bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Size 4.9MB
Sample261003-p7e95azzft
SHA256 bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9
MD5 78bde080f042b180d34c357aee299156
SHA1 1792fdd062d7ca06af68c6a9150af78b044b481a
SHA512 028f1528b22e8cee45e8a60d61bd8faf01cf3f16b44243b7316f0e1f98a7159dbb126003edf9697cd155e6900aac49cbaeefa41c9ed1f06fcdab68033cf0ae11
SSDEEP 49152:Rtz8DTC3b2/mrhZ3nGQXAPaZdx5P2xU1woP1mUuS/WRucrQdICHZmWMgpJFpvUFF:X5ZZPe21OQdIREPt2DVU023W
TLSH
T110366B13F19600E9E05DC178DF569231EB72BC4A0BF2A6EF269076152E77AD07B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4452	elevation_service.exe
3552	elevation_service.exe
1500	maintenanceservice.exe
5716	OSE.EXE
240	PerceptionSimulationService.exe
5536	perfhost.exe
5396	ReFsDedupSvc.exe
4596	SensorDataService.exe
4532	ssh-agent.exe
2500	AgentService.exe
1560	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\alg.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\vds.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\41df16031e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006fba5dc3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb92b11f3753dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074d2861f3753dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025b6c2db3653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014cf39dd3653dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4452	elevation_service.exe
4452	elevation_service.exe
4452	elevation_service.exe
4452	elevation_service.exe
4452	elevation_service.exe
4452	elevation_service.exe
4452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5032	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2500	AgentService.exe
Token: 33	1560	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1560	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1560	SearchIndexer.exe
Token: SeDebugPrivilege	828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	828	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	4452	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 828	5032	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe	90
PID 1560 wrote to memory of 2344	1560	SearchIndexer.exe	102
PID 1560 wrote to memory of 5776	1560	SearchIndexer.exe	103
PID 1560 wrote to memory of 1564	1560	SearchIndexer.exe	104
PID 1560 wrote to memory of 4116	1560	SearchIndexer.exe	105
PID 1560 wrote to memory of 3400	1560	SearchIndexer.exe	113
PID 1560 wrote to memory of 5024	1560	SearchIndexer.exe	114
PID 1560 wrote to memory of 5760	1560	SearchIndexer.exe	115

C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
"C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
  C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=79.0.4143.22 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2d4,0x2ec,0x1404341c0,0x1404341d0,0x1404341e0
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5716

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5536

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2812 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2812 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29e4b95bf813af4514da24726b3d19efa01c7a523d9229f906a15f119a443500
MD5 417408f8ab41de798ff676137ea2657d
SHA1 93b21b61195a19cc5ab1cdd7c7b8de1b260cdaf1
SHA512 323dab6a57cc21ca2430fc05136e95fff9a5c2157a969c3a0bb148936b04ec4b8c87332f7a3848a1f0404164cf5e53116817bf9c5b09dc981709f3e106a08b4b
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3e30jaNf1TWbdz:a3q6mjByU023W
TLSH
T1B3D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c3f6a7016a7f3dacd57625068a380f606ebb6d155e9599aa30ebcefd41332198
MD5 998037e7b665f232e83795316a8617d0
SHA1 5b7e57cb7b66ffcaf0c65736d4b6df853d3f1b83
SHA512 276dea6cf4cdce1059bd322171356627b4f53db0b8de5d800b80465471cd18f74324198e17238edca2ebb3b5d4f902f4e14f2a25317c762ccf0dbdcfe9a114cf
SSDEEP 24576:hXYfDtczAfgXe4i7ojhsP5Lgrk1TWb4AN5:ktcpe30jaNf1TWbdz
TLSH
T19F85F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4d3525b8c050a1f03fb4f44e3a6e10bf3cb10f560377aa369886ae6551117b07
MD5 fd6813ffc8c982bf0cb8f05b044fd5e6
SHA1 89776c0e75f20c7a7ab4bda977148fa95536cf53
SHA512 2fe16a65a51f002e085b99c8db9d4a0ea18ee1239bee31f744b78a50d3c2e051366aff2514df206796f60802ca383833cac97087a13f09d7aada2d9351a56b52
SSDEEP 24576:20Le5ji0hmxfrMIgXe4i7ojhsP5Lgrk1TWb4AN5:2Pji0Alke30jaNf1TWbdz
TLSH
T13F95AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2d98ca85b6511bde06e0c9b268a66cef9c0d2310833b59212b27e1e07ee3a8e
MD5 9cae708c3c6ba112de3d48151b66dbf4
SHA1 7c45ce302a5472b53c466eff4ae8ed386465340c
SHA512 62eef857962d095cc45912f870564d4a5b94efe3e0e9ad14a92ae557be1744b4c44bedab2ba67d8c9b7a580743886ae80f07cb86d82aa5d543f5db31b2517be6
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWj6q8wyu2gXe4i7ojhsP5Lgrk1TWb4AN5:i/ezSC6vUzPv+HjyIe30jaNf1TWbdz
TLSH
T11C756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ac39e462039033adab5ce238e383fe5e2d7fad49b8c21ae04aa03f022fbd314c
MD5 79fca27845afb54aa978622047a2ac16
SHA1 a96dc5f4031ae441e0e1fce4213d27beb609d612
SHA512 85d6219b7785ca4b1440921dd7abb0eafe2bc7b8b0da5336b6f1c9ad474845042d88a3393fd3940a42af68da6294c082f41c670eeeba14b4ba0ce77e432708e0
SSDEEP 24576:4VbqPb88hv/l+B7gXe4i7ojhsP5Lgrk1TWb4AN5:4VO88hXl+Ee30jaNf1TWbdz
TLSH
T1C3559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0f474cb8ecaa98e4ee93be86790529e893a4d2bf39e4b76c1b9d2c9bc0750027
MD5 6fe84495112a5ac67d7edcf399fe69b5
SHA1 c34d1e875c6d8d5a8840888eb6d7bd90a4dc1492
SHA512 5031574bcc3e1bddc8c1c0d525decf5bc8c881f4a94b42876e3e8d2c816a656678ff1472dacd9d37bf014138b883141b025c112808d131f77903b6359e994698
SSDEEP 12288:J0H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:J0UgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A26523929F5409C6F38FC3F0A0F7CBD1E9E11EC065448D6B47E0BA9358BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 7d7a04890161a8b55f1c39232b3be2a97eb47fe06d41812fcf5495d4fc86a7d1
MD5 b00e6abfee8cd435f5f01e8370b703b3
SHA1 542712b8c3b396ebba826214f60a7b298d179f8c
SHA512 5f7d2f80ecccd723003ba04b64ec507570af4fc5f064a23b4def3ee2ed1f3714e569337111ede9649dc06052d0b40dfcd1bb289dcc75b45f988a027eef4e6181
SSDEEP 12288:FeBNUbTVO86U60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FJIUTgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B85CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b05493b8747850c324f5bbf517ce4c57033ac5425aeca75913e5894fc11472d
MD5 f809c20d2b9d0111386325de14b13035
SHA1 ad36e24a17550ff1256b1c1349a8ccae030dec0e
SHA512 caeb0cf6ef7cf641ce9ef1c3bd3727fb965b66cd1032779fcc29fa48a8dee46648928395771c6b8fbe6ae435e571ef20e6d1901c1e8ed3de8f68c0ecc5758366
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THW:pQvGAdlCEL8c/WRNw5CJU023W
TLSH
T19D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1307af94c9941addc1bc1d9615d531da04f279c2a3d3bab43b31d5e38d809979
MD5 934a052f01a49cd8d8a80bd85e158fe4
SHA1 4f5ab1dda2e5adca2fbd68b52fbbba99de99374f
SHA512 32d96f4a7cdd238334228e327a454300a40b9000f0a997bb1df95dd5c74348a6d7f0f46d67b881114995a20675ee3589841341d882be7a86fe5eff76666b7188
SSDEEP 24576:MNewsAjpgXe4i7ojhsP5Lgrk1TWb4AN5:MljUe30jaNf1TWbdz
TLSH
T14685E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9917a9db535d4b94fe9a3842091e4b888165cca0b5d55b3dff431c4987804bf2
MD5 b04a9810674658fe103d29601fa2079f
SHA1 b089fd88cc040e4290ae5b446bd030d164641832
SHA512 1372556ce01ae9ee11c0e409667a12a3959199c027d7c0ba3466e9b49f6d466d3d46e6bc9639a9f3ea8c263dc367d156b4cacb3270a74d1f43422b2a2efc5eee
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHsp4W:UUEtQevvqc2W1cpV20I32s4W
TLSH
T165474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 97b113f01af0cb7aa6d6100224f21582659463adf8a68b2f06df4cf9512baf1e
MD5 7d8cc19b5aaaf32fed1c2bf04f07c9af
SHA1 8ae959ed24b81bfede17a9954ad4379ac2576171
SHA512 861e4d93d45cf5e506c511e5345a71141754d1c99cb4eaad34ff8bd0b9eb9b235f63e0e1fb76ab19f66f73af816f810764f882c0a4dfa84a4db346ed3f4dbf3d
SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/z0e30jaNf1TWbdz:Woq2Vjnm9U023W
TLSH
T1D5D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fa936822592ad593b4a9b9b051585e4600ccd4831dcaa46052a65c861c53eaeb
MD5 da193db44cb6eddc2441c1ec2c40b9fd
SHA1 e120257c03ad469ad887185cb23ee76297cca658
SHA512 e11e0326f8232b8c0e59683451e64c46676b1416b9a105c90a4164a987c0387152a068e27914ce375d53a0c2b2e3ec3b34a234148397f474ad8ff688da72f3e0
SSDEEP 24576:3AhGL6IFoiwtA5l7S53agXe4i7ojhsP5Lgrk1TWb4AN5:3AM5Foiq5te30jaNf1TWbdz
TLSH
T1F9359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f551f017b82e8239574dbb9200da49fb5109a4d4ab16a637357bd77334ece739
MD5 cacd342c54396a4f78bcfa6b1678a989
SHA1 14a2637b055106e0e196c38f3734d31770c509ee
SHA512 43cfa5fcc43677d419c59d22050076bcaa1ff2646b731c5d3091c112bcac5807fc840d1182f00ec33cdcf932ededc36c9f0085894b87648f24c471933ac18962
SSDEEP 12288:rmw5HEjsChNWBFgl0WDm+CJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:qwu/OWtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15F85E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 7a5f90d53df16ae0ba22ecea25828120916b5645f51b20cd8f98fd0366d3d4ce
MD5 b442eebd602cee64454003281ad7cafe
SHA1 2982417ff87e92e0da72fe7e85658cf9a130a2eb
SHA512 4668ebb176210e823bb23c4794aed31d8cfdafe172ad1ab82260d5ef6365ce27c646f5af9a2040cb2a4018d4dad62bc4b99e4083fc0994b58e5f7478b6dd6645
SSDEEP 12288:DIZ1Iy40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UZuggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11675129637D420FAE2978278D4F68741E7B23882233147CF06A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c1908cbc997134e04e9c9f204afed0dbbc3c99dff01c211fbc53527eba39dcbf
MD5 8f9f69717333ba0e8e90b2126b13f297
SHA1 251586f084f950d452cc71a953118b852625b9c4
SHA512 eed0c46c501401dec3da4af9afe2e3357903caa8c3ba90fd5d1f99b44bd0eb6f37ec4f676c066c39f6f5997d8255efafa99a8139ee24a16ded5b40dc0db47139
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:0QRQyi36YOcPDLvw2gAf+PN3eU023W
TLSH
T162667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f51c1f68411526562c6884acfd989504bea7a4574659daf70e23a993227b4027
MD5 5dbbd12907fd762cf85ccd4bc8dd6b69
SHA1 ef193934ea558b943c83d87f2ae8c257049fb305
SHA512 43272a464d5d8802927153d3ce19d32f159612400a437568846208196757afea74ab0224195bb2e6ffb52047031e9eb855120803334652d29d560d41e30b0896
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:7QRQyi36YOcPDLvw2gAf+PN3eU023W
TLSH
T181667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff07e32e3364a86d9acc14953f24c80a5778d2d1364c48fc63cbd2f879ef3925
MD5 55c476d70c24eb3c111797dfc5b30f69
SHA1 161ef1a1609f2b78d130251dd5c06bdc50c45af3
SHA512 7ddb8597e66883d8beebaa84cade2535a47cad0eb80cf6c31a5571c5c890e00ee7ca253b27cbc77c804f723f29be468d78426019b737368b6667decde7f1d174
SSDEEP 49152:n68Qg55nhkeWu7PNU3/ke30jaNf1TWbdz:RthTRc/kU023W
TLSH
T1D9B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 938bf84aae8a3a989ce55e313c4713d642b67d9fb9b00d59c9b4089f813828ad
MD5 bf9d3d6588cfcc47f8a4932ff7cc61a0
SHA1 795c278c689eedffef3f01400820dc48584999d1
SHA512 474508d1faa0ff1754a525cf69f4f0111e07f3d0b3543bfaa024686fa2edd475595a705fd601f642dd856252993c9655a4162e6892ebd0e2d6274900d9b6ff68
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Y:Oy5112gYy5azzVvU69nLKnhZbU023W
TLSH
T1F6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76b65b6ae8d59b51c7d78e8ca37d2cbd6c4a1a48090de1def311cd20003208a2
MD5 0831b1f19f21c8e18d866b2896f869ad
SHA1 b87819142edcea37a5e60ef84f7eb3351ce4e248
SHA512 44ed2212608deace6b3f2e695b28f0b97d50c86679bf1d958daa456a05b5c82069b37ce0d35b81ba0d8fb2836e9aa4d0694a372a2ee5e2b3861a19986a3209c3
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glye30jaNf1TWbdz:Qu6JmIxd2dyU023W
TLSH
T1D6D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 734eb826edd62b9292c5bdc2ff696f5a2f88cbac4bbcd14d27a46b50c119529d
MD5 50fba78af5ee4ae00b8d27070e8bfcea
SHA1 e8e17b74035e43c72cf86513c9bc487bb6de7d50
SHA512 89187ce0443119fd5f0a5777bec15236660ec2e786e9a8652bc0c3b8c4e4b08d6ecc036360fdf2fa3d14a133e1942a8831a408cb590633c9453871f9e4d936b3
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4xKe30jaNf1TWbdz:amifPqR9U023W
TLSH
T182B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 203f14dc1b66c2ee3b8fc7f204a687b4681a52fe06ae7c42b708fd5dd1c6edb6
MD5 e04c103af83dbfb69be690b43b42c786
SHA1 caf00190deec29b6a2ad38191a09dc993eaffedb
SHA512 6763fe8ea7238ed08958d23405c2cf5ed40da7bf9520afde9ebb1c42f9ddd83ef8169b0c08195a91c5722ca94110687184b86c46b5e27fd0ba130feec3675e52
SSDEEP 49152:DSuZQIY0Be2KkRVtOnks6NMHqne30jaNf1TWbdz:h5dKqi61nU023W
TLSH
T1FEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c294eef7cde9d24cb4b1c89abd9466fc3df73367368f743e4190538deeb073cf
MD5 67b97432adb82667c478b4309ba542e1
SHA1 e46ea7b24b2785ade1ca89c16b2ab8553b2baf03
SHA512 b8bf8c38b3c02599eee054baef29fc8adb94e5fd8cd0dd66cac52f8cc953567c53c266edb3f4cde34817e8c7c49560f7e9ba21bc74abd8006fdda26b5af3ceb7
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5w2e30jaNf1TWbdz:WX2iWphhU023W
TLSH
T1F295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0f074c70214952b5bcabb13711805b28d095b1dde5443044122e8d6c7ad144b5
MD5 db0092e693f89354f10da863a9b43f52
SHA1 195905cdfa4e0bb476008b001f21595cede968e7
SHA512 30cca55748c97e9b7bfb6d29b03c91418110b1bbd049fa839c512defb00907337355bc4fd46a90102d60ca54523d1dca05d8aabb1f6537961fb9876b22ce36dd
SSDEEP 12288:6/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6sgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E4652391AE550ACAE34BC3F0D0F787C1E9E01EC672444E6F57E0B5631DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 adecef19d06808367780ac7c44ff5ecb301c034f3f55750bdd2c0f8493b64edd
MD5 4b96f2d702353365a0452c77fc13ba04
SHA1 193c6a059e4bfa36fb86be7e58b757b1c0b48b8a
SHA512 fa61c5d85cd695458999c603481ab8651a6dab47888993474cd4572839f72b0687c451b13b6a5299628dd32570eed2ae95c291a6eade8642b67d6b0f9d2aa443
SSDEEP 12288:z00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D86523A2AE5509C6E34BC3F0D0F787D1E9A01FC672444E6B57E0B95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4e16ac4820fad7641b2acfd2c25969531bc3080eeb806b89810797335e8af3a1
MD5 38d5ab69abe84f408e9c81ffd9b02348
SHA1 63356058cb992296b5c44bf5878d7f4d3922da48
SHA512 fc220919390e37455ff8a9d0041db41c8f24844ec9c232f3e0fa172b35ad39a9c3c8b8b9fec5a9d0c1025df2f57cc7b20a32ad82252b29b58c9be2d599cf9aa6
SSDEEP 12288:gy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:grgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T154652391AE5509CAE24BC3F0D0F787D1E9E01FC672404E6F57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ca3741507341d233c400e36bd4d7ce0db3d2df7ba9ffd8182324e239fa8ee06b
MD5 e2a0d20122c506f9bea8031da08a167f
SHA1 202ce3e034b400fdb1efd798e25ebd9468cab2cd
SHA512 f2d4630ef0a1242c0f7f0da00d0ecd1a3a70f8f2325e554b815826dea7d77b92a75b083164b167f40f9e62471ec8649994c9d89c21c5edc91806eaf9972e7228
SSDEEP 12288:nVt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13E6523926F5905C6E14BC3F4C0F38791E6F13DC173118BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 acdd480c1b8562a47ddc5bd0ab9b1b8c935a8bd747eee13996a3b730ecf66a33
MD5 36d67339ff5cfe6df347a727f9247236
SHA1 f663432ed6114c00bfbca553d520d925f8f6d38c
SHA512 23558bd2ce03b99569891bb97ad84fbf001e9faf91e057e68fec83d9565f86c657250379b2c393da15834471a10923cf50952f610745613e15a7de22ceced6e0
SSDEEP 12288:q10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B7652391AE5509CAE24BC3F0D0E787D1E8E01FC672444E6F57E0B9631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 52cb1304914b908fcb7ceeaab7f98d8721b8bd046c20990f33b6a0594b6935f7
MD5 d3e9cd84a88152a7b0d7f436d3ce13dd
SHA1 40ef2fac2b5c95d3f830bd2069a4910a3f786fb5
SHA512 20d549943c43efe5d86eeee0fd2e9788a5ef6be28bc7b78015da9665ed2572b4265346446e259284b59c19237a2ca66c6bf6b07e21d4739d43f5b33c7a628983
SSDEEP 12288:rg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A9652391AE5509CAE34BC3F0D0F787D1E9A01FC672404E6F57E0B9531ABCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 bc40142d73ea77c2d122b56a5bbc232f6721eaad1314a4840bf8d7251e5aee33
MD5 5d228daf1348957f2fc737e744878c12
SHA1 d784491a37fa3c8c397f0c394e97cd7dc03d06a7
SHA512 579f4161cf32bec751d41304e142b3dd27fc5d4d6a55a902c8c7db4b1194db37208a65167bf8718e943a32c5adcbb76c02ef1866217fef038c2a6b808de384b5
SSDEEP 12288:Ac0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CF6523A1AE5509C6E34BC3F0D0E7C7D1E9E01FC672444E6F57E0F9531ABCC996A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 38757d608cb192e1e81df951665c5761e2c9d1b16f4a40fbf9ab5ea3dde57d83
MD5 f34ded7904c70589b08dfd865ebd807c
SHA1 56d22502abd51bdd50aa790cf513585f749cc23f
SHA512 05678523240050bb61ebd8524718531e6cd85cf6fd42b3a1dfdffc3808d82db03eec920b64a3080760fb409a1e0cfd128790496c24a941b9dec42ec4930ccce6
SSDEEP 24576:yZM9zFVSO1gXe4i7ojhsP5Lgrk1TWb4AN5:yZM9zfMe30jaNf1TWbdz
TLSH
T171850195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f798bb235ea594a823357bd10263237829e759503357783a4975f18f0e0947f6
MD5 67e98bc2ab80c083834fac67733ae63e
SHA1 76906045a7380cdbef1afea79b3c14013a1fddf8
SHA512 ee9a800dc21f99e90af3c9d9dca1ff680334777d7a39a7473b83e752fdf348dff77d43b3555b3024a44313aa138723a5dad41cdca25109ab519a4b407b0b98ec
SSDEEP 12288:xz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T100652392AE5509CAE34BC3F4D0E787D1E8E01FC672404E6F57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b2d1c3e344a41b44fadc120c3543895dc6afa67e91093328c5098dfcf3a79327
MD5 52e4484096622c0d3a53c50493658ae3
SHA1 b2ff9a931191fe61fcbf2425ab39cefc84cbad5b
SHA512 d9cd3cfefdb2e30d3217d1c1cf439521a5fdccf6aed8a7e5396f9d3af796a02ab4a52837a355767958137c65ffd1ecf97e48a3d8251d9222dfcb62a44e44dc0b
SSDEEP 12288:Z30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T176652392AE5509C6E34BC3F0D0E7C7D1E9E01FC672414E6B57E0BA5319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7b0f5accc1ef8cde17075dc6dc1826bbbe45987a5bf51c1a7adf66bb6d824f53
MD5 20d32100ac91e23beaf6158387a5739d
SHA1 c6729639d42e75fd073b7f0dd1bf1e2c1a9a8bb6
SHA512 46c9c7a2aa61b62d4c8435789c8d94a4f425fc0d5a1fde4f5f58be614ca9121b85fdabccfc48d30461feb65b99027ad31397709dfb37c0f9854bc3dce1d12bca
SSDEEP 12288:dyPz5L840DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Uzy5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BB75025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0906c2f3b2faba098333aba1811a0adf67b1534f6474d0a3e18d47e3322e89c2
MD5 29a4bb9b87b4c53a34eeb8ecde4b7fbe
SHA1 029b7fea1a5e52c76344fffa2018a3c12598a911
SHA512 bd6bf9573ae4960be047aa6da6d7c381444c6e380cd787b988bae68639ca244737874608a4a612c17c2786919a5226f553079de4a6418e5ccfa7fc42746dbdda
SSDEEP 12288:Pz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T161652392AE5509CAE34BC3F0D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 d3746569052c808ed3962d585863d764f707eb4b13a167ff617ec3103bdc5323
MD5 06fb4f5dfc276c81d23cf7b5341eae2a
SHA1 7688e90bcf8252d7393cfcaae1857dc813280f9e
SHA512 4a73c8335d1fcb93832cc63d5bd4c6fd5b74b9d6dee09a74b92008886d4a663d720c845c2e83a8b7ca5d959d8a68d5bc8ff187141d23aed3c37665f72d8d3d83
SSDEEP 12288:Yz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19A652392AE5509CAE34BC3F0D0E787D1E9E01FC672404E6B57E0B9531DBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 1aadd9ed89d8ab06dc9a4d0b9a57b91de7524f4445a10d41825c0a7eb407d316
MD5 0aa3dc8757c331b219966c4ab0e3eceb
SHA1 340cac10be0615835d6de10e0b8ee9d78ef7bd1d
SHA512 912f50bbcbcc636954edcb78cf048d82db438ea96c6f9ca1fef8167b5eb12488458cc589dd9be18008eb11ef1d7b4707646b8a577e1acca875aa1c6e16a4a294
SSDEEP 12288:XyPz5L840DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:azy5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11875025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 4ab39126f465d47a338886478b51b6ac758e9d9891bc590bc55f9974832c48d8
MD5 2c15f0aa256a846b53c7fcd6a6025ad2
SHA1 cc3b20e3511074f5d4ae81003eb29e4f36a95082
SHA512 23cff29ffc3b1d9e880c7efcd992478e7c00354753755a9c0ddc782ab4002a25f2540d402a40c525fea38e115252b7e7de960b3156d95ed5bafb4fe5d35783b7
SSDEEP 24576:BTqaLl3z0zDbgXe4i7ojhsP5Lgrk1TWb4AN5:BTxLljZe30jaNf1TWbdz
TLSH
T1E98502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 8cd72973fffe007601a8a114534b1572627b11d0ab6d5bf9a94bfb4639e59442
MD5 8b82be99636523920c1784e33315e3ae
SHA1 2b00c51bffdc575820448bfcaf43a472d83ad221
SHA512 533926948bbad8c699c5b4762489012580f87748e0077044cbb795f6ee545a251ada42b3865f003b7061e9831c935b2e489e46b51ce3c954f4368b19528186b3
SSDEEP 24576:Z3Bd9CHKy7GZ3gXe4i7ojhsP5Lgrk1TWb4AN5:pBd9CHKyaMe30jaNf1TWbdz
TLSH
T1FD95CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 aa14e2a356abb68b16a537ff711af5567cde8cdb3814d58251e35961a95a429d
MD5 9ff1340c50db8e0029efa9b1f959cb4b
SHA1 c17dd1b3c3da7ffa8839485d6b66c50f6e27c519
SHA512 382fe7bd49429df47c475e2bca99e479a2d0057134ca3bdfaeda5918cee6a9c526bdbd3e2b9eed86b96988b04aa9cad74700ce2c37d596110e1e07cfd852f743
SSDEEP 12288:xS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1376523A1AE5509CAE34BC3F0D0F787D1E8E01EC672444E6F57E0B9531DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 bc6485f6284282e80aaef7965f44bcf414ebb6c3488d3be4799458d5246457a6
MD5 ce6af08e72a01cff0d3d3ee362826ded
SHA1 e2553c62fa36f0785e430e6612554375831ea751
SHA512 f4054c79bc4b7460b1ae7222783d828084bac26321e0a1ac9bd06a2db8fb8b7decb90c3c326a40f38e6386fc810302b8c4e6addd7e2aba2c6d0452c97478ddab
SSDEEP 12288:qY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10E6523A1AE5509CAE24FC3F0D0F7C7D1E9E01FC672404E6B57E0B9531DBCC9A5A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f8b9d01f4630c27e189e69b1baea12657be5b0a1af88fda5804c7aecd22d8754
MD5 4bf078e440be401296f8d4b82bb7af8c
SHA1 4d47cc87f297d31be92564753cb31e2750a25442
SHA512 0f5a258a879a032785e76d8b709d32cffeac963d26dc09f248d244f7ab0f3a8d621a78c99e0f1eb07d53a2d7acd67a707ff5b5dd552f2c681f49e98bd61e459f
SSDEEP 12288:Wx0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:W+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T182652392AE5509CAE34BC3F4D0E787D1E8E01FC672404E6B57E0BA531DBCC996AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 4bea2b0023cc4fd3a0d79a9ee131e6cae73c657c482ce803d926b17918bbfee4
MD5 164acd856b7b35f8b3eb87b111ff614c
SHA1 06028732bde9c7b3b77f8641d7c27524cab1e929
SHA512 d2b003b7c8447e7ca18125e8dd60c528b734f00168329c6595ac1f4b05f511c0409576d503799c89a61b0660fd3643017b23a5a1bec7adec927fd0ac789a88d9
SSDEEP 12288:0z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0wgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T115652392AE5509CAE34BC3F0D0E787D1E9E01FC672404E6F57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d5f6c80c9ca70b8f67951bec3ac832daea443669f14c1c7bd5bbd193151bdded
MD5 6a73a8381fbc8cdb687e4f48aae15198
SHA1 4745bddcb3796f39d670148326fb3f4c780dd2d4
SHA512 7001f63dfb16af6fe61a35cb608577542a12a7c3e86c9b6355b1239d387967cc7b444a5f4346fc95f3288c0e370cc364d9bd31a504158a933ea84f0f04d50838
SSDEEP 24576:6fwvRk9RX6wkyAI0gXe4i7ojhsP5Lgrk1TWb4AN5:DMnYI7e30jaNf1TWbdz
TLSH
T14D95DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 acdb8aa9824e873c6a52edff8485b744b3093485dd563aeea66555230cb9585b
MD5 de77369532ae5b377ea263f0a8306cb6
SHA1 867dcebad79eed61697fa4bc5103ccd9ce53256f
SHA512 23c1525fd65285e77b392c32e30c779f2df6ee06d6d2f3e6dea227f4f761288709543c9b7d7bb7bc80cee91bc495783dee692d90e37e99606fc7bacc51dde1e4
SSDEEP 49152:LYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0We30jaNf1TWbp:WySzP+U023W
TLSH
T1FA067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1111ec5376a95782fc523f4291039c39d92668ed3df97dba4424c49ea363cc50
MD5 5ed8a6463f2e0497f91bdb463de7366b
SHA1 1801c24c99e0cda8a6c36c2af3f318fd75f5fbfd
SHA512 09bb8b7969b9deff5bd61971a3686ec96d094f253586521e3a7413303b915c968b670c5bcf62c257ba269765f3cf6078727b956eb255e4b364231556902c24aa
SSDEEP 24576:I47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYFgXe4i7ojhsP5Lgrk1TWb4AN5:I47JUQjqirIhCnDHUPfF/Ge30jaNf1Te
TLSH
T18965AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 396a6d11f2f49fd0f861b52c4d7a7ddde56da7dff7d79249c8e63d5ad4b52ac7
MD5 2a2d90f3038297bfaa6ad61c5fce26f3
SHA1 88f7a66e3e5797dd59549ba6e5ede9de843a31b2
SHA512 9145a871420b91ee5789d1520fbe552fcdd41fa5efe0757caee1ba86a93285cea4ade14314bf34b3e63299aa3c7e33088bda00c5251d9b43c0fab9bb396052f5
SSDEEP 12288:RDsfD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4ggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B775F15AD29802D8C05E92B5C3968A81F3733C9193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 244c481812b7a6042bc81e6895bc3d71c5ac35f70b3d730b297d6c5cdcf5bd8e
MD5 65e80cc7347d07d27223bc9be7969f5e
SHA1 18eacc6ccacfd5529d75a65cc8f5803792950f9a
SHA512 13b4e233e7bd261e2d83a3f6d18f838144e42378d39d10084b67c218cb2c14a5ecb8a5fd0a1e88d9da0e231b46f19876a972fa695e2370e4128f95b75c5fa222
SSDEEP 12288:TUQ3fGU3f6kIC1Tl5tVWIqwVLx6kLRZRaRM6XQhu2N1:TU0OUP6kvpVW0MkdTaRM6ghu2N
TLSH
T1AB352740B666CB4FC66980321E33D2CCAB707D45EE45AF0373C9873F9576659BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 386KB
SHA256 064983d7b20c6878b3b47e095ab64f59d1757f79db0eb3ef19af4dcc4cbf1768
MD5 41164447bf163c80705fc967be93e396
SHA1 74b98058fe152a107078d51f450f2bbb424efcd1
SHA512 89f1b86a499acf4871ae713a04af93b21a5459840679f52e0514614a29298015990ff6b5ceb887b4c42e05ca9561d20b9d29319b9495b2f5bab95fb76b5bf311
SSDEEP 1536:JIYjZ4XAYatY1XGvcywqWHWHy0PCGyG3TWv0rprslBl69lYSE:JhjZ4Xf91YXwkHzCt7v17Km
TLSH
T17784F740B754B71EC4B68077047192DFAB39B813EF126B023BC41E94DCB619B76BAB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41df16031e6882f.bin

Path C:\Users\Admin\AppData\Roaming\41df16031e6882f.bin
Size 12KB
SHA256 3d9c4ebb5aea605efb5239533c1f227f16b368a6a6b3ea7b9d71cf86e19a0baa
MD5 49006895eedb390088bfc149f1b391a7
SHA1 338b728ac450a692a58dbf4970dbc90220abb453
SHA512 8ef874c5846dd6c34f9605e1c592433e3291857fa63967bcef9c2f8abd9c530a8f383f4d591b5b61d8c8d7a72b4f7cc370c0845c557d595761d946c4a97aef25
SSDEEP 192:DhUMAodpwv9OBFImcxtWIOtWpRUdxrrpedsw5I9QtJmRwslEANeHSXvQvlj6cDdo:DhHAol2XMd5d8EQrmj7vQlpq1gAl4NS
TLSH
T1E542CF54DDFDA594ACD923C183042EA7CE6870EE600667039BA3BE4E64D8205CDF5B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8f2fdd1-e61e-4e00-92ac-5444a6b2444e.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\c8f2fdd1-e61e-4e00-92ac-5444a6b2444e.dmp
Size 297KB
SHA256 05a3d2d103e8ef660378074cecb0025a33105f604484085a37a1669d5c5391d2
MD5 ccffece5dd781b326f231a0f41c1d0fb
SHA1 0289673350ec3ec60902273d9705d3188105dc44
SHA512 041e325e43b8ed22f0973514c9c5007d4de3acf30ada64e19cdffc5e6cdcfecbf947a0f4e332ea4cf5c466dae5ae3ed3d486a30c9601cba377d6c1633661ffa5
SSDEEP 3072:1416DsERgD98CXFN5R0cyTAWuu0OEMr44V5RxvbVZUA:q1ggD98CXFDRz844fRxvbVZUA
TLSH
T1C354F8AAA7D844A6C13AC33584936B52BBF2F8100F6347DB5B50467A1D63FC4AE36F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 938a2bdf16ba54f3fb95aac271cc77f10e6d28cef7747d803ba5081dffe8ea05
MD5 bf129eba2395f7fda84e7a11327a7597
SHA1 6076200f834a996edf5c655f138e78c00f801b36
SHA512 8b6a83690d0a6cc03ce4cb0ca1ccf2534105ef1923ade83e92bbe1e4ef4dd740a76ae4a86de006560eddb6bc6c71b1f154c89e41e9246eedb4f95c3e7db77b7c
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8c16a2bd6376bafddd1a887be3a9297e9edba94f675d0cc67c4c06aaa028c325
MD5 7740fa55ea866fdd1b766d483382771b
SHA1 eb275a6b43c630e98af9022e8ceeaceb9041dfce
SHA512 64cf6298c32347f0723b0de88d1a9222def8def4bf438a92e5f458ea042cfc2d1d45e26a42584cc0259efb4ec212b30a28eab31fd1382c991f345bf8e5ea1644
SSDEEP 12288:uL7L0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8ogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F6523629B580DC6F29FC3F090EBC760F5A53EC0270089EB96D0B69319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c5999dcffb84635a484700146f5eda5827a49bb8fb9590e4cbc1e075eb32ec8c
MD5 d7f6e9e588c5a20cc6faa485576cecf3
SHA1 05fd4657600c9eb24cf6a69fdaf2dcaf371f0d9a
SHA512 cac28b0a8ed0b23c1a10c29d8ee4b9b6b4b73f3df7ef574b0b95d0b2864f56f1ee419e60b9e443ffbecfa3d16e8765b768a9bee7d434d1c77b8c96d6af1db711
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bY2gXe4i7ojhsP5Lgrk1TWb4AN5:Ugb4mBIBhGFQe30jaNf1TWbdz
TLSH
T1F765AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ff9623df96d05fc356434eb7bf7146e9fa68e244e2096caf88214f2b729eb0bd
MD5 03c6aad63a5b2968018a3f7a700337f6
SHA1 6dafcf65061df6ae184f9e57f6f06f0491c66f76
SHA512 a2d7ecf6e33bdd938b8538a1b1e8a11869237c0c679e23d286edfc9ac78237b4e0665bb4c80f3d4414eeb40a289e534cfe7d9dfcbe94f29de4065afa5bff97db
SSDEEP 24576:GG88u8FpJqH19zria7/m1gXe4i7ojhsP5Lgrk1TWb4AN5:N7ZFPqVka7/xe30jaNf1TWbdz
TLSH
T13B95F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f45d99428e75f00ffcd4ea9f3b8fd2e89c3fecce9b49192eecea2a6b2af20d2c
MD5 1e67d02a96e1902edfcf04f3111139b2
SHA1 7c2dbddbff032c5dbecb76a744fce6fc60887ab1
SHA512 829081ca9ec10dc52a0fce420aa2d7e215edaf5a11f5caa5288eb347bd1b0f3106a52187745e662039aac5cd22d4d0fdf478827a45ea8218b42537ffd2b229e5
SSDEEP 24576:EPUr+NQxgXe4i7ojhsP5Lgrk1TWb4AN5:EJQMe30jaNf1TWbdz
TLSH
T1E185E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 87715aaeb12ae8a66409f1d3b62bc71a444d368ef19278bb59af2fd8bafb522d
MD5 7eb65a21d232d10efa8fe7f477a100b9
SHA1 f2ca79da817b2725cd5c52a3ad81fe448d64d6be
SHA512 f78ac6c5e7f313a4ac166def83183f4eebca7f2bfb00f9235f7d11cbe5b1b5b03d0fc89a0f2b6591e8eb78ac026af1212687936a1f419b946b67220232247842
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjce30jaNf1TWbdz:mG05lO43bTU023W
TLSH
T17CD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 db5388b45e181c05e4ae07dbc13a876906b1701226c5423de5990678dbf1f3cc
MD5 9baac889a8e04612dcc910aabd05f9af
SHA1 2af9fb3fcfaf893783e3135b6be104f12ba65f85
SHA512 1cf2d031c303fe37a258afee516ac4134ba2812377c41030fec258b492b15f763b9f58b52f1aadaaade86816351cf2726ead1eaec8fd57f14b8c46fbd86462a8
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn/gXe4i7ojhsP5Lgrk1TWb4AN5:Va5POZ3lJt2pasx2+mke30jaNf1TWbdz
TLSH
T13765AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a263a60a4829ba604046187eeaf399c64c291bcab96219d37767a429cde8d040
MD5 3df5233b2aabccbf59a783c4270e5ec6
SHA1 e9c3fa57e67de3acaa456e8dd2a3a992c8d19f71
SHA512 01e5998a18f34819a81d3fcdf9bfbb82b44bb6eb5c2b637f18f89424f7b9535136460265a37ac7b949c21e5eccd477bfd6b8eaf74b957a6ba7542daa87b3f17f
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkNgXe4i7ojhsP5Lgrk1TWb4AN5:1Nc/zEOVHFRe30jaNf1TWbdz
TLSH
T143858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8161162ddc3fa1303a10ab0fcfa12bcd120d51ce6a4af4c10cc389aa86dec6a9
MD5 be39894254dab524aeb12c31b76a1161
SHA1 330a5d708bde24ddb78e7f55a3101ab817174973
SHA512 622bc7d72db558d674e3fa6738887adc2c9618955cb35b199c065a16a21bacfc40cf15b01b1d4c2d29153cab76ffcc8098971ca9943760eeb6472e2e8989dacd
SSDEEP 24576:8zkNvNnaFeYhJNtmZBmfgXe4i7ojhsP5Lgrk1TWb4AN5:8zMwBtOm2e30jaNf1TWbdz
TLSH
T10955AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 03d726da87af241a7f4ae85f87a478306d9d2f41310e7977906d2d8944a96386
MD5 571bd5e30a84ce4818e0ca0a6685e188
SHA1 526c7a53d65111b54e9fe8c0bdfeb8a485c3e2d7
SHA512 9c46847862c65c7915b31f68f8fd0c389a6f6abfd2708df3d3b6c1fa24f70ddebd1e7cb43f5531c04e2f8f0ff298b05932533f465e9a14b80b56d76650a55f2f
SSDEEP 24576:DD3FHshBIYQgAMgXe4i7ojhsP5Lgrk1TWb4AN5:DDVHeBIAADe30jaNf1TWbdz
TLSH
T1D695E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-100-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/240-94-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/240-92-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/240-341-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/828-12-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/828-19-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/828-22-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/828-114-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/1500-73-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1500-66-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1500-67-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1500-79-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1500-77-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1560-207-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1560-349-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1560-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1560-179-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2500-158-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2500-166-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2500-169-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2500-164-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3552-313-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-62-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3552-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-56-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4116-434-0x0000022790810000-0x0000022790A9B000-memory.dmp

Download

memory/4116-368-0x0000022790810000-0x0000022790A9B000-memory.dmp

Download

memory/4452-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4452-51-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4452-44-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4452-50-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4452-206-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4532-345-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4532-153-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4532-204-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4532-147-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4596-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-134-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-141-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4596-135-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4596-348-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-346-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5032-0-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5032-39-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/5032-9-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5032-6-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/5396-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5396-129-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5396-123-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5396-115-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5396-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5396-370-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5536-342-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5536-104-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5536-110-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/5536-105-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/5716-340-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5716-82-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5716-88-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5716-81-0x0000000140000000-0x00000001401AF000-memory.dmp

Download