Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/10/2026, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe
- Size 1.8MB
- Sample261004-mffepszy8r
- SHA256 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6
- MD5 4b3c50461118492d595024b4deb07ef8
- SHA1 8298d01533ca2509c195dc4c86be7ba21917475d
- SHA512 53c3a097a90c289a6190fc87cc9d35ad216f03075da8e29dea2f8165fcf18003e977cb254fb6a48a901ca2fdb848a930277fe6a4c0c9282d157264d0d9014894
- SSDEEP 24576:kOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNVqdCN/j2GLl3iFSE33b9s:VHPkVOBTKHN/j2U4FH
- TLSH T18695F1581BAB4256DB5877B9C8A6A69409090F436F18C0B15E311E1EBD2734FFC23EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5868-11-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/5868-102-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit - Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/5868-11-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/5868-102-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat - Executes dropped EXE 11 IoCs
pid Process 1108 elevation_service.exe 5704 elevation_service.exe 1500 maintenanceservice.exe 1408 OSE.EXE 4932 PerceptionSimulationService.exe 5152 perfhost.exe 5148 ReFsDedupSvc.exe 2156 SensorDataService.exe 1912 ssh-agent.exe 5048 AgentService.exe 2664 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\R: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\H: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\V: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\G: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\D: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\K: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\W: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\L: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\M: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\Y: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\B: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\T: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\J: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe \??\F:\ 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\Q: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\S: 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\AgentService.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\vds.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\vssvc.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\wbengine.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\770f78907465cd71.bin elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\snmptrap.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba9f4186ea53dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000838f7b85ea53dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000150b5dcbea53dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeBackupPrivilege 5148 ReFsDedupSvc.exe Token: SeRestorePrivilege 5148 ReFsDedupSvc.exe Token: SeBackupPrivilege 5148 ReFsDedupSvc.exe Token: SeRestorePrivilege 5148 ReFsDedupSvc.exe Token: SeBackupPrivilege 5148 ReFsDedupSvc.exe Token: SeRestorePrivilege 5148 ReFsDedupSvc.exe Token: SeBackupPrivilege 5148 ReFsDedupSvc.exe Token: SeRestorePrivilege 5148 ReFsDedupSvc.exe Token: SeBackupPrivilege 5148 ReFsDedupSvc.exe Token: SeRestorePrivilege 5148 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5048 AgentService.exe Token: 33 2664 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2664 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2664 SearchIndexer.exe Token: SeDebugPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeDebugPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeDebugPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeDebugPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: 33 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeIncBasePriorityPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeDebugPrivilege 1108 elevation_service.exe Token: 33 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe Token: SeIncBasePriorityPrivilege 5868 2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2664 wrote to memory of 1036 2664 SearchIndexer.exe 99 PID 2664 wrote to memory of 1124 2664 SearchIndexer.exe 100 PID 2664 wrote to memory of 3260 2664 SearchIndexer.exe 101 PID 2664 wrote to memory of 4256 2664 SearchIndexer.exe 102 PID 2664 wrote to memory of 2784 2664 SearchIndexer.exe 104 PID 2664 wrote to memory of 4900 2664 SearchIndexer.exe 105 PID 2664 wrote to memory of 476 2664 SearchIndexer.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe"C:\Users\Admin\AppData\Local\Temp\2332c55e7cd85ea49395724ae9b9ec7756ff0e05dae62d826c424016d873aeb6.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5868
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5704
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1500
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1408
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4932
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5152
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2156
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1912
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1036
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1124
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2864 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:3260
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4256
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2784
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2864 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4900
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:476
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 c3ca99b947be2f35c644dc17a5d2f7cd5abff4de6a44b2ecdff74c477c8f59f1
- MD5 2e1148d0b7286a4d723832f1e7ad8e8c
- SHA1 89768491f1e31f920c2683ed4ac350e151bd5c9a
- SHA512 759eef8ad3d12a3a58fc9da9db66aaf90080b31a7206b19b0ed98a9489b2b14d89241acfbaadaaf1d42810c413bc83b6587ef04e57b16054c6dcfbf359fbee1d
- SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnGN/j2U4FH:93q6HjBzj2jF
- TLSH T145D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.8MB
- SHA256 41c8d2f0bc7ffbeed1217e74c3a4fd9188ab0bb0c56832e9fbfe76b8333a4191
- MD5 1d10c6e907842272c69d8acf2e6ec42c
- SHA1 cb3146bae86680f1d4b83b87d19fc09c2792bc16
- SHA512 6d49ef4c4d19c88e1237a79026cfeffdb3e20df8187cbbb726f58af899ff6d5ba0ca77aa364210784648f04ff7ec54ec546277fa796c74895ebbc63157c6dfb8
- SSDEEP 12288:51XLsswWkxy2lRq2czAqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XXYfDtczAWdCN/j2GLl3iFSE33b9
- TLSH T1DF85F128B7E409F9EC67827CC9A2C511E632B8948760E7CB03E499661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 f3f0b2e70e48c59db05374f94725360aa60beae3402cf3636b5487c372526b6e
- MD5 7d65f5d039a15ef4d407412d8a82824a
- SHA1 37431eb14ceb76bafeea66f50e73475b87030c8d
- SHA512 d24f47b1d4486e9c50c672960cfbafd2f4060dc5d1b55b521d06d1d2da8646e2ff4ee1ebf481afc65af415fe6816c5dda89605bcd4c66e3f426c731d7831a3d3
- SSDEEP 24576:90Le5ji0hmxirMJdCN/j2GLl3iFSE33b9:9Pji0AcfN/j2U4FH
- TLSH T100A5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ddf9095344296c19f3552b0fe154c0a9380d692d64c33fd8ddfe6168730c5882
- MD5 5c1de3a2568edf3a38583a8d6fd354b1
- SHA1 1b4cbecd1ad6444d6cd29612ff572d6cc1f34098
- SHA512 c479f92834b6a61b1e9be11f62ca9e3ab1b3469dd71720f8d54a1b1b0fe4b3910d196e0d125c0fe28a3bb163e642ac787c05e58cb2156912569f041b70fcfb80
- SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyuDdCN/j2GLl3iFSE33b9:u/ezSC6vUzPvxHjy7N/j2U4FH
- TLSH T104755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 41017d82a99a439a39924157f50df6eeaa183a1a8d6ad442cc32d479d501aea4
- MD5 117d34169a8e8da97633279c3f6907fa
- SHA1 8bccf3b83c42cf3dd9c7d507e888e44aac42fc53
- SHA512 fd06171a42490330b12c3af3630f2b795b76cc25efe072ea7f80d5dc361da72824fffc32be5c2227ee140ed1b077338af5959c7d0d7c551c0c008631a81cb82d
- SSDEEP 24576:jVbqPb88hv/l+6qdCN/j2GLl3iFSE33b9:jVO88hXl+aN/j2U4FH
- TLSH T1BD559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 15e306f2000316c3cea3949cbd8f2f4c567ec6a87fec761f5bb882d4505966d1
- MD5 6a1cbdba49860e7f5a10d989c05b82a6
- SHA1 b0e7ca255465144433bad161ebecb70fb4c8efd9
- SHA512 84d175bbb460814c7f64a95b41d64ba6e627f4ef5e66e24c4ed57cffe69443549ffcba47698367372be5435138ac9fc443c939edeacd6be62d4450cf3c81e9e6
- SSDEEP 12288:HRpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHB:HRtdCN/j2GLl3iFSE33b9q
- TLSH T17E752364DAA5B565F2AF837903AD9E616200FEE8D925884782917BEF113CFD8D037063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.8MB
- SHA256 c6c1393153a3809b407cfda04866e00a9724d62e81a32dba52d6ac59cebca1f3
- MD5 6bb6e41375a424a6a7402295eb62c511
- SHA1 107ad08839628cec00b423e36f8b553ff3ce671c
- SHA512 209a7c4499c205f5e578d927269549055ce71ebbec9b5299338eeb363ea8c00c849252ea83da6c35eac866819e68f6465ac9cd8dfce9ed75dcc4283008c0dc6e
- SSDEEP 12288:0eBNUbTVO86UOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0JIUidCN/j2GLl3iFSE33b9
- TLSH T15285CF3BEE28FCD2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d88aa0491b0940375dda5c8ad6b442e233eb1df39fa0a4f324da498a248de002
- MD5 6cffa2ecef1aaaf4359b750302f3f3a0
- SHA1 a539eba6af0e4862386fc48596982aeaf244f3c1
- SHA512 331ee10a794d78b3ccbe49b1221a7c236a0fbf1dd1f5a4185e4c00a6840b493356c33afe6d15a5522202e072e504ad057e0eb7a99e94f2d85311896347f448f1
- SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:VQvGAdlCEL8c/yRNw5Csj2jF
- TLSH T133267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 4bd86434500b5016dd97a61fbd7e84c744f16dc30dbdbf2cd4710a6f0fcd830f
- MD5 85a22c59a243bfcbace57273147fae8d
- SHA1 ae1773bd953678f833ec3173b2a9cc84ce01dc16
- SHA512 0ca18d94edc8631a0e68f4baa828e3252d790c3a15de8a595865dfa596180d38f7c5479d367a32ba348cb6a91bf3226ea93f8eef13e84dd4c41b0a4642fabb73
- SSDEEP 12288:OAwSfxL/2Dc34DLLmt0LDQewsAjMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b97:zdewsAjkdCN/j2GLl3iFSE33b97
- TLSH T16D95E031FE74E036C2BF0DB61B36C716142CBA608B6119C3E3E85E9E59346D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 6dd3067ff847376e5e0dcf0faa63e27df13492846767f565110067ec015ef5d1
- MD5 2082512b8a122fb0c878c01395f2e9e3
- SHA1 bd5a4a920037ad14250dfdd628d508a4e4c05017
- SHA512 56bd0f5c1252593495ac876a48a899367f53d67e24c96e6aecdf51ae487dca2fdeaaec11b6a1d026ae881a1bf9be47bc2b6ac89f4d30caa9563cf0f45e2650f6
- SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJ8F:nUEtQevvqc2W1cpV2EI32J
- TLSH T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 c78c0916ac341ae61ce3d800d5fa07f325e78adda371719d5d33c6d0632becbc
- MD5 e9a2534a471b0d0241068c1152ebee54
- SHA1 0c62ec6b371b79f41f2eb958b8d9b348bb7c911a
- SHA512 3700bdeac54fdcb8f6ab09e885395d79e30510e626fdd17f313c4160b6d6642e41ef588eed0a502d0366a5bdcd1bfdc3315517acf21b84b4d162c531847b3958
- SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zvN/j2U4FH:7oqtVjnmgj2jF
- TLSH T179D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f42e17bcc265ce14cdf9b2100f1116158694c26b3d135e46fdbb02349f7f92e9
- MD5 7234bc4e60ace3835ae6277d2905941e
- SHA1 e022c55ffc2b11d42c4928fdb90422fb8b8e5e6c
- SHA512 2c3d8444f2c2b894f209b7928051b93ad072e3d7f3a6a7541f8c66a4e8f2161bd20db793afbad655f46dfe7fc78c7456cd3d4320824c0598cead8448e98b4c6b
- SSDEEP 24576:gAhGLJIFoiwtA5l7S53/dCN/j2GLl3iFSE33b9:gAMyFoiq5cN/j2U4FH
- TLSH T163359D80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 065de8dd5e553191a84e64a29cb35d9def522b4f919c059ede80cb45e790b39b
- MD5 edbb501c60e133b5806b975f6d920c3a
- SHA1 1e79c0552f0f6c2377e756eb15b51dc9d1105846
- SHA512 f46ffff5b6874371c60cd86b87ef702429db02ea98b229bc2f20703bfce85779ed21d741db0645267a7cb6a6e708adc116b57509bfb4dc6ae179754442609a91
- SSDEEP 12288:umw5HEjsChNVBFgl0WDm+C7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nwuoOWQdCN/j2GLl3iFSE33b9
- TLSH T18F85F14576E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B5F37361AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 e8203800af6233b6811cb128552b6a10852af173a5e9569a7aa3f4c898dd5c76
- MD5 a509cd66f720ebc40e48a45e82161cba
- SHA1 1f1bc2596558f3bd14e546ef51cb59a070a676d3
- SHA512 ad21c5d10cb1673f6e37a431d06b7209845cb0b9c198311eb6998aa16a6e95b69e6e6d8806d6380a7b2873b95386ab13f51bfd6839b486e09c7d211c5a381864
- SSDEEP 12288:GBZ1IycJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QZuhdCN/j2GLl3iFSE33b9
- TLSH T16075125933E471F9E1A7823C8AE59A05E320B8A5A73243CF025147EA1F36FD55D3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f8b53d9ea59b4fe6a5a032569df62d371a563ced97b62607ca04c643d6ddfff8
- MD5 c80afcce35e2a898480b09060c43a62b
- SHA1 6ae5d4fa737030a9ebbdd109f5ac578adf4d8c10
- SHA512 f44d633a42c72f4363050d1eb4c6e4c6dc471f3a9c03d0c04d66ba958e8a527f5341f5e21427a3d8a8885ec8754e0f7c8126ef5292afe10d0fc2c5f5c0daf27e
- SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:NQRQyi36YOcPQLvw2gAf+PN3/j2jF
- TLSH T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b624adbfffda2286a3b570c1dffe2019d3c4fda72148670c6ae088549dd1e736
- MD5 36e1f92b7f0ec9116df42ab736c72907
- SHA1 4c043306b5686d1aee0decdc835abe6abb6b8f53
- SHA512 0e4543b97514c679bd9c2d70599d195059f51a2a1a665bba5877d14ac9f5335409edc17ea362e45e14ad7a5ba8dda6c9e890db44005b5767bbfd6b2688d8dd34
- SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:xQRQyi36YOcPQLvw2gAf+PN3/j2jF
- TLSH T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 7ebe80913226ea14903e668b46f253e696ecf438ff67bbf22937ed8b8425e483
- MD5 937a5bec35c702f8c87537054b1d675c
- SHA1 0fbcce5444132ca62816e549b1db72d618419dec
- SHA512 da072374d3a98e9d7100a521d00fccc0c9bd039c9b21d955789dd7205da98f76336cb901c52970397eb49d7d73bb886b3831dcb03c296d2f315b3f6ebacc5bd5
- SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xdCN/j2GLl3iFS+:P68Qg55nhheWu7PNU3/fN/j2U4FH
- TLSH T153B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 377d5a3f094209fa0cd569d0a7f4d3e5e387fcadb5399ca4c701eccc3ad2be9e
- MD5 1c7783b88b58877a6b0229c3cc56b3de
- SHA1 ac422d03119e27234f4231174121c167b36c24b1
- SHA512 a73d5c7bcb243db75eb68f247cfa4d9f98ae2fc95cf62891c198c67161e78dc8c9151dfcdfb283828c2a2d411adf9e70c4da143a462f96243c332d9e07ca980f
- SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:vy5112gYy5azzVvL69nLKnhZSj2jF
- TLSH T125168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e365473b5777218f219d8628aa0de230215d5ce84143fa51357d55dd6ff3f033
- MD5 45783bdabe508a6e03dd60ed7feb5f84
- SHA1 a30bc5c1b4b8827379e05133c278b4c2e69f7de2
- SHA512 d377b80c1bede219ea67be74bdcbc9ee0f7b15969f2829a9dd735389755a099a2e30ae368433855acf4ff1cbb7fa716ed83a5f8fed4363a0dfc85154402b8646
- SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpN/j2U4FH:9u6JmVxd2dnj2jF
- TLSH T11CD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 c9835719ca75eccdcff120dd5a696019f8e419e1af560ea2b5a9564126ee1b1a
- MD5 fde256f41a84321a64a0c53f3a85662c
- SHA1 fb71bed2bd48f0a21cf6ce601f7fbf8a69271b47
- SHA512 4705d7d061af09189c7ace550d4d83dfcc2c57fbeb1e24b871fb3388dc550c7f4d88231a2fc6cf667eb54ec3e86bbe60727a58169b75d5b0014456c2f5dcea6d
- SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xFN/j2U4FH:pmifPbRgj2jF
- TLSH T113B5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 7c69eb20a9348928b9a612f419d8de0aaf64b54766264deddd0f6fa7816baef7
- MD5 495eee151c01a547f688406fbb334f2d
- SHA1 c3e0d8bcf6e613e73f00ce848c0b1666fd9ead9d
- SHA512 85cc2f43dbe7e5a0d756a24c5d6e20ce15848b8cc3df7aceae3d1aec938b9ab4a2a167b10b1ef5e559309c7c7b9fe442ba586bac441d6922a6b537dfd8f3ce0e
- SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHq2N/j2U4FH:S5dKTi61uj2jF
- TLSH T14CC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 76762301466c5c2aa2f6e60bbcba3d1ea591abb1a9bdcc4641fe21c1ca925025
- MD5 b7b343c4fd086dd0345636e65256ddae
- SHA1 9345aad8dc062a4d3af227a0f5ee2cb507a3c660
- SHA512 cda62c03834cb08ae2fbe38e7c8e171baab68e04c79ca4508294b9bd3bc2bb5d4e4696a464df9e0454c7e148e03e27204afb326310742c351b7c2ebb16c9b842
- SSDEEP 49152:HhtSn8EApI0figngiDn0AP5wZN/j2U4FH:WX2iyphEj2jF
- TLSH T1B295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 1fc9e646ff2525d12a733f0343280dac721ad79b794388d897933620c0a74443
- MD5 b5a11c7c86eaeba52565f7a18d5bba7b
- SHA1 a5996405717672c11710bd8a5b299597732362ac
- SHA512 eb26081ad78179d51643d9980cf792ef44f771605d22c92986dc431a16d231085b7d45899f896c509aa7cb3579f3a9258d52747de052802b39b7005495010215
- SSDEEP 12288:hRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hldCN/j2GLl3iFSE33b9
- TLSH T1A0752364E9E6B669F15AC37943A99B516100FEE8F626448783C126FB233CFDC9037472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 206112285cc12201100bf8cdebc80765d5445217806584225ae8d7c512e2680f
- MD5 2d60f63a1a36735be6303de89ecd7812
- SHA1 d43b60cfcef68097bb0237faa5b240665348d3b4
- SHA512 c081c0ae674e8eb709269dbd7accf3c2a825bd71af5d8eefec56446736126065659d1b41a3e25530de332cc87f07f4707919732616c61572be3cd8ef74ca1986
- SSDEEP 12288:lYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lYdCN/j2GLl3iFSE33b9
- TLSH T125752364E9E6B669F15EC37943A9DB516100FEE8F622448782C166EB233CFDC9037472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 e2503e7cc398e7d77aed22f8317b0f7795a64fc76c6a166a5796a91b7543470d
- MD5 1f0a4bd1e0e3e4cae5329acabd6e23bc
- SHA1 0bf40c09fbf441be4ee73dd74bf0b9faa5bee9cd
- SHA512 301fbf3ee40baafcb0bb05d069c95e87fad5fdd3b8ce4e824c248202918c3b18859f76e1bb989615f4d4e1c657ad8580e6d021cded8ba0a19a22717777977d0a
- SSDEEP 12288:s2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:s6dCN/j2GLl3iFSE33b9
- TLSH T100752364E9F6B659F15EC37943A99B516100FEE8F626448782C126EB233CFDC90374B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 168811e7bbba42a1117bd3262f2a0e04b8dbaf0103009cc02e2d31986e2e7130
- MD5 39f549ab431005684fbf2bfc63b29773
- SHA1 c9f945ee735275f59fc7f7a0b662430c9226fd79
- SHA512 0a49285dd5064ae598a60ce08041b0e046db58b199d51f0386727b74571f75dcedae66b7da6d801c0206f9f45139d618e75e22c1ae9b7d3044132edfe864b984
- SSDEEP 12288:OVPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EdCN/j2GLl3iFSE33b9
- TLSH T1AB752364ABF561D5E06BC37C83B99A11E320FDE8E73285CF874116EB1B34BD89431962
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 9725bcd55c1dba6b0324b724d0708a1d8b8651347aa727f5c9ad06c55a126156
- MD5 8fb24c689b2c15b866d86c6eac85099d
- SHA1 c7da1266ed8f25db1569f7a8f671387c04dbf31b
- SHA512 bf75df848151b2354d9c9fb44d7764d5b1220230f5df702279014009ad52ba03fea37f6fb78d0cab6fcb197c8d4e422df081902e9233eb5a516a01e36e38b382
- SSDEEP 12288:SHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SHdCN/j2GLl3iFSE33b9
- TLSH T19B752364E9E6B659F15EC37943A99B516100FEE8F626448782C126FB233CFDC90374B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 6a17c5c0b808bde5e32525538a6de377e9066edd80b4246408b5da9f488c2481
- MD5 361a364ae91d422b1940d380cd7d0591
- SHA1 288d2363a6096a4a9eae5e910d397eee97e340f8
- SHA512 847a10af6320829522f863b87daef5d0195bd419bc992de99f60d11febba5d4314ccb1d067eecbc1f1596cc87f6b37640cf7a5edfcb689311e3ed4d10a3f19ad
- SSDEEP 12288:Q0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Q8dCN/j2GLl3iFSE33b9
- TLSH T108752364E9E6B659F15EC37943A9DB516100FEECF622448782C126EB633CFDC9036472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 dab970e24478ffb4dccd298292dc4a9c4ffc0e63bf12d2997a2290c172023aac
- MD5 af1fbf3fd9a1921af46694d865b78d5f
- SHA1 adc142d13d592075953db8a5f2cccd504d52cf13
- SHA512 81567a95afd4c0b0889278cec8c916ae22a3019373fbb3b55304e1a6fc851c9069c26edfc4629089cc8aeb4ed8345337c859aa08dc5484431eab7b901c0a6977
- SSDEEP 12288:pQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pgdCN/j2GLl3iFSE33b9
- TLSH T1BB752364E9E6B659F15EC37943A9DB506100FEECF6264487838156EB233CFEC9036472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.8MB
- SHA256 d927e8e93506ebc1a143fb5c698bd83705edc9a56f59a60dc7cb87e940e2f111
- MD5 4be364ad644225f9bb52d05b46502903
- SHA1 9a78dc6917761ef1ae015f4cf1def6e3c71709d6
- SHA512 ed74a4bda00ff6149d61eefa1fc8df699f7bbeb8d6c34d03e19c145a6947a2862f14e789eea0a9585a5654b80475dcaa8418a8b307d6f49f3ec8926fcb97c26d
- SSDEEP 12288:7iZwb6zzFEoS2cPvy4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mZMSzFVSO4dCN/j2GLl3iFSE33b9
- TLSH T1268502A4B39018F8EC67823EC9658916D271BC594770C64F03E4366B5F377A05C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 b10d29cad5941e3e9b0c764735ebf18d7aebbdeb9f14e50d67e480f39fe62bec
- MD5 e650471974b675cbf9c7569562490703
- SHA1 58866a1ec8415e7184c87858ff4dd08a5e6c851b
- SHA512 31bfb20f7658aa7b9aaf10169a6a1e06f7f2dbf7b1ab0025addfbffbb506d78d74615f58f3967eb402a7e8bb8a3fd93756b347d9e12158e040114108dd490544
- SSDEEP 12288:M1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MRdCN/j2GLl3iFSE33b9
- TLSH T16B752364E9E6B659F15EC37D43A99B516200FEECF622448786C116EB233CFDC80364B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 fa60157b1e6db7b840ee24342c8da660ceb024a8c1b469aca7c51b2d5e48282e
- MD5 341341dd2a03bf5325c91408b8b339f0
- SHA1 59c1ca644869228b44862e43392f29eb09d99585
- SHA512 786a331373fb9087b21bf3078d185aae063171320700dbfe8522d5a777844f99cbc44a71acb6fe5a14e5058cb1f1e20db988c3ece457d70f9d5c026fce804e46
- SSDEEP 12288:d5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dddCN/j2GLl3iFSE33b9
- TLSH T112752364E9E6B659F11AC37943A9DB51A200FFECF6224087828116EB233CFDC8036472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.7MB
- SHA256 375a9595de88fcc2fc06828deed46e4078dd194ea8fcc5bfb3dbdadfb8b8c36f
- MD5 b0ccaccc78a97a681fd408d4f9505226
- SHA1 bab947fee86b7d92a7acdd3118b49f88c5fb74ca
- SHA512 a4239a4e61cee5e1a082e897df0c8fb403d6070caf5c46f59a1f3ebae79f89380c28cbd708d03e8a1187d5f8310f7aa0e15a7a11b6605e2101dbf52fcb16bedf
- SSDEEP 12288:4yPz5L8cJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZzyUdCN/j2GLl3iFSE33b9
- TLSH T19385021777A131F9E167823889A65A01F331B87597208A9F43A007BB2F377D49D3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 154986e8f1eda6405c82f7f804f231d6b7fcd20a2289ea8b8f05ed44543d3f05
- MD5 7b4f3269cae5176cc25cda0dd36448fb
- SHA1 7607ba01c75a92c187d6acdc74c5999452fe3f3a
- SHA512 afd690974e63738aad568111b2f78d03f99c1b95a1509eb162e4c24b1caa619242ce78dbeb011c105521444bce6a0eeda08c6d9a27323f59d43f48edeb0bdbd4
- SSDEEP 12288:o1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oRdCN/j2GLl3iFSE33b9
- TLSH T10F752364E9E5B659F15EC37D43A99B516100FEECF622448786C126EB633CFDC8036472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 8ccab2dfe9ccb06811c1485b60cf841135f2bd842f728f3ede5bed01ccc67055
- MD5 7376f12af819666c0c6a95126304bfbd
- SHA1 cd728327791c7bae05986a304957d13afdccb756
- SHA512 330716d9d3c0b9f2d5cae7b7643057aafc95794de7cc4127619ca0144d60b3cbd7522a5650c1c6bbe53fdb37d5ec1a5119de2ee6ea7ebe0c6dea58134f81cad8
- SSDEEP 12288:d1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dRdCN/j2GLl3iFSE33b9
- TLSH T1CB752364E9E6B659F15EC37D43A99B55A100FEECF622448786C116EB233CFDC80364B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.7MB
- SHA256 f5fb5225df8483f73b3f7cf2abac7118bb37b0d5b455ea70b95134945c1fb1e2
- MD5 f1cdb71a0ce73e96cafc4da891a46493
- SHA1 06aa5916c2dbcb664d49fc3f1d891d761c28f257
- SHA512 8b8d6b77971221b91df4fbe7819fca5e5b2326dee7de2b425213c810615c3fd7aff0a2ffc03d96664e58bc985a8f4cc6d39c0c1916b2c66d4e1967134e7427a2
- SSDEEP 12288:zyPz5L8cJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+zyUdCN/j2GLl3iFSE33b9
- TLSH T1D685021777A131F9E167823889A65A01F331B87597208A9F43A007BB2F377D49D3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.8MB
- SHA256 65ca3eb67c74e55636745765466dda59c725e68e0df1156b387c13c3ede8ecb3
- MD5 47015372737cfe4336bea24832080d60
- SHA1 1be72edd3916e7dc274e65dbd0af9731729ced9e
- SHA512 1b0a03ace6033cb8898f74dc2b485f51987d030539ab4b19443d3f632275c7d636cf96db7d7421718dbb82c942101c9b601f855b1e70ae83a1f1532f2a536ff5
- SSDEEP 12288:mCd9eWYoaLHF3z0z04PDvhmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nTHaLl3z0zDKdCN/j2GLl3iFSE33b9
- TLSH T19E8502A4B39018F8EC67823EC9658916D271BC594770C64F03E4366B5F377A05C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 2.0MB
- SHA256 a91b1350bc3de2c2cbfb49bfa358860555c177ae17f2cc50250d0489bec5470c
- MD5 f44b54f4040f945f6b7b402ba7b281d8
- SHA1 0edc0df559e06632a43525b6be857b9306d0acb5
- SHA512 97fd3b26f079e959122580d306f01c2b8d0c297c67534bd9fb9859fbbd793ba195ac15af12d8dc0bc9c8111da9270805c6555ee3c1f194fbb0db6f2959c2aa86
- SSDEEP 12288:Xi4e7+RdTfgwCHKy7GLbbdIvTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:X37d9CHKy7GZudCN/j2GLl3iFSE33b9
- TLSH T14B95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.5MB
- SHA256 ba4f9835a6ac198adb9e52f2d8c1343c74a5495643aefee370c5792e5b0d24fa
- MD5 37b029a9f336083b0be9427fa1bb12da
- SHA1 35aa870fc06dcadb21c3c113d05f9ffec25b353c
- SHA512 cd87c9e958046958de0c520bd865270bf37cfa3bab298b424e42dc6baac35009fa2fb334f1cd15ceefc96155d27a8351718bf1af5c84a085e40b1aceebf55ed9
- SSDEEP 12288:1WJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1adCN/j2GLl3iFSE33b9
- TLSH T11E752364E9E6B659F15EC37943A99B51A100FEE8F622448782C126EB133CFDC90374B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.5MB
- SHA256 cf40da94c2be2ba5d810f2435a8a68f3122eaf4a7546cf28ee18829726715473
- MD5 85f335398982dbcac5a00f6ffe183273
- SHA1 86c123f2254efb8ce6210d11fe48772d0fb91e97
- SHA512 cf22f4c4811f627f652d4025359d1bf9697386be3ae74fc326e284398bc33861fb746918dc690f62a3a04df3845dd115c328b3d3f897008ce815a9b650cf687a
- SSDEEP 12288:O8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:O0dCN/j2GLl3iFSE33b9
- TLSH T1A6752364E9F5B669F15EC3B943A9DB516200FEE8F622448782C126EB137CFDC9036472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.5MB
- SHA256 a4fd0a5a68c517e07f627bb10212b35e70cf4cc8cdddbd3cc9efc326da325bb0
- MD5 d6959f4625102d5106f7e7c8f70c5e15
- SHA1 0b4955b1babc0b77b73619b62227ecd11eb6b019
- SHA512 d7cc0f9b5e279548fa675d8c6f742512074e52c8a93bbcdc2fc243d8e4030066e6a352d900e3f0bc00b86b34334067c1603be1dcd228286a3ea6b76e53c23978
- SSDEEP 12288:NTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NrdCN/j2GLl3iFSE33b9
- TLSH T1BB752364E9F6B659F15AC37D43A99B55A100FEECF622448782C216EB233CFDC9036472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.5MB
- SHA256 996e08d09fdc86e8e7cf6f510b8e3464553191923683153ed089444536b52b56
- MD5 a956870025516375dbf97111cd44fb6d
- SHA1 492ef7d3e54f3414240566571f99cc1d8fa4bc7a
- SHA512 567d5dbb85432309c8ba61189209c4011565a445c260f072ebbfae0e8f0ca11467e14efb6d9e4d7233679b48890862dcf317172fa978355abc6deacd0c7d4c83
- SSDEEP 12288:o1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oRdCN/j2GLl3iFSE33b9
- TLSH T1E7752364E9E6B659F15AC37D43A99F516200FEECF622448786C116EB233CFDC90364B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.5MB
- SHA256 78ad6515be14a8edf2e1f30ba197adf1ff1ce99851d245ac930721bb4000b1dc
- MD5 0ebd913ad97504692411720f93a05ea9
- SHA1 fbef7b63573b796a5b9bd3509877be4322ee51e3
- SHA512 5d6fa878c4b6d1d680a79ddaa01b5bd8f276019cd09173115e9001d219e1a6187e81ccf3d15c4c92a56f38b497b223fef0f43a012d29e229d28a8e812efe7369
- SSDEEP 12288:rWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:radCN/j2GLl3iFSE33b9
- TLSH T1F7752364E9E6B659F15EC37943A99B516100FEE8F622448786C126EB233CFDC90374B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.5MB
- SHA256 a5b5c5eaa9e1d82f4d135298c06dbd25ca716b34a48875991d4a2b81ab5872d5
- MD5 6f3d7ecc40c2e8c437bd53abe7356c26
- SHA1 e116329a4c17a3617b0bdc42b1c24af5273b6648
- SHA512 728cb80513c186cfb721829d6e1b1ce8d031a6ad64259985d84ab8f92ede4446102e1b38f8d0a3c97c963a36db8d5dee2953cacf6ee1fa768b16dfbbaeb9e190
- SSDEEP 12288:ONJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OZdCN/j2GLl3iFSE33b9
- TLSH T16E752364E9F6B659F15AC3B943E99F516500FEE8F6224487868116EB233CFDC8037472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.5MB
- SHA256 72389b0676160c3c7fab7b59aaca45c45c59c070f9f4e45df5406bd6b73399a7
- MD5 1148bbc9e3cb7019f29d17ccc29caa41
- SHA1 dd20d9d700473fbefb38d9a8b33f054dc3bb7779
- SHA512 98f4acdf39cb2ee1bb07eefa94326cec2cedcb533aa611fbac11c4b0a15b14520415e2eb1e4c4ae0ca16955fbfa7f5ec5caefe916d2beaf2a0aa4ad4b62cf3f9
- SSDEEP 12288:IHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IHdCN/j2GLl3iFSE33b9
- TLSH T181752364E9F6B659F15EC37943A99B516100FEECF626448782C126EB233CFDC90364B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 2.0MB
- SHA256 561e8307604acde274f72164ac697d5c8f964da01a087800e152a4033a732a20
- MD5 03d3b1ced28727c1e5b6cb4aeb362c4e
- SHA1 7b787b263073baa8056fcbe1a9aca0321319b3fc
- SHA512 2def1cb7847489ff666a0a0e05aebe8125b2779529a48f33a56bfd740b9ffa6a55257bafb1eb257829ab0bacac29d4b9f739de86bab8dc5f172ead86c7fe8dc7
- SSDEEP 24576:qfwvok9RX6wkyAINdCN/j2GLl3iFSE33b9:2MnYIiN/j2U4FH
- TLSH T1ECA5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 e126ee5438443d8cc7c9ae32a961f99abf8de88eee1e6b5fcbeaf66b30fbcce0
- MD5 bc068c5bfb0a4c09ad650e88012a8aa9
- SHA1 6bbc6be5ddd26a313d831e11b592a49abfe7f8cb
- SHA512 72732ba5741fecf69f33e26fc7efb45eaf7b021f8ea0f6b2511da96641be2b8d0a5596d4b2926b207ef827411a85a1a72b3e2a989f2161b3e83b33048a9cbcc9
- SSDEEP 49152:OYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05N/j2U4FH:AySzPfj2jF
- TLSH T144067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 1c532ef00617b4f8f77a780c332cebb36c9eb0ffffb119c76253d306e2d47948
- MD5 bc01ab4bb6419589c717dcf83c8edf2c
- SHA1 5da6521197dccc46468bf8b58aa019afbbf08578
- SHA512 c786fd2a943df57c57b2900aff21c2d9975a9415e970dff5a5f10c94c5c5ef57b3ef8ce9ce7bf309dca4c94e7bcc63e50307a141f5d3636adaf5903efbd6b3ba
- SSDEEP 24576:E47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYodCN/j2GLl3iFSE33b9:E47JUQj1irIhCnDHUPfF/pN/j2U4FH
- TLSH T10F65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 00187d68284cb22029119746b84e0400612c7d1a646f250727f1b85008a46e95
- MD5 48079b3a6de83ad9154bd23c862b12ef
- SHA1 78fdb34b1a32fbe22890048d9ba24aed28ab466b
- SHA512 ab74317782e29686d0e91aa1fd4acd94c05b6c4772319529f7eb235cfde0bef7b081f8f69ffab19f4039bd35f134d935df379ca89097e1b9cc4401ea627f6829
- SSDEEP 12288:ENsflJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VhdCN/j2GLl3iFSE33b9
- TLSH T11A850119D29412E8D06E9279C7568A41B3237CA497E1C3CB43C0F5BE1F39AD49DFAA13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 fbbbb46bc944488f6b07b95dbed42b5b6fe2a48480fec99ff9dd9857ca182dc7
- MD5 1eb18b1ab7f4dd67cefc5eace378a119
- SHA1 a09dc8a1265b86ebf8a4154b739e53e73799a862
- SHA512 ac5ea913c6617cb6317cd1fb354a19eb888b3923e58e51d9ea7dfe477a68d5338e82f64fe4ecbfdf18da4618e4ffe92470485649e694c2596f50b148dfa6b95d
- SSDEEP 12288:c5ZRUXjU3fpL5twkZtBzf6fEbliCCM5wGY8aRM:c5ZOzUPpsk3d6spiCCIwoaRM
- TLSH T1FB3517017666DB4FC6A940321E32D1CCAB707D41EE04AF07B3C9873FD576659BAE2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 354KB
- SHA256 10b0ec41b9224fae4545b6da7a279e44ad63b4c3e796b09c7a9e1bf231b69962
- MD5 fd5ab7570b4be239874b4f746d0ed0fe
- SHA1 1d453605e3afd59d1c1f03bc3b5ab23c8bf83cea
- SHA512 857bdd3475a7c300a34462551d3243af03554c19c7156c364523e6d90516045c964f362f71d7210559425615e8afbf78b245439d8a35ce3d169ce8c0503b80c0
- SSDEEP 1536:Klx/DFJBlFJd5eT/iLpgzYRL18MFJHFJGE1slwjNymg:Kr/DFJLFJXe4FJHFJQ
- TLSH T1BE74E901B718F71BC4B640734871D59B9B7CF4229F1357023BD90DA8DCB62AA3A76BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 155afa1f92d45a81a40f973f64d07108d9386e24b7bb124bd1f6d68c1eba97e7
- MD5 73365d41591d28fafcadb201126a7985
- SHA1 24be0bfb79dacfa0b764f292ece931fcfea68988
- SHA512 d3018bb2df2001424c2780134f7daa515991bb03bcf6a3eb0999620819fe6ba1a2a2bd90f3668b9d973b5aafdb98d98feba8d9efe081254d2c29a2eaa15fe0f3
- SSDEEP 12288:gM79JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH4:BpdCN/j2GLl3iFSE33b9n
- TLSH T1FB752360D7E9BA55F07E837803ADDA216200FEF8DB1184C7858167EB6238FD8D876563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 5ebc1365f4add205c6077230cab91525c8c3039e1abd19f6e96a65cabb25908a
- MD5 3f9c86dff1ce243238de4ba45d24fc23
- SHA1 004dec938074b0892df0db09e26b05b015e16a39
- SHA512 acdb33493893834e49da551ce29d499de46621e8be7f6b1cac5037912d6968bb05a3d2df9906e43eed8dd08b16e21d214b353b718015ba3f4e26ba8c373296ff
- SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYDdCN/j2GLl3iFSE33b9:wgb4mBIBhGFTN/j2U4FH
- TLSH T1F465AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 0eea4456ad0627c88c093d8c68053810634365035b4eeac981093b6111989528
- MD5 9544d6b3ef99be775dd10c6ed33b947a
- SHA1 c9e643c4a35e33e2f36349295c4307d60d654afc
- SHA512 49bda2c5b4bfe59736e84249cdfea21879472c000975cd2975f8c3a3a4ad724a8b769e1fe06cd66bf2633d78fdb041f173932b5783f1238ad74e8e0d1295c2da
- SSDEEP 24576:BG88u8FpJqH1bzria7/m4dCN/j2GLl3iFSE33b9:E7ZFPqVea7/oN/j2U4FH
- TLSH T1B3A5F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 eef8d12928cb9360e66acd97be9398999bb7640c61699696d11a4501d198d03b
- MD5 28c137be191e9e51c08a4ac09bd1f84a
- SHA1 b235fa1d64911bdc2c5f162fd436c760c01ad31c
- SHA512 c8eaf96b76d8bab9d8cd08d628d314685ad58648b4b64626922d533a4208633efbdcdbbd191bea7878766f4623e95533f229e7b1c1dd8456ca98b6d9379f8938
- SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnN/j2U4FH:gG05lO43bqj2jF
- TLSH T107D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 498177ca38b6d3640df49de04dfeabebfd9fd9350f95fdd10195b093dde67eeb
- MD5 9fdc5457c47b0931b510ec29b68f3c78
- SHA1 4dc9548c47e1655b4bd330c1a4cfd193d9971eee
- SHA512 b668a2ef996f0333820e58d06805c64d3e0c70bb23b0e860c94c9ab0cb53f467bb0ea632a18bd4aacf6cb1a848eddd77f171e6d07c72a59b59e2c479c3024347
- SSDEEP 24576:3fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2dCN/j2GLl3iFSE33b9:Pa5POZ3+Jt2pasx2+mfN/j2U4FH
- TLSH T18965BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 444167020ba293d46243b6f8abda2a8c30bec77b6e293aa2dff495c97f5234e6
- MD5 ecb7cabeb788a83b45985216245419bc
- SHA1 1b0445b63e2512d98166e4ba63c0276f7f50671d
- SHA512 7f950611f361e1b04573f23486193233505680eb8ca4fd15b3188d215258ca5c0c2b1f64a9b74b97dd455b4d7a07a774fba97b2492273efb1d0f40832249d307
- SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkwdCN/j2GLl3iFSE33b9:nNc/zEOVHFIN/j2U4FH
- TLSH T1AB857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 092e487b42e97e0cd53d3d7012c21ad3c91851514fea0eab59a44860079274f4
- MD5 cc19a2121fa7b2fd013d00f3335d26e1
- SHA1 b0d2f078acce5c3099f859385026c11580f5a7a8
- SHA512 f22f2b371291849b0f6f49fa9964712e096773da590aefda6bafca1bb4df13abe6e137e5d47627cec7b853fef75c4dacf293cfac0943ce65ec0a4497d5b7af95
- SSDEEP 24576:a8kNvNnaFeYhJNtmZBmSdCN/j2GLl3iFSE33b9:a8MwBtOmVN/j2U4FH
- TLSH T1B755AF6EB6F846E4D1FEC6B58E238512E6727461173292CB4390C13F0E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 19637580d6c7c4bbb0ddc354f34fc8070a871e02a68537968674beaf0af1076e
- MD5 d8e015ba6168dbb6df49963abc589482
- SHA1 b35c1a0cbfd2a02de19197c8b194544380131176
- SHA512 26b6711ed898e5c8c943bf9b23215c400e70b388dbbe3c2c99c5a82ccfe8a9869365ecc5939b5833c7fd2fb2a9462a189188668403c661678a03f9ba604d5c9f
- SSDEEP 12288:tHvUrBFrEjwaQEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tPUr+NQsdCN/j2GLl3iFSE33b9
- TLSH T1D685F12E62E918E5E67AD17D86868719F731B8615712D2CF02D0817E4F27EE8BC3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.9MB
- SHA256 d7b4e9690c541e5d488a6ee521956202674f94a9cc0482f4efe2ce7666c7ebf0
- MD5 cff6199a71a515325ea8673a623d5700
- SHA1 0a8c5013bc88fea66a33fed139f1be943e3ceea6
- SHA512 0fefeafac513d0f4dfb9d53b33f65750d82ca4bc889043c75b18263927eb83f84e1946e7ab910241343aac65eed882cf55e2d7fe8917f69e4646ca1a2f4970b9
- SSDEEP 24576:5D3FHshBIYQgAFdCN/j2GLl3iFSE33b9:5DVHeBIAA6N/j2U4FH
- TLSH T14695E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH