f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Size 6.1MB
Sample261003-pw6myadb98
SHA256 f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999
MD5 a1297e512550bd580d54f7a36648a481
SHA1 cea0800e63a66411297afa57bae1260bcdee0941
SHA512 6ebba26930622b7ec1434475d356f3dae0f9c88549e621845b1dcac5a8ac48fb6c43821ec8d4cf156defe8a6b873fb5f9d3b489e17c7561146afc862f6647b86
SSDEEP 98304:u1eSPFhl+t1CIEUhkZqGIsGDpQO2SGXJ:M3PzgtJKZqIiyX
TLSH
T1CB566A13F29500E9D049C179CF5A9232EB727C990BB171EF26507BE62E76AE07B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4416	elevation_service.exe
4604	maintenanceservice.exe
5684	OSE.EXE
4844	PerceptionSimulationService.exe
4716	perfhost.exe
248	ReFsDedupSvc.exe
4836	SensorDataService.exe
5788	ssh-agent.exe
2836	AgentService.exe
3440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\AgentService.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\msiexec.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\msdtc.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\wbengine.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\alg.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\dllhost.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\System32\vds.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\672e7d093ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\system32\locator.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ded27b9b3453dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000128c819d3453dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f14939d3453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000814214de3453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fd9b59d3453dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0bf269d3453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009dd85b9d3453dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5172	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Token: SeAssignPrimaryTokenPrivilege	2836	AgentService.exe
Token: 33	3440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Token: SeDebugPrivilege	2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Token: SeDebugPrivilege	2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Token: SeDebugPrivilege	2920	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
Token: SeDebugPrivilege	4416	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 2920	5172	f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe	89
PID 3440 wrote to memory of 1956	3440	SearchIndexer.exe	100
PID 3440 wrote to memory of 5436	3440	SearchIndexer.exe	101
PID 3440 wrote to memory of 5044	3440	SearchIndexer.exe	102
PID 3440 wrote to memory of 5880	3440	SearchIndexer.exe	103
PID 3440 wrote to memory of 4348	3440	SearchIndexer.exe	105
PID 3440 wrote to memory of 2404	3440	SearchIndexer.exe	106
PID 3440 wrote to memory of 3520	3440	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
"C:\Users\Admin\AppData\Local\Temp\f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Users\Admin\AppData\Local\Temp\f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe
  C:\Users\Admin\AppData\Local\Temp\f9c15eb8b648b6058f2eab46a87d6716ddf31ee059ae023c3b5e8a596d5b9999.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=102.0.4880.46 --initial-client-data=0x300,0x304,0x308,0x2f8,0x30c,0x140551ff8,0x140552008,0x140552018
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5788

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 db5581bd515770e546bdaa4ccd475bd7f9cc884b783a51d3e14a89cd59a13163
MD5 1170277773fda31f05768d6b4d279d91
SHA1 70728f3e8e4ea49189e2bc6682ed8a3e84ced5af
SHA512 502ef54b78a5502ed681c67a2368844c2a8a12aaf75afadaa695837a332393edb9b58434711dc5849e84fc92a3307b65a21361fed21e2641ab46a52fc6efa5d9
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnT8Q:H3q6sjB3
TLSH
T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8714b6ba3069695bf9b1281d08fa4ee948a01126836207ce80fe1199c5cfeff6
MD5 28514fde4aa327b9b19261bb66bfd6ba
SHA1 8a606119047e3b9d85d16bfa14e45e9c02816aa5
SHA512 88c7962eb8fa9c388179505eb227d2f00a75570aa631caf22de0822a8f2525f2a416a0c35caa41f5626f905a767523676522c9bd8ccc95677d8b8b7d09235f30
SSDEEP 12288:51XLsswWkxy2lRq2czAQ8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:XXYfDtczAQ8z8m5QKr/j
TLSH
T13075F124B7D109F9EE27813DC9A28502E6337C514760E7DB03A49A260F377D96E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7d9eba75b004d4232535d794ca9cbeeb15519944909c080c3d3d548758cd9794
MD5 4f4c1118bf8bf11b25c302bdc11d048d
SHA1 e1768ad3b73f61de4d82d3d7c6dab8b6e5da80f9
SHA512 ff9debced6f62947c33ce11d57097e7d9bba3303dbf3a34f3a9099af655669e20e5c191a116a86e4204afa42fe600044f31ec00f4004c7784b6be6071c7512d9
SSDEEP 12288:qXZNYVLeyUji0h90ZD0wxpGZIVuCrHsb8s/DCR83jKj75jIVeYHJVirBkVFu5K+C:e0Le5ji0hmxxrMb8z8m5QKr/j
TLSH
T184859E16F6748335D073C0B9C5D2A68EE97230815B308ACB4296D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b244eedf88d14b0cc840272b1d2d47b59330060eda5c43fd1c35d2ff88d26d7
MD5 b652e1d94f773b8e3bc642de74b54528
SHA1 f8027f451d5f18b78592127c878ecfa778468a1b
SHA512 68acefbbd8f05921f29287fe84115af99aa6af12c94972023727e561e1d3bba677a3802c045187ba8ece5ba5b10b4665c022efb673f7819cfacaaf2a87eec1a1
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyut8z8m5QKr/j:w/ezSC6vUzPveHjyi8Q
TLSH
T189755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e609e1bf0f79f7614c08a0223255eedcbee35e3559035043ddaac460e9a0e36
MD5 3bd5a81491cbcb97190782179990d91e
SHA1 6e296b4f10c82929b0abdf93f91c605e7139131c
SHA512 7ffee76b575a2559ee7fd511a45af38afaee28e7bc20cd029ae61ad801bc95e7206eace982de4422584109e7618031bb66472043194a0a96e14c9869d66f33b1
SSDEEP 12288:xVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98E8s/DCR83jKj75jIVeYHJVirBkb:xVbqPb88hv/l+YE8z8m5QKr/j
TLSH
T107559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3262d53a270e12637e9a7702cca4626c62bcfe5681fc0d3aeff2b3b6a2a6c5d1
MD5 ae7d40ba8c1b047bb0d461591c3d590f
SHA1 b3eb8d250510be20efcb3931d2f993b62fcf976a
SHA512 a8484b3da49b97e4ac71fb71b8b07440d4cc2a916196039b6cd72c7fabde3fe61bb30957fc8934a6c81d931c4241a83796ca4bc50f0ae22ed5063e3372803cce
SSDEEP 12288:5LP8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:5LP8z8m5QKr/j
TLSH
T160552341AEC202CAFB37843E915D0A46B12B3D107440916E4A357B6B42BD9FBF6376ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 cb32b55ee91c361118179e86d562d53df312ee6f8abbcb146c7513b299abc450
MD5 6be581ab40be54b1047ce04ac3549161
SHA1 970dfd024b54f753c767c47aec5abac11eb83d82
SHA512 69bfedf8beb9c02b6933b5649b54d3fcd994be8d0eb8b24eda729a589b6bd4c20c5ea8ec847b5f53d1adf79deb3eeb7efd7399e6629067083d427afee1c43f46
SSDEEP 12288:zeBNUbTVO86UM8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:zJIUM8z8m5QKr/j
TLSH
T10475CF3BEE28FCD2D23A8CB956918600E77278304B51A3CBD175830EDE275E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9f95a4b757bf1806d4c345a5e8d9e95243867036070542c41fac09bfad990e6b
MD5 cbab05b084baa41c57b2120318c7b66c
SHA1 5be4e1300f8f81e35596261a83b93986fa18eee5
SHA512 da961bfe6395fc3f8fb282591b9f75009b752218b8a4e7e80646cf5f868b9c0fb59bf1691bea668b740b24eed1109aef0f0e488e2c40a6c51d358a0921f3d957
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH:cQvGAdlCEL8c/DRNw5Ce
TLSH
T1F6267C656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0c17b66a4a3a82c832ae5799cc40af95c54a46e14060cee88925f015ba0dbab5
MD5 8cc7eec647759532c7b22d896adf460f
SHA1 ea888437dba77769e7dd8fbc4a193559ab05879b
SHA512 3771ee71203628b2dadcbb3a5724178cf15173bd03f2e9d0bd7f26e0a8ab8a420a46c3e0e4dd1116cd1086f97ebb55be6a6263f0f7f89db632e47c041054214e
SSDEEP 12288:tAwSfxL/2Dc3RDLLmt0LDQewsAjG8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:e0ewsAjG8z8m5QKr/j
TLSH
T1DB75E031FE75E036D37B0CB61B26C706643D79204B511AC3E3B89E9E49742D26376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f113999aa6256c567fc203eb035d16de78e8da57be8bc61c6895f33896cc819f
MD5 5df79fb7f793a2e18a6e318cc14191ae
SHA1 36d2a9fe9ced894cc72182ee1e5a5354d23bca74
SHA512 6b80b245e3c318813986e7c7ad17eff9683606361b2237ee7acd3133e8641f512aa9aea3e9fe4471766e9f8e29f844af50ea365c02838ef12a97024f3d3dcc2e
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH:wUEtQevvqc2W1cpV2tI32
TLSH
T1C4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 53c01148c26b50acd55822041d2d059d6ca219c5e95736e81c4ec2983d026ecc
MD5 3bbb8114dc92a9be9f3ee65085ecada9
SHA1 c3d14260e9f9d9160b80bcda765a38bece995420
SHA512 b926c7963112d556f6babf2236e4cc416ce1ffcf4d4a4d9b0e19895895d842d2c0a8bc4778216f5fe696b736bf51a338e3f79ae3bfe6bdc3fa2de306b6d22465
SSDEEP 24576:FCbRquA/m2z+L5WqJNrHCYRFiV+XenmE3Pnzc344Z8z8m5QKr/j:FCbRquA/m2yL5zLfFiV+XenmE3/zm8Q
TLSH
T1DFD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e53415f6fd52b2736ea8b96cd600ce1598bfba7ab7714cca4c49449fd2bb713
MD5 a705c21932ae007fa80571da327293da
SHA1 17b19e2db20936a308a30abb56374d5029e49f05
SHA512 c135d4a7a306bd326dc99f18f3ebfde7ec8aaa9b205129d9bd06b0f02af2e1e28645039a1116b333da208b3b857144619e5db6555d152445a699b92b4f6edd41
SSDEEP 12288:2AZ/GL3IFoiwtA5qy97S9uaYFLq3Oo8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:2AhGL3IFoiwtA5l7S53Z8z8m5QKr/j
TLSH
T1BC35AE81E7F955D4F5B3AA7899B68171EA76BCA55E30C20F2160D11F0E33E90AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 265952b81d8f8b912e04b357472d1bf267fff9e5c273838df3e4733a2aa15b4e
MD5 644a41cfb66aaaef89f18dbc9e3d691c
SHA1 1837521eded99dc8f9383c460d0e7d4f7f4e9538
SHA512 918792fe8568393b476ce52c979f6e6195aef749c65ed643c9f91f472a929afd796628cdb58b3904cd4470728d0a1e582524fb91261db69f290163cf3a2caa5b
SSDEEP 12288:/mw5HEjsChNVBFgl0WDm+CN8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:+wu4OWC8z8m5QKr/j
TLSH
T15365F04676E50CF9FA67813986578136F7B3BC012A20D71F0760C65B5F372A2BD2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 70008becf17129ad25e7faf8e79bb7adbb0c67eebd8de3e44c4a1218ac3c49f7
MD5 c8d076caacd84f39fcd0c15e27371fbf
SHA1 de410e99c34efed674b0bcd445871abb874a17c5
SHA512 83bb5f01b1ab33763a82058bfd98a117ce7c59c55228fa8bc7dd0b4ec027d84c488eced04b93be66d85f78cb4c035b7e6f96c0ea12b5436cb5c90bd36b838026
SSDEEP 12288:/eZ1IyW8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:mZuj8z8m5QKr/j
TLSH
T1F655124637D521F9F323803DC9A54606E3363C61273183CF1625466A1F77AD6BE3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 29ed2ef67e77e0f8bd6f72c046ca03c3890e20dc4e456da3b55f80d077f69d7c
MD5 c06b7a6ea29e7d57f45f81c3f7cdc8be
SHA1 39be705244857639705e4e1939e4b7cbc8bc85d6
SHA512 4ec764d6df73724d8e77c43449d8daffecfe2ca7f44c6c06209cb6450103e2b2bf291873ed7e8e9f7f9e2fcdd2814a1126a3c97082c1b5e8d3b3f806167fce66
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:jQRQyi36YOcPbLvw2gAf+PN3b
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f1a5c8cebeecc169f40d0bfc8af34f847af19255be9d8423404b4d72ef6f0976
MD5 bb968294fff400c02c31570c0cc991b0
SHA1 32cdf9d9e3c6bcf789abcd2756265b2e2ca266c8
SHA512 34436a803ab8b8d58747fbd7fc48e60f6c7dfaa88cace8be8f6de8d8596464be7ef483e8150b0247fda077f9029d02785b587947e0a2575336a5239f39ebe671
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:eQRQyi36YOcPbLvw2gAf+PN3b
TLSH
T150667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 825e492f6b89c3a9eb5b5f5cd800c82a118e6e492865eea90ba712be4d52e7bd
MD5 32e755abdf3c291cd5205fdb6730ae4c
SHA1 b1b405662d0ff19516892e0ae2a0473f63701b7f
SHA512 2eed0016c8a2667245b08e6c097aa8ffda21781b573bf14b85a1fac17a1381a9b37f22fdf27c614c89338faf58952dcf6cc0ff9a019fcbc186b55f57beeaeb9e
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0T8z8m5QKr/j:n68Qg55nhceWu7PNU3/28Q
TLSH
T1E5B55A33B2F20099D44DE1769F4A872196D27C758FE0E3DB8511731A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a6e0f24a7db5da5449eaa9197b225d662248bfd19120c99194e9aed90908918e
MD5 06682ecbf0b506913fcf4fbb552fb2f6
SHA1 f9406023d0123df7751f8a6802958f13a2545840
SHA512 893daa32cb84f1094ecbbfe0d5a742796d6005e32325ac32b7afce185cf297d3f080c3fe88be8d3c9dfefc108ac7931fd54386702e2811e012a73fb06309cb41
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99G:6y5112gYy5azzVvt69nLKnhZk
TLSH
T195167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8900620a8a5f976bbf625cc450d2123fb470d968a8a1b3e2bbc8173aa426a064
MD5 115e45eecf2235786f568607009eb846
SHA1 156475969fddfd2545f463bc8252755f66e1db1b
SHA512 e2210b5444e1a5a52ef0c8bf4c4945391c43b225ac9a42e0f829849c1d53b2c54af6535c24f632bb4ada3e4d5a462a3c2476889e1e3150b5f42b4504a41a7e2e
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glM8Q:6u6Jmdxd2dP
TLSH
T175D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e7c4b4b95a88f733fa8c107e961fa41a4a27d1a911dd8eae25b605dad94c9632
MD5 5a97213510060d36b260dfa9c9e54877
SHA1 10eba558b3839a0bedad6b59098bfc0e8fecb381
SHA512 c4f1b0051b7d6ce41c1d8c8d6e1a7ee45cc43cda4d05cfc7a8d0de5777d62fb4655104e610c2b41260f82fc5d28c94297b26faec4c02dd5b33c176ef89cb46ce
SSDEEP 24576:/hv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx388z8m5QKr/j:N1hpsNoJpF1A63U44CwH7R4xs8Q
TLSH
T111B5AE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3255cfda6dbec7049940c41dce87fc83d054e9c6129e898aad957fc92065db2a
MD5 83dcffaf2100c1f35337f4cfdc5225ce
SHA1 4957d943660a6566fda253e3f4c6d6559629e93e
SHA512 5179cf50e34a9d458588f12b9f12a63ed5722d894da66988cff07e3a0d7fd03dfd301206f86a3f440a8e89b5b6c5076b400b343a55ddf2be4812a8b58d849a63
SSDEEP 24576:r4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnqj8z8m5QO:lSuZQIY0Be2KcRVtOnks6NMHqj8Q
TLSH
T1D8C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cd69df02ed83ca46ed696692ba613cbec68b075de665e4175fed7c8b5fc51938
MD5 a7def5f63a65caa5df435a0c31678a21
SHA1 b86968252644569388fc956353e30ba204318f7c
SHA512 cdc6578f00c448c01c8ae5e1c4a6c9815272ba4dbfdefec264e100c196ed76573f97ae787c4e71b0d164fcb85f2712c7f1c3d6b79e6c2ff74654ede8057017a1
SSDEEP 24576:ihiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QL88z8m5QKr/j:ihtSn8EApI0fig3giDn0AP5wQ8Q
TLSH
T13795BE13F2D901E8D05ED078C7468632EA62BC150B35A6EF0A90B7561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fe4aec8eb42e1e8940980968e6a87f77036ec67324b63446708fd88e7f87da50
MD5 534ab126d94a367e9f05c10e6334bafb
SHA1 a194723aaf7caa6ee2ee5c6a159eca1303ec2ec2
SHA512 9e940d07bf16936172ef4c9bf93a5f01bd63544c6349ea2343d17ff651301a945e4eb3192498d7e0e4e20e64c11741a02aa73ddf336aceb20e0090f58954c149
SSDEEP 12288:C38s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:C38z8m5QKr/j
TLSH
T1F4552341BDC3028EF723C47E82590646F12F3D50794091AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 69318e1f03d04a5d0bcdb167a6aa7b9fa70759c708b28f444a39ccd2ca407f1c
MD5 b9ed74338d49b2f29cc5cd406c499da3
SHA1 5d5b4bd08eb4a128f5263745d2537591aadfe476
SHA512 5d81a5021776e1130f07e11efca266bae1d17b9563f8515507e8f859a2ffc77098ad3b30e45e93b147cbbed2a708786038d98ade0dabee8461cf79c3362393f1
SSDEEP 12288:H68s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:H68z8m5QKr/j
TLSH
T124552341BDC3028AF727C47E82190646F12F3D11754092AE5B29662743BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 09f54b103e9ee625e576bfe8212e2108d93c541d44d9e90489199b8e1a0c2ff3
MD5 3c5767a995e74f1efd625a592d679ef7
SHA1 d52b9a5b238c2b732ed4c1760c5aa3ed536c6f39
SHA512 ba974abaeec9f9f0b86613174688fd9ae61e24f10f2cf21061c14cf7cf7adffc312bd8fb6932f58be5d97446ae87f749c352a687595c8de4f62f35326b1a40eb
SSDEEP 12288:d08s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:d08z8m5QKr/j
TLSH
T1F3552341BDC3028EF727C47E82190646F12F3D50754091AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a8a3ac97507d54658d60ef4be3dbbdec0246b189dcaab27b601452516b3686c6
MD5 20acedd9773ad6104a4aa73e9de8a794
SHA1 5d04acf661ae80f437fb5206bdf33ba7df1f6aaf
SHA512 4d97d780c290362b39865aed2be5143c1677f482fb69428baed4426922913863e9cb60ad976592b7407fd93752bef8521a3d9fdbb33acaefaad1dd11f2fe7a08
SSDEEP 12288:yV58s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:C8z8m5QKr/j
TLSH
T1315523417AD602CAFB33C47DC5560646F23B3C50761093EF5B21162A0BB9BE6B536BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f2c5b73936111e51c5ac6156ae37db8b092f9722c4e49497ed26e480059864aa
MD5 956900575fa569c5bf472f880a35b645
SHA1 1f4a93d1820e01c587bdda48420d7d39966c484e
SHA512 57fc283b3cba2fabf55158855672c95149645c4dd48b74e16efd876c0dd6a7688ce55bdba8b6d5a6224cc5790dc2ef198b9deb17febabaa9c8be6e81a9a2cb5c
SSDEEP 12288:0R8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:0R8z8m5QKr/j
TLSH
T1EB552341BDC3028EF727C47E82190646F12F3D11794091AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6b7074e1990315cf4c06900eb127dac7050bd3a6b3e883f8b2472abba0e8d30d
MD5 ace50fb3a62c35ee60f00298a08f975a
SHA1 fcecca18a8e5c13b7ec19d61830a24ed47d2cd56
SHA512 e99b80d73bf0145291f238ca7fee7b067a425c9f395f34a1745e723f2b86902ee8a027ad1b3f3ede517a288c93e298f49e5c7ff7d27f6a172ac0f2c8375a8fdd
SSDEEP 12288:HO8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:HO8z8m5QKr/j
TLSH
T123552341BDC3028EF727C47E82190646F12F3D10754092AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c29853aca308ffc03574516cc549093555ebf61b242a9edb5df3680bd244f26b
MD5 7272c5fbc5dd7891c41eb02e67225700
SHA1 1716e0cf89886570134c091fc0abb3b8bba6aa08
SHA512 106366fc7814c1d4b7506afba0988d8df772b39c18b75407f6707a468577916618569938258226c781f17145432127c09df1810cfc66eb4ead8f875658a955f1
SSDEEP 12288:Zy8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:Zy8z8m5QKr/j
TLSH
T109552341BDC3028EF727C47E82090646F12F3D54754092AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8da76db92ba68251bffea0caa7600ba85941aac0ebc23ac4d8add4b7febbca06
MD5 14e890c8c44212f51e705438349a4e05
SHA1 499531a6ff181f86bff62a33e99797609cc24430
SHA512 1ae140da7ebda14003a3b37feb7249b4d19cea007884f42f85b695fcfcfcb1dfea441721f58294762c299d13c4e96950b3fc5522350ab143e652a2e99a5bef68
SSDEEP 12288:AiZwbVzzFEoS2cPvya8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:DZMRzFVSOa8z8m5QKr/j
TLSH
T1E6750195B39018F8ED27813EC9158906E2B27C191B60C65F03B436275F773E26D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 996357fea6d8996dc2a19e56577f07343f2449783c6b03afc804a4825d90009c
MD5 9cb3ba9f7d1b0d016c3f6f7f6bf662a8
SHA1 ab588737678ec4673f1cf08e23071c42a0ba5cfc
SHA512 c6eb8207164209bf7d44536b06e2e13c41c9c6a0b717a22ce8b87e7637e44fa9feffdec044c5818c7da5d20cc7782a4950af8c3d8a85a5a085087353729ea800
SSDEEP 12288:Mz8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:Mz8z8m5QKr/j
TLSH
T12F552341BDC3028EF727847E82090646F12F3D54754092AE5B39662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f4a6789cb63ef31b8f14285fecab0e4d860066f040177f06bb9e3c9f40c27cb2
MD5 5e607df08b653efacd2cd3cd6f20b4e0
SHA1 634cf4120fb5c602ea75a1e6fb083cc811da3d03
SHA512 ad46efc4e2302476aa915a964765491314a043b03b28c3e758251730d90026c29a157a30460f90b9dd4ca610a4c1e06527dc6c47ddff03268bf0ada5974ebee0
SSDEEP 12288:Gf8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:Gf8z8m5QKr/j
TLSH
T1E0552341BDC3028EF727C47E82090646F12E3D54754092AE5B29662743BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 569342e94fd98bb6108576982a79478d2ee2f55cead44014b017f7fa488ccd56
MD5 81dcf9e3e3202eb314ac48ce877b2887
SHA1 5502cecbf1d167928b2b2c50d502389ce0d88cf9
SHA512 342931d4a5756f4fd1f64ca9028473f1af22265289f771fc5547b5f9c2110decd3ca786ac38aeb9bef5fd3846e5264b9437ca9f3cb6f86d28cbfc6210968ab4a
SSDEEP 12288:myPz5L8W8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:bzyW8z8m5QKr/j
TLSH
T15965020377A221E9E2378139C9560A06F3767C3117209AAF176447771F776E1AE3BBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3a6ed6b95d22c7430939f17dfd3fd8fd125920ec897aa644be1462b4be355c12
MD5 0b8c5aaafbaedb8b9a8ac41625569640
SHA1 8ecf2b64f4098a953f08b26aa3d798ac150491e9
SHA512 c6c5886644c175f84ff1c47bcd2d9c277a8b44161b33e716a330bcbb3f24ba9bf78173ab73d1ea27c5cba7d3cdd9e25e7ae60df08a835f40c0ff124d12b6b026
SSDEEP 12288:Qz8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:Qz8z8m5QKr/j
TLSH
T12B552341BDC3028EF723847E82090646F12F3D55754092AE5B39662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 92d84f06a227563b3bcc3da76c29a963f55d7cd4c78c80beb387ae046a481487
MD5 63d6fcbfd3c7809f76ed9c3f8a455df3
SHA1 08c6f49f79e780d043f6eb588c4167bda66f508f
SHA512 8a5f051d5b7a3fae4c44ef72dfcbf023d62980c44f425fe00c5ff2ba4be5b89e55df0a3010b6617f0f7aa94c256e9949971829c808fca78d677216a9f88aec06
SSDEEP 12288:zz8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:zz8z8m5QKr/j
TLSH
T1EA552341BDC302CEF723847E82090646F12F3D54754092AE5B29662647BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fa763d2f61ea37aad58b84a8eca069f5a6c92b150ab039a7c812a8952bd5e3e0
MD5 445bc75bc200310da82580d0f87922b1
SHA1 6895eb05c3f79ac634e0b9b550162dcac59b9206
SHA512 ea5c2c23e10bd62b375dc7c05e39045dadbedaf95e860b3dbe84da3fc37db71ae484181deabd12013e5ab7d910fa4a6e95284c3a462d0adab58374e3305e4474
SSDEEP 12288:myPz5L8W8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:bzyW8z8m5QKr/j
TLSH
T18265020377A221E9E2378139C9560A06F3767C3117209AAF176447771F776E1AE3BBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 29310ededa85b70da56d12d719f53282c62fe986268778b769741f5b8b927cc3
MD5 914456e1e489e3b2acefb8b4a1d01057
SHA1 57791f442934810535276ba1ef14fbc3bac07dc1
SHA512 d285b96778fc4b88cf729e4bb8b1a0a10bcde209340e64bb166e6a05e325271c9724b3612f51b17fd6a1f540809eb4005e994500cbd0bcbeb8d22bcd9aeb3697
SSDEEP 12288:9Cd9CWYoaLHF3z0z04PDvhk8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:oTDaLl3z0zDk8z8m5QKr/j
TLSH
T193750295B39018F8ED27813EC9154906E2B27C1A1760C65F07B8362B4F773E16D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 33c6a5ea201e8f166b106205b1c7fbed1b8bad6292b848dec3f50d3b2601a6dc
MD5 0588c9301b950a824be98b1e9ef028fe
SHA1 7e8fc474ea747036e584dca0ec94693281c7cb53
SHA512 237dd6c249be916ba75fa47a36e372c044574c3760de25ce214e1f4efa13b4f4e588ecee87bc8b9ebe3627bf30ef41d414c4415e1abec41088667612edadc05a
SSDEEP 12288:yi4e7KRdTfgwCHKy7GLbbdIvF8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:y3vd9CHKy7GZY8z8m5QKr/j
TLSH
T1E385CF90F3E410E8F177DA39C9764502DA767C591B21DA8F03A8661A1F33BE19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a67140dfe2b860461f3da09bb9eebe1ffe527a102959085b6b9c928e860010e5
MD5 6cd04021eaa240eed527fbb03006d86b
SHA1 9d00bd37a34818e8f6f3da959a63eaefb56da849
SHA512 8050310946413ad3314e5293fd1e4a1a9be2a5efc8067675d571c57bece26ac27dd16ac89b4aa55c3cf419fd8576c7726cc7669049b0201e6511cf7ce5739a09
SSDEEP 12288:3U8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:3U8z8m5QKr/j
TLSH
T1EB552341BDC3028EF727C47E82190646F12F3D50794091AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 50066ae9659a04d698b2af185be375380b4c0cac36b86571a67989f12073df31
MD5 e2511c76ae7b54c4d58cb843474a83c2
SHA1 9f6a30db3a8887f654e804664fa706af8286b9b4
SHA512 70f93b29ca26d37798ceba7ca09fd05eb65b8a83c588018552dbd784491315c49726f0cb3edc5a06dc77b5272fb8683f04d7ea46a0ce00297136b8b4523c6aca
SSDEEP 12288:D28s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:D28z8m5QKr/j
TLSH
T106552341BDC302CEF727C47E82590646F12E3D10750092AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cbd4e963808f0995b596796b5ce734b8cbd3fa168e13c392238ca6873218b3eb
MD5 fb1bcd2ab4ed3220e3358a2a8be5014a
SHA1 6b6acdf44966bed4420ef5f44f934e6a02b947fc
SHA512 7e2a6b54b6acba83df6504eef9f972e2bdcee804e05afd40a8639b43a7f1868c1c79999b03e4203a822134e78611ac741808946a5508d933ff6c2af855ede281
SSDEEP 12288:4F8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:4F8z8m5QKr/j
TLSH
T1D6552341BDC3028EF723C47E82090646F12F3D54754092AE5B29662647BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0ea149563672ecb5ace2c7fd91318193f9f22311ed0bc27e77f29672477ee25f
MD5 2ab684046c9a80fe00916abea26f8ed4
SHA1 17ddc3ea534ac61e6f194f23f9770e2d2acdd60c
SHA512 0ea0222958c233786c6a2e40ac82cf56aa236f8c6d19c4bc9cad5a60cd2ba5eb410b0488c7c02bd8598d550c41b9d7280a84acc19e660ceb2c2cb90b379447fd
SSDEEP 12288:fz8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:fz8z8m5QKr/j
TLSH
T13A552341BDC3028EF723C47E82090646F12F3D55754092AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3994ce0708bae67b098735a164b8554277d0ece76bedf5bffd7fbb573c4d11bb
MD5 18ada99973d5a534fca2186b4dd21cec
SHA1 42b0a22cacfa2dc3b7ead7a5284cdd7fe22f0f27
SHA512 164b0246f36fb04983815f68453af921ca7977f2f7e5cb668d6ecdb237a7ddcfa19fd39d572e13b8bb4d3e26780e487d91d2d01d6f24e91c36c7005247fce2c3
SSDEEP 12288:fU8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:fU8z8m5QKr/j
TLSH
T138552341BDC3028EF723C47E82090646F12F3D51754092AE5B29662643BDAFBB6376EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7104ed9d2af0cdded75f816f0e051339d63a825dd0671e233e67b00a65bb52c2
MD5 8ad6a47c2b7b03ca4b74f1bd1d72b9ce
SHA1 1618879bea67513ffb6f4d1806aca818f39e772f
SHA512 e0b6ec253e44c2c6931fe60d264a39e42e1d7d6b0665474134e086c4bad2bda1a83f75e5685023650717651e77d9ad8f14fce53328023e16f62ccf5a66213371
SSDEEP 12288:6fwvD5ur64Lk3tRX69qkyAI598s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:6fwvUk9RX6wkyAIv8z8m5QKr/j
TLSH
T12585D029EBD804D5E177D13C89B7460AF6B178691B31C2CF125A536E0E37ED4AE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 22fce774c2f4e37d7b6318fb3b1239d3ea02158bce23b9cf07be886edea627e9
MD5 ffc4241f76d1da7ed71eaed06ae4fcc3
SHA1 2cca6807af1b6980452aa1f3498442faab758da9
SHA512 a5ad17e11fed3a7e3e0b9d1078daf065c9f4fe6ed1cbfbff7dad7d882e054bdd7670f53c53d7773df40c4ee1de9022ab0bddfedd23a94bce1e2a3a412a12ab1f
SSDEEP 49152:pYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0w8Q:kySzP7
TLSH
T15B066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d49d9f730ac596c16b19623cb4e0e795a610c410f04da3c2ff2b297bbd45c406
MD5 8d193ca78ce7ba5aa3181de668cf1da1
SHA1 9f7d93f39807227f109de6b23597cc7b4ec230d5
SHA512 7cdb5bb2a1c89c1e3c0ed1d29b967c32c89a902a63faa6a7fac67b4bc84d6a145e99dd126062e02164ac4bf1b0f8754d92fbef6cf76b8ad4458040d741434d46
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYq8z8m5QKr/j:347JUQjTirIhCnDHUPfF/A8Q
TLSH
T16865AE1EA3EC01D5E17A927885154A5AEA71782D2F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 923a9b073c0220d158231e53c0b481998820dadf88351810d139d1657a60a721
MD5 e76bb0ed306b26d33e3d64f7bc0d51a0
SHA1 5b795e52dd4eefd31c22d1e2072ddcf257c14169
SHA512 3f79afeca46221763b46fedca0077fd1192f7a3d5298ec2f07eb5d15d17b5a827345dd8d568c4584ec1b8ad28a7be37dd48a4169f0584da8907997fa9d53d33c
SSDEEP 12288:ubsfj8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:1j8z8m5QKr/j
TLSH
T1D765F005E29402D8E22E9039C7564A41B3373C2097E1D3CB56D0F53E0F7A6E5AEEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 94eb369da3fbd204c2698291469d3cacd914af76b81d5313f34a150743cbce27
MD5 1440dbafe6303f98e5f92fac7d3507ce
SHA1 82e1625f7616f7b9e7b9a52392165ea20de89ccd
SHA512 642ef79aa8df7d219776988fec14159905adfd778f30f1432a09d92c0eff09d80b567ebf80446b68d98b8c94f6b1119c96a5f9dfef14e64d3093783f86f7ebdf
SSDEEP 12288:huTLQcuU3foRvPfIEiNe23JX9ZAncpo+m6wLw1j:huvQ7UP6uV9inw/m6wM
TLSH
T1E435F6007626DB4FC6A950321E36C6CCAB607D46FE04AF0772C9473FD576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5068885f2cb29e88a304a38c8f13d74d3b54ca7474054abd7353d15dda07b37d
MD5 96a26e0d63bed99a70e4135463ae703a
SHA1 947c73cac41e2a3a5e98e218900c3b3e83f05dcd
SHA512 50ce56fed35258371697c0e0a20eeedea3e2242a4ae5e035e9bd7800f9085c5729438c1c31f8042f6fcfe3c9ffe764a2f0d6276afaad5950a75632183593cda0
SSDEEP 3:OlH/lqVEa/lbwfbS1bl3y8Dl63mCllltGlslslslslslsl6YmrQlll/l:K4Ttb0WrMmCtEEEEEEE1mE1
TLSH
T1958192654F4E9B78D915E8B101F66B662372D18A20C687A75180B49E0E055A98C1276A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aeb34966da2f2ba8e07bb0269db9e750561668ad72a7bcfc9ec6bf1d5868cc98
MD5 626d3f4739bebe09d36e322a815d2221
SHA1 ec83317be076ec26584d18d50a9adb310a8abd43
SHA512 95fba28776633b068846177fb388c37c7df3706c9d491c5b616a2dc779aa73f810ed39614c6c778fdd534dd80a4e9bef6190c5e848d00631197419f684af2849
SSDEEP 12288:oW+MqYdLbUwyyAO6SxNJvve/zsKSd1YvNGfrBsEpckqHJnQjbDluSk/Xq4QhyHtL:oWClRHcXne/zQd1Y0S0ZWXef7TU
TLSH
T146652A015177D74FC9BE5037073296CCAB68AC02FB497F02B3858D399866A5EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 244B
SHA256 d0f615359a2474b62df358972401a54418fbfda1a0107eda45733b6aabd13918
MD5 b2cd8bbb83f6da87a0dc33995dc0e5b1
SHA1 41458de58d5d0d2a673d0f2fda0515a88d26349b
SHA512 edceb5700bc58369f32946e1b984b7d6e97f95ed5c32731ecf0d6ed7d2a3ddca17ea82c0dcb865a5b992f178464c6d3e6a51685e5485dab1326ff6b55930f6a8
TLSH
T11DD05E361A192EEC206F40993749EAD15991044D8268B6B4A2EB00C0766E8A163ABF9A
MD5 SHA1 SHA512 TLSH

Submit Download

672e7d093ebf6fe8.bin

Path C:\Users\Admin\AppData\Roaming\672e7d093ebf6fe8.bin
Size 12KB
SHA256 aa0ee1f2ee80382a453107748a4e5076a0cd9c2dc6c0fed841823e6f9aa2a711
MD5 bd647733afd642690f33a509d50c3d57
SHA1 9c53015553a4417d3b5f5ec33edc61f4590185e3
SHA512 51a51c88a194a4fd49bd726e0ff96e5530b1e5919e15c4e091f6afadadc1b43f2a7d09e55b69ad464ac6dbbaf5a0976334568e102c4088bd77be15709ad1e2c8
SSDEEP 384:NJyV8rjI1lM1U/sfpnqNzY53XqEmk/MzNJDYJLin:uuI7MW/sNut8/GfcJin
TLSH
T1D642C193300A9F609401ADC0DD52894324A959B7A5C6A8CFFFBEC08FC8491D59F7865C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c7d4793ed499a67ddcc13bf2c5e5c499058b2ac7c4158de26afea86676f60777
MD5 d87370d025aaf29bf937a0d753b895bc
SHA1 dcecb8193f0caaee638fd297276e05c08c3dbc10
SHA512 a9769cde83ccd38de72f4aeb2545c112d656c425e26691f3192111638f7076098bc2298d0c0a4ef63b42e74f001677ea7e09bf1deb07f084ca3eccf0c76c5f00
SSDEEP 12288:6F778s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:278z8m5QKr/j
TLSH
T146552311ABC6028AFB37847D411E4605B12F3D203B00D1DFAA25666642B9EE7FE367DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 153341cb0d59b8362ae787e144ff0aba20f28777548bda79c01773a60dd81f55
MD5 3358a36f6da442bced6d99ec8f052c3e
SHA1 70e06965fbf30fc8000bc17651fabd10fd1936d3
SHA512 b72a48c063de456f0cf1774f3d1322b98ecf9121d83f68c41913d92e51e02693011ef17f34c09f176a10861b238da5e6595255d049b5fef5c2d3b01eca5daa14
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYt8z8m5QKr/j:+gb4mBIBhGFq8Q
TLSH
T1C365AE1E22E802F5E1F6D2B8CDAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f52c53282c6706d251394eba3f6f79c3b55fae87617e6936a42e89882cfed125
MD5 988db1cdc5dd087e28332c4ca5716465
SHA1 d62bfd549ce66dcc8edb9311a0c0dcbc0486d057
SHA512 f07df995ffb8f8ab4ed27da00616abdc1a6f316e81f8dd551b207c0db26f89771074453730fc566977fd2305374e54f56bb46d96d84efcf60da86d6338bec285
SSDEEP 12288:uGn88u8FpJqH12mqQyizr9wA5hUo7WCma8s/DCR83jKj75jIVeYHJVirBkVFu5Kt:uG88u8FpJqH1bzria7/ma8z8m5QKr/j
TLSH
T1A385F16176E101F5E437D0388A464663F6B2B8211364EBDF07A88B561F33AE55B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 38cf552d66c50225ac37a45c6169149fca4f5f65552e263add8027acefdf37ad
MD5 745ba67c8b2a2886d08fdd7c3fc8f98d
SHA1 3b9c847279002cd3fe2384ef7a59fdc1e283e70f
SHA512 cdbba54e084495edebe60c388d68af0f03d9af333acf3c0d5dcbbe074c3a75410807a1ece2db9a879b43fe664d37e42fc73fda63c376dde5abe63bd25e444dd2
SSDEEP 12288:IHvUrBFrEjwaQe8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:IPUr+NQe8z8m5QKr/j
TLSH
T1FF65E11B26E918E5F636E07D85864709F77278621711D2CF02A0817E4F77EE8BD3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 236a8466ca30f6992a29ebd2124793b01990e9ad1896b0c6a26335eaa0782534
MD5 6feff9939551bd66f9df5e2b1e9c554c
SHA1 de9c7b2c60fa1a55ab906cf91ddf1751c53bfdd7
SHA512 194a697e8cf40adaca28aecbf148645d366c29ef77cf3b1ede0d36b68c8283b98ef0a50ffdb97bd9595b1cf4085d6f81364434d3ac1f390a99d8489b7fddf0d5
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjO8Q:VG05lO43bc
TLSH
T17BD5C06A62EC11F9D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 574133ec7fc5f97642e502d74968b99efeef0af894c28dfe7f6cb302a5d2d8d9
MD5 c7dcae4f9b4eeefd3bbc61e1ce6d8330
SHA1 134d9cca37e075c13afaa55ee5fdc7194e957934
SHA512 05e13ed7e82311f25a11944f636ac3c09a399c26a72a8d9b6484c3b080bf924518df6a19e27614245805d6f8fcd33becd8f7435260232774b91868a0f3f95cde
SSDEEP 24576:Xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnw8z8m5QKr/j:va5POZ3BJt2pasx2+m28Q
TLSH
T10165AF5EA6E801D5E67AD17DC583461AF5B1342153319BCF022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 856c4fedf65ca12f151f09c25bb6c77cd13ca5f80391bc2b5bd0149030c47b3f
MD5 1bef2a24742c942055dcfd2d61811114
SHA1 a3f19a48e5bbeab7d644735ee90d54cbcf7e2c2f
SHA512 f66ffc5bf91e959e90cdbc3fb1205579d0ea31426b26b997028b8ab5487e897732fa7e9337428641df8f3dd76271805a1cae6dbf6eb8787e9927ff9931eb9030
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7Fki8z8m5QKr/j:2Nc/zEOVHFF8Q
TLSH
T1A1857B1623E901E4F6BBE1BE89779546FA717865133086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5ac8eb2a79fa8f238896abca415de6e9be839d890ee620345c464f06b6641163
MD5 67cb25b3e36ec9b0ca649004c306b060
SHA1 e242c335dff7d359335dd4c3e247da6d56ff0855
SHA512 68d76bfaefa2f7c77b9b4c97bb6fe5547cbd68f7b7485a577984a508c05616b4e1d8e3e2b7e6e02154ea401c905faf567ef80bb9b86d12c46d8799de3fd9681c
SSDEEP 12288:KQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17m8s/DCR83jKj75G:KTkNvNnaFeYhJNtmZBmY8z8m5QKr/j
TLSH
T1FE55AF6EBAF806E4E1BAC575CD238512F6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 757d69c0b05df6b48145ed9ef37e75cfa1d0913dfa3942410790bf0a5ea74de9
MD5 1913cc7a5d59b01d529f2a331e63038d
SHA1 be796c35c27e4afb20163d1f8b99b440cf61d50e
SHA512 702f49f4f6190f10a7c57fc71e0287fc4799414b4dca18b2d163ee79f5d1fca91927592b3d0e7b498a52d110e57543d247cde0075fdfe2bc0110b774b03c0e97
SSDEEP 12288:2QcMxWDXN1Dp/fshBItT1IQgAX8s/DCR83jKj75jIVeYHJVirBkVFu5K+zO:MD3FHshBIYQgAX8z8m5QKr/j
TLSH
T1BF75E17DEA9D00E4E53BC1BCC6534A06E77238A9032156DB069481BA1F7BEE47D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/248-337-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/248-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/248-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2836-143-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2836-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2836-141-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2836-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2836-135-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2920-11-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2920-17-0x0000000140000000-0x0000000140634000-memory.dmp

Download

memory/2920-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2920-108-0x0000000140000000-0x0000000140634000-memory.dmp

Download

memory/3440-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3440-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3440-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3440-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4416-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4416-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4416-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4416-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4416-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4604-59-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4604-49-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4604-55-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/4604-61-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4604-48-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4716-86-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4716-92-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/4716-87-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/4716-318-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4836-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-321-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4836-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-116-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4836-110-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4844-82-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4844-313-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4844-74-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4844-76-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5172-0-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5172-34-0x0000000140000000-0x0000000140634000-memory.dmp

Download

memory/5172-9-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5172-8-0x0000000140000000-0x0000000140634000-memory.dmp

Download

memory/5172-26-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5684-64-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5684-70-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5684-63-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5684-293-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5788-122-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5788-324-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5788-129-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5788-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5880-336-0x000002476FF80000-0x000002477020B000-memory.dmp

Download