ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
Size 1.3MB
Sample261014-lvldtsfe49
SHA256 ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371
MD5 38f34114ff2d193b59c2d29128b856ba
SHA1 a56e80c31b965129452281d608fce615496afa8d
SHA512 c8dbbc29630f2708a6e1ae2f6db618e485ab2deff5aa7d82823777ff32d07d43309f7808ccb09b6edb514f13ec2b4ffe0dd519567ffd7144b2902a3c83ce31ad
SSDEEP 24576:+znCE6ZeFvIdkm4W3uHfVx5mS6xBf9wuNwod9PRqxUu4jQ:+znCEGmMuHfVx5f6PJNwod9cxUjQ
TLSH
T10055239836834BDEE409D3B2C3FFA4FBB842A730E171FF94AD0A55A119175660F3125A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2160	elevation_service.exe
2768	elevation_service.exe
4660	maintenanceservice.exe
4388	OSE.EXE
1464	PerceptionSimulationService.exe
4720	perfhost.exe
2588	ReFsDedupSvc.exe
4896	SensorDataService.exe
3916	ssh-agent.exe
980	AgentService.exe
5856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d5c80623ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4756-0-0x0000000140000000-0x0000000140289000-memory.dmp	upx
behavioral2/memory/4756-74-0x0000000140000000-0x0000000140289000-memory.dmp	upx
behavioral2/files/0x000100000000932b-117.dat	upx
behavioral2/memory/4756-121-0x0000000140000000-0x0000000140289000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecc21b9bc15bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053ef3fdec15bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d7315dec15bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d8d2cdec15bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000774ab5dec15bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b81ce9ac15bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0aa229bc15bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4756	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
Token: SeTakeOwnershipPrivilege	2160	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	980	AgentService.exe
Token: 33	5856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5856	SearchIndexer.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2160	elevation_service.exe
Token: SeDebugPrivilege	2768	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3464	5856	SearchIndexer.exe	101
PID 5856 wrote to memory of 4820	5856	SearchIndexer.exe	102
PID 5856 wrote to memory of 4284	5856	SearchIndexer.exe	103
PID 5856 wrote to memory of 3388	5856	SearchIndexer.exe	104
PID 5856 wrote to memory of 4040	5856	SearchIndexer.exe	106
PID 5856 wrote to memory of 1080	5856	SearchIndexer.exe	107
PID 5856 wrote to memory of 5864	5856	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
"C:\Users\Admin\AppData\Local\Temp\ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4660

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4720

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4896

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 adffd2087f8d91eb1207874472c3241940452b40c99375ee5f291d5919097db1
MD5 103e126c9d8202ad33d771285e607ced
SHA1 207ece8377d62825717de35e8216cff6ddd593e7
SHA512 80733a9574847464027acddb090b8430ed641cc134d9fc65eb0f60a3af28aff36213e1ec68428f0636ca36bf84491373e55858c5038eb00f1ab37363ff8379e2
SSDEEP 49152:Cb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn0nCEGmMuHfVx5f6P:k3q60jBIHmMuHfpk
TLSH
T124D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 42ed30873a3e33eede17570ff1ec9e77a3576156446dfeee013de07271d426b2
MD5 9fe6f1312d2f797559e7f91051a5cc67
SHA1 22800385b09896ece53a97f84013139ae45dcd6a
SHA512 f03a1bab4b88ab00bee84c3a4b9446dc123fef3733dd86fff27fa148876f9c3cfeedc4074c509d4c6a415d059d2c85941128dffea827065054574deaba024c28
SSDEEP 24576:nXYfDtczARnCE6ZeFvIdkm4W3uHfVx5mS6xBf:ytcanCEGmMuHfVx5f6P
TLSH
T10005012873E509FDEC2B827CCCA2C515EA7378514764E7CB03A49A660F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 651b89a5dd837461a6b5b64fd59cf3d326446dca7f2a7cd76ce9763c600b2301
MD5 b33f50181eff3fca99a6fd6dfa43f457
SHA1 7439a131dddd6f789d58aba59ad6fed031a7de89
SHA512 d629b942e3f9450f19f0e75ce2bd675a149cb64bd55573e3f60ed666a67185274a02506ffd6c55f28d4a8acb914f13309ac0d18b0a29ef30d0eabf44b54b1f3b
SSDEEP 24576:j0Le5ji0hmxNrMwnCE6ZeFvIdkm4W3uHfVx5mS6xBf:jPji0A7bnCEGmMuHfVx5f6P
TLSH
T1D5359E26F6748335D073C0B9C5D2A69EED7130825B308ACB4286D77C6F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29f28b6137442ac3314a579aa09bc29728478ca406de723a398b9c09617fea01
MD5 f063a1179bee18305f33d3fb2e39937c
SHA1 6ef7bfca333c861f52e6b2d76752b6587ef0ba52
SHA512 cf913cd354eba888f5f2d4f899876d97c341693a0a5d5748b3c42d6b799cfa6e9d42b0ce7e4ff4ba60729142938a4c5ff54c36a894e0e37fe42d8a984df412d7
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWr6q8wyuqnCE6ZeFvIdkm4W3uHfVx5mS6xBf:6/ezSC6vUzPviHjyvnCEGmMuHfVx5f6P
TLSH
T14B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 188241230316248567058477cf34e6e8022529ab1e4fb1f39f87c0e239e86b29
MD5 caff87711485f38cc97abaf3ba368cc2
SHA1 aa6dd12fa20c4e4b58e73315ba134e4da00e51a3
SHA512 258d0889424debdc93f61a66c685d8b48b83e601267c622cde87c7b0c5c62cfe9fd427f3789a3d6ccddce5cd72775f243246bd0c98631bad1e960adb7af9fd82
SSDEEP 24576:YVbqPb88hv/l+bRnCE6ZeFvIdkm4W3uHfVx5mS6xBf:YVO88hXl+tnCEGmMuHfVx5f6P
TLSH
T171559E66F5748331D073C0BAC5D3AA9AEE3234425B31CACB1246D76C2E67AD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a9d430e9b9f7cfbfcfeca2e0b34caa982906cab7a43c2cbab1ab83d35f6c1ff8
MD5 beb89e61d226f6adb95d35d588fc6c86
SHA1 28f0407d7eea48baf94560022755b0734ff2c593
SHA512 a72098bcb0eb3d4b00bca5030b274448f58d37d832e172c6286e5e6599a2f96be2c94cd676bb889c24cb12b34975c916b4697832db2fc91f17bc227e34a877e4
SSDEEP 12288:XjiiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:XjsnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1D2C42322129747EED91A667145EFBCB9F58D6E20486CE5477E083FA64E3B8C88F31311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 97c886a6b64920d65de5a88405bcd25b8ee1d1322e3559501fb520ed41636ced
MD5 e490ff6f541ee9f4b9b21492f3e85b4c
SHA1 8365e6f92ff3d2d5d96feca4d1ea5393b2146631
SHA512 7688bcae70e99ac2934fb5d3a1d51983556ee0dc28a9cc07aeacd6c3d3b2a27468d2b5b4fd3d9b87093c7a199ee1d9ca9f02a0fff81e8a09d3abae6ccb20a32d
SSDEEP 24576:aJIUZnCE6ZeFvIdkm4W3uHfVx5mS6xBf:aJIUZnCEGmMuHfVx5f6P
TLSH
T1F105CF3BAE28FCD2C27E9DB95A91C640E76278304F61A3CBE165830ECE235D15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b6c596cfb2bf70aaabd459da561638ed7781e5d2a58d4a0d996bef2f15341829
MD5 dd99e894b3376672c4c95611acb54b0a
SHA1 b5ab62bc4fc473d5d6d379611f5ee667a75fda08
SHA512 f808e9e7c9cf2b1a1796fe64466e824e2c8748c428111dc6d8c30770b8ce8331d7e5d6a09fc2b794de76265c14ccca61c0475c66cfa95e7013801e4cd57151d5
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THC:VQvGAdlCEL8c/RRNw5C3HmMuHfpk
TLSH
T112266D656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f5e99172c127d5265e0eb9f3fd3cfdf9e0e26ac3e278b2a92c5491776270e501
MD5 a1c04c5d2a7438867f8965663d01b7e8
SHA1 cd85a303f1d40236853bc2a8231a1890cdf1a9be
SHA512 cda77899355467d559ae1d002f5d18ea226f77d3d35b35bb3252726b1871060f02d4bd579ee6ff2f5e4483c6b2d30357cd04f1362254c8d98e84f1cab9a05035
SSDEEP 24576:dSewsAjLnCE6ZeFvIdkm4W3uHfVx5mS6xBf:YljLnCEGmMuHfVx5f6P
TLSH
T1C115E031FA75E036C67F0DB21B3AD716646D7A204F612AC3F3A85E9E49301D22736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c1f660d0c9e37dc31aec62321612d539cc20e177e9b6e4b1e5a8e82a1b7481be
MD5 f7ee05c8fd5445db69cfeafc4b888678
SHA1 6c43c153b2fc8833f768b9bf1bd6071d704774f8
SHA512 871c6e05bfbe98ec2ce51386621f0b3b4070724bdb6927969e8e133812f54bca9682efe1d7e9138102e1fc8b19da6bb675a0bc369c5d5df506231026b14b25da
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHgZOG:dUEtQevvqc2W1cpV2RI32gZH
TLSH
T169474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aa5454f65a2ad68aa58271c5c947cb55ada0f5aa76b72ea644891fcd5a65f65d
MD5 43b996de0547206af934cf76f70c791a
SHA1 341a57534e0718ae275b946fdabffd647dfbbd73
SHA512 d07e9b23e130b506ba7d45f4da55c0e2588974a0a523c8e648c384c1fe94e189cc08b0fc6b38b2d832d1953755fe696bca6328e275a2b3de1ff65cb8b93f26f7
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/zrnCEGmMuHfVx5f6P:BoqtVjnmLHmMuHfpk
TLSH
T1C7D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 17e27637e05572c1582d304b522486966cd20e080c01971d7d6896bf731b03a8
MD5 9ed90a02850f7a0d24b27a0f40842781
SHA1 f93013bd7d5ea72afdeb75795c7e3bf54013c217
SHA512 6ac307368c253886057578af6ae36a9702c2af8df27540dbb6a62b8a73d8dc740776e20ccc24880679d1672a80b4a342d9765305a214cd9d615d8cc5918bc527
SSDEEP 24576:vAhGL2IFoiwtA5l7S53enCE6ZeFvIdkm4W3uHfVx5mS6xBf:vAM1Foiq5unCEGmMuHfVx5f6P
TLSH
T19A35AE81E7F955D4F5B3AAB899BA9570EA76BCA55E30C20F2150D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9af880a43ef88249f463e04a0b3d084c27f8ab4852f5adb224262900985421ca
MD5 f61629cc8842eafa84c309969426b4f1
SHA1 3b128d1c8349df0ee99ddd020fde52e1b9730f06
SHA512 8daee27fc638ad4ee8998298c7b368ceee88efe64501ba2c58f36556e509935086b5d4b9162547a3c5700a9370d3c59db9d226b2577f382345c2633e6f5dd4ff
SSDEEP 24576:SwuXOWPnCE6ZeFvIdkm4W3uHfVx5mS6xBf:SwsOynCEGmMuHfVx5f6P
TLSH
T11C05F14633E50CF9E9679238859BC536F7F2BC012A24DB1F1760CA5B5F37261AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7f576a053664b8ae1b1b7caf6d9a502d35925ce9ac32d38afcf460f20e9c0a27
MD5 aedbff94026e6081d66c667230252295
SHA1 123fac0d57c58adfa6d00adfaadc4358af799869
SHA512 8442dc7e724e0f4c0c624649683c3e4fd04eac568c3a2a478600717e9087f17e1f69a43a4f00ca22b164c572de242923c9084f52902d9fbfd6a077ce4fe9a920
SSDEEP 12288:z/Z1IybiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:bZu4nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T112E4125633E521FED1579278C9EAA959F7B27862573883CF2A140BAA0F339C50E35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 12036f9dee150f455b9bb9aed02f383e81973cd1406e8e474ea9d71182c263c2
MD5 5bcc4ee4083840d8c2440ac5ace591f8
SHA1 1e414623fafb8cae3f9ac23c22441c705ec4e7aa
SHA512 b106071fa510a0cf7d1755be56b1edd1337debf4e36a86a70257aacc49b2c7311ffdf10245cb55e67fbb329a94c5b87ad59d1703ff0e5f98b54666d936da6047
SSDEEP 98304:dQRQyi36YOcPhLvw2gAf+PN3QHmMuHfpk:UQyiKahX+PN+ZOG
TLSH
T137667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 442b9c2823c3034ce0667d16daa36b2412cb20579af313c1d200988caf218f21
MD5 77cc14451510d5ebc428886c30b3e2d2
SHA1 642815268c7673362878b01b1d11eba9f1641ce5
SHA512 75986e627cfe15fb6e654ef56c448bc2e6e55dafc7bb0fb7c7233b91c9ee05a9834a4b2ffa2d0a3683adedceeeed702e5d42de571b43f0933d03648cbcf1c95d
SSDEEP 98304:rQRQyi36YOcPhLvw2gAf+PN3QHmMuHfpk:aQyiKahX+PN+ZOG
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63aff23c3273c116dd57db210c49e963e591dac97004ea8be03e37e7e2212b11
MD5 90cee7f089fc80d4f473121b79c3abc2
SHA1 c4539e4cfd6b02ed0b1ef0ecfa05d2edab33dc41
SHA512 d9bd69200bbd4cc68bbbf3643d4b3d594d4cfea614a0f5cce0f1aab299b44339678814c03fd2ec79c964fa8e466ea37f6716f5eaff141447388e2ff533eaedbb
SSDEEP 49152:568Qg55nhceWu7PNU3/bnCEGmMuHfVx5f6P:HthLRc/WHmMuHfpk
TLSH
T160B54933B2F600A9C44DE1769F4A973196D27C718FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 501ad6f3013fcba6c66ad9866e1b626318aa125d60d5b1d2fedd27ad814eeee6
MD5 37f0c5b9fdaa7380109f6eea2ec30fce
SHA1 5ed9f02cca3c7963d39d7c2ea8a2d58efa81885c
SHA512 2b748f051829476681e58d00a55f0e46e36e4cba3e12ee9a4522e90e4d5f10ef4c0368e8c7c8b876bd2d65aac0fe32a77e54bf3f08efc35daed565713a63e5fa
SSDEEP 98304:/y5112gYy5azzVva69nLKnhZ5HmMuHfpk:yLIHjWhzZOG
TLSH
T17C167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 19e8b98eb6202645e5878d56b69b49a2cef84bfc242153edc61b4100b9409ca9
MD5 90369500ffd5be2ee5227fecf2621bd1
SHA1 4c64ad20f0e1fd763cbea601b34eb0b09086ffdf
SHA512 3f31e5815b740eae364556d44eed8478de70f3a392cb11efd7d8502f6521ddd678609d4fce5e131be2d8ff839cc914ecd77a40a455444da77f9a142a4427214c
SSDEEP 49152:lB+taZ3usBWOBr4tEG20bqx0z+n217aau1glhnCEGmMuHfVx5f6P:Lu6JmUxd2dEHmMuHfpk
TLSH
T1B2D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7701fda5b91f8c5b3830ac11d376ee172fddde5c7859064b17524f1779d544d4
MD5 b961e35175d7ce643423b439170a3e6d
SHA1 7ec3dd553edf28bb6507f7564a157b5c3dc02cdd
SHA512 3346dc904dc4d89a2f3504bec70d547c3c639355c201286e51bd0f4389c3fd9e65750d9cab3b004e75bbca602091a6091a98ebf92eb7308551fa957041c29fc2
SSDEEP 49152:E1hpsNoJpF1A6BU44CwH7R4x5nCEGmMuHfVx5f6P:EmifPkRLHmMuHfpk
TLSH
T161B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4a269fe4f67523ccd579693268398adcdc5c2c78484b7a09e76ad16d171d6d90
MD5 77ba91d48521408ee7681ff7fb1dacdc
SHA1 fc525ad75a6c6c86279dc64eeec2e64c86f5943a
SHA512 6f563d45adf3851ea2a7aed84b9d6779dd96f590a7ba40e0d351f58a66ca38e54fd46f46a07ec70bfa392ddb96ccb44539d6f261d19701ca6c0af99aa539a3ef
SSDEEP 49152:iSuZQIY0Be2KNRVtOnks6NMHq4nCEGmMuHfVx5f6P:85dKvi611HmMuHfpk
TLSH
T1E1C5BE13F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5f095d46abeed9e5af763b7fa747c6ed81df15fd852fb0869df3c42a735c18fe
MD5 69e7f0f273221a715339b2a420c913b7
SHA1 bf0d9f1a0ae39405ba61e9c3ca8b252c08bfaa89
SHA512 e87d213462000a5bc9b2f58505db80b967b8a036f58afb0985e48f1e00dc60f51c2d12e2d95962d227b5acd473b8633199a01c7e51d5fd14b056903fdd0201aa
SSDEEP 49152:EhtSn8EApI0figXgiDn0AP5wVnCEGmMuHfVx5f6P:FX2iyphPHmMuHfpk
TLSH
T16895BE13F2D901E8D05ED178C7568632E962BC150B38AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d0d4f66a7f3e3697e4b15600c991be51e837b8d4f876fddb5aff6154ed177d73
MD5 3e50d5f44dff33b624e0a657fbf3b059
SHA1 c3ddc92333016c84dbdc7b7e8987f36cef81ac84
SHA512 9f7b8ff2239dd1ca9bc053e170905ff2fc3bc8398d4dedb8a4d3dac38bb2a30fc151b80859846098bc0090c63cd64ba5d87df6192781a84957759bb7286439b7
SSDEEP 12288:8KiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:80nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T165C4232221A747EFD409A6B145DFB8F9F58D2E61896CE1877F0C2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 98218da252d05a651782e7f75cb2f6fb108fca2f0c4bff1a97fe7ee8c63a76b1
MD5 a7d25d1eb7c7c433774e13b20d0fab48
SHA1 ed961b83d7e820892936cce745c056db9a3328b9
SHA512 11f12ce1c89b286252cbd973f754c91139948640bb614e12cf3fcfc0adf11733a894a21e83bb617404ee32e2f5f3f83e4467ebf635e800eba28ef6845fd0197d
SSDEEP 12288:QniHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:QnnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T16CC4236221A747EFD409A2B145DFB8FDF58D6E61896CE1877F0C2E624B2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fa56b787bb110b267a3364308558d0f82955ad936905d64856837129f65198af
MD5 90df8cb0c4d3b18ac1efa445c866b289
SHA1 1e4daadeb8849f042deb6d1d5c271fdab5479358
SHA512 f50e531d56118543165a4d15093a78c2deea40c76932107ba8a6c22fb0fd11134003d3d656e78a85d099d879a5a5028fd69a4a878bd795f2f8c66abc470cb446
SSDEEP 12288:RhiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:RhnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T169C4232121A747EFD409A6B145DFB8F9F98D6E61896CE1877F0D2D624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4cbcdf4598110b9a2550d3ec54cf4baa6bc7fd32807472f45d6dcc64d0bc277e
MD5 18a1a1e3d9fba7fbc9b57c7a8b0fdee7
SHA1 4b5293542ae442dbb575095d80129e1ba5f688e5
SHA512 cbc599f5a1963af71455eb4954742c56a7a53be53e25c840b0e760dfeba1c9b45f4b76a7c7728c211b4babebcafd476d52216fc55a4363418026b6116e1ebf5b
SSDEEP 12288:FVsiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:+nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T12CD4232223AB06DED816E2B5C9AFA4B9F6A97D618638E2CF7F041D560F375D40E31710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f068a3d18c913d59976ff7175ce85ee2996c67ed21856ee3bdfb5e766ec8af75
MD5 f47ca48a11b2134966727b155656fbb0
SHA1 3d9668ec6da9d424e9af3d1696c6c34d19fb7161
SHA512 b3ce0dfb276a16bfe18624b68fae46df59bfc3cf5f73bac7a0cb6ba96cf1ea8fee8cfdf93c503d40f73ae3b00873175cd312dbb7b7e7d78b2b37dfd1e0b71b2d
SSDEEP 12288:MEiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:MWnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T18FC4236221A747EFD409A6B145DFB8F9F58D2E61996CE1877E0C3E624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 136056c5b65e40bf8b2f19b11e759d88e1539fc3512b8b48d0a550ef942d2a39
MD5 fe0d6325585f4fb69860d31f18a8fec4
SHA1 cac341ba8f66203cf1c67d4136f5111338bb88d4
SHA512 4498d96b182a91e14914eab2d0c07ec339859f78dde88aa118434d53aafd61510b16bf79fe631428a0bf9b1b4aea6b11f09749928bb60bc2cd7e178d38d51920
SSDEEP 12288:hTiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:hTnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T112C4236121A747EFD409A2B145DFB8FDF58D6E61896CE1877F0C2E624B2B8D90F31224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 40d5d1e93bfb6f3c9969fca7747656ce3abb40df50c09f9761aa85a5c4a43401
MD5 491b434b4c9eaa6bdffa0c79094fcfbc
SHA1 4bfb2e62e11055f0b319887b529b3856c3273dfd
SHA512 b33912817ab868d7e23281a0e064b444e379804fe16fe9843c16330544af0e89754c1c567d7f664a327e7cb76a2da71caffc7e97267a0cc2e470b63152ade0ca
SSDEEP 12288:e/iHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:efnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1CEC4236121A747EFD409A2B145DFB8FDF58D6E61896CE1877F0C2E624B2B8D90F31224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e1e5d9aa62c9f893e28c6724bd0e1cff319d4fe5aa0b30333045a24f6623e1df
MD5 2aac840bf46ce4d3c1009c0d749ac35b
SHA1 7f5150dda9f846cfb057b4e2e0c3d556c0c83c10
SHA512 cdb93c787be70f99f9807029dba9f6874a33339b4b3050643e61d480c6b3cc3d3a7abd6b29454ab13da549df8ee39b029c0646185915b3bc8c9b58b4a7ff5cf9
SSDEEP 24576:RZMMzFVSOHnCE6ZeFvIdkm4W3uHfVx5mS6xBf:RZMMzfDnCEGmMuHfVx5f6P
TLSH
T1BA0502A5739118F8EC27823ECD5A9916E6B27C150B70C60F17A83A675F333A10D3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 af4f832538aaaeed6231b2eee7fcbc0c1401a278f1e28103bd3c9325ef69c930
MD5 875f3e3c0edc7cba1d0b2a85f64df58e
SHA1 9397ffd5bf5341f59dc933a36eb6ffd40b2a36f6
SHA512 17c214381f4a73ad3f0065609c6b333e188e6e709ae4a8e1c3e288dd0f9d814336c3b53434f86c7ac4702e40de3fae31b4e139b563bf004fc4e92657d4526338
SSDEEP 12288:3OiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:3onCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1D1C4236221A747EFD40962B145DFB8FDF98D6E61896CE1877E0D2E624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6dac4adec9ae453f00a07f050356d808dd70ac05a973b2bf6497bc0bc73962b7
MD5 0d4f78bd092538bb8fa049025f4a3121
SHA1 9b21a869c807f9122907fe5a19796ebfbd77ae3a
SHA512 2051663731ed043dd1ed746527a4d3c6fb2459e60485673a4b8ea7d52d09d13e2537ba2297283aaa18853d80c4027635f13faea236b3efb143214c681b12f64d
SSDEEP 12288:OSiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:OcnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T17EC42362219747EFD40962B145DFB8FDF58C6F61996CE1877E0C2E624B2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f2b7c07a0f22b85c991d095f1f13513b4852545ee4850d542c22f4c28dcfcde0
MD5 07f41da0705aabd4fe64431228617c4f
SHA1 75980f6a7f963aff095a11193d1af922d8d5a398
SHA512 96297ed6a7079cd66f97929d3814f90e209f329353f6eaf36caa2d903261df97b5d10c0fe70557a1be2189813d772548c7a095cd9e39a130593c9f2b2912e38f
SSDEEP 12288:/yPz5L8biHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:yzy7nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1D9F4121733A631FDD0279238C8A61956F7B6B8324B24DA9F2B540B771F276D05E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ed33042e4899240f7961adbe0bbeeccbe2791afce279df40d4378d2a5ce91743
MD5 bf2d88f597b21ee7d75beb7d74397d0b
SHA1 796836e10244dfafe919a2ff8e143a55a0df512d
SHA512 7b49e8b934217905092322aa8ad018bdf8d51d11ba738ebd7b9b5d16fa64a01265f1e52ae16f359c07a20467ba8bca1fc91478f2a6f5e19892454f2d159741c3
SSDEEP 12288:FOiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:FonCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1D4C4236221A747DFD80962B145DFB8FDF98C6E61896CE1877E0D2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bd918ae44a235313733d02333888ab8f8ab56e179ef1daeb46d6ffb4d505f78d
MD5 eaa8deb2753555c87f38b9261a939e49
SHA1 df86cbdd1920ab25acfd40fb1d379f598c13b77d
SHA512 645e36fd138807e272c86ca7173bc4697b493913eae2221d3b32154840e7303ddfef64c3e39b9d0818b8cc66aad0b89baba3832242dc0e6e1844aa156d307309
SSDEEP 12288:jOiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:jonCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T15EC4232221A747EFD40962B145DFB8FDF98D6E61896CE1877E0D2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0234e23ec5cdfb1551115861443a2bd5ffffb5a58697efe77b3684f628eb0455
MD5 f146b1d194dabf8f06335df73aa7e6fd
SHA1 f7eda56691ae8e6ce72c3dbe7f028f211ceca6c1
SHA512 10e6d6588b9739e329e68db1af17266b2eff925cea497f318fb478f29f87ef74a74564e1e7819a3ce77b546c8dc5a9fd2073e210a67019385302a004bc193330
SSDEEP 12288:OyPz5L8biHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:Tzy7nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T125F4121733A631FDD0279238C8A61956F7B678324B24DA9F2B540B771F276D05E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 245150425c027d9424c72dc4baa2e45416f64e06f0579923fc6ba88629af2044
MD5 c519e0e6c7d52294a2bdda84ce5fda65
SHA1 8c9ec36d570073be4d05a8208416ef5ac7f96095
SHA512 6da9cae720007a94d42e81645d196f71f51bc19ef6e344e3ac972497a0fd615fa7b5834fb6584bdffceb90a82b373596b2d0e181d3550191fb57600ee0b684d6
SSDEEP 24576:fT9aLl3z0zDxnCE6ZeFvIdkm4W3uHfVx5mS6xBf:fTQLljqnCEGmMuHfVx5f6P
TLSH
T11A0502A5739118F8DC27823ECD6A9916E2B27C160B74C61F17A83A674F333A10D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 891e5df9eb14696746daea655c6d927fd04c87f06556acd5bcae36e6d038c955
MD5 54bae05a4c5a6ad2874e7de17209b527
SHA1 957da6520d74e7b2b25464b611e4a5c65d15f4f0
SHA512 a6f6beb9d759b6ea5f93db2241f4f70de1af0264489bae7305dc15756a00da01e01f5b293f0d5ea163e78463b94769623b5e93c1c29c5a3866f904a17b8dcda5
SSDEEP 24576:Z3td9CHKy7GZ9nCE6ZeFvIdkm4W3uHfVx5mS6xBf:ptd9CHKyaDnCEGmMuHfVx5f6P
TLSH
T16225CF90B3E414E8F077DA358D765511DAB67C5A1B30DE8F03A8265A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d2e4e694bb61bf3754417749c10996c6c39d3ccde1e89fc7f06ebfc6064b2cec
MD5 d5ff42a23d022a124e410e26a9fee082
SHA1 23437dd0dc6399da1bbbcb5401e96bfa236128b4
SHA512 10e59962e4f0be12f0ed9edcfb0324be57d5fe136bc2ea4dda5f8004e1ada745090f8f819da66dc77385fca08054d139ca852374a74d636f378288e1f2dce66d
SSDEEP 12288:4BiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:4BnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T141C4232121AB47DFD409A6B145DFB8F9F98D2E61896CE1877F0D2E624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 25c8c096629e32bc87eda3f77bde88b4127aa336434d073655b6b4c5702bf252
MD5 ccdfb3a685aa0d213c9f91f64b795dd6
SHA1 0f95d4fbf83716a3688c4006f465900f2ef8f5b4
SHA512 d44c99d778267d45b0e98ed494f0fbdc78f14dce034d48a7cb61bac904bda3a0d8962fa3d2d7903e00e688a47d1db4f0820968f321b1b8cd3e4307789f4cddd4
SSDEEP 12288:X7iHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:XbnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1D1C4236121A747EFD409A2B145DFB8B9F98C6F61896CE1877F0C2D624F2B8D90F31224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 767d84c17a30e0232a4a64c427188f6fa6404ecc5395082ab111961092be2dae
MD5 ff0c575f909765a6d84f5bddc924e3b2
SHA1 e23a922b08f61c024274ed9fa4a1b13d2c5659cf
SHA512 c29608fe38b0841b5859c561232bc2cbd50327e5c8349ae2ab124ca36a7cb22d34d7707fc7653281f5192c6f654a867e358e5f0bc45395e3c1bcb475718bc02f
SSDEEP 12288:QgiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:QCnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1AEC4236221A747EFD40962B145DFB8FDF98C6E61896CE1877E0D2E624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 88cdfc1aefd5f9400e23b63a815a605b0ffe6080f88d49670f375711f502ba0a
MD5 1783ea96da1f11e152af17bd0ac1d71c
SHA1 fb7087e46d6a574fcc262d631ffa2c3832cce085
SHA512 23a31b2e3b7bff599ae46a7404c1c1f2c304db9d39d43815095d4995cbbb041f838d007471dec205a71f83a12f8040e8572bf15bbadd461bf047eeb4e1a9895d
SSDEEP 12288:9OiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:9onCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1F0C4236221A747EFD40962B145DFB8FDF98D6E61896CE1877E0D2E624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 53ba6f68b78a1884851dfd5e4d71c0d1b25beb71196cdfcafa33a3ed3366a0f0
MD5 db9aee53a5514b3ad3ea7a894de8a36f
SHA1 0317232e1353cd6b45337929c0c07a798b3de8a0
SHA512 dffff8586db8ee186986d97218edeef3ceb98de5e01d058ec5a5f88f9227a96ab7459832ae9921827bee63bc1a684d195081f50058454a5ed3636d4f1ee765c2
SSDEEP 12288:lBiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:lBnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1AAC4236221A747EFD409A6B145DFB8F9F58D2E61896CE1877F0D2E624F2B8D80F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 abf3d0fa42e2eeb73ca25a98779423d8e42fbd7536ee1685588a8399b9f4bc13
MD5 280f2f6183823851b9eae482885ee088
SHA1 ae2292804867cff4cf1e1b2413ab85fd33951458
SHA512 20a08ffb8d614f35864947b71730ba5e98b4e16c9214ec76c01aae5ddc3b9610b5b36ef7582ca4a07b02202f1e6393b3488b530da46d476ec133efffca92a00c
SSDEEP 12288:amiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:aAnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T18CC4232121A747EFD409A2B145DFB8B9F98D6F61896CE1877F0D2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0d72785895bd82c997c69583502c9f3b60c95d39fe9a7de2a1b9bc4dd152acf0
MD5 9d39f853f798c2cdbbff3cc2cc8a08e9
SHA1 4a9c03c5bf98e133602d49fa3c418d8c7aa28ec9
SHA512 e21c6a5cdaa45f83013ac676534f000444617958ec76c10d1a71f89f819b6d1d29197a7c73648b5d3056ec82996ac004326d2dd35e884b78fed0e99c854c4ceb
SSDEEP 24576:rfwvok9RX6wkyAIMnCE6ZeFvIdkm4W3uHfVx5mS6xBf:tMnYIMnCEGmMuHfVx5f6P
TLSH
T11135D029EBDC44E5E077923C89B7460AF6B178691B31C2CF125A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a38301633b9960ea05c0ee37593f45997f03375acabc5edb39adef38fc62d7fd
MD5 6851a3946adfa9e1cf2b1c7416002561
SHA1 2de213cdab40d941550b5257c8b842d3d502364d
SHA512 a0415ac1fdd4110eeb2c4def19ca8fb277e824ac60581e152e2ac2d7d421f7c2696b854097e47db71064709f44c56bf8eba88f83352672d72ae7247c77685908
SSDEEP 49152:WYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01nCEGmMuHfVx2:SySzPwHmMuHfpk
TLSH
T149066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 466f60466fbe9f94871d6c182f3ac2417f17239681abab3dcb53b8697f60a568
MD5 ff57320c6665219d11151eae9dc91ef2
SHA1 edbc55318928744705471407ea5c496c1a998606
SHA512 304b53470ee511386aa4a20080538894178de9b57d22eb10223ec39154d2c7eebc7cd41a64cab38df88ceff4c180dcde6cf04aceb13283d922fe2fc692179027
SSDEEP 24576:k47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY3nCE6ZeFvIdkm4W3uHfVx5mS6xBf:k47JUQj4irIhCnDHUPfF/lnCEGmMuHfG
TLSH
T16C65AE1EA3EC02E5E17A927885554A5AEA71782E1F31CACF2270437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 18f02d002593567c728360edcd9ed54f017e25098fcedc59783f65ae069f9730
MD5 4b5bbda279bb873fc37c87d28c24e58c
SHA1 e9e130d0802002b3e78e769a2fa8c2e234dbc232
SHA512 b58da9f59cc466f119e6be5e1e9ed2d93a89ca2ed0e6f24b78d84606dbd2c18236e646d4ad8fdd311a61e502045b405c0344a056c6eadc910483049e229eb209
SSDEEP 12288:fGsfeiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:t4nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T12EE4F01AD29902E9C02E6275C79A5A51F3677C2187E4D3CB6AC0F93E0F365D05EEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5da582c41787cb47810855fa6f2a40bdf26931c1e0797ae308ff20787c5403ef
MD5 239c40f5cce1a1ddbad82e3bca71f892
SHA1 79c73319449dbbddde1fe3c7e264641523a09ddf
SHA512 618f7c0ff0247e9a5119197a9af7a17cc7370a9e47a093c9a6e5a57d40a97c58ea9311ed114a19c61ca00b89838ee460d683b120d29e9ad23220081de691f7a8
SSDEEP 12288:qwArw1csU3fBXh0Z+WVMS6WNszDUnjoYxnHLh/u:qHc1ZUPw+WTsv4joY1HLhW
TLSH
T1EC35F6007626DB8BC6A950321E36C6CCAB70BD42FE05AF1772C9473FD476659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 9cc587349147298cc972349e26bee9c879b886791d506ea577da5a7b43928a7b
MD5 b169104cbd2f61bcbceb9e0dae8620ae
SHA1 b246f921bb2d4c7a65cca531f65c0ba8788f36f7
SHA512 e6d3946e5796de4ab75d58baada1f4fafc599df3bd1e7f72a51fcffc4482c17fd721fca34e4de8589a7c120634cf5bc38c8e6d47aa12f504e8231e2a82750023
SSDEEP 48:JQ/74RnXllullN+npBTUREK0kENRu+Ucn:+/7gllullNOBo+LRT
TLSH
T1380290A1FBA0F531D973057548A1F3EE63B5F4A8D9100353755066E9CCEA2830E6AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 cbdbd53f305f13a0e50b3ad446999408c93311d0aff893a9c10649fede187dfb
MD5 6c79a024f155f799aa2bbdf3dacd5b83
SHA1 df8d08192fb3dd4db160d9b029621c6c3c42c8a7
SHA512 e1b94265bee495f7d7a8b6e540a77ffa8c8fb50fbeb0fd0264b01661ce2d4c88288500d97b1258ec8bbfcbfceb1a784f9cd1095b0e12d75d69c438bbd2efc48d
SSDEEP 24576:Kt5h2IEv43j8DEJfURwP04+jsMlvNfPgX:c93j8DmsVfY
TLSH
T14E852B015577DB4FC9BE8037423286CDABB4AC02FB493F067385893998B655EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c0d8e671e9a46ab67fc0a1ae550d6b34cff97ac23efdd977ea5489400e3a2c76
MD5 cd4e92308f13cad19832895370622f3e
SHA1 d16ac956fa8cb72657aede60c3c97f26c009d325
SHA512 079ad7608bba2b85b18242813aaae46c2e3dad27bd6f7eee8499e1e6bf4b8e8486f0ffa490362a82403cb47d2aae9068a1971b00214f3647b630e23431248400
SSDEEP 12288:MM7yiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:N8nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1EED4232213AB4BDEE82966B045EFE479F54D7E604F28D1C7BE082EA64A378C44F31315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d396efc60d2bb6de3c721c38741dc0eb973d8d65ed22c44c4d6f067035079d00
MD5 2d4cabe5b31019c210e79dada78b0861
SHA1 52b3a5decf9b01ad6294083bbc8f4434ddd7cdd2
SHA512 30f7c917a53bd461da0157a84753cd0810d199ade28c13d7c1a229378a0957b16aa03341ae6dfb9c8f9afe39ec00b23ae9f8826f0f1cb2542235edbbf788bfb8
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYqnCE6ZeFvIdkm4W3uHfVx5mS6xBf:rgb4mBIBhGF3nCEGmMuHfVx5f6P
TLSH
T1BC659E1E22EC02F5E0FAE2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 b9e32ef367782b71cb6d8489777f625e08e38c5db2220b3d8046b7702389be7c
MD5 bbcb0822f046026ed3ee63a40124ad77
SHA1 f257f1e31e6f9934bb1b272a8dfd4f654aea4c7f
SHA512 f1b62a953d56a484498d663460639baeeb473e0f5bacd0e5fa4edad4d6bbfd7011d9bdf64594b12f46d75eb76cec20d4e4cc0aee75f40d0b6bd1e4ba5bd48b4d
SSDEEP 24576:ZtkNvNnaFeYhJNtmZBmdnCE6ZeFvIdkm4W3uHfVx5mS6xBf:ZtMwBtOmdnCEGmMuHfVx5f6P
TLSH
T1F955AF6E76F846E4D1BEC6B58D238516FA727461073293CB5290C13F0E279D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5963269ef651862fd8a82a21f6ff6b3ea58803521868667428e60fb3f25efd08
MD5 d08c1dad56cd653f1defcb9644a359a9
SHA1 305549cb5fcb2a8a2251bbd0e402f3947706d350
SHA512 7a789075493b2a0fd6b144df83c1ab4d7579a9fde16b3a9b572c3e779fe47bed289e7c4e281e1c0316fc2c1986505d80eebf17d6c5affa32b97dd67cc0cc8431
SSDEEP 24576:2G88u8FpJqH1Wzria7/mHnCE6ZeFvIdkm4W3uHfVx5mS6xBf:d7ZFPqVha7/inCEGmMuHfVx5f6P
TLSH
T18535F16577E102F5D47BD13889864667F6B2B8210364EBDF0BAC8B511F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6ad0583cfeb5865cffe43da57faf57e8e8c8d465ea01254a9216dfd0865283b0
MD5 29f748ab9f8ea1e4addd79a153fb8bc5
SHA1 908086c0ba64e3b0e6d99c8931aa6470a8535ab3
SHA512 6305f3d8131ee00c195b6134bd4751e61d77522ea8bb58b00032b0c491fcf77ec4987d7b412d5141131a1b4f287a5815a22e42b5f3155d571245f4625001030e
SSDEEP 24576:RPUr+NQrnCE6ZeFvIdkm4W3uHfVx5mS6xBf:RJQrnCEGmMuHfVx5f6P
TLSH
T15805E12F22ED18E9E67AE17D8986861DF771B8620711D2CF06D0417E4F27DE8AD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 247d741f32279395d5231e8aae0884253502e2609d1a8609f627190d233152f7
MD5 34ce3900cc6a6d40ed9a659ecf4e7f3a
SHA1 06d7bbe74e9aa4f77554f1b78d2b178aeb83de16
SHA512 2fb4c4f773915f1c001e91184b0357407b58c425839ab4440741638b344460f9e12f0dcb6a40f0e89e48a4047871c36327c2524906e1d8c34f71fa99204a37af
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7nCEGmMuHfVx5f6P:tG05lO43bFHmMuHfpk
TLSH
T17CD5C06A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 726964a2c9438137a6e611728892618005542a4c7af5ba2b42e04b42c3797e8c
MD5 0d04951a49b4648af4d80c1f562fc9ca
SHA1 f22e8600ef76eb17ee19074852497889b34cb7da
SHA512 9694b30a96a1164223a022ece426edda8c6663424cd7e6e44d1d4dc932470f7bddbe57c746d11b35d78eb466d85f28c3f9deddee34d0a92032acd92c14df61e2
SSDEEP 24576:Pfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn1nCE6ZeFvIdkm4W3uHfVx5mS6xBf:3a5POZ39Jt2pasx2+mbnCEGmMuHfVx5k
TLSH
T18A65BF5EA2FC01D5D579D17DC5838A1AF5B1342253319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0cee7193d279f1733f83c01c3136c8f56313256266f029d0c90aec37fdf6d66e
MD5 7d223d532d3881ed2833bfa1e844196a
SHA1 c1a116882b02a4e0db52ef3101ea62588c546b58
SHA512 dae88a652fb8efc71b25fe19551a56a70612a605c4d45bfb3ba73fa390481d95478531b4cb59fdc69a4b98a82c0d9194a0d06c0a96003941678550b1d9c31c4d
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkvnCE6ZeFvIdkm4W3uHfVx5mS6xBf:MNc/zEOVHFCnCEGmMuHfVx5f6P
TLSH
T119858C2623E901E4F1BBE1BE897B9546FAB17865133486CF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 eda7534c048305aa58ae6ffe3b6196dd76e9fc6858b8e9611f05272fbabe3227
MD5 255431f1ac1d0e72d4a032d387b0fda9
SHA1 349ea718aefa5deb8ea902881144dfb16599ac1b
SHA512 e19d198166ccd7926970927090a91f60433c517c6b647f43a8951e383541175088cadb7188bced770b46e9ed988eba57ee7d0172a671c2ef6294f4b292139d91
SSDEEP 12288:h1Hck6j5ZI7Dd33W33b6023AHIud2VTOr7ARqxCc4OPBWTye6AM7GtXO1coC:56DIJwuNwod9PRqxUu4jQ
TLSH
T16A25025C336701FAE0ABD07EC2D30053E5B2B170D362AADF4655C1B95E93ED97938A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 70375bb3e17a90c9e7cc01a7b271de3ed772970c0151cfb775b4a43531110795
MD5 2f7a1b270594c1055f74d9ddbf8a321d
SHA1 c1f28235997f254f993fbe3d71b8363d9ba8664d
SHA512 c67131ce999d44edc85235c19b7c1630ec34d8121f6b3cfd3e08c5606221e5ae28580c7a563d834dff170ce7c947559f9f92234485af263e5707b69ed0e91b2d
SSDEEP 24576:/D3FHshBIYQgAUnCE6ZeFvIdkm4W3uHfVx5mS6xBf:/DVHeBIAAUnCEGmMuHfVx5f6P
TLSH
T1DA25E17EE69D04E4E47BD1BCCAA38906E77138A9033165CB16D481B61F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/980-159-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/980-161-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/980-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/980-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-320-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1464-86-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1464-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1464-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2160-30-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2160-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2160-126-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2160-31-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2160-24-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2588-111-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2588-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2588-353-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2588-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2588-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2588-105-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2768-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2768-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2768-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2768-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3916-146-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3916-140-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3916-138-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3916-337-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4388-70-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4388-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4388-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4388-304-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4660-59-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4660-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4660-56-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4660-48-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4660-47-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4720-100-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4720-94-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4720-95-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4720-334-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4756-121-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/4756-1-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4756-0-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/4756-115-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4756-7-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4756-113-0x0000000002950000-0x00000000029D4000-memory.dmp

Download

memory/4756-74-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/4756-8-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4756-10-0x0000000002950000-0x00000000029D4000-memory.dmp

Download

memory/4756-17-0x0000000002950000-0x00000000029D4000-memory.dmp

Download

memory/4896-125-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4896-338-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4896-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4896-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4896-127-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4896-133-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5856-168-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5856-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5856-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5856-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5864-417-0x00000294939C0000-0x0000029493C08000-memory.dmp

Download