Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 06:38
Behavioral task
behavioral1
Sample
a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
- Size 1.9MB
- Sample261011-hebb5sdc49
- SHA256 a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309
- MD5 88f9bddd01b7620663b0086c368535e1
- SHA1 e92263976d2c1a934f91630437ff922953b3e388
- SHA512 e5d0ae5e6da89b1ae3c0fc08539901120bfc7699a157d24bb25dcf9a3b22c90bf4fdf013501866a1800541afda2698a2588a89e8c11a3cc60fc994aa978cc8c3
- SSDEEP 49152:yVpCDxstsR+ft983Dl3gEe8xA+GGbHNvPZumqUIWPLXFKo:yVpCDxsOR+l9EDl3VxA+GSumqU1LVKo
- TLSH T1F795E0F06640F55FF2C099736FD88BB21939F92DC9CA915766802FAA59310F26732633
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5820 elevation_service.exe 4148 maintenanceservice.exe 4908 OSE.EXE 2252 PerceptionSimulationService.exe 1932 perfhost.exe 1216 ReFsDedupSvc.exe 3256 SensorDataService.exe 4128 ssh-agent.exe 3324 AgentService.exe 4112 SearchIndexer.exe 2904 elevation_service.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe OSE.EXE File opened for modification C:\Windows\System32\ReFsDedupSvc.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\AgentService.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\AgentService.exe OSE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\65a8c09eb68fd3f0.bin elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\vds.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe OSE.EXE File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe OSE.EXE File opened for modification C:\Windows\System32\SensorDataService.exe OSE.EXE File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe OSE.EXE File opened for modification C:\Windows\system32\locator.exe OSE.EXE File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe OSE.EXE File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe OSE.EXE File opened for modification C:\Windows\system32\dllhost.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\snmptrap.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\vssvc.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\wbengine.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe OSE.EXE File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe OSE.EXE File opened for modification C:\Windows\System32\alg.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe OSE.EXE File opened for modification C:\Windows\System32\snmptrap.exe OSE.EXE File opened for modification C:\Windows\system32\TieringEngineService.exe OSE.EXE File opened for modification C:\Windows\system32\vssvc.exe OSE.EXE File opened for modification C:\Windows\System32\msdtc.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe OSE.EXE -
resource yara_rule behavioral2/memory/2584-0-0x0000000000400000-0x0000000000836000-memory.dmp upx behavioral2/memory/2584-113-0x0000000000400000-0x0000000000836000-memory.dmp upx behavioral2/files/0x0001000000006211-235.dat upx behavioral2/memory/2584-370-0x0000000000400000-0x0000000000836000-memory.dmp upx behavioral2/files/0x000100000000a0ca-402.dat upx behavioral2/files/0x0001000000009369-405.dat upx behavioral2/files/0x000100000000a1d0-404.dat upx behavioral2/files/0x000100000000ba3b-401.dat upx behavioral2/files/0x0001000000009b8e-399.dat upx behavioral2/files/0x0001000000009cfa-398.dat upx behavioral2/files/0x0001000000009cd2-397.dat upx behavioral2/files/0x000100000001b987-396.dat upx behavioral2/files/0x000100000000994e-371.dat upx behavioral2/files/0x00010000000093b2-364.dat upx behavioral2/files/0x0001000000009323-363.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe OSE.EXE File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe OSE.EXE File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe OSE.EXE File opened for modification C:\Program Files\dotnet\dotnet.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe OSE.EXE File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe OSE.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe OSE.EXE File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe OSE.EXE File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe OSE.EXE File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe OSE.EXE - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe OSE.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d9350404b59dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002440743d4b59dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0b16f3f4b59dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000521cc23d4b59dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000052af83f4b59dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 5820 elevation_service.exe 5820 elevation_service.exe 5820 elevation_service.exe 5820 elevation_service.exe 5820 elevation_service.exe 5820 elevation_service.exe 5820 elevation_service.exe 2904 elevation_service.exe 2904 elevation_service.exe 2904 elevation_service.exe 2904 elevation_service.exe 2904 elevation_service.exe 2904 elevation_service.exe 4908 OSE.EXE 4908 OSE.EXE 4908 OSE.EXE 4908 OSE.EXE 4908 OSE.EXE 4908 OSE.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2584 a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe Token: SeAssignPrimaryTokenPrivilege 3324 AgentService.exe Token: 33 4112 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4112 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4112 SearchIndexer.exe Token: SeBackupPrivilege 1216 ReFsDedupSvc.exe Token: SeRestorePrivilege 1216 ReFsDedupSvc.exe Token: SeBackupPrivilege 1216 ReFsDedupSvc.exe Token: SeRestorePrivilege 1216 ReFsDedupSvc.exe Token: SeBackupPrivilege 1216 ReFsDedupSvc.exe Token: SeRestorePrivilege 1216 ReFsDedupSvc.exe Token: SeBackupPrivilege 1216 ReFsDedupSvc.exe Token: SeRestorePrivilege 1216 ReFsDedupSvc.exe Token: SeBackupPrivilege 1216 ReFsDedupSvc.exe Token: SeRestorePrivilege 1216 ReFsDedupSvc.exe Token: SeDebugPrivilege 5820 elevation_service.exe Token: SeDebugPrivilege 2904 elevation_service.exe Token: SeDebugPrivilege 4908 OSE.EXE - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4112 wrote to memory of 1300 4112 SearchIndexer.exe 99 PID 4112 wrote to memory of 5432 4112 SearchIndexer.exe 100 PID 4112 wrote to memory of 2752 4112 SearchIndexer.exe 102 PID 4112 wrote to memory of 5660 4112 SearchIndexer.exe 103 PID 4112 wrote to memory of 4228 4112 SearchIndexer.exe 107 PID 4112 wrote to memory of 4772 4112 SearchIndexer.exe 108 PID 4112 wrote to memory of 3496 4112 SearchIndexer.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe"C:\Users\Admin\AppData\Local\Temp\a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4148
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2252
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1932
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3256
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4128
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1300
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5432
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2844 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2752
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2924 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5660
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4228
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2844 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4772
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2924 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 9e9791f757157c4e2fbebe35096e71131c9096edf3b07bcf0a50f05b378b7a53
- MD5 809937e19eabffbdddb36ab9eb958024
- SHA1 3e14a2f0e2980a22591d214b73fafe9fcb80f5e9
- SHA512 9c4a793c8a1b86d38e4ca4e8e2472f2fe5059e954ee4606db6bbc3ea5369e14b2b71a81e23dc09c3a2a6b4c1659036a14bebe44264c25e439854a58db5c6c4e3
- SSDEEP 49152:Vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnHR+ft983Dl3gEe8xA+:r3q60jBkR+l9EDl3VxA+
- TLSH T128D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 f70a8c8989f0bd2fc031f76e86f2e903ee02cedcbb876ec856a0fce51c737760
- MD5 8b32af455ae0f2a6a5bfd9235c323f29
- SHA1 da606c09f4a2bae3f0276507a5f5486c5beafb8c
- SHA512 733de6e0c3d08d552555d1b2055ee94d8d25b6b150b5c8484c860be340afcb27f72cc7c813dfe8e50c05db62e3a9c96aded774fa41e7aea5b80ad493833c412a
- SSDEEP 49152:FfcBR+ft983Dl3gEe8xA+8bHNvPZumqUIWPLXFKo:FSR+l9EDl3VxA+gumqU1LVKo
- TLSH T1D07512247B9909F5EC6B81BDCDA2C511E633784907E0E79703B089665F233C85D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 53312687313fab4c63437d2928af202aebdbe9c6fa56e28a0ee9be26ffb1116c
- MD5 3e9a4f729d4638c4a803e7fad07cb56b
- SHA1 ba1b2ad0fdcf1ddee8b9764ac27da525b7989a31
- SHA512 6a92f3a866dde8d3ab71dbd1dbae760b7115e7c5137a8b6d86106fa6e411518c95ddece01b39c59a76b52bedcff9ac1d93abb6f3fd3c614e49875017ddf66226
- SSDEEP 49152:1fcBR+ft983Dl3gEe8xA+8bHNvPZumqUIWPLXFKo:1SR+l9EDl3VxA+gumqU1LVKo
- TLSH T1EF7512247B9909F5EC6B81BDCDA2C511E633784907E0E79703B089665F2338C5D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 ee3ccfbfc65d6dc57e93a4ee741e8a1acd2b906bb2cdb2fe38ed70d0acf4cb88
- MD5 aa8153f99971c2d273a03f9278a6ae44
- SHA1 28845b2be54be6331b59590f12adfa9d9d05325f
- SHA512 049365d1f5c6100298dd7b706da81e20ff627aa5e89253e80a88c448f642d63c548898aee4921db35690c8a2f8f9beec25aa6decdd6412ab7cd67e62e9773aa8
- SSDEEP 24576:mXYfDtczA4RPWxNs298r3OCDIjG3gE9ow+8xA+:FtcBR+ft983Dl3gEe8xA+
- TLSH T15805F12877D808F5ED6B817DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 d08099d8af977ae27b4ac67f6c4afc1d53d1e2838253a77d0af0af0240a1a193
- MD5 6a43ae46ff8955e8fbdafcbd7ef0f03b
- SHA1 076e52bd73193541b461555fb8a102ed1b11b16f
- SHA512 6e765fc35e0c6919f24ef34c9552622485d8a3cc3825659201f5a98a452a64607a01a7c684ca27e1e56846e891d81b30c714490ec566c14dc3b2a83fd36e58f7
- SSDEEP 24576:L0Le5ji0hmxNrMPRPWxNs298r3OCDIjG3gE9ow+8xA+:LPji0A7mR+ft983Dl3gEe8xA+
- TLSH T12D35AE15F6788371D073C0B9C5D2A69AE97230861B308ACB4286D77C7F67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 9e01d9665b13ba3c7ec5f1bc70bd6e89d6fe7a8aea5b9a327b7de3e24a13ba0c
- MD5 4808f7e736404b3d7e95ec243e110742
- SHA1 fb489801f62d4b113a3ae18148f9f366ef7a0c3c
- SHA512 59c63f1f78cd04a7767a6e228ea66eed39b55baf9b3efd4d9dee4608739f1a948ce399b7cb3203d354442c9c8ae2bf7eb7f3fa33e7700b7100b9645ded0087e0
- SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWr6q8wyuRRPWxNs298r3OCDIjG3gE9ow+8xA+:E/ezSC6vUzPviHjyaR+ft983Dl3gEe8H
- TLSH T145755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 7c76272857b30df6e474ddf48a48900a4eaf79cfe5e4f8f00953c5a1895f032f
- MD5 8270f8db65a77f3163f6f5767facc812
- SHA1 63126ce4e019e9fd6f60c7f7629869ae35898adb
- SHA512 207aa3dc61e705e4a1e660e1f6f7d13fca9d0eeec88c2842df4612bd58512b6c1e0d6ec5e76c1a0fc2dabdcf55246d049878cbd5718fa70b0a2994dc2f3fade0
- SSDEEP 24576:oVbqPb88hv/l+b0RPWxNs298r3OCDIjG3gE9ow+8xA+:oVO88hXl+QR+ft983Dl3gEe8xA+
- TLSH T17955AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 e257a1ad8a2cee1a5fc1d884882d0c7929809d6591f1a6a837f97577abaf728f
- MD5 78837ebfecbd8020ee87b13a3476f2bf
- SHA1 e722d91f2edf154512df8bd0dc0ee9f7fd8fd894
- SHA512 9ab718ab23f5e145433fd896fad8fc584b5ce7f4b763093c6e98a22fb5e42a09301ca0075bc8a29cc6ec81a321f50829940d22aa6a27b0024e3ec72ef3c599d7
- SSDEEP 12288:rj7RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:rj7RPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T1B9C423042D4C35C2DB2F91F599CAF0F2A0335D4D28F939F2D461AAA2AD7D25ED980177
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 691d0103501d8599f7345d4adcf17a68e5f0151dbbeab38d4e16bd2e1e05fd2d
- MD5 84bda596da9053db15ba44f1b3e130cc
- SHA1 70c8c7599fa329ecc372bb571ae64fa11c1d71c8
- SHA512 1892d028ffedd33abbf9a33cec4c5c0c2ef18c34279697ebf7bcd6e43e3311b6a945667b8dc3568ff4a3088166482c0a2dd97c9175b2dd1ae3c1745cba7ef31a
- SSDEEP 24576:pJIUcRPWxNs298r3OCDIjG3gE9ow+8xA+:pJIUcR+ft983Dl3gEe8xA+
- TLSH T1D705CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 8d77bc51c2f2c6df82df7f2c1ed2ee90312414b7a0df152cda0196c6682cc7e7
- MD5 c12c060122d3818f60c23cdd504cc042
- SHA1 8d8c0315186b24e24e453fbbe6a0c2bf5f5db294
- SHA512 e65353b1408552cc8de8cbe9d8cdbb24185d4ebe6b34c4b531fb05962d68804b09621af92ee70bceeea1704a46bd0c167f62bb9ef5192e070c47bc02ad5bb6a9
- SSDEEP 98304:2QvGAdlCEL8c/RRNw5ChR+l9EDl3VxA+:3vyEYc/R3w8h4sDlF
- TLSH T163267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 a5fc696dacdd95fe1b1d06e5a14a8328884cde15bcfff5eb021aa579e0db6f37
- MD5 c2aeec6730ca2751f782f76645db3c9a
- SHA1 4512622869ac0dd14ae2b0711191d293aaa7d873
- SHA512 d071acdee40808765750e1dbd775f25e6d923001390f6c5432fad98830bee825dc7744666b4316671b07a9ce4b4b44a3a4ea75a9fb03d39f637b6e8735374f7e
- SSDEEP 24576:6SewsAj2RPWxNs298r3OCDIjG3gE9ow+8xA+:1lj2R+ft983Dl3gEe8xA+
- TLSH T13C15E030FE74E032C77F0DB61B26D716543D79204BA119C3E3A88E9E59342D26776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f6507217bebdea5d40f64b5855fd4a727280d6371ab4f56a23f52a6aafbae076
- MD5 731b2fdd916866b07beec4f0bb205a88
- SHA1 06e2718253d2519d9b719337631b105221d4c2f6
- SHA512 bf93fc9569f28e8f429a560f1b6c8dca5f570ab3622db3a4a0be42683873ffde8a792fe462d400b8c92f0dd99e49e5de1fa59b041d10b14326b4a016800748cd
- SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHu4sDlF:pUEtQevvqc2W1cpV2RI32A
- TLSH T11F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 859def3336532af1fbe3c034ba0c51e985809e60847d3ea1a5afd220f5f4a80a
- MD5 b8f488b84e00eb75df69f2fb34f3b08b
- SHA1 ecce60c5de248b74073156ccd7060b2d80f2343c
- SHA512 77f01beb0a37fd22fa34547a44d7c83a2343cbb8419af40cea84b0acac56d2d16408656d7dc316b20fa5352ea5c48ac8bbbdca0d05dce5444c4cbe514fabbc45
- SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zWR+ft983Dl3gEe8xA+:XoquVjnmVR+l9EDl3VxA+
- TLSH T1AFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 193b0bf8c9bba2df78f3b92e1e48504d882154a7baf590aa7e3470f0ec61b14d
- MD5 2ffd7bb83c16393148730f8f068609a6
- SHA1 61c7cfd29d0b923525073e4870ebbe66f665ecce
- SHA512 afc6eeeb740edbea5db895d5245cd67761edd5a24eeb85e9a7da5a62468f6f0b04aec0f870fd146705689a376df35e3d7f7952f424c635dfc6d0b9459384ef7d
- SSDEEP 24576:AAhGL2IFoiwtA5l7S531RPWxNs298r3OCDIjG3gE9ow+8xA+:AAM1Foiq5lR+ft983Dl3gEe8xA+
- TLSH T16135AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 083c474d8593eba7f5e8822d5124bf63e19381cf2d5051e0c0317a893b1eda64
- MD5 a564e1e5f9f1114d1a88b814a49e564c
- SHA1 8be4c3226046d416acd4ae88db521238928af67a
- SHA512 84ceb9ea84306c5e3cda1c5769128ae8c6881ff3977082b4fd7234ded062133f17cd4fef81edc9d08eb3529e1b363952300678b3357e1a7f03c8b1e4d1843f9a
- SSDEEP 24576:8wuXOW6RPWxNs298r3OCDIjG3gE9ow+8xA+:8wsO5R+ft983Dl3gEe8xA+
- TLSH T1B705F14536981CF5E96B8278C687D132F7B3BC022A65DB2F4760C65B6F37321AD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 c9474a904ec2d43986f004516a6d924a50de3ca7059213e69d98db1ce1257e29
- MD5 825eb8e5dfec24049e74ec5b396a0861
- SHA1 eb428f416258096d30b0c3da2280717a882c267a
- SHA512 fc3fd56ed5fb1e75b947c69ee77d780ba7f4d4e8d6b0ecb64a39c14bf827bbb57179a838d0d3e5b8c971d3d1a3b69589c5f11e71722e15daa9825a70f11c0922
- SSDEEP 12288:w/Z1IyGRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:0ZuXRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T1EAE412493A9C30F2E66B82BCCDD59141E3327C4627B513DF542186A66F37ACA9E35332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 189eb0a49a3759c4ec16d2ffa9eb9ddaa82ce0228c0b385c1859f4d6a30f52bc
- MD5 795a27aac29b785f44d802c029b4b737
- SHA1 d4b1b657c5c217681e387a95d05ed430ca288fb4
- SHA512 c847a1ee737fb1a0a8c0152cedce6a55581b96f8c99c467b7374926fcd753926837f235ba8af6e9d90703b8b1c6546034e051d7d70733c84df486027f7f19f35
- SSDEEP 98304:PQRQyi36YOcPhLvw2gAf+PN3gR+l9EDl3VxA+:+QyiKahX+PNQ4sDlF
- TLSH T1EC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 7613773055b68c7306735177ccfc2f413d9005e47b194f918aaa68cd3e620635
- MD5 4ad35785887b3d7acdcb5d2f81d2175d
- SHA1 b8e1d5f0a88439020cedf231e6f4a4f7387709b4
- SHA512 a109822690f4ae31624bbc3b18c7e096d92844c4ff544d839c42bccd2b2deee94ee9da479a58783b6933d48f21d3ae1cc3c1b82d88737f0fc2888487b3aa4cda
- SSDEEP 98304:9QRQyi36YOcPhLvw2gAf+PN3gR+l9EDl3VxA+:0QyiKahX+PNQ4sDlF
- TLSH T12E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 6a1b21170d16c22a1aa8a3506f84390ec09cd181a47b07b11168cdfeb0af7062
- MD5 b0064703e2bbc583f2d8b0a620abcbd6
- SHA1 4d13525bf2f5addae021d095de77eacfd871cd52
- SHA512 64660c22edd623654767fb56d6c1711f5673e20bd763e667a5f71b1c6e12af0b9ecffbfd70d94e2063fcbe798588634b92b58299fc57976365496ff52fb1e58e
- SSDEEP 49152:a68Qg55nhceWu7PNU3/mR+ft983Dl3gEe8xA+:IthLRc/mR+l9EDl3VxA+
- TLSH T1E7B55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 ffadac1450da42d514d166e92a6a2eb142c63a019d679de72253d2037ce0d8a6
- MD5 59a390622c0c6f17ad43546b2d5ee8f8
- SHA1 150cf10d16edee8904ec6af22909572ed0613f44
- SHA512 ef279d046fc275ae1b56d5bfbed92a4be239fe9a2a356142e39d99dc50f23f50e1c619c77629211430803ab5930686810f65abca782ae895b7b5a5df774fbcdf
- SSDEEP 98304:ty5112gYy5azzVva69nLKnhZ7R+l9EDl3VxA+:QLIHjWht4sDlF
- TLSH T1F8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.6MB
- SHA256 fe09a0235b1bc16b25f7f9f7eb6a8ecb9dfd25df2448533d573305d0b16f259d
- MD5 ff96149a3d4234ea87c2464daa880de1
- SHA1 9cbe17a08f3f6f874e31f4076e77ec2c68dc44e7
- SHA512 c9391ab84b43e82b41b5f41f27ea7d42721445a79cc124dbbb8d717ea5cf4eafb234a120b97b6c62c75420eb288b1364acbae68c952634c4211bdb7e0cc6ec33
- SSDEEP 98304:9u6JmHxd2dIumqU1LVKouR+l9EDl3VxA+:46JmH/umqI5Kou4sDlF
- TLSH T1BF06BE13F5DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 80b2765e57d420ef2e80abb7c91c1925bd2dc8c31f1f73bd02b970fe2e171b4d
- MD5 5f67a11194a0f94028a1ea7f212d806d
- SHA1 93b1c3f2b6c393f102b8bd1a5786d80b07e4cda5
- SHA512 f9822eb5b1be9b7746f9f8e58426b2256dee453210826ee40dfce989fd22448b39abb3c3e9c5d29a8ca16166fda7dbbbbbaf8f42fc2b3d352625840c85fcd618
- SSDEEP 49152:T1hpsNoJpF1A6BU44CwH7R4x8R+ft983Dl3gEe8xA+:TmifPkRVR+l9EDl3VxA+
- TLSH T1A8B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 295b809f214a9fb339b9611a9302e7e4f27455df78b80d9711f779638694dd2b
- MD5 ef8e71f22a269eb6f8b1d434da7f1482
- SHA1 c81d823014c27415c9cf11575409c21f98827c06
- SHA512 68e3b6b256a07f5d33602e38b70ca487e4f76aeb8df443aa448be4d168540b4a571b7c4308abc5d258a802fcf0b7ab30afe77be509ae7ffb6e2caf29dcfbfeb9
- SSDEEP 49152:nSuZQIY0Be2KNRVtOnks6NMHqXR+ft983Dl3gEe8xA+:95dKvi61XR+l9EDl3VxA+
- TLSH T153C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 5caf784e143b0a85317335eb909e9ad80b6bb7accd76e200e3356bb6f3b2947b
- MD5 b680412091fd079de90f0d651cd2ded9
- SHA1 fbd2f112ca72fe0f3c32dec46638bec347127547
- SHA512 18f554c18f638e34f4cfdb81d64f6d4dd6fcb0ef14594ef63b3a23982c09f099d98ef487d18ba40926fa43ca24aebf046e647be91ee516d49590d8a5cddb814c
- SSDEEP 49152:whtSn8EApI0figXgiDn0AP5w4R+ft983Dl3gEe8xA+:hX2iyphZR+l9EDl3VxA+
- TLSH T19095BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 fd4b15551201e14ba72edf79fcec4d4d3953fe9c7eaca2df0fe419bcfa6877a5
- MD5 30f3cfd6449341b28bd68db67d52e8ed
- SHA1 48c659bf428732244db9908568aa9faf34d5a6bd
- SHA512 8c7f07b1b3c2f52346c86880d1f42488d2b39978bdb5de462465643b371453f04fe45309dcc5e62135ac0fae0f408adeadaa0d6174c1ae3d56406cf925bd08f9
- SSDEEP 12288:IDRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:IDRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T183C423043C4D25C3DB1F81F59A86F0E1E0376D4F78F931F2E4628562BE7A65EA98017A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 5717ac809db180ab2dce693afdf393068b8f29f4c69c347c225e48f87aad22cd
- MD5 e80f0f075293854f285b4a361adc81cc
- SHA1 0ad876322b1f58d9e1df67ffc249a9b4c06e9118
- SHA512 948883d6dde0b20863b2c93764cc82ccc8e0a62118dd000c405636f0eee02d5f0034329e21a1798582f068be0eb63210ee92cbf6906b24dd6d402dd6029e992c
- SSDEEP 12288:WyRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:WyRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T18EC423043C4D25C3DB1F81F59A86F0E1E0365D4F78F935F2E4628562BE7A65EA9800BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 bb6833da255e159d24860f5206c25de30d58260f8a935d8545df0ec536107df2
- MD5 71704463cd1c478cea125777678546f8
- SHA1 0b94cf7be1393b20bc5ce75504f1939c72b837c0
- SHA512 e53db0efe3d3c327e90fbcd4f2a24f93f3570b543496f6d4434e2877a5271970d9a1de712f51f825ba9b227d03397e18762b083c09b164c3ee1f618a1d721cf5
- SSDEEP 12288:UkRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:UkRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T159C423043C4D35C3DB1F81F99A86F0E1E0325D4F78F935F2E4528561BE7A65EAA801BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 3afa027e806ec916a3d42c8244b3316b957749bf0d434a91cea8cca2aa18f0e8
- MD5 f1fdc083feaa8fa5ee825793a90e9289
- SHA1 501c04accf31695c4adc71f0baee82a643bc06fc
- SHA512 78cbf642b508a210bb71938772d88fc983eda20782a4cd5a7c9c091c5a891ed22b3801941bfc4b8bd2e94aa6d398f07d89cdbf9fa8890242baee344dc1447347
- SSDEEP 12288:DVVRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:vRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T152D423003E4D21C2D92FC2F9CD86E0A1F133BC8E79B526FBD81149625E7639DAD60676
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 4cc2c0bfccebe7bc123a8e48544e363d26e06b4b38224eb71ea3cd428cb3d598
- MD5 fd8604e45fff8a81ed01a234c805395a
- SHA1 c69572a66b04410fc56a7eb28716b7517ea62b1f
- SHA512 65526b482452873abd18b37546d0014297a33c697ed9fcbb9ead74df11a41f970838a3a5c115fd1cd22bfc62b6a27776e191bfe992ac623151170471266bcb8b
- SSDEEP 12288:3NRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:3NRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T1D3C423043C4D25C3DB1F81F59A86F0E1E0365D4F78F935F2E4628561BE7A75EAA800BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 7f52768dae86581443e807a44d831ded9a3eb9d579a4c525cdc0e5bd65381fad
- MD5 0dc5d6147c997585b5c2ed8cf01d4909
- SHA1 687a2fc08cf1295c541d68734361b10ce7695439
- SHA512 1e9018510454cad993073fe677f04987405ed71142eb5c8005669a8487d2747840f75bc039f538885a1227f2893c317c9178800630057c37fd02049b39cd2a05
- SSDEEP 12288:A+RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:A+RPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T1BAC423043C4D25C3DB1F81F59A86F0E1E0365D4F78F931F2E4628562BE7A75EAA8017A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 b1fc8cb8b6b340a08b865f49840477efe142d14e0ec22b9825c146bd4dea6495
- MD5 e8f2ac5f1a522522f9288fa3ea5b153b
- SHA1 bb2db0178b39e3a823a8240cf2c1b4e5a3b8fa76
- SHA512 a5e82571c8a1f796678c1a7280675eb4505bcf3753fcb248128b76c25aa18200fc411b3ab75d96a365805deccbe39dd9f22ce6b09094ce1d7ff0f5f5fda77c55
- SSDEEP 12288:5qRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:5qRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T12CC423043C4D25C3DB1F81F59A85F0E1E0365D4F78F921F2E462C562BE7A65EA98047B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 9c3be4a061d23f883c2d3f8f63299836cdb8062b4a7cdd07d0123fe4f3220731
- MD5 a5e0da2b674e7331068c29621e747233
- SHA1 99bc4fd0a726e767e9c6f3d7f16a50db2ea66c0a
- SHA512 73296299e54e84684b8b7b3433d4637b97c5d5da1cc2ac37667e8fe8d4ba2c8c36d998b960c7dab5c38c37a2d5ab5c354aed03ccbe1b03c25f5565b535a19150
- SSDEEP 24576:PZMMzFVSOSRPWxNs298r3OCDIjG3gE9ow+8xA+:PZMMzfOR+ft983Dl3gEe8xA+
- TLSH T186050194779418F0EC6B817ECD559912E2B27C4A1AB0C65F03B036675F333A11D3EBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 3bb0cfea34ccdb97db3f9a0f663bfb18e78a9d937668249ad2cd888031b15511
- MD5 67694b5fd4792b272847335ae95494b8
- SHA1 b8efa76a054be94c677eb855cf434eed2990f1a1
- SHA512 7f0fdf3ecce45bb3331e54c98a3c7db866f192e36b4b5c8de7d9b75dd3ae2a4dce86547191d0a6be3c7def8b23c23b93a8db7aa8e3b690d0649d18cff0cb5fcc
- SSDEEP 12288:fnRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:fnRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T195C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 8b864515d4db73b6c88d851badf66c2b66e9c997c99f5649a83dcaebb466dd66
- MD5 27d091199fa32d35a21112cad28c0995
- SHA1 24ec97cc1997a730659708c36c7cf6fe452f14ec
- SHA512 489d5b995e8cb620a4a14c7d1fa1f5ade31d9f0d014465cb0a29e905db9ff5f8a91e9d47f23c11d8a8e920b8711b8cc9eacaab8a5c25f4519a09597e2a8c6ba9
- SSDEEP 12288:YLRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:YLRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T111C423043C4D25C3DB1F81F99A86F0E1E0365D4F78F931F2E4628562BE7A65EA98017B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 524260b3bc13bed1b2ce71ebe0e66b014e08584e9f7b42279abbbcb3296d6e01
- MD5 ec9a79d24c181bb9c7f3f2849f3d246f
- SHA1 30d9ac7447c0408adb2cb9ce5dfb1b13db040513
- SHA512 60998c890bb7b8dc9226d8406b6a1bf7a8c0cc230143efa120e5dbcd73c96c3419c929471b6a623d6d79a4068da3d69489bfff89ff30d23615a2087bad1919cc
- SSDEEP 12288:gyPz5L8GRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RzyGRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T13BF412073A9930F5D13B8278C8925952F372BC361B709AEF526047722F372959E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 fafa9277e0c9219bcb16921f1c5d09715f5653256b11047f2cd11af7f575bdbf
- MD5 9134554e6fe5b03f96daca6c4eb338d3
- SHA1 d7d2a2818225a63fffa22dce6b795927dee46699
- SHA512 5baed24c2820de22c2b388d10bfa3a2e885b60d6e3907c43635ac852e4016d0020a28326fee554e55b306397476af1164cdca60bd2922498d87301bae5a9c200
- SSDEEP 12288:YnRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:YnRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T158C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4528561BE7A65EAA800BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 1af1146184563cf7278a4e3d3a636bbebd74498d10d8322c517daaa45f2ead1c
- MD5 d0b6fd42ebe52cbe11addfb0e23b427e
- SHA1 dcdb1b3d4ab02a5f5a7dd61a7a256fc0c23932d8
- SHA512 e9e67b00bc35843125171b2862acb7f33ea309e51daa8a2631cb8c3446c880be0969f6496c0e830b32dd2cad848cee35576398678bc3c5af8df9296bee452065
- SSDEEP 12288:InRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:InRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T19EC423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4528561BE7A65EAA800BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 99751e9352eede47cf715df39a04e9f1ccfb1fd1d4162dd8c3e8fc962f3e9d60
- MD5 8bb98704a32428ba98ea31edab47054e
- SHA1 e00817921e29e130f2174f1d3240766426b77c4c
- SHA512 c670a946b331d1f131f5005644dc1272044c5eb8bafc27735e39306a7ff27d74380d8c580e037d05aa05cbfd00dbfeeb4f4d425a7797b95a85738b68a589053d
- SSDEEP 12288:ryPz5L8GRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:GzyGRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T148F412073A9930F5D13B8278C8925952F332BC361B749AEF526047722F372959E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 dddac5879fd1f082ecbd5dcda86812c5e31e2b584694490d8234abd11263c844
- MD5 74e676de3c40bea986618332bd8606d1
- SHA1 504f51d4912891b6d530e5e9d180a44b885fe70d
- SHA512 3576719de643de43b3804487314cda833916e5082cb3de0e0cc7d28981bc542793d6934aef27bfee1b74ab55e444d22334787f31e35dcd4462513b083d19f3f2
- SSDEEP 24576:BT9aLl3z0zDURPWxNs298r3OCDIjG3gE9ow+8xA+:BTQLljRR+ft983Dl3gEe8xA+
- TLSH T11D050294779418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 0ba2350672961ed84ca88c48e5d6a503ee775f275af2d1bb2d30ed1dc05399ba
- MD5 8792146906db31ade51c097924bc708a
- SHA1 92bf1499087b846a78fb913afb4ff0da786d3bf9
- SHA512 3f1cd53129738f133f1e6e8beaabcf7d04757ad96c1a3784dce5ee9381c91632b85375c366b1eb8fc3bfd0af97e57187360b98c1839d0c33bffc3e03149c68d9
- SSDEEP 24576:U3td9CHKy7GZARPWxNs298r3OCDIjG3gE9ow+8xA+:etd9CHKyaOR+ft983Dl3gEe8xA+
- TLSH T1FC25CF90B7E810E4F0B78A75CD669512DA767C5A1B71DA8F03A4261A1F33BD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 7aacbc3edb5acdc703712de1418c08e94dd4bb96cdeda3dd66a2e3304456a14f
- MD5 bb6dc0bf2477bf5e54330479f581a641
- SHA1 f70cc5bf53149aa5c9f4d09b56868386c0f81b17
- SHA512 8e34e05aceff8afb5e4213c61a7d91d7bd4a941aec51743c26eba9a15e80f5a61aea050abe43ee2a865095f85adef7cdb42364632c068b0b32d9f4b503d17eaa
- SSDEEP 49152:nMnYIbR+ft983Dl3gEe8xA+6bHNvPZumqUIWPLXFKo:M5R+l9EDl3VxA++umqU1LVKo
- TLSH T12F85F129EECC49E1E1B7917C8DA3864AF2B178591B71C2CF026643AE0E37ED45D39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 dd5f6b448806607c4d521996e766b9378e51c7210cb847a892c9c165a672054c
- MD5 73820729dbd5ef96bb1ebcabd4dec9b4
- SHA1 16d2d5b6797eaf9f0acbf9feda431761f2332a66
- SHA512 0ca80a8788cbb97d454d35a060c892c3cdc1083afeaac6cff152066ec8785e0c4faa97b0b017bfdb4539e8dc98a5ef6a22dec2c0264aa9d0117b89efb26bb3d0
- SSDEEP 49152:PYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YR+ft983Dl3gI:pySzPAR+l9EDl3VxA+
- TLSH T1D3066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 b39775b37aa0c2bab7819e3a05d01fa6e042362ace08fb4d666e5a2eb3c0514c
- MD5 0933a88df29de3735b802c7f1a61bdc0
- SHA1 1180c06dc771fc4ed02b818d59aabaaf52a17465
- SHA512 bccc7cad63da35a66fa27eebe1db35fca14de75caced2aed867e7117a60bf2ec303c693288298bf7240e9572cba4000a3ef17a5c938222ca7c2088b9c0b93e98
- SSDEEP 24576:L47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYiRPWxNs298r3OCDIjG3gE9ow+8xA+:L47JUQj4irIhCnDHUPfF/oR+ft983Dl1
- TLSH T1D965AE1DA3EC01D5E1BA927885158A5AEA71782E1F31CACF1270837D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 2db01a46c5da658a792b16430c10a260ffa67cbe1f84cf5ea920adf22e1d5a56
- MD5 e6053c541786f858165e08e96112d863
- SHA1 47bfe6f2e80922d72f0c69d0d7014be1efe99d18
- SHA512 03f36d4902dd0f84354279807adb11727332e445e9b95ede1955c235033e50a11ede81e22c716fc127e4bb5cb6f9c6b1ea2033bef93b9ad6d741535f7887c3b6
- SSDEEP 12288:HGsfXRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:1XRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T18EE4F109D68812D1C02EA1B9CB469681F3337C1A97F1A3CB92D0F53E1F7A6949DE9713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 7e9811185bbc7e8e484d47a9eac1a1db220b8db342c0807f68fa65cb4478c3f6
- MD5 05cb636150e8acae551bfa10af85111a
- SHA1 9834b2b374f3ab1dcffc01ae3a61a753c81be2f5
- SHA512 e67281a4620d2bc8472662ce47dc86c6bda77a5d5ef6821014050a6d341ca18db454d271204bb88046d598ad22509198456a7ea8c169df62f46dca56d6ce7094
- SSDEEP 12288:eARF1R/rH6rEc6eN86IVQIIMb/wvX0e8IiN:eAH/j6rEBeN8sH+Yv0MiN
- TLSH T1554528007666CB8FC66980325E32D1CCAB707D11EE48AF0773C9873F9576659BAF2291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.5MB
- SHA256 c52ba13bfe268ca30c1aee5dd91bff1772b0578dc811931fc4312f4af9960efa
- MD5 80d21adfdfb94c7c5fc9fc3d74e7260e
- SHA1 f6a5f6330e4baec9f417309f5a6ee4c7c4a8f6a2
- SHA512 bcba65e9a88a8578b4b945f5efbf48ee7e65813cb323e5a31244b5fec7cbe938bff30aa4a89873c1ce698cfe290cfe81ef066c675dc91ae8415222fc5d79c2df
- SSDEEP 6144:Hcd1CN9v9Yj2juFlqjOJkiKGAUlvcAotMxAsotMxA3WAKGkzSbLaXtpJ711u5+l6:8d1CaFGOCNKG+7+0lrcZX19
- TLSH T1F1751A415137E7CFC1B76032072A9B4D7B68EC167B096F22B789453AD86B711A0FA3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 6KB
- SHA256 c1a9050096c2a1f2f94c59c006ffd0d6e7f04354abfbdea86d11bdd0c7d45bf1
- MD5 1ce6cd76530d45b884fdbb77e43dd235
- SHA1 9c9ec462203f90d6cba0bfc715c42db38f3a1fd4
- SHA512 61cacc981c4ff176acc410374e023e203bfcd68bdbe21665836562429415ac83c22c625a1f07bc67d9765d945e4e3d8363fa97754a4cd1f92518a5cb3f7e3566
- SSDEEP 96:ouHsy7vexxxxwwwwwwwmmmmmmmyyyyylllllllllllDDDWWWWWWWWWWdP:Eat
- TLSH T174D179AF0E8EBF7F17652074A71C24A5260001A18D875E282B9E750D76DCAB8F357DC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 c2bb15d4fb1ced2fc6b26ef81ab1fb4f207dba50df44b56cdbef7772bc4ec942
- MD5 70a5d5486d7b2095de8f3cb7aea9cf70
- SHA1 dfe15a6c559aa710dbab34248886734f69d15650
- SHA512 30f152520055cd4d17d4f0bf35d4e497beaa708638560a0055e04cca911fc6856ece320e2a30d8fbd29958aa74b7d67627aae43902f9fa5976ff2dd6501c259c
- SSDEEP 12288:z07vRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:4vRPWxNs298r3OCDIjG3gE9ow+8xA+
- TLSH T1C3D423002D4C29C2EA3F91F4598AE071B127BD4E2FF465F3E41186A1AD796CDDDB062B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 d2521a311c16fdb25d3b007c518bf6aa1ed9c82a1b8d7010135985aab105f02e
- MD5 82b3149d4576078050c0b00e7b5e5b4e
- SHA1 6e2384c133ba14233a978920d797bd6bfec35ec6
- SHA512 ce80f510e11792529ab3d629579ccad3e2bdcd706820609d484fc8fbcc90abef868ce5952b8d9a42f42dca64480546fc608cbd5d522b07ef7ff9bf75fe2a46e4
- SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYRRPWxNs298r3OCDIjG3gE9ow+8xA+:Ggb4mBIBhGFiR+ft983Dl3gEe8xA+
- TLSH T14765AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 836KB
- SHA256 1d4a2c064e9b23728111289dcd60e2659c539edd27282095f56d15f5a4a169a5
- MD5 9485b9154c5441b0aad6b38d1c1b3d57
- SHA1 16cf66dc47fd294a7133306e12db49ef8f2d17cf
- SHA512 f7ac4f5f742d4e6bb032865e1486b8a44c7215c9358a3feb20edd3dbad7ae2cebd3c02c2ddff67a743e7a96a25bdd1993a33731a9a034e6ee96854918d593eac
- SSDEEP 24576:AGQyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:AGQbHNvPZumqUIWPLXFKo
- TLSH T1460523346DEBB798E43499BD8D22CE96B6B132640FC0D2EF04B00675CB946D92439DED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 672df4c58e798d874262881e4e81645bcd3baa2deef22f3da31caef899d4dfff
- MD5 c0ec62860b192a2fa9ba91ff044def52
- SHA1 3d52bc65b005844372a87f2803c22154c2415836
- SHA512 37321c7c3d1d2681fc0007d6ea3f9d8e6727d11db9b51f731833fe636e980b03adcdaf0ddcbd61a5244e432fe360e83c70e651d8c6eb781fcf7de43b7dc2354f
- SSDEEP 24576:0G88u8FpJqH1Wzria7/mSRPWxNs298r3OCDIjG3gE9ow+8xA+:H7ZFPqVha7/JR+ft983Dl3gEe8xA+
- TLSH T10935012576E401F1D47BD1388A824663F6B2B8151374FFEF06A88B511F23AE54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 556e4376feddd49198dd90a25b11df56e7dccd780df2cea2d5fe0e73cf9a73e8
- MD5 71f510690efdc084d3d51172e4e0c8ff
- SHA1 4fd525a0c85587ac02a9e4383d7226c3037ab3fd
- SHA512 8845af972f87bc5ea41a3646f46bcb9879d5f8bcd1fd5c2cdd319793c18eb6a78e6839a75bb306e0d53a3877958a63ae68613e0422441755525dc939b1137353
- SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+R+ft983Dl3gEe8xF:pG05lO43bTR+l9EDl3VxA+
- TLSH T199D5C06E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 2501514aa382a289a0f9e4bd1ea5d7bb406234efa2ee33964e40bc7235c70924
- MD5 4bcc02e0bff696536f1d088610b1b662
- SHA1 458f215aed2c23f53e5691bf84aaa4c7ad876592
- SHA512 250b53ed2f271cb9fbec80d29568e20be04179206390504da88ce666870bc097f6e734aadeda80c894110099d978ae42680911bd511a191632792eda93ee5235
- SSDEEP 24576:efa5POZ3dpqWVM50JicR2hG0lasx2+47eidnYRPWxNs298r3OCDIjG3gE9ow+8xF:Ga5POZ39Jt2pasx2+mmR+ft983Dl3gE9
- TLSH T18465BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 17e9b4cf1d303479b54656ec0e6302cfff187259ad77f56967fd482d9ef0d7b2
- MD5 9dc42b43cb5cd02ffc89d62b074f3ef0
- SHA1 6469898fdf5c6bbe6cd53913c6826661e090188d
- SHA512 0ca9615019ca0dfe09439870cfaf130f63d47489166168ce0ea82435b32d5430b16e470fbcad3b44fe1546409a37274cacfa4e11b0c1e9f9257f0f37402855bb
- SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkaRPWxNs298r3OCDIjG3gE9ow+8xA+:nNc/zEOVHFpR+ft983Dl3gEe8xA+
- TLSH T179858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 952KB
- SHA256 87522124add0cce5411b259f305da910021382a63fa0ac5fc25d36769b890fa0
- MD5 4c213c6c19f9d67ea95557d01d29a7cd
- SHA1 11abfe75c7919a60d254a227c930623bd647942a
- SHA512 06d1bd2e6ee215df732f1a9763d7b0fd0b2932cb7d043808ff279ed35a54022961950228ea9dd6193bf35d39ddff64dfd095c7ff6b5aecb2e8b3d6e2cdff7284
- SSDEEP 24576:46DIEyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:46DIEbHNvPZumqUIWPLXFKo
- TLSH T16925022C6B6B11F5E077D07ECA434542D2B27175879296DF06A085BA8FA3ECC783CE91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 936KB
- SHA256 89d41d8d50c9ef397d6d4c355aea33aab78e4cea25c330de128b22cc02550f8e
- MD5 9c6e69da1052e1126bd1264835b299a2
- SHA1 f414e94c021aea7b655b5414ec769b636597ef45
- SHA512 a5fb537f6ff49b12fe52aac0a71d58c3176f7ee819939454f5cb1af676820d92038701910bd391ef7bd1bc96e1c93ddeb8e36bd43f04a3a108ba9c713062845e
- SSDEEP 24576:Ltyqyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:LtnbHNvPZumqUIWPLXFKo
- TLSH T10C152210AF9AA6D4F5B41578CE23CA959B713C241F91C3DF10B05B2E5F367C92834BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 808KB
- SHA256 e2aeed150fb01e83f20ff561d8554b59e31547e89b711940de5c9498f27c7b97
- MD5 319ee9d52640a64044163cea036fa079
- SHA1 d1bfebb6d6d383dfe0da25fecc8838b87c100c64
- SHA512 76635798ea8940c338b070c8481c1b4cd9cccc83e37e7c5e8eb41cb16b158d599168921f1461fcc370c3cc0dcadab440568cd2567698e657f13acd7409312515
- SSDEEP 24576:Foyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:FobHNvPZumqUIWPLXFKo
- TLSH T1C60523309E5BAB95F4706CB98E17CF9A9371326D0FC2C2D714700A96CB953CA18359EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.1MB
- SHA256 70855da076d4c70f8891fa9c61315dce6a276788f9cc2ffb68f906ae2299df67
- MD5 b0634c76499065e627fa37749245ee83
- SHA1 36aee25f95c41eb9581abda7b58e74b8715242c0
- SHA512 46b1a553882ba555918984a14778265a413323caa22ab322b2eb6ea634ee8099e2442a7dd4632b6b6632282b4c909257d3a92e834899e39b35fbae4c81b7527e
- SSDEEP 49152:2gb4mBIBhGFiR+ft983Dl3gEe8xA++bHNvPZumqUIWPLXFKo:2tZR+l9EDl3VxA+6umqU1LVKo
- TLSH T127A5D01E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.5MB
- SHA256 9590a5fe9ae0c429d973f348a13bebcf2523656c148f1f6752b71d07e8d52ae7
- MD5 047962b89337d97ab8bb33a6d6bdf9cf
- SHA1 8106838eb25f9c7e8b0c57a2d405cdd8bc3272b3
- SHA512 1c77c02bc64d9b473305a6c0cc072183119b39401072ca64d3e44c49055ddb4f909839861cc48cd84293690bc556691e1641f7c2f840a19ffd6f1766b81165a1
- SSDEEP 24576:eTkNvNnaFeYhJNtmZBmMyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:eTMwBtOmMbHNvPZumqUIWPLXFKo
- TLSH T1C675B02EBAF846E4E1FAC6B5CD238512E6727461073293CB5290C13F4E679D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 835be9be74d05412a28d34b1bf6f3d67e8cbad916e343c0e73e88d9099e2ab0e
- MD5 be94412aa3a902ce5605817335f99925
- SHA1 2b7eed09bbc4571b3f6a2accd7af2c18f0c7b206
- SHA512 0d95f896169e29ca71beb33f7cfcea3cf631f122e021326ef016cbb6451718cb16e9d469a17817bb9170daeaaae9a0ab56264c13c24c065089029eacca1b48e3
- SSDEEP 24576:tPUr+NQORPWxNs298r3OCDIjG3gE9ow+8xA+:tJQOR+ft983Dl3gEe8xA+
- TLSH T18705F11F269C18E1E67BE17D89828219F372B8521751A2DF01E0817E5F77ED8BD39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 c7a640d785878f4736f8a0372e68553a40448d7e5be14b351e4a9243fd8b6e2d
- MD5 e1fc269f17ed68d90bfda695e01086fb
- SHA1 6b807851b40de2f75373c33a2d91121b63bc368e
- SHA512 1850e0c58a0f0bc0645e887cbea4b73e9598816576f1b654396d09b4ae71689c51ce19b1e74ac7d146e6eccd5d4e890f88af3d30c2c531320e0bd70aa4360a51
- SSDEEP 49152:9DVHeBIAAjR+ft983Dl3gEe8xA+ZbHNvPZumqUIWPLXFKo:fR+l9EDl3VxA+VumqU1LVKo
- TLSH T1D285023DEE5D04E0E57BD1BCCA538A06E37138AD076266D701A081B65F6BEE82D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\TieringEngineService.exe
- Size 1.1MB
- SHA256 234c17da384d5282005053f31f37c161fd3b252719ce5755f0317d259eabdca8
- MD5 efc47da7bdbd2bddd1cf044ac529c94b
- SHA1 4f6b91be51548a5eabc21b3698a1860f68365c09
- SHA512 43b753542d23d8992d07c2598f81445a62efdb79aeded0f830930fe5f00cb1057c5380fa8167fd5ffdbedd08bdbed7b1e11c131cc85d5630a7564da061b77e97
- SSDEEP 24576:EJnJPbzB4Swyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:EJnJv6SwbHNvPZumqUIWPLXFKo
- TLSH T15E35E03CD2A810E8E4B7C2B4811A1B5AFF71346D2F2269C719B4D5353F52EE0A939F58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\65a8c09eb68fd3f0.bin
- Size 12KB
- SHA256 7e34e397634251be288bf11a2bf04f634d401936eb2628bffd6c2ea36fb2a1e1
- MD5 4e4532c3b7d2863a88ac368dd547899b
- SHA1 5c8225d151030df0efb724dafd6419a4e9d4b8c4
- SHA512 46047f68ca02c7fd20cce75aa11cabc14881648dc81e90de826ee4e41f8b4d29d67d5d4bb01e09c71afc4fd5c24a3559382139416e71097ff36977ca4b158f1f
- SSDEEP 384:mxBllDeEl05Db4RgBpB07nNLE+MQej9AtJ:mvDtMmgBpy5Laj9g
- TLSH T11B42B07A2C6C8E8468C5E7331ED4C20363D6C3421D2D12E79994298DF973A5DA98D793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\locator.exe
- Size 800KB
- SHA256 e2d8ef0fd40109f69d46526d1b00c62cac70b583e1a637589572b9f5687f8edd
- MD5 f907cffbae0491b07d695ca64467b8c2
- SHA1 67c3d2f9a53e96b7800ee6f8e5ab6a541d52de63
- SHA512 ce8c3ab2580f3ffbaafa973d22e78a575aa2a37bef46c20a58b772805f2938c35cb26450aa372b532d547a13da5ef1fbca8bad79eec32dbf3ce5a42738e95525
- SSDEEP 24576:/Xyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:/XbHNvPZumqUIWPLXFKo
- TLSH T16C0523309E8BDB99F47068B99E17CF9AA7A1325D1FC1C2C314300686C7996DE18395FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 944KB
- SHA256 05ce1ad6ce882e09f216c1705f61869f67edc55e1d525fcc483ca1cc77918791
- MD5 978f0d7f6db5b43eabf9b242a8402792
- SHA1 158b4aeabccd336fb494526beacfbba33b36b1df
- SHA512 a4d7e016267b8477a67857a58c96525bcd00522cece004f8e31f250bb7432d4dac759e334bfb29536332fdc3274d48ea336a1c54de78904d7a59019b751d0a07
- SSDEEP 24576:z6Uqjpsyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:z6UTbHNvPZumqUIWPLXFKo
- TLSH T1742523285EC665E9F0745578DE22C66A82B139360BE1D2EF31E0067ECB31AC9443FF65
- MD5 SHA1 SHA512 SSDEEP TLSH