
- TLSH T1DB267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 3ea686b5b481866eb906141f3dd28ef3545ea9026528ae36cda2a05526fe53ed
- MD5 56708a12a320c4ea83b3037dcf5848dc
- SHA1 44cbe30f605cee8760d486acb3e1e25e86689012
- SHA512 142d5f06fba4f1ee9e8d4f73fca7f794d25e0b0c5d6d9ef9bcb96c37b560e791c4fafa93434cf7a41887987ae999512f9d67e8f0a5f27a431ca275a902c54eff
- SSDEEP 24576:/oewsAjtgXe4i7ojhsP5Lgrk1TWb4AN5:gljoe30jaNf1TWbdz
- TLSH T16C85E031FE74E032C3BB0DB21B76C716587C6A604B511AC3E3E89E9E59342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f71fe651c536115debf77bb25c834584ab5341a5c32ca6129f2ad402661eaa1f
- MD5 7a46bd43f3c1ca5fa02bfc5d5e23cee9
- SHA1 83c61e7afd7445e0d14d2d6a03af14ea6f7d29cb
- SHA512 142baa4886ad54fedf37cd84c8a901aed9a659abc044bc382dbe869cbd8a4b89b5e6cbdef6b429d24d13466056ea3ff20ac56c28162c0ef99c78fb07c75e3b54
- SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHgp4W:UUEtQevvqc2W1cpV2RI32A4W
- TLSH T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 cc98404acf89ea9c1adb0e7fb1cf6b3312e44e944426c5c05fe6e8e8b937fdfa
- MD5 6e433f4ea2019ba5cb861cc9d1f592c2
- SHA1 620fa67c095cfecbde9581701fa83b718d250327
- SHA512 17ce9b91a1526ed03422c1e737cfcee5b0bd9a22b1560f24e15ec09dc285c41b69a568cadf4c2c942c398431f304081830fe0e738e180d67e6ea83d14c7e9196
- SSDEEP 49152:PCbRquA/m2yL5zQfFiV+XenmE3/zIe30jaNf1TWbdz:IoqtVjnmhU023W
- TLSH T1DDD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 84ce17128172ea9c2e83a388cf040ff6881332d1359904de22c70b323f312491
- MD5 c458fce64efcf621a5e90bc6e3315fdd
- SHA1 aa2b0cd7145636224c8d9426596097d0868f5909
- SHA512 3894f55f4af750291c7d76795b456df316af1f7b27984e0b84c9e7e7206b63054db8715f4362b57bc0db9f8f182a71d9e36b3841b97262dc209b9648da720de5
- SSDEEP 24576:SAhGL2IFoiwtA5l7S53OgXe4i7ojhsP5Lgrk1TWb4AN5:SAM1Foiq5Re30jaNf1TWbdz
- TLSH T1E9359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 3fc4184466b63fdda9e6f2991171968b0a3f085d06b28d520d14244c46fc4883
- MD5 b9a94cbb98d17b5bbca58cc739564aa5
- SHA1 e6842dba99433ff5643001465ba61f6ed7db6e9f
- SHA512 fba19ff00d0212e1d8569ba048a1f5a7c0b1d8156f33f4a90b0b35ee86eab91f8ba7ca013cfb82a0b34a89187e96dd5cdddd11acb741804f6e97f3250088df2a
- SSDEEP 12288:Fmw5HEjsChNUBFgl0WDm+Ct0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:gwulOWRgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T14885F14676A40CF9E5A78278C597C636F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 bd7cdcfc4e96d1f5be109332f4048c236b5ec4b08f0ea05f5951372f86f12dfa
- MD5 ceca4e2712c78fb1256ae7713e41c2d0
- SHA1 92c634404d6b4061048f47d80a15e922312872ea
- SHA512 8878e20e88cd52c9e6a4d16f54d960243322096a1a9dc5cd8a9d6f261ddcbf74da9e792ec6adb9c566d2b305fc8d3de28c8afd67108fb308ca7ca6bbc5e5fedd
- SSDEEP 12288:WJZ1Iy80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YZuMgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T18E75129637E420F9E2978278D4F28741E7B23C82237547CF02A096A61F76DD65E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 60b2ef6bc6632ba7518c956f6a75f5822bd0fd2de4010415252f02eda8743499
- MD5 64cf78545f0de83a61ade79c6ad9ca7a
- SHA1 886114facddc3284199b201d7e99b42c20cfad15
- SHA512 68d668070587335f73f7d57ef3661f94aef5de5da3a37e202a2b0c47b2981dc5b93af69742fb9b3a72700c5e232a7a236a7c6a960dba8e48004a329e03a3a2f5
- SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U+:HQRQyi36YOcPhLvw2gAf+PN3SU023W
- TLSH T11B667C03F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 d6e0fd7212a6e392c3c8b396f729b243599499fda8f33589255568ab3e39d9f4
- MD5 b05d0009bfa6e9779230e558dc61d4b1
- SHA1 52a2230d851e5000f58a4e80c4e71d13756726c2
- SHA512 6ec0951fdaec72dc9a2d08f99eef2546c4f6852bd71c5854c9ebe73b5e02c073f56ae19b0f00bdb3a600cea02cf25b27a829bcc89b60d756e67f10a3de1f0672
- SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U+:lQRQyi36YOcPhLvw2gAf+PN3SU023W
- TLSH T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 7bbad5a219f73663dd75ac4951eedc8da80a30cfe52eb630f7f74ceab0ba0466
- MD5 3307a6624cd040e0f4dccd986ba156c4
- SHA1 cbb0f4ff5b60988365abfda56b29bad194c2572d
- SHA512 e5b35ef82194a2f7695132757352e0a0d6547c4dbc540a702feb873b1880b3a8ad333aa9df9f8f11d6410315958cadc199339d185e7d604587ff368ebe3cc0d1
- SSDEEP 49152:268Qg55nhceWu7PNU3/4e30jaNf1TWbdz:UthLRc/4U023W
- TLSH T138B54933B2F60099C04DE1769F4A873196E27C758FE0E7DB855172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 76909a35da3187cbf01f85a2c3161a308d8edc5f99a772fd423d47b860151938
- MD5 c73f87ab7d52d35a82236ec6bbeb9e19
- SHA1 d9c73b0817340d1366b9d1d0c52f2b69e747846b
- SHA512 6fd529c53b395e5d8c1b4e29196160997cb8f9e2209ef1286e0ed709d7de833e37cbf68c60a0de8256fe5af2fd988c2170676d1e60d02e2ccd348b5c867f2410
- SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99E:wy5112gYy5azzVva69nLKnhZXU023W
- TLSH T184168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fb518d5bf72c18e6c7fa95a4eb44f31c90b345499caa868ff46bbd928b6efe68
- MD5 329b8540ae79a440748800988cd9d4c2
- SHA1 1d6502fdccf1c8137fc21fbdbe0bf410e587cb6c
- SHA512 87c64d2d1297482cfa7ea3f469204a3dbfa0e68b817930ae1b255971f407a64c366fb31b99615d97a0876102ea2b699dc5dd6f0b59d9a12a2e71388a3a511476
- SSDEEP 49152:pB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl6e30jaNf1TWbdz:/u6JmUxd2d6U023W
- TLSH T182D59D13F1DA01E8D05ED178974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 0990e1eb287a5a753674d5245d49622d0d9d033e7a57ac25e07d0ffcca5bbc47
- MD5 3aa85284deae84999e71952a5283224f
- SHA1 6900ab6f68a9c9ab5903696cff3af73cdc3c1bee
- SHA512 46d25941e7de9c057f4dcd609428ea4ab38d5c6db4c05450ce45ba61cd1b45e9d6be493389a8b0b6ea8f6da9fef32bd4702aacd3d5996a9a9b69a51e7543a618
- SSDEEP 49152:/1hpsNoJpF1A6BU44CwH7R4x+e30jaNf1TWbdz:/mifPkRhU023W
- TLSH T1F1B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f474147b529f3ae8a055c30f36bf9157cff09e049d60c527f1970dc9c1fbbc12
- MD5 3236e4b21726fa2b8452347b772fdb00
- SHA1 1b86d5b6f6e71ad28a6bed4815d5eab0757adb10
- SHA512 28bb4a88813761111da01615b0b617d42db4d18ab2402301742bfbc96a3933f297050f200b4993cc43b616b10f12ac889908d1319362b5b655d22bb9499ddcb8
- SSDEEP 49152:ySuZQIY0Be2KNRVtOnks6NMHqDe30jaNf1TWbdz:s5dKvi61DU023W
- TLSH T113C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 7bd6d9e13f845e756f3be3fa371c508c4d705ec06fa2ecf938672635ee12bb22
- MD5 1779b481cde13a4d6262f8190e5a15fe
- SHA1 d5090b76d828810e38ac5d7765698cd426c656f7
- SHA512 6c432f1bd046de276fab657976dd426e0d82dcdd91b7fe7d3540df6e2c1fbc381ea5ba605e7fd42470a6a0be634831ef6d47d35ff02b6735d4477f640105c420
- SSDEEP 49152:uhtSn8EApI0figXgiDn0AP5wqe30jaNf1TWbdz:vX2iyphFU023W
- TLSH T12795BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 189a24437b48b069902b8205474643e6f99db6a5f795d522fa1644bef0052233
- MD5 105d1b476e6affcdb2e238331e1cf7dd
- SHA1 f4104389f059dc37a9cce8ea194d34bf629a9050
- SHA512 ac2b33c49e811c78ed15e9c9efd02dfaad87de9722172cfa06369f81b2058e62605858b7a907d28d39c74572b74bfe5330a86dc217bb71569955372ec2f40d28
- SSDEEP 12288:kL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kogXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1FC652392AE5549C6E34BC3F0D0F7C7C1E9E11EC272444E6B57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 10b358e871991dc972d5336e64f37cb2ea3452dd0b67810a19c2c1b3e504bb8c
- MD5 be46f9efa2103662c5e46f0f5b120f2a
- SHA1 cee87f784d91320f8594027c012c9d45ccce9272
- SHA512 07e48357bd5d4aa9ec46444f46d05e1e4edc4195bbf33bb2153758315d9f6959cc96aa009c3f390841f3edc27f79d71dce68fc10dbb5a75398e481b35969fa19
- SSDEEP 12288:240DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:25gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1856523A2AE5549C6E34BC3F0D0E7C7C1E5A11FC272454E6B17E0F95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 23ad59cf9e4962abbe99c4111f234d460094f919eaccc2366e162dbc89074691
- MD5 38d4821da47b216c2f971b99ec872868
- SHA1 18ae68116bbe24d256d16dcb9cd03344a3763c0d
- SHA512 442da56fe18e9602116bf8626c470dcf2a6c1c2533d35e462861d5addfd8072e8f0a8f4d52a84338061cc7e3505400b765748294578be3ca234a2d7527522952
- SSDEEP 12288:GW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GPgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T17E6523A2AE5549C6E34BC3F0D0F7C7C1E9E11EC272444D6B57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 c179abf8150cbd16879440c29591cd937ff3811a8d3deeac41c357438647a492
- MD5 4824aef09099a8146fe79f5b38c8f39f
- SHA1 a9ce816545881490c2925126c0c55597d6cfc6d0
- SHA512 ba800ad3d5b947868cac1722ecb1ce64b898b62d0e076db206951a791a3e692d6ff9808da44bd9e87af97ad4f63c457cae5918dd305a39b452e3510da012a1d9
- SSDEEP 12288:zVB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1A06523926F5505C6E28BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD9AEA8A68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 806e435b3d1a28618da4262b767608d13b430e86ca580d987755302c33c15e15
- MD5 c3cb836c792afd436ca83c1c714cd3f4
- SHA1 c56d532c2d19fe0adc0743a7c38c8c93c9cd710d
- SHA512 a63f1c661d3402815f87ea9b313adc2c8492cf023576642b5fc7e862edf6aaff6721c6d58a00bc8769c1ab244a36902252e1e89f307851f702721ca2ab5d8f33
- SSDEEP 12288:gJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gWgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1AC652392AE5549C6E34BC3F0D0E787D1E9E11FC272404D6B57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 021c3bd169fa04f192b820fe1ab26b0e75b067fe38db8603d95a3e27000c95db
- MD5 3d63f0a281a93d1114718292f61d5219
- SHA1 d73842c586ac56ed8c9de0c948aed25142ab7cce
- SHA512 44c3311cc9c435591b97998f53b2c057130e4404fcf4e32b7ba45d0d1f2616c6290c8a97d7c116ae7158c52545d399c31d78aceabe1eb7564c3c7629f08e4340
- SSDEEP 12288:+E0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+FgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T15D6523A2AE5549C6E34BC3F0D0F7C7D1E5A11FC272444E6B17E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 da17c71f41c5b58625901dac43cb1801871d3ed7ceb1b73fb075936c70013b4b
- MD5 3df6720cc49cf0d03284b5dcbec3c5a0
- SHA1 611e9e9510a2f1b1711aa2478fea0ed9e25be3ab
- SHA512 d97f98ef1e8feab06f0f1b1900c5653ffbf0f01f195eda213bb2da6f7b132f49e7dd888ba682f1e7b1be6289434fc4325d59e9a0776203495e083b9bfc62a656
- SSDEEP 12288:kA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kBgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1066523A2AE5509C6E34BC3F0D0E7C7D0E5E11FC272444E6B57E0F95319BCCA96A884AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 6501c37d1de058bd7adf99c6ae01f01e70b05b525728703a6713072ef7fa16f6
- MD5 93ffa3a8cc040df7c92a59440f6689f2
- SHA1 c8625b2d23097122d71f3fedb306a9577fc26bbe
- SHA512 68cc09748b94453b23fb75409e09cf4ad14592e2c8a0b5e900b5989efacf5152d58a8fd18e7235e90a8debfbbf3a07c2fe523aaf856ca3ab05b7412453703566
- SSDEEP 24576:KZMGzFVSOZgXe4i7ojhsP5Lgrk1TWb4AN5:KZMGzfAe30jaNf1TWbdz
- TLSH T154850195B3900CF8ED67827EC8A58A06D6B27C561760CA1F03F436671F733A11D2DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 eef82e4a3442c47d02be56d4ca6f3d22a2bf87b898c6265f024495b5df6f3d45
- MD5 6836353c8a423c381df6c1fced9a3a3c
- SHA1 dde5b9a5c15aedc8b2fad6816a00a5fab4342a54
- SHA512 c50d9bad45d58134c7fd0ed8fae80ffd227dc15222277090e7fc5e5bbdfe55cff29bbdb6c7f20c13064a2ff3adf576e8d98d866afa8f713f67f97a43cdebe894
- SSDEEP 12288:+P0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+cgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1E5652392AE5549C6E34BC3F4D0E7C7C1E9E11FC672404E6B47E0B95319BCC9A6A884AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 db9f4b5acbae9a46d9b65e4c4b84f4bc7bd8aeeca80d12c90999009698b91334
- MD5 8c1c3f0ad5c59ef889a09bc0320a776a
- SHA1 f677b86886742b92fde20770a84f8e9f3330eb88
- SHA512 a08f38a7f7b4e227f7cdc8a135369a7e7b9d1416893328a8ea334ee1b310a5d09f99eb4ce723c45689b4892d07c78458b16324aaf84fe30e019b5e1558858871
- SSDEEP 12288:Lj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LAgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1976523A2AE5549C6E34BC3F0D0E7C7C1E9E11FC272404E6B57E0B95319BCC9A6AC846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 42ce92d52bca883f0d1249754363872f4b2a4776606cae796149cc69c1e8cce1
- MD5 04594e6122f6fc57e4e66e09706b28de
- SHA1 7344c03691bab7c7a5b21be5d9277901d0684d6e
- SHA512 21982d67643a09cf556a3f64f0b9d12ba654bfc8b13784bda072c987b8a150fc052e1093768fe39645badf67552ec2bf451ca1f2f21d5909ff92285039c6bc1d
- SSDEEP 12288:jyPz5L880DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Ozy9gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T13475025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E376E19E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 68b143a0533e1ccddb94507e2beb0ebd393d6a1819fb46e7d2f5ad6fd5842c21
- MD5 d0b6f48cce2552d04e1a4cbbd9df4f3c
- SHA1 381f24707e06b925cfe57c44316aa14b9c501d93
- SHA512 a6186ce8fe9e99f5fc3e565a16d1f6684b96dcafe158e99dd47da66247c56a760a5742c9ac322e8a865f26a0cda908a4fe2ef15ecf87cf6e3a1c46fe6076f42d
- SSDEEP 12288:OP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OcgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1C1652392AE5549C6E34BC3F4D0F7C7C1E9E11FC272404E6B57E0B95319BCC9A6A884AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 a8b0a18643fa149475fd52a16d4540a17a3f5d0e9bba67bd16da71e04b61405a
- MD5 cf12c7eb0002c5935e403b3b4fa2a4f5
- SHA1 0663ffe1d912a3a3670ab752770faecb33e7c0a6
- SHA512 5170df6c9e36dfbae7be64a403e31f96d68dc510f4ab66156a64b6b018e7af14b60e87b19ff7545e3e2db4c48db79eab647c7ccf9f514e637e5a7314a81795d1
- SSDEEP 12288:LP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LcgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1A0652392AE5509C6E34BC3F4D0E7C7C1E9E11FC672404E6B57E0B95319BCC9A6A884AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 6eb28732081caaaf58c430c4fd3db46f68388511a1a860f801afd709b8c3d877
- MD5 1bb3c972f6169663783e627e1517dbf0
- SHA1 0e44d1cd08883699b637113b3a449bb117735251
- SHA512 8eef7c417b912c93236f3c918c1bd7e1d7435af7d93ae2a35c3bb0aa99108ff99a91342d6b2bc1ca89f30c9d4c4b07354f0d9f79285244f8ecc53f768a9135b6
- SSDEEP 12288:eyPz5L880DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Dzy9gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T19E75025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E376E19E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 0b73b7ec92a31f5756bdd1d5f2ddfbe09f7c3a8bdd2b032460ad97c398fff95e
- MD5 4432cc51c618521c212790cd0989e0a3
- SHA1 af222be9e4e278feea325b419be39d6d46e021dd
- SHA512 19f6c9419b779f02a8b25ea82a68e929243c2fc23209e45d2e295806410da8349eee9de60dde043926da36790c4b9b90fe2460e99072ff0509d12738231d9253
- SSDEEP 24576:pT3aLl3z0zD/gXe4i7ojhsP5Lgrk1TWb4AN5:pTKLljde30jaNf1TWbdz
- TLSH T1378502A5B3500CF8ED67827EC8A68A06D6F27C560760CA1F03E436675F733A11D2DB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 416c234dc2b7434ba6d7dee53b78c92d4665fd57c5e51a3e82701eb4a89f2a04
- MD5 1bc3d8034fd7b970152ed1c38337e1fb
- SHA1 4302599adb4adf30a3aea465c6a859aec710696f
- SHA512 1692853264999c7afb5ed9920b73518010958b779f5a5e09f0a22499729ab19374d7385945a02ef1de74c587c39cda41e23479663434db21353857c56c7f725f
- SSDEEP 24576:A37d9CHKy7GZrgXe4i7ojhsP5Lgrk1TWb4AN5:K7d9CHKyaAe30jaNf1TWbdz
- TLSH T13595CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 53d9f6bc6007b33a583bed68267925ae88c4367e7b5c0544b02cf86eb868faf7
- MD5 921db5497a820e0bad504c7017c25cc9
- SHA1 5b9d153092782340fc3ad807f3348dbd347894f7
- SHA512 60789369fdb21b2d974a50804108bbd230a2e57ead46442396200f43dbeb0fbf03c7eba8a9c534d8b81cdc9e1e7c96d1f0a3b1e0794e56dc3e0f6801a39b4731
- SSDEEP 12288:c20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cvgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T11F6523A2AE5549C6E34BC3F0D0E7C7D1E9E11EC272404D6F57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 4fbe818241695f525201fc7dcaf2be2e18f6fb53f4fec5eb58924e049fd6ab1e
- MD5 e05bbd236488b1f640c2350c3ef2f4bb
- SHA1 451237407fbf7b7cbd6ffd539cb73c56dc04855f
- SHA512 e8babcc91d84f5757ed74f1dfcf491fc681906deade2b05ba6e364f0d98a35e37a8ddfd078130ede9362da1dc41de8030e9214e25b3386f56d869d06b6b9e5b7
- SSDEEP 12288:8c0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8dgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T12E6523A1AE5549C6E34BC3F0E0F7C7C1E9E11FC272404E6B57E0B95319BCC9A6A8846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 1d2ffc8a2aca6375cf1e20788d5b3dddfa54df7375066e86ad163074cc06227e
- MD5 e4882a6c80e5d13a64005f63ffa6c783
- SHA1 a3c141aea2a201b2526684ad5ae0025a65c2a391
- SHA512 85382d5b70cb72e59d07af52646ac9060b32f23d2db8caf581d8f86ddf8a624a2d030d81607954aa6746f98a57d1991c6b6d7818989ea6cbc1f4f8dc28dada4e
- SSDEEP 12288:WV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WigXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T156652392AE5509C6E34BC3F4D0E7C7D1E9E11FC272404E6B57E0B9531DBCC9A6A884AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 4d304c7040c7e06e3c2f7a46c7698b7e6726fe83b6deccc42293883ed68a9a50
- MD5 1372e5785a61962e055770b12e6d07f2
- SHA1 3c9159ecb7f917af9af1ba09d572c7d6b07f50a4
- SHA512 b9337a8470dc0e3a258835543feefc3a441006ea11f8a04442754ea711b67c1e5e35b6a1160e5d1680e1c014cc672006fef135024ed9faef105ccdac049069cd
- SSDEEP 12288:TP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TcgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1F26523A2AE5549C6E34BC3F4D0E7C7C1E9E11FC272404E6B57E0B9531DBCC9A5A884AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 2337ca212d0b0f8068ac08bf4af65f590c55541d2df1b27801b767c83c9e3cea
- MD5 0de21e81f16c667f8635c6ad2269b80b
- SHA1 9f5927c7b86af3e18e95c814b7d5633e3ca1eac7
- SHA512 877dc3ab23da2a670a1a0adca18e910d8f1825693dbdbd4515c03ff5a9f07e891712c89527947e38fbf495be4c46c25930e7db6b17ee22d0794e92cdb7f397e2
- SSDEEP 12288:X20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XvgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T17A6523A2AE5549C6E34BC3F0D0E7C7D1E9E11FC272404D6B57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 b09c15d76159f6982695d4bdd1eb7caffd670625f4807de22e77f6787df94cd2
- MD5 b7469e4f1c83dab3a7bb0efdff8701f0
- SHA1 5ea9c435ac09a9aa6a50d3cca4be89b0ecc3b456
- SHA512 5c09c8d90133f857f4e4b07946c1fc76f3b9e31fe7928b78ee03e95b78ed450fc6de193ef797c1c3e5ce311e498a14ced400e4f9f68f26db257b4fb6a38deaa9
- SSDEEP 12288:aX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aEgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1146523A2AE5509C6E34BC3F0D0E7C7D1E9E01FC271454E6F57E0BA5319BCC9A5A8846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 4fa57d34fbf9be8102e024f6b87fd91e5cc0d6c4d8dcc541c9d306ff8051731f
- MD5 f3e2476bc1f54770415d74062ca1437b
- SHA1 2275806b957290bdd01540e10b75d37ecb52c263
- SHA512 ce524fe2195291f8cbde2a65b3f921ecbaf4dee913f6a680b387ae05a0ca5ce9166b15e319bed50e948ef9fc8bc3d0f3e6f299ca84c2d0c6945d8926ea1da377
- SSDEEP 12288:6J0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6WgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T100652392AE5549C6E34BC3F0D0E7C7D1E9E11FC272404E6B57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 a2616ce4d8e3c140bf08de0fec69112ed9dfe7f1c47366da761beba3a6b0dfaa
- MD5 86acb8dfb424229198e06f795c78f0e3
- SHA1 1cfd62c79c37edb63a7b5b38427a06a49b3359a4
- SHA512 926e66fcd13be5418b03f50cddc3012cacae9aea7f8011370fe060b22c5b04155fa87f0e61a639dc3644825a1ce8c93fe80b1de42fe2f9de7c928572825b08ad
- SSDEEP 12288:mO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mngXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1B56523A2AE5509C6E34BC3F0D0E7C7D1E9E01FC272454E6B57E0B95319BCC9A6AC846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.4MB
- SHA256 d9c229b276741506187eab7cd80145a11cb3fcf98f7faf703805b7e041a2d60c
- MD5 cd0e7e3e39781674c1074957c41d1889
- SHA1 3aa42869d4713079946a20f6d6d199bccf5b4f0b
- SHA512 fd10b08879281fe753a770747873c16633869f5b7e6820e47d6ea20c03f1ea47158551245dadbfe762431ab05190b86485313919ee4b27cbde18b07e830d97c4
- SSDEEP 12288:bJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bWgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1016523A2AE5549C6E34BC3F0D0E787D1E9E11FC272404D6B57E0B95319BCC9A6AC84AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 6ebd4625ac9ada00bd5eac07764bcbee5312da91110edfc587ddaebf826edc80
- MD5 81b86f35bb306cc2f3ec4799d5ed5b9a
- SHA1 b5ff03ff92dad874874773c59e02ee55ce72c8ad
- SHA512 19f1198fee340c0dc2844b28d4997f0629cbff58fad13634adef4f97ee8f08fe94b2a357a358aa174aa95fb23ac17ddf7b629ca7ffb7e26aa4fea739c8f435a1
- SSDEEP 24576:tfwvyk9RX6wkyAIQgXe4i7ojhsP5Lgrk1TWb4AN5:RMnYI3e30jaNf1TWbdz
- TLSH T1A195D029EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 12874f045b142ffc6d18fd19589933295d72b965ba4cad74af0f57ef2d1b1a88
- MD5 9e04de1435f8f013eb9b39661e22ba12
- SHA1 9a2512aa25387defd1416ffc26d18b04503948d9
- SHA512 d162f529a3b11b1a327081bfd55ec8e2a8ec342576c7410ba9920cb456055d51a33d9874c8a560a412db086b21317aba77a3b234b6cfc2adaa9182c694d00d80
- SSDEEP 49152:lYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ke30jaNf1TWbp:zySzPyU023W
- TLSH T143067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 bb454a8b4d21fe26e9ac1d6882e219fbf79ae186cc9aea30be4d27b8f0ef79d1
- MD5 aa560891bef27d9fc3ff903712ea1d00
- SHA1 ec8e164512755b272b9202a0001086b502e4024f
- SHA512 4343cd1d52a8738076c03bd38550bddb1adb73c78672b5f633348bcab12637c14ac935761d9ef53b9dbe1e648f754d35dc19024e13fd5b11497da38afaba23b6
- SSDEEP 24576:247Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYpgXe4i7ojhsP5Lgrk1TWb4AN5:247JUQj4irIhCnDHUPfF/6e30jaNf1Te
- TLSH T1CD65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 c590da4440138598ad2434c088117455e834a4d9058a8b7f8332aad23272530d
- MD5 239028e76b9d02eedc80e66d1b14f3e0
- SHA1 3b5bce94f3beefce07f1f807787589a0ea8004e1
- SHA512 1e8cb7f177ff68bcac06c7fdc44206451502efdcc2a3acde5879e8dbdbfe6467f4a6deb76ded11692f875833340a6f103501628641a179abe472913ad95bd4d9
- SSDEEP 12288:/Asff0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/MgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T18675F15AD29802D8C15E92B5C3968A41F3733C9193E1C7CB13D0F93E1F79A949EE9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 a14f8470be51301822ec24159a7790bbd8cf58c109b7673558b5cd87bb6db12f
- MD5 455a2dbfaeeebafe6795f80beb9f3f8e
- SHA1 28e3211eefe4e54745ca8ca172955ac1f22bd35e
- SHA512 4a52c52e3695515921c47720641e7726aba9bba982026c8d066a984b56a41a2bb04a3b891d58d34def23f7e703a3d7c47f024b2add35c3e758d25f81b6b3abe1
- SSDEEP 12288:icqexcWA95o3f4ZXwwAqoz4oioFl21t1NU:icn14RwwAdzjiozAt12
- TLSH T1083506007666CB8FC6A940321E33D5CCAB707D11EE45AF0773C9873F9576658BAE6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 96d71a38a536d1a9c7bf5fbd7b1e6e64ffa3e775369adcc68d56fc58dc285021
- MD5 22da73d5ae15679b4aa5d58506958853
- SHA1 bec344be9e8cd9e5df55b254a526faaad4491c7f
- SHA512 37ae488a816a024eef346641e941f5cd3e767c195f3fd460c9e6b640d1bd14deafba4402f31d5d6c0e7b9d3062ecf43dcbebcc1a64c6bfd8c30bac2b91380757
- SSDEEP 12288:czuTwU0UtDimNItoDVvBlKzn8ZMRSG0fPDZhtwTtESN5rpF:5TwoO5+GrpF
- TLSH T16665F8815437A38FC1BA6032072A5B8C7B74EC167B096F26B7C9453AD82AB5570F93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\VentoyPlugson.log
- Size 357B
- SHA256 a1978dad3d92b376e41f94af8661d7e6610cb1be9c9c4fd3c6d8125a641a3f0f
- MD5 e387195301ec165fb8372bf93eb261c5
- SHA1 45b13c554e5ba1ccc1ca015fb9227579ad989f2b
- SHA512 e9ca0f59b61e84453f60e2883e4db55805aac542a57d5ca29a8fc69352a355919b3efe7dfa64977069f05457bcaf5a343c8e62197f2e397fd8d83babaa344dde
- TLSH T12BE0CDA058DCB7FB4519411A07837D88D771949F5F862B58B785830F7A48F0CDBA21D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 85c9a427f39a52219f0493e8ab687a57a40bac1da8414a10bfc79602f9cac407
- MD5 faa2930064aa1c05cddc0e230e6117b4
- SHA1 95e72f8666f8e4014aa1e9d8bc68d9de283f7ffd
- SHA512 5869b7241cac25aae0677132f37167d93ad1870be14cdc3d08135d7bb26acea6771bfbdf228b194e6d05d864eabaa4d3379356cc0b2cd8762445ac6660966de4
- SSDEEP 12288:5+7n0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:80gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1786523629F584DC6F29BC3F090FBC760F5652EC0270089EB56D0BA9319B8CD99EB451D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 457e13dd8d98f1d3e8fffa99f58f210663555dad43ed8c0181c744e22fc0c19e
- MD5 77a03ece1e360e5113dfbf05ec37b803
- SHA1 116f27ae7fc7823d01036706d59f3405e08ed3ae
- SHA512 94f2ee85cb1927835ee3c89003aaf19745eaacbe9ee551b31175881fc3c7100281b9fbbc48aed0cc2fad5a2be9504d90c6f6650de00c50473e231aa499c22b49
- SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYagXe4i7ojhsP5Lgrk1TWb4AN5:Kgb4mBIBhGFUe30jaNf1TWbdz
- TLSH T1A665AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 cbaf15ae493d6da4aacc1309697b132d90fb7034ceb27ed534a77e988689e7c9
- MD5 b0cc16ddc38db2ed5a190206e44d1b2d
- SHA1 2965b4efeb7a0ce38486a839e49b41d01e7ad5e0
- SHA512 bdb1df9f61f60821992d6aebe830020643dd582b73a654cbbb587a6cdeb61d8c785ece70ca3a18496c50c1a249e559b6d1a54fcdcf109edb48577ba709b06b5c
- SSDEEP 24576:BG88u8FpJqH1Mzria7/mZgXe4i7ojhsP5Lgrk1TWb4AN5:E7ZFPqVra7/Ve30jaNf1TWbdz
- TLSH T18795F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 b61c9a7a33e68637338330cef7ab2bbcadc30e4bdd8367279b91a98b89ac2183
- MD5 d1e1b07d0f14c5030b332b46fdef6bfc
- SHA1 7f0aae3a1b8f49f44f43004f607f1a30ebea025a
- SHA512 d303505d11655aeef4bc3d4f09ff86e8e2711e9df0ea85f4e022a2b3b53f03c8ff3f75c0a32f22d478d603147061ea0252767ef57f7334dbcc67480e87a0d82e
- SSDEEP 24576:DPUr+NQVgXe4i7ojhsP5Lgrk1TWb4AN5:DJQAe30jaNf1TWbdz
- TLSH T18285E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 4f38fc7ad702c985ce0f89da933055cf29e0e796f55c8fbbd0e7c55fb606b6c2
- MD5 d7398e49c839396c861d69bd85242182
- SHA1 914b47648e11d38b44ff809fcf347115a3cc9860
- SHA512 67c79e58cde74336883cb58c5a3796d068ebd9e4dbb9088b303e4f0270552e5e2f17bd242f9b58bc82561cb6886b97dee6a843deb3813ecd00496b3ecb1d5a42
- SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQe30jaNf1TWbdz:4G05lO43bPU023W
- TLSH T1B2D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 dcd9c668bb5e02846241e28bc5c4b91961488b6d86185e1dd39db56d85cb8c81
- MD5 fa469bb3e04456c38d359044db036c1a
- SHA1 acc337eddd61aa1ee08d95f8947c8bb0b5025f3c
- SHA512 194428d3ca328413c182ba42510d5f90c82af59062cac5c9830b7268b1e50a20b374cbfb365e7d740a03f7983783939ac79b6296e1b4792caa8bc2fcd8124bbb
- SSDEEP 24576:Mfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnzgXe4i7ojhsP5Lgrk1TWb4AN5:Ua5POZ39Jt2pasx2+m4e30jaNf1TWbdz
- TLSH T1F065AF5EA6F801D5D1B9D17DC583861AF5B1346253319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 95013d7f650e9bacff91e19073e946300acf1c7ec1b03eb1cc538c2421c9de09
- MD5 46e26ff684feef1313cac42ed98965d9
- SHA1 2da56cca0902a12af2fb7cb8030a020086e3cc2d
- SHA512 f46f6499060a233186a5b52fd7f40df51053a26ca0209e26234f4d4f2c7cef9a6b7d0cff761920ec025bf2c12d83a723e4329ce1f6887155e4166f707ac1f03d
- SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkxgXe4i7ojhsP5Lgrk1TWb4AN5:LNc/zEOVHF1e30jaNf1TWbdz
- TLSH T1EF858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 cd2259651cfd3d1292b7bbcf7f0456b47161fbc340785bba7f2473eac1f6277b
- MD5 73b072004665a71e07801a9b9957865e
- SHA1 bae9d8e0e58921de7caa24bf6530b0d6442093ee
- SHA512 6aead829a99655a62170a26d74ff246128dd30ca24471deff7add1955ff2f964743aa9a888d96406ce2338213beca3eaee87116a98af179685a21357a3eaccc3
- SSDEEP 24576:UtkNvNnaFeYhJNtmZBmngXe4i7ojhsP5Lgrk1TWb4AN5:UtMwBtOmOe30jaNf1TWbdz
- TLSH T12F55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 f757495b781c3c01e2732fbc66aebe351d766b922a347d76347a022754c7e2de
- MD5 972f421d6d25b2805fbd67fafda157b0
- SHA1 d17ec4da2d2adb9a078776a366998c1069576ac6
- SHA512 d5fd6f855be0b3489e3caa0aa3b22f5bdc8dcc8ccb6cfe00c94137de9c67029096761174370ab530fe84ceb71f95a2589ad1b0378e160062d1dc643b59b59b92
- SSDEEP 24576:AD3FHshBIYQgAIgXe4i7ojhsP5Lgrk1TWb4AN5:ADVHeBIAA/e30jaNf1TWbdz
- TLSH T1DB95E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH