gh0strat | d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
Size 2.6MB
Sample261009-mefdbaey3y
SHA256 d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129
MD5 7ead25e1fe274d2085d67927348492e3
SHA1 b5b2a785469351c1ddab1df595ba8cffd60ab0d7
SHA512 46784b1e443969d0c5490395bbbf52ef01d302a1d4566f7aba2aa3f9c7827e8c3d05872fb363e028cf269930adbf4892c0add84b8b9b48491dda48f7b629fd26
SSDEEP 24576:Rcl1erdg0MCiVWheUdCN/j2GLl3iFSE33b9LAxf0ILuQDcQmBbW55ydkSjNYJDXx:G/Gg0P+WhON/j2U4FHLtQot65qrNYB
TLSH
T1ABD53351BF65B32AF64B9179CA985DAA4E24A7D4CD210C435F093D8F1BB97CE8833D02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3136-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3136-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2800-171-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/988-308-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/988-307-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/988-406-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/988-409-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/988-402-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3136-180-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2800-170-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/3136-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3136-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3136-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2800-171-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/988-308-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/988-307-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/988-406-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/988-409-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/988-402-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3136-180-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2800-170-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 13 IoCs

pid	Process
2660	elevation_service.exe
2800	TXPlatfor.exe
1116	elevation_service.exe
1068	maintenanceservice.exe
6116	OSE.EXE
5836	PerceptionSimulationService.exe
2916	perfhost.exe
5356	ReFsDedupSvc.exe
5760	ssh-agent.exe
988	TXPlatfor.exe
6020	maintenanceservice.exe
4860	SensorDataService.exe
3188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8bc081ca3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\wbengine.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	TXPlatfor.exe
File opened for modification	C:\Windows\System32\vds.exe	TXPlatfor.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\vssvc.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\msdtc.exe	TXPlatfor.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\AgentService.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	TXPlatfor.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	TXPlatfor.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	TXPlatfor.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3136-6-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/3136-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3136-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3136-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3136-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/files/0x00030000000170ef-43.dat	upx
behavioral2/memory/2800-44-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/3136-51-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/2800-171-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/files/0x0001000000009952-182.dat	upx
behavioral2/memory/988-308-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/988-307-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/988-305-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/6020-242-0x0000000140000000-0x0000000140315000-memory.dmp	upx
behavioral2/memory/988-406-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/988-409-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/988-402-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/files/0x000100000001b93c-418.dat	upx
behavioral2/memory/2800-235-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/files/0x0001000000006215-229.dat	upx
behavioral2/files/0x0001000000009b92-228.dat	upx
behavioral2/files/0x0001000000009cfe-227.dat	upx
behavioral2/files/0x0001000000009cd6-226.dat	upx
behavioral2/memory/6020-199-0x0000000140000000-0x0000000140315000-memory.dmp	upx
behavioral2/memory/988-189-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/3136-181-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/3136-180-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/files/0x00010000000093de-179.dat	upx
behavioral2/files/0x000100000000934f-178.dat	upx
behavioral2/memory/2800-170-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2800-168-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2800-166-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/2800-153-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx
behavioral2/memory/988-457-0x0000000000400000-0x0000000000DFA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	TXPlatfor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	TXPlatfor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	TXPlatfor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	TXPlatfor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	TXPlatfor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	TXPlatfor.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	TXPlatfor.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	TXPlatfor.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5824	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TXPlatfor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TXPlatfor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5824	cmd.exe
6016	PING.EXE

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000741c243fd857dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b206d64d857dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc686f3bd857dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f45d664d857dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7792338d857dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000065a3f38d857dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000868a293ed857dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9d55938d857dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6016	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
1116	elevation_service.exe
1116	elevation_service.exe
1116	elevation_service.exe
1116	elevation_service.exe
1116	elevation_service.exe
1116	elevation_service.exe
1116	elevation_service.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe
988	TXPlatfor.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
988	TXPlatfor.exe
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3136	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
Token: SeIncBasePriorityPrivilege	3136	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
Token: SeTakeOwnershipPrivilege	2660	elevation_service.exe
Token: SeBackupPrivilege	5356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5356	ReFsDedupSvc.exe
Token: 33	3188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeLoadDriverPrivilege	988	TXPlatfor.exe
Token: SeDebugPrivilege	2660	elevation_service.exe
Token: 33	988	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	988	TXPlatfor.exe
Token: SeDebugPrivilege	1116	elevation_service.exe
Token: SeDebugPrivilege	988	TXPlatfor.exe
Token: SeDebugPrivilege	988	TXPlatfor.exe
Token: SeDebugPrivilege	988	TXPlatfor.exe
Token: SeDebugPrivilege	988	TXPlatfor.exe
Token: 33	988	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	988	TXPlatfor.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 5824	3136	d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe	99
PID 2800 wrote to memory of 988	2800	TXPlatfor.exe	100
PID 3188 wrote to memory of 5436	3188	SearchIndexer.exe	104
PID 3188 wrote to memory of 1900	3188	SearchIndexer.exe	107
PID 5824 wrote to memory of 6016	5824	cmd.exe	108
PID 3188 wrote to memory of 6020	3188	SearchIndexer.exe	109
PID 3188 wrote to memory of 4796	3188	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe
"C:\Users\Admin\AppData\Local\Temp\d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\D1926C~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2018bc61b1c971f5c0129efa877e8d5818562a502969762c4921a8ecf4778e1e
MD5 e5c234cb8f08ae100917f98f8d900b79
SHA1 6731e14870af8d910b3a9331bbb4e6058abff96b
SHA512 55aa7ab94cb436e69ed2922381ca0c1bebc5f8a82387636474769a2e684f467f9f01c276471cf8cfa228e2529ee05d793476f75219d1f610d9c89d3276a9284a
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHN/j2U4FH:83q6HjBAj2jF
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 6b13fa9ddd6281843d7a22b050640232b49472ca9539953529a562fd65df4d50
MD5 97314e00468190da06b5e107d7845507
SHA1 2143cfb654564c34be7c18c783441a637ceb3e17
SHA512 b4d394e8266e8255dcd0ece35ae2e6efb3630a36df7fe78a4e261db1ae71002ef2ce7ac1d7bfa8bf0355923f804a4b1cebb859a06db3330acb762ad6a95a2c3a
TLSH
T139510BBA817979650486EF85ADFCBC19565C205C64FD10F83725EFFC0EBA884DA822F0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.5MB
SHA256 c9e93db4db0736f9bcc8dc6e888364ebcbe1cd977704f581d58b82f6222d77bb
MD5 569e5d6bed54a83977b4d2ac1cf1b50f
SHA1 288327ec66396c09b9f6de480723d8b031cd5c2f
SHA512 a6243116b05a20b4dc584c0a18fcc78bcc0a911714c6eaaa332e90df8035b49a568e6e549400d415a7b1aa2a4f799de09c423940ced6b0b5d5c00c4c727f7561
SSDEEP 24576:8XYfDtczA7dCN/j2GLl3iFSE33b93Axf0ILuQDcQmBbW55ydkSjNYJDXbt:7tclN/j2U4FH3tQot65qrNYB
TLSH
T118C5122477E45AF9FC57823DC9A18912EB32B8918360E7C7039499661F377C85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.1MB
SHA256 93b5eb7224cbfe5a21bc8afe4263ffbdd85a9f0c381ad64643a44c7e9b767e18
MD5 42561cd2e1fdf850252c87969bd52aec
SHA1 ea0030a6d713eb0d9549c07b5935c09b3f905300
SHA512 d3b12704d73de05de959b78e46757897255e9cfe3ebd80e4eca6f983edc54571e5ae053bcb8661a9b75027934ed49ddc69e931b808fb029653d33b1c64c993cb
SSDEEP 49152:KcclN/j2U4FH3tQot65qrNYBTN/j2U4FH:Kbj2jFX7U5q5qdj2jF
TLSH
T1FBE5232477E45AF9FC57823DC9A18911EB32BCD48360D6870394A9AA1F377C84D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4046fda38e79a55ba09714c2cc8506f754723a5dc7ac8026a2079c73de6ad543
MD5 049f87b5d6f4dfc4b58a0b0159a97fd4
SHA1 5757638757143c415f9b0de3592516686caf0910
SHA512 13760cce0d4e56b5c33a94e857689ded8936826e716d0420cc0712b720b0ca187de0d748854b7c45a4a634bcac419138b6c1ff0634aff2483b2f70af25fc0d9f
SSDEEP 24576:70Le5ji0hmxirMEHdCN/j2GLl3iFSE33b9:7Pji0AcwN/j2U4FH
TLSH
T1B8A5AE26F6748335D073C0B9C5D2A69AE93130855B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c11d16ec03445c6219e154b8b711c670976b22e439593f79747f1715116c662
MD5 0fa21e589597a789a9282ef6398247b3
SHA1 29ad49f9bb4023ac83018d67a973ec3cb088d81a
SHA512 fd32f5d5b63a8e1059b666e4e1a98d28e0dff27af92860652c688801e69eb10bb44fe0c4986580520f699d1c9191585acc8b4cce55ca022fc0b3aabd211702e5
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuWHdCN/j2GLl3iFSE33b9:i/ezSC6vUzPvxHjyUN/j2U4FH
TLSH
T155755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 04b85bf3863a6cd088f0ee0e8422fbb30dfd3cd03b5072ae543a834e6af2239a
MD5 c489569e5e025279f4fb76b9f017a707
SHA1 86d76e4a692861365fad512f326bcbf341702ecf
SHA512 e0b8e708fa14db371edf7ca6f376d804b6cf72c4c9869291c6acc4ff84c37fa596fb41dae67fb2779934f30e3ee1a44e01333a75c3c0bccb401460f8f362fe0b
SSDEEP 24576:KVbqPb88hv/l+6hHdCN/j2GLl3iFSE33b9:KVO88hXl+ZN/j2U4FH
TLSH
T196559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 7c9c6798a17c72641e59de9b1f31037ee173db4104d5936cca8d2ed732cf8520
MD5 5ef430c162e97c713429f9dd36c8dd6d
SHA1 e7a91bf54e0a7a51bbfaa11b2fc1af58859d8632
SHA512 27ecfca32bba58a6fe0ba6098113a92004799abaa54f61cd1f23c4e7ae3b5aa30ab84889c145f6cd212991b0083e9ffff5626bafe50721850468edd6e0eaeaf9
SSDEEP 12288:GRYHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GRYHdCN/j2GLl3iFSE33b9
TLSH
T13A752364DAA5B565F2AF837903BD9E616200FEE8D925884786813BEF113CFD8D036063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 910fe951a85b0a291ddeabd3cc783d2a9650e92958c73d3b020094e45320703d
MD5 69cf27dd4253aa70dabd3b1330601bf6
SHA1 3c3d3837d288a9aeab7f352b459b3d2f54f67a69
SHA512 e42f6b851981061b4660289c375552169768e69d1d2f72f4cc5ad787d4460d2fd8576fb566735d825e43a247272b5fffb2021a5e7b57d7cf4353cc27b3ce4596
SSDEEP 12288:keBNUbTVO86UpHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHE:kJIUpHdCN/j2GLl3iFSE33b9n
TLSH
T14085CF3BEE28FCD2C27E8DB857918600D76278708B6293CBD165834EDE235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3dc98823699b10197d33912e059f8551e8257b1fce6e7737283d411f629b26a3
MD5 a8fcb642a8b001428bb29506427d0034
SHA1 85415d6b6671d3c94fb4fb71d39dc71415404321
SHA512 d2046bf795d6ce65e1a4e50c2bce8afd52576844f7a07b9e4afbca695a67e427f9639587139672f7c9f33c2104bc7a4d965203d0a4a9ac62ee9b8426a0cdc70b
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:OQvGAdlCEL8c/yRNw5C5j2jF
TLSH
T16F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 470e2400c305f768c47a6e4bc6849f1db190ca768f625b3a4b1a7112b18a51c7
MD5 e268f9e54f3c7d7cae7080c3efb13611
SHA1 4e19de5d2d17770ebb694571b0830cca347a1b97
SHA512 fcd1e9993173cfcf8a3b7812bc1e1c5717353141e852806d7b895e9cfd89083b9d7c340df7387f2f6d882c91ab77edfba3df05bb1ae853f0f47e5ba0ddfc6c85
SSDEEP 12288:SAwSfxL/2Dc34DLLmt0LDQewsAj7HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33ba:XdewsAj7HdCN/j2GLl3iFSE33b9
TLSH
T1A695E030FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E85E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5cc5c26a3a4d1b3d9d0ba1fbff9736d5fa315b12a9b3b06deaf86cdcea0f9a10
MD5 ef87577980347d6c5b9feae6da8ddce5
SHA1 cd1582a62c1f209b5469ca28ff5f9b49e96cc093
SHA512 3b51f34d8d26fda2bccbf0bf730b6afb44866abe8c7aa02b37e06ed65b1912900d64eec1b4f633ee7e9f4a7a43f65ffc8c96ffc389d8143f4bf3757e11466a76
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHk8F:FUEtQevvqc2W1cpV2EI32k
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4eafcb03e16b187b29ac5610741c32570baeb99048387b79e4d509851a7ce255
MD5 16f752b21051921b85b3e906dd3a8ad1
SHA1 2ec9090e2263848e7d49a14dfb765382b7f7a703
SHA512 af01eb2bda78d0c749fca090d50ce8b671dbaab4cb617505dfa4b84bb618f3c8775e1917148e47efc112755d41afc48024cc294ca1cb6f00edfe995685a6584b
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zgN/j2U4FH:SoqtVjnm1j2jF
TLSH
T1EFD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 370080a0901b6ad7a636864610c6f5ebc0672d753d5677842f30b38b2e815022
MD5 4725304cefae7749c5595486d46f8a26
SHA1 5a4f1d5f6554aaa185493d23841a3da561d4b311
SHA512 88cb067a72f2b8608a5a0ac5851e33a6bad9d3c7e0965129892c60e71d94b4aa67a5f8f31972f1ab8918a636ef7ddd7cdcd402f3fb3968990c95cb8c48430792
SSDEEP 24576:IAhGLJIFoiwtA5l7S53CHdCN/j2GLl3iFSE33b9:IAMyFoiq5LN/j2U4FH
TLSH
T19C359D80E7F955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7034c88e25dd24f35e4d18ebeed0e9c82f09b9ef20345583d36e996d91bf2362
MD5 33fed5884c1eb834ab30db345a80488a
SHA1 d0cd6052534fb554ea6d7a4b879516ea9e8df81a
SHA512 f68733158279347283c2da78eae737ad426e945099b7ac27e1c4d2ac6db60ac10d623de7f04ac01c6abdca3f072be1304521c667feda014dc9c9d2437ecb4bfd
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+CeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nwuoOWpdCN/j2GLl3iFSE33b9
TLSH
T11485F14576E41CF9E56782388697C536F7B2BC512A21CB0F0360C69B6F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 1d5e2c7bec45fe229ac035c9ffaf552d9382bf49e787c0dfdc65572b2b8759ea
MD5 4beee0fa2fb5201ad9cb2044f3785de5
SHA1 07d598401c80b4f445a92ec29eb9ae1605419c53
SHA512 72f032e507f5727eb1172725c6d1ec061bee2a37b58d753894bcb855f9432d5560f27a77b20c5c75fbce4e5ad8f7329181776e3c5ef55f6c64059103d03d79e1
SSDEEP 12288:JBZ1IyrHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nZuMHdCN/j2GLl3iFSE33b9
TLSH
T1F175125933E471F9E1A7827C8AE59A05E320B8A5A73243CF025047EA1F36FD55D3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c55df2d6e9ef027e6a04f3be0f64658f3385567cc42f0db76cd273683a599e6b
MD5 21188172c46ec9dc749fb8e3a4eac597
SHA1 b222f24910093d5f466fa1744bd208b15de0b33d
SHA512 5fa87685efff10e5a8cce43d7802825bdec2acb045f6d96394ac36b57cad1d912a07501879e380bac046fb979dfd5fea76b967303a1a77fd5e478e579bd2f9d0
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:7QRQyi36YOcPQLvw2gAf+PN3Kj2jF
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 778dc1d9526ecf4417e9dbc65c92cbbc1bfca72583e1744c23fad7b1152d88aa
MD5 cacfb1eb93944b116f171a71bbf02612
SHA1 3fa81bc1b9eacdbcae8110bbaf36e973bbf98116
SHA512 41f3b5c9341c324a11932f5920c75bf903308a38dc7f2f7b071b311491deed923353d7eed938c8cfdf0799cb69e456b5d144b0bd59a95875a9de4beeb1e36ae8
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:6QRQyi36YOcPQLvw2gAf+PN3Kj2jF
TLSH
T1F5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e31c7071b4f91726be9ed3cf18cc0266534ccbb38580085e8f7907c01fd17719
MD5 aa18c177d93670ad8093c36ead983999
SHA1 62edbb127e5adac6c7c387459260c01555b1567c
SHA512 4bab96d591403da9b5dea5831b7fbaa5cae4ba119155724d3000126a26801c896e430e0af536192c2a32b127ed35c9321bc4ad46f09b7d0306434284f086bb12
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cHdCN/j2GLl3iFH:C68Qg55nhheWu7PNU3/wN/j2U4FH
TLSH
T10AB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cea6b05474aa35afc975dd91f76c4000eecbe4c0127f2e31d41563e2dd0a9d86
MD5 5f1a2942b67c2e6e438d5273a76f1ad4
SHA1 556af91e61da8fc4951f7deb61fb9f537ca0fd76
SHA512 9c02b9c4a294bf728089e417bdce649b696db1c853b0690c8c96802639407a716566333c37f01dc705619a5dee6b4748eda76b49e66cdaa9d522bd39a233c5e0
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:qy5112gYy5azzVvL69nLKnhZ/j2jF
TLSH
T158168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 57d29fd2ee02f861ac2c3ee4013855bdf2d43707880c4fc97ac5e0fa1e657a25
MD5 296efba04d97715e2d87336876235109
SHA1 1cd6e1345561e8668d796b1c8bcdbe80078037a2
SHA512 1f7abf75a50f2202f7432b261995427f3579ee99330d1d93ec41b4fa9cbe8fbbd91c85b39c87483a0a2f8849946c5c8ecc6e1665257c51e9032e9630d3f95c17
SSDEEP 49152:GB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIN/j2U4FH:0u6JmVxd2d0j2jF
TLSH
T174D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6beea83ce8f66cc2088ad2a7f829e46a7790017719e50e21bf930712d15158d1
MD5 b45b1770da5e6e06a6402e33a04429fd
SHA1 99edf87d050d7c407131307d59f356ced3432ba3
SHA512 bbc7c9a5be46f95afe85627e0dfb449b6799367f137cc07b65ff0c8c300fcd2bf8acab4374188ba76e7d9b48a07aece0f9f3c92595dd93cf239a1a2737fa4399
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xmN/j2U4FH:bmifPbR1j2jF
TLSH
T18FB5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5375855e6d3a966c12917672c70be77bda06434b13391a0a9abe74c16b42482f
MD5 0481bb63b750637654d9f0141be74086
SHA1 ccff39075394b0606eabca341ae68751ac5385d0
SHA512 7ee4c9c4d02ab0ddc7057f4be522aeae5d81fb3445dcae7a2ca6a749509b396884c2646646821932abc01e2806746c8430dc265332f06a9b01b66d9d6a373146
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHq9N/j2U4FH:e5dKTi61Tj2jF
TLSH
T1FCC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ca07b5678784d64d619407ba3333d65740806e2260a9c8717454f4beb0c5f50e
MD5 4eb83e487520c1e945a759800e13dfec
SHA1 dbe42ed86a013fb01a4bddba51b20628b435061e
SHA512 af73c07923d9b51a7bc4d42c86d3401f2c5075dacb537f1293da6666e189c9159d321b4b076b2b40d0808d03364d2dd10f63eed5aa76c19bdbde0c6181ade304
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wCN/j2U4FH:+X2iyphBj2jF
TLSH
T1BA95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 260d1e1d4a0545fa0ccd87f0f949dfb89969a8636f6c14401077ec2a3224cbc9
MD5 813d87f05f4f16815e79701e2e1d11ee
SHA1 db1e0550fdcdf6d92845b4bcec1b09a8cc5f2071
SHA512 1f8471edd00d21ae2e80d1ed21f7cd9f8e6e597c48e1308f53f90f19f00a88293f2b4f0b5bf4d10ff33831e50565a29b0bfc2a4b23c0aa73b634251d4f5a71ee
SSDEEP 12288:DAHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DAHdCN/j2GLl3iFSE33b9
TLSH
T16B752364E9F5B669F15BC3B943A99B51A100FEECF6264487838116FB633CFDC8036462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 e5d89234fad257174609a1afa16081d3eb82df6a113c770d29a1e25e320e3150
MD5 50b30b0295d0381e8230f52b9916a215
SHA1 c103e12dc370d9881c8183af8ab2e5d655ae88cd
SHA512 9897c36dbb97f0b9f9c8886f47a54afecc7532929cdc87496bd1a3684d7f683be0668fab3da42edf7f0f10db7e84701d61606526007f543da82f666a15f1ff39
SSDEEP 12288:Z/HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Z/HdCN/j2GLl3iFSE33b9
TLSH
T19E752364E9F5B669F15BC37943A99B51A100FEE8F6224487838116FB633CFDC90364A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 38880db3bab24c378ad509c213d7876ecae3c3ed09f0e3fb66f3a85acb87dacb
MD5 3db922fb87520724808f47aa9f378984
SHA1 3906e7325b67077f07edeb7fe17d8eed8bc5b4ac
SHA512 2c5f7574fef12b4d126ddc79d6fea402a0f9f4b8de40a50e283a34e493e499bd50a8634d084ff7451493eb1cb55d52e96721eb730586a9d1e93f5e3f74ad387c
SSDEEP 12288:ZxHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZxHdCN/j2GLl3iFSE33b9
TLSH
T181752364E9F5B659F15EC3B943A99B51A100FEECF622448786C116FB633CFDC80364A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6cf4243c9d809f520ea6a5e8a1b2c28e95d47eeb8844d21e5355d5c663ade5e4
MD5 cb36c71a44a70d330158e653796e5775
SHA1 8ca7931cc36ac6ca1f5c17904069292a74b638eb
SHA512 651fa0ecaecb0d541c9c89045c5f4d2bbeb8d5fa166a55d8f8e7b034f8414b4f7f4510db592024df449fca5cb53946749ddc2cc4808298efd35db14996546712
SSDEEP 12288:9ViHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qHdCN/j2GLl3iFSE33b9
TLSH
T181752364ABF561D5F06BC37C83B59A11E220FDE8E73285CF87410AEB1B34BD89435962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 37dbdcd41bbd99fb7dd47ca354ab5b2e895e7cb01b4ed35d9b1722120cc7648d
MD5 b6e698ccf577c87b4298ef5967672d2b
SHA1 e9d4b0f6e0215e5cd13d73f93ae9fecc825bbb24
SHA512 67d06c07427f2d77b6ef5618c432935cffb6f103bf36187cd525c1c8c242d9cc0210df09be7411229007677441f552ab7c7a2f0d0e26ce867a557d4e9ab2ece5
SSDEEP 12288:naHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:naHdCN/j2GLl3iFSE33b9
TLSH
T1BA752364E9F5B659F15EC3B943A99B51A100FEECF626448782C116FB233CFDC90364A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 6059a4973858071fd004cc55df8668a665f037eab615acb34e7cd17d80d23391
MD5 f769af93a28fed2e85c0f11290cc9c69
SHA1 ccebbd37c26dbc4f71314e2cb3d5511ecbc5d966
SHA512 cb199c74d3989b74e5de7b60b19df5d3e1c87abc89b8d9763c40543c7743750d2290e891c35fcf49174932b54541f8810c0ef9f223ffda4fdf0f93edbfc45957
SSDEEP 12288:0DHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0DHdCN/j2GLl3iFSE33b9
TLSH
T116752364E9F5B669F15FC37943A99B51A100FEECF6224487828116EB633CFDC9036462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 a5d7901047844ec2ee7fdb10754d8fae055d8426b3649cbd10f43904d9d06bbe
MD5 269136f10bce750d907691b1f2dc27bc
SHA1 0922f886a6f600616a772a37c28d77a32f459cc1
SHA512 f4a49edc619d7d59d08eaa3211091d84348ef87816fd05e78ee36d5bda7ea9afa0cc9c81c486c635ef84d429c9bd1dc937b78fe8e7e00c3a902d55042fd38f8b
SSDEEP 12288:g3HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:g3HdCN/j2GLl3iFSE33b9
TLSH
T114752364E9E5B659F15BC3B943A99B516100FEECF6264487838116EB233CFDC90364B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 5c6e3b499a9d07bea73b3f9ec3e33dd633724ca3c25fc79533e6acf1fb0540a4
MD5 f16e19991ffddee64699b771a4aefc2f
SHA1 99f16d3277b542e5f6158ace91d88e4eae459d87
SHA512 f7060ce466005db3fd309c88bea0075eaf335532a2fd5cb93496eff16b3137610b86a678b026fa691cdea7f715cbff565bdc67348f2678a61c9c71091a05d25b
SSDEEP 12288:RiZwb6zzFEoS2cPvyfHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UZMSzFVSOfHdCN/j2GLl3iFSE33b9
TLSH
T1BB8502A4B39018F8EC67823EC9658906D271BC594B70C64F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 4f89294ef1ae94594e17c29ee703c8936df481072b9ecd4c7a61d50aeeedf440
MD5 0496e50df301c44ec230746fbc6475bf
SHA1 edf320c9e83ab7aabcaf88ff2cf5bcab05547e77
SHA512 f2bbdc45f63ea1bd49a5dc93e471340f6961b4c7a8adbb43a08ef521480e03b70a104920ca13509bc28937c55ece05c4a9ef6a1946d36b1957bb7970d1ed08db
SSDEEP 12288:E8HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:E8HdCN/j2GLl3iFSE33b9
TLSH
T1E8752364E9F5B659F15EC37D43A99B51A100FEECF6224487868516FB233CFDC80364A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 8c4a5905de9031768617f02ff6f0ad911c08e125fc86a62d6cb9b899e4f37065
MD5 076fa24e98097b3f2f03fe6cbec14f2f
SHA1 24c695feed8555620326b4d71b59fb2422f18564
SHA512 e3ea49f0c5db73d3c389c8a6fce07b0bb7e1392d2214c4cc853f10da6b22794b25f4633f167ef7a170a2b1860d17a54e103d16523d51b2cf63bd9983cf2f36e7
SSDEEP 12288:pIHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pIHdCN/j2GLl3iFSE33b9
TLSH
T1BC752364E9F5B669F15BC3B943A99B51A100FEECF6224487878516EB233CFDC8036472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 661e3247a0fe76ba4e00fa8e363b011bd4baf1b3e1cf0ca7566e08fbfb700d45
MD5 89b00684e4184c9106b79b148a6185d5
SHA1 48ffa095fba9bc4c174fbe8633d94178751375fa
SHA512 8321bbc1209be958acae1a95e3edfc427a060da23a70aeaf1e79a515d506014c577f9f000f48e5c51d92dd455874fa405b14240c51d77cdc39effb030d7e8e90
SSDEEP 12288:ByPz5L8rHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QzyrHdCN/j2GLl3iFSE33b9
TLSH
T188850217B7A131F9E177823889A65A01F331B87597208A9F439007BB2F377D49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 9266c9542cbf704b17c56bb1c8ee731d081450688faec9a74771d24c317f74a8
MD5 5c7b5c39ff0779aace9e454750615ced
SHA1 672c2b40189603c65fc64a4bb68a54010a3934d8
SHA512 ea23236867c9807ea1f280a4fbd67260c24e63e8ee1fcbac340efcd8ef00ef38c5d9773504db184b34e4945890802a761599d46e54039cf409568619078ad6f1
SSDEEP 12288:U8HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:U8HdCN/j2GLl3iFSE33b9
TLSH
T16F752364E9F5B659F15EC3B943A99B51A100FEECF6224487868116FB633CFDC80364A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 4c6eacdc463be6415679a40b5361d0e8819d462fc0972301269c9b910ef590de
MD5 c3d8e0d3191eee87976721425d96b762
SHA1 d30a7439eb9b00bd557cfa66e24a64598984f6c1
SHA512 45ecaa76b00c1322aece316a133e39c21e43e7349d5c002d1e189daacbcc2dcc4c473016952d77f221b42fe0d42e4ca5aea1b4e535c844309e74155b8ff78139
SSDEEP 12288:08HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:08HdCN/j2GLl3iFSE33b9
TLSH
T1A7752364E9F5B669F15FC37943A99B55A100FEECF6224487868116FB233CFDC80364A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 90923ce6990ebff3ce8a189b7a8b960d3b09af0507cccc1da1b145d55208ca65
MD5 166e8897e9e0db3f6b5e4ad97396f1bb
SHA1 223d08f6d99da8116248c84f00fc84ff0de1c9f4
SHA512 05016596ea8e236dfdb4be108a51f74faca45da4cbe9546b6da36e498ee4af2f66a99af8b6e495a3da6b55e03104a7ec758c54d26561a15f5a8a2726e9e02553
SSDEEP 24576:r1wvAk9RX6wkyAIJAxf0ILuQDcQmBbW55ydkSjNYJDXbtwHdCN/j2GLl3iFSE33J:vMnYIJtQot65qrNYBTN/j2U4FH
TLSH
T17B85F129EBDC55E5E077823C89B34A0AF6B178685B31C6CF024A52AE0E37FD45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6bcd1e86d7090b52a9dc747fe7e95b2ef7961941fbf59fdb00b2db31648a5db9
MD5 39cd39c5f171cefda86700ac34274461
SHA1 872e005389ae2b4fd90454dd9fd3ac70de342e94
SHA512 71f504be25802a6366ec834276554309da6c669f880fe07c22ced2a8b380c86199ed19d5cfa5d2f7c5e7f5780785fd147519b6b6272fb52f487196c865de4a4c
SSDEEP 49152:kYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iN/j2U4FH:qySzPqj2jF
TLSH
T1AE067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 24ce790a5e67a0b18bd570d90f4579f2497dd5e791386aede7d8f834317da85e
MD5 4e9162c9850cfa00ae9fca57281bdf1d
SHA1 de2d2dbf30c73d56d3a7ecc2410c9ed3639b7736
SHA512 edc72bed6d3de80e478d4bde4fedd6b3d02d785600677294911e16edea03dd41e745d23d68d7cb57d31cf0e52acf8190e0d663beea938d16f50b836833611d3b
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPHdCN/j2GLl3iFSE33b9:k47JUQj1irIhCnDHUPfF/yN/j2U4FH
TLSH
T19065AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 086580527dee11eee82dd527f67ee99e9a0c5b3da53c3b554a251e93d3fa1b63
MD5 c5d37c81735ab6ac69984c333522121e
SHA1 61216409296444d080d8fc5eb4ba6d0fcc23b973
SHA512 680c37ebfc90ef58d88ceb97054c8ca0fd33b0d1574cfb5b328e4f6636551f0f0812290040c33619df639379c429b1acd2728d72da52b49d93c72ad35c840716
SSDEEP 12288:CNsfMHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bMHdCN/j2GLl3iFSE33b9
TLSH
T136850119D29412E8D06E9279C7568A41B3237CA497E1C3CB43C0F5BE1F3AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3b22d859a4d0d298431a4857a724de5d08299b2d8cafb39aa269dafb41c9ccf1
MD5 14b0bedc79f7592d41f1d62c3c55cd5a
SHA1 030fa2c50ea540c0ffa360453fb4333221ef47b8
SHA512 9613de66d1f7d8ab600b8d1f1d89d78a04e2a45e209ee9ee717c2ce5c3a3f3f2c8be52b03287e81b58915b120d3c488a3445786405a0b1f656b32a94742ee7dc
SSDEEP 12288:UcApqBq/Swdf/rSryNG62CIXKMAOJafy9fwKyCO8WLeBD/UJo0luP8:UbqQrdEyNG62CIXh9YeO8KeZsJo0lS
TLSH
T144552811766ACB4FC6A940321E33C5CCAB707D11EE056F0773C9873F9576A59BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 1da90ea0822e3b98c74915e6371d737328cd89e2f524ca5c8072e5ce59779469
MD5 7f0de408860bf91aed1a6059572e7370
SHA1 e07f46300e7f4a08de4d878ee4e8076faf8db41b
SHA512 2bcc22cdda1d2c554a4568da893aa2775aafe446aa1b61be6b74ef9ce36919bbe29c6a050f4f5a2ed1a6b2edf50d04c5ca9d74d9911a0f2e5e1ea31fc6a5b596
SSDEEP 3:OlH/l8JYqji8Jlo6Vf8tti3mCllltq3mCllltGlslslslslslsl6uZEl/:KuJYqji8JlFVwqmCtSmCtEEEEEEEvZs
TLSH
T1F28192DAAB818E20C1162031086253886730C456B84247EB011CA812CC213CD6D0BA3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 269KB
SHA256 5c1c9b234c1c82542b1d13d9594bb01776038ac77141829592031f6ff6d036c0
MD5 4a052b86d023ac669140acd5234267bc
SHA1 2cacd53b5458bc5ed32bf01e43941d76c530cdd8
SHA512 1d9621788028ddb974b73d8b852dde31968f4011cec3a42d267ae8e842b50cf24262f5524befbbcf1196088107797e688423f57416088c4867e08c0bc8f7911a
SSDEEP 1536:KYR3l9nGljaK6U/+Lnf4GBWE2EW1wydNIyAyu:X3lhG0b0
TLSH
T1EF44B711B364F22EC9B280770431A9EBDB7D78229F115A013BDD4CB1D8B224A77B6F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc081ca3a35217a.bin

Path C:\Users\Admin\AppData\Roaming\8bc081ca3a35217a.bin
Size 12KB
SHA256 45e717c1a92f0bde94614ca8baa0abf99f17630927c76e2d7056bd02da257ee4
MD5 cb0c993362e515aacd39dd39561fd070
SHA1 7231859ab494b5e67f6dcca0e7031237a8d5d5ea
SHA512 455e9523090ba4b2b15016298f88bd79aa537f27bde011edf78138349878705ebd0b98d98ad00381dff8a16a1287d4dbdda0abff5395669828926cd08f6220b5
SSDEEP 192:TzmXkuZ9HyGTyGikTSF/kO2uqjNuPohgjZvYj/oRSwWILy43Ks7p7+3FJIL/j/:+Nn+Gi40/kLNuPH1ve/ogH6BF8FWL/j
TLSH
T17642CF8888196B4EA50E1BE44CFD9CAB66F6C053DB6C1B44B9ACB09F10FB1CF1577521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TXPlatfor.exe

Path C:\Windows\SysWOW64\TXPlatfor.exe
Size 2.6MB
SHA256 d1926cc1f9239ee5ffbb65ae19bdce307b25ebf014c380a1a55fa01ef2290129
MD5 7ead25e1fe274d2085d67927348492e3
SHA1 b5b2a785469351c1ddab1df595ba8cffd60ab0d7
SHA512 46784b1e443969d0c5490395bbbf52ef01d302a1d4566f7aba2aa3f9c7827e8c3d05872fb363e028cf269930adbf4892c0add84b8b9b48491dda48f7b629fd26
SSDEEP 24576:Rcl1erdg0MCiVWheUdCN/j2GLl3iFSE33b9LAxf0ILuQDcQmBbW55ydkSjNYJDXx:G/Gg0P+WhON/j2U4FHLtQot65qrNYB
TLSH
T1ABD53351BF65B32AF64B9179CA985DAA4E24A7D4CD210C435F093D8F1BB97CE8833D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2567c5d095a68319cddec6d01b9628d8d9cbaa04794eabe94a5e9ccd858ff020
MD5 db13e3679269c88dfdb03715cd9ff8bd
SHA1 8747aa1e686032b1215f4c6bef241cf9bcc2aa6e
SHA512 7363719553c0932389beb9609c20141131e8adffbf6a1692055dabb51749d0415f5719a5aa1f0d8e7fed5fcf1964b338180e92bd885c9f57b4f6cab8d0d93b63
SSDEEP 12288:UM78JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:V0dCN/j2GLl3iFSE33b9
TLSH
T1AF752364D7E9AA55F07E837843ADDA216200FEF8DB2184C7C54127EB6238FD8D836563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 a4ea1ab5083fcd5e5a5304bd7e324a01cb8fd32f8514e0a3637fa3bb9da515d4
MD5 7ff0c9fedac1e41c766edaaffd0d577a
SHA1 5e3ac039fe9a8bee1fb3f0630111903c96c8ec6a
SHA512 60ff9af486b13c2133f522d444e46abcc3c44b9ae9a0bef32874375d95bab502c2d2b5063f49efc327c2f3280f4e60c13d4daf6556b5faa307ba40e5eeca16e7
SSDEEP 24576:SG0Axf0ILuQDcQmBbW55ydkSjNYJDXbt:SG0tQot65qrNYB
TLSH
T15705232A36B877E8F4678239DC602CA77D7576A153111BEF0248B4364FA7BC15A36F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7498fef92d4a24a46a30ab7f647409867a993304ebb2823f140d4501ec6d60ac
MD5 7950b5072a31bb855101b2cdec31295d
SHA1 f66538c5d32a01416bdcbb5f64ce06f072b29e8c
SHA512 100e1bb36575cdc2df599f370d522d9968b3f4d972f83540e0ea5a00e31b6dbd20eb59e62e24964b9dd6fe89a4b24c79b68429f502775d5874bfb7f6abf4ff93
SSDEEP 24576:lG88u8FpJqH1bzria7/mRdCN/j2GLl3iFSE33b9:I7ZFPqVea7/9N/j2U4FH
TLSH
T164A5F165B7E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BD44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dd52b1a0f5343a82cdb2d30213ad2646310c811d97a6843ad5d987fcf4ace1e9
MD5 c0fd0281677472a82425ff80aab8913b
SHA1 7f6471cde9908a366a42c076846ade2365aa666d
SHA512 db64ee7406fd6fa6ba35d49dcbd97ae16c1ab34bb51e021c3d7adebd4ad8d696591a2ad8187fd0e087721ecdd7337487ff7a40a54a646fb1ab492846b34d2952
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaN/j2U4FH:xG05lO43blj2jF
TLSH
T135D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 49335269bc697e33d5e09b2f672e3d2f5881bc1d5f07c6031bec8dd54fd64b45
MD5 14adfb79cb7c97d233dfd2db3d829cb9
SHA1 56d65cc3917a62a5174e4529eec4ddd9cfc15bfb
SHA512 d40d281b6df2df2dcc2b07fbdcebe51360ca7d18a4c0ec385c934671dfc100146f9891bfe8737f675a59edfe5df95679ddb65d60690d4411d20b6251cdb62dda
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnNHdCN/j2GLl3iFSE33b9:Ra5POZ3+Jt2pasx2+mwN/j2U4FH
TLSH
T1F665BF5DA6FC01D5E1B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0f9ef2243af4678fce00a6690b8080be8f99fecf701b407c318676ce903dad7c
MD5 f711ec2bb8c3bbfb6e12c12991e285b6
SHA1 07e7b1262366839b768955dd7b58d054634e5a75
SHA512 c5eeb358a70b7139604b44006d94a7709a69c55e8fc26a695dd565c2029cd91feff05d924d0172826148f7ad64f6ad2a0a961d1ec5a3de6f50a4634119e46334
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FkHHdCN/j2GLl3iFSE33b9:jNc/zEOVHFPN/j2U4FH
TLSH
T1B6857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 e23d32261ecb20ffd1a1e940f844eba370b163a4a545c36b146ae2a59de0752d
MD5 7caf47497573e968795d852df0809d47
SHA1 9133a5a84668b2d20e72a0defd7c96269d1b279c
SHA512 1eea9808ab121901eedb7eaf05ff2074fb93009d1f37c079bde88b4d1c44a80597f5228bb9988bb9efef7752b1bc70d51a4450e662270f23484d8edddc9cf7d9
SSDEEP 24576:u6DI8Axf0ILuQDcQmBbW55ydkSjNYJDXbt:u6DI8tQot65qrNYB
TLSH
T1C425025D337A22F9E067903DC5820956D6B2B1B193221ADF0788D47A5FA3FC9B939F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 df2760a914f7e2c038572f90be1b3ada133c82d6b663834b3e3671f5c4323520
MD5 d0aee93c2456657c6eb9075ed7248818
SHA1 f0c56cf77ec5fe38954abf773dee5f7b9cb9687d
SHA512 a060e03e285b50df8bb152a401c3a9bfd9d16665328fba5a19a9b454fe6309268971526a99cb98106efe6c378a517cbac4dffc5cd4ea621d89d1997f9f12a281
SSDEEP 24576:jtyeAxf0ILuQDcQmBbW55ydkSjNYJDXbt:jtttQot65qrNYB
TLSH
T17815230223A877E9F9A60238DD6245A58F39BD61972117DF1284F52F2F77BC1AD31B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 d75387f692b583d623172f43a65a313ca33bda44ebead9d14909de9c934fe620
MD5 8843fb4e7fbb9fe7f8d568eccb190a4a
SHA1 4e26e36bc371e35b356d98702aa13bbfcd326e66
SHA512 2a735c6dda954f7a31e17b867298ebffad2b22552b61cbed7f13284de058e1425a81ad046742fe91dad15c8c77e42ab399b1ecbb64b8ba0021ca6f64e25a9d9a
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYydCN/j2GLl3iFSE33b9:rgb4mBIBhGF2N/j2U4FH
TLSH
T12065AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 010360537e6397fb849df44a8b960d546c53a1fa7d9973b6388bb99f98d14767
MD5 76f01d348b36a773bf28ae5df54df33b
SHA1 5312424139168d04605fcdd9a16c03239015c39f
SHA512 5e323a4603a241f8be996732916143274052e5d569d4e98771d83f1a6372d3bcc2e1a7b72091a08d0ea8c7bcde86822635c376d738c5f16ebc7c7b5c5c19e17d
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmAAxf0ILuQDcQmBbW55ydkSjNYJDXbt:RTMwBtOmAtQot65qrNYB
TLSH
T14C75B02E7AB856E4E1FAC6B5CD238512EA727461073253CB5390C13F0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 031cecf3f0d749f18807769b638f03d2834cf85ef863b6ce2e077503027cb23b
MD5 80324b3336ebb6b8480675c6bcc9aaca
SHA1 237809216356c4ef9db2dcc3f4aef5b19310ff61
SHA512 b50b51e1ae29cc53914a51537563e4b81f629a783be526175f047b956b32ccd3168db7724464bcf063b450e964c918a1503ee5e4939a22d35226c2b01b4b60fe
SSDEEP 12288:uHvUrBFrEjwaQBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uPUr+NQ1dCN/j2GLl3iFSE33b9
TLSH
T1D985E12E62E818E5E67AD17D86868719F731B8615712D2CF02D0817E4F27EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 95b4626356e472c54ec3171b68ea5b3026c31564540fcac50102a96d81c28cc7
MD5 b8f3b97fae2a2f7b77aa34b15dabd3e8
SHA1 694ef7540344ce55e2face5e478157a80b44e5c0
SHA512 c2488f004200ace4be0fcfa6d31e4c31a3a5158ca099824ad366694018d9b7a41b2abf1aac99150a9fb6192a80e703b89ca861c9ea4963c50616174d46990d9f
SSDEEP 24576:+D3FHshBIYQgAwdCN/j2GLl3iFSE33b9:+DVHeBIAA7N/j2U4FH
TLSH
T19495E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA5F6BFE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc081ca3a35217a.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\8bc081ca3a35217a.bin
Size 12KB
SHA256 b698ebb86cf280e7558aa1a9dd8c8952b852f13ba6ef01cace8869f0a571e504
MD5 044a195014c441bead310354d105936d
SHA1 ba8061d0892664052d5012f8fdaa4dd9c3f4021c
SHA512 975ad554363b0054aa5097c1b02e1593755cc4c30a61071a21192589522cddc583d8261a69a0d2619e083577679b95212c666adb18d556f084c0456cd6873fc1
SSDEEP 384:g4bxdZb7VquhWFJNyYYeedi8hjnNVeBhq:gk3bBR5HxUyd
TLSH
T1EA42CFCD998A14ACFC1821A1D8CDEF59BC2E8F7AE97FB612F8F554041B815302029DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 4401e90790055dc9a16f59584c852a7a627ce854a28618f9ae2b61897d3dec80
MD5 9b9ae6b9a8192de7bf38c0a384c5c256
SHA1 a2c2be5c28ebd7c4f11c919dd9f59e24774a32b9
SHA512 0d4b0d80a8ec773256c2016d6c39ed7ca001a0e82b1b34676b5a97858989fc197bf16f325eeacf389f7a18bfd47a5f56125af9f6673b6b6c6d75bb92e742562a
SSDEEP 12288:rZgNJ6TQf0IIca9QDqdQmBMefq16fHKBB3D5ydkSjxXXVme4H1dN7Xbt6NR+:rZAxf0ILuQDcQmBbW55ydkSjNYJDXbt
TLSH
T1AD052353262CBBEDF4434275DD912C961E79B7A293621BC3230D744A5EDBBC29E32702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 6fccaaec3d58d893ddd25012561b2da36a5bb43e62f6b037ee5867d3622d983c
MD5 1be8332d6dd0c720624634ae61c7abac
SHA1 3cd51aef5be455a599f09bf03f3ca0f1f5e076b3
SHA512 d688a687ed77ed20c1032db48bd0c78cf0063c5a88aebf8aed74f935fc26c974d503a75affd48192c70c457a91b6cdffc978d6db45c09e53710fd57df51182fc
SSDEEP 24576:i6UqjpbAxf0ILuQDcQmBbW55ydkSjNYJDXbt:i6U2tQot65qrNYB
TLSH
T15B25225E26A876F9F0664234DC61456A4975B9B213721AEF328CA43E4F37FC1893BF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-409-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/988-402-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/988-307-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/988-305-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/988-298-0x00000000039E0000-0x0000000003A47000-memory.dmp

Download

memory/988-189-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/988-191-0x00000000014C0000-0x0000000001545000-memory.dmp

Download

memory/988-457-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/988-196-0x00000000014C0000-0x0000000001545000-memory.dmp

Download

memory/988-308-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/988-303-0x00000000039E0000-0x0000000003A47000-memory.dmp

Download

memory/988-406-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1068-76-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/1068-65-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1068-71-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1068-74-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1116-61-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1116-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1116-167-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2660-39-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2660-33-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2660-403-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2660-40-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2660-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2800-166-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/2800-168-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2800-154-0x0000000001C00000-0x0000000001C67000-memory.dmp

Download

memory/2800-44-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/2800-235-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/2800-50-0x0000000001480000-0x0000000001505000-memory.dmp

Download

memory/2800-171-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2800-45-0x0000000001480000-0x0000000001505000-memory.dmp

Download

memory/2800-153-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/2800-170-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2800-160-0x0000000001C00000-0x0000000001C67000-memory.dmp

Download

memory/2916-114-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/2916-109-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/2916-163-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3136-0-0x0000000001470000-0x00000000014F5000-memory.dmp

Download

memory/3136-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3136-5-0x0000000001470000-0x00000000014F5000-memory.dmp

Download

memory/3136-8-0x00000000011A0000-0x000000000134A000-memory.dmp

Download

memory/3136-51-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/3136-180-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3136-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3136-181-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/3136-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3136-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3136-20-0x0000000003A90000-0x0000000003AF7000-memory.dmp

Download

memory/3136-13-0x0000000003A90000-0x0000000003AF7000-memory.dmp

Download

memory/3136-6-0x0000000000400000-0x0000000000DFA000-memory.dmp

Download

memory/3188-261-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3188-260-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3188-267-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3188-463-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-438-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4860-245-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4860-439-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4860-252-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4860-246-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5356-164-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5356-124-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5356-118-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5356-475-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5356-477-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5356-452-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5760-145-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5760-151-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5760-165-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5760-453-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5836-162-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5836-90-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5836-96-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6020-206-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/6020-240-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/6020-208-0x0000000003920000-0x00000000039A3000-memory.dmp

Download

memory/6020-214-0x0000000003920000-0x00000000039A3000-memory.dmp

Download

memory/6020-215-0x0000000003A10000-0x0000000003A70000-memory.dmp

Download

memory/6020-221-0x0000000003A10000-0x0000000003A70000-memory.dmp

Download

memory/6020-199-0x0000000140000000-0x0000000140315000-memory.dmp

Download

memory/6020-200-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/6020-236-0x0000000003920000-0x00000000039A3000-memory.dmp

Download

memory/6020-238-0x0000000003A10000-0x0000000003A70000-memory.dmp

Download

memory/6020-242-0x0000000140000000-0x0000000140315000-memory.dmp

Download

memory/6116-79-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6116-159-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/6116-85-0x0000000000880000-0x00000000008E0000-memory.dmp

Download