616742ae42ce8c82246dfe01eb5397ff17d1416f6cbcc7c480e91add9e417138

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ddos.exe
Size 8.7MB
Sample261015-pbt4eacv9v
SHA256 616742ae42ce8c82246dfe01eb5397ff17d1416f6cbcc7c480e91add9e417138
MD5 831a1b2cb17d7065bbd6c91e1a9b62e2
SHA1 50ff1b26bdde8e780814bafae5afdfcd726855db
SHA512 42b3eb9cce57b4752ffe5c6e65d25d974c09d7932c1b7b2eba0f1108d6b7374faf6a877c39753025fab7742f7966bf494cac50ea1f2fd897514538631d60fcb0
SSDEEP 49152:TH/npjXT1tk0i4WIU9BvV0BUk+AUgmTOrEhMSp8PVahD2y4iUaOoM8xLmebjneOa:7TFPVa6f+8lstbN1CznKV2
TLSH
T1AF962A16E36990D9D07FC0789283AB63BD217489073977F78AC086652F60EF8AD3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5972	elevation_service.exe
5308	elevation_service.exe
5804	maintenanceservice.exe
5020	OSE.EXE
1304	PerceptionSimulationService.exe
6096	perfhost.exe
2560	ReFsDedupSvc.exe
1916	SensorDataService.exe
4716	ssh-agent.exe
2036	AgentService.exe
4472	SearchIndexer.exe
1548	240954468.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	Ddos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\aFoj.bin.part	240954468.tmp
File opened for modification	C:\Windows\System32\GameInputSvc.exe	Ddos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	Ddos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de8ebfd77465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Ddos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\240954468.tmp	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Ddos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240954468.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240954468.tmp

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000167f58639e5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe0801239e5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000134945249e5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fe0f9239e5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000923d07639e5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076ee6e249e5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5972	elevation_service.exe
5972	elevation_service.exe
5972	elevation_service.exe
5972	elevation_service.exe
5972	elevation_service.exe
5972	elevation_service.exe
5972	elevation_service.exe
5308	elevation_service.exe
5308	elevation_service.exe
5308	elevation_service.exe
5308	elevation_service.exe
5308	elevation_service.exe
5308	elevation_service.exe
5308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	832	Ddos.exe
Token: SeTakeOwnershipPrivilege	5972	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2036	AgentService.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2560	ReFsDedupSvc.exe
Token: 33	4472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4472	SearchIndexer.exe
Token: SeDebugPrivilege	5972	elevation_service.exe
Token: SeShutdownPrivilege	364	svchost.exe
Token: SeDebugPrivilege	5308	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	Ddos.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 200	4472	SearchIndexer.exe	101
PID 4472 wrote to memory of 4012	4472	SearchIndexer.exe	102
PID 4472 wrote to memory of 2312	4472	SearchIndexer.exe	103
PID 4472 wrote to memory of 5968	4472	SearchIndexer.exe	104
PID 4472 wrote to memory of 5544	4472	SearchIndexer.exe	114
PID 4472 wrote to memory of 5492	4472	SearchIndexer.exe	115
PID 4472 wrote to memory of 3348	4472	SearchIndexer.exe	116
PID 5972 wrote to memory of 1548	5972	elevation_service.exe	117

C:\Users\Admin\AppData\Local\Temp\Ddos.exe
"C:\Users\Admin\AppData\Local\Temp\Ddos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\system32\config\systemprofile\AppData\Roaming\240954468.tmp
  "C:\Windows\system32\config\systemprofile\AppData\Roaming\240954468.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5804

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5020

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1916

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4820

C:\Windows\system32\CredentialEnrollmentManager.exe
C:\Windows\system32\CredentialEnrollmentManager.exe
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 335d3b7382135ee03aad14c8550f0802b0c6fe213cf5c744d2109d1949d69149
MD5 ddb881c9df8e25264be507e53cca8ec0
SHA1 b890bfae26bbf83a82460ba6f6555b035be1edca
SHA512 ad5c38ef30b341b921d5079dc4c93aded0b4384ccfcb2e1bdc1b24a90b17f332b0aa0c2659d1cb62d2d80701adee1bbae67311227a60cd7aafea5bd98d1931b1
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnfj4MYPVyGLY:83q6HjBrVc
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 484fa55709eeedbcbb339c7c51c695dab809d0d0317b0822f979e0d25f59f3ab
MD5 d24f8aee8f3a5813911ac77d8fecaccc
SHA1 c1b984caa2f7bbed2a6719e7a05c1194c26df79c
SHA512 4e227adbb9fafd33e77e1751fc995e9435323c3bb3295dfaa8ebad4eae94ccc2036817ff8fe49ef6447331de3c51c69778fe6db87a5955ebf63771f41ba94fbe
SSDEEP 12288:p1XLsswWkxy2lRq2czAW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9g:nXYfDtczANSnnrFb4PM4MYgLxEVyGLS
TLSH
T19165F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5a587dc8e11151ea71df4714c4c1dd4cefb0b7ecbfc550a489be81fe5535aee7
MD5 6af330f216fe2ad390062631333fb9ce
SHA1 d7208dbc90cf63576a626c4bfd9acc4c8857451b
SHA512 e00ce5a64233862a26dda45b284ad420d1e8294969a8918740595334c8c29238580d9003efcd603e07568dcbec657743217b220cce9ee58c41906f31f1648e64
SSDEEP 24576:F0Le5ji0hmxirMESnnrFb4PM4MYgLxEVyGLb:FPji0AcQj4MYPVyGLb
TLSH
T12E859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4aea5498e9ec49404783bdfba63a46dea44833c2f5365b26177cc28d623c1477
MD5 a55059c445fdbc5c30f72a82d920da45
SHA1 bd98ef6de6ce1af07b546b10efa7290b8b08e4e4
SHA512 1b91ba1167827ded41173b59e505ca190e60c36a16d9693f66998135c4de0578938895b148cdb59ada995e3a5d0d6ff6be62141d8ad0fcc5cf8964e5d65647cc
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyuqSnnrFb4PM4MYgLxEVyGLR:m/ezSC6vUzPvxHjycj4MYPVyGLR
TLSH
T10A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f3e3eac9af19cc2cd83913ca65370fe9146eca7ba543fd56c4fbacc423f7e55c
MD5 064b1462eaa5e6c900970a8c21ba90c4
SHA1 5e638110f77576282087b2f8177f705a5e44206b
SHA512 fb2c6dcf486fa1761b48c1b1e0333a1c4d5a8952f2e65e8a9c89e5e206daf6c76fff92a2550556d478a3b99cb748282d6e57c35314ae755145d7d0a9160a528a
SSDEEP 24576:mVbqPb88hv/l+6hSnnrFb4PM4MYgLxEVyGLr:mVO88hXl+jj4MYPVyGLr
TLSH
T1CF559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 66b5278402f86dc4103e131c491aa7f3d8d14af066cc9af62c3211461cedd7d2
MD5 a3e164d5992a184a95b39851f78a2f05
SHA1 1af81b1988aeed72e5630e78c9d69fbd3ac81704
SHA512 2c89dba2c2366f1ae004a3b5c1a6477d4aa1ac021b9a6bee5be541586a14bf8c37b7f30f98a42ce86838995bd32e24171e189d7fa966294f2feb525e2f367591
SSDEEP 12288:LR334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:LR4SnnrFb4PM4MYgLxEVyGLb
TLSH
T1CD4523A75BDC10EACFAE15B0D1B96AC8E605BC61F875B20B6741785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 08af9c6cbf21de49cd0c7a66e8e07b4c3abe9ccd421480860924bbdcf30d067a
MD5 ec66e01d9e110bd1478608fe4e6495aa
SHA1 ae465e3661bc5cf5eb88b266d88d0fdb023a81fc
SHA512 15a72e7e6c59927079e880f5f12535dee34849b623d52925cff2fd0a64dcfab1ec334559757b590123c8a9532d9dac3c703969d60bcf62fcb7c48c49e049cab7
SSDEEP 12288:DeBNUbTVO86Uq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:DJIUZSnnrFb4PM4MYgLxEVyGLM
TLSH
T1A265D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 21b8978d5d55bffb7dae4425eba17b213c5d96c5f88537a2ef440e704157e5dc
MD5 3741c8deaad32bb20fa52e703f0c21b8
SHA1 90cecc8fbc409de00226364f990e8c54f8b0f15e
SHA512 b114b45878c7d0f649af01ec5631d1a12dea6a10c440e10c9e78aa1b21cb1266939c74486495746295a9422bd189e3078ed81b83e00dfb738de72929feab0632
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:AQvGAdlCEL8c/yRNw5CuVl
TLSH
T1BA267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 00f41ef22920b47da94175a02d4d5d1fa992e750aa4aaa0b4235d58675b6afb4
MD5 95c13fc510697907f551c1c2e56b6156
SHA1 01cff5291cf87a0c58a570968b5181931311e762
SHA512 ca89ee333028e9b9ffc973de2b15e847ad9bf2a3e9406b9d3ab7da952163e1874da02452422fe1d5ed91f7bc44534f2d186e57446693c9e1ccfa00e20f3d5d26
SSDEEP 12288:TAwSfxL/2Dc34DLLmt0LDQewsAjc34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA/:MdewsAjnSnnrFb4PM4MYgLxEVyGLM
TLSH
T17275E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 560a573dc2d068a0059bea0fc154f272afc37ab386e0f889d4b949f7e583d760
MD5 327b16fac7f8a8e2daedac70fe2e9060
SHA1 e79c4cf2ca22cd702cce8ecdcbb89be956b1583d
SHA512 da1c8e427dcb804009fde8dfe87b41ae32079e3715792888baf523a0d3718ec05e806cb97ba9cd20cf29220baac45246c10171083529c966e51e0af27dea87c6
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:gUEtQevvqc2W1cpV2EI32
TLSH
T107474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 61b34b720c994ca33b2a309fa51ead54cfa186e967499fbcf3b3743bb8eca3d2
MD5 25c88ed26c53021534c294d760a26b7d
SHA1 ab06bf023d261903402b6da26f6c79d428d2e9b8
SHA512 783d194f3e5bb890066b26f027fefa38da6548cdf724eac6026604e49cae20d260092b7d5b4a6e5f8a6afbad9e885a91eebb56ac4cfc17afa0fc7d4123548859
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zAj4MYPVyGL9:FoqtVjnmaVB
TLSH
T105D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8b96eb6fac7c1fa8a03b318ee82e7cb34b5b370dd9e1f9b1a088394703b3f2f9
MD5 c93b65b05ff8f81817f2be273502c487
SHA1 e682621bd7f5e8311335673f9046a0f76188226c
SHA512 aa540844faa41c161ea711c3fac5e4ca795679dca603a45a37e4f74cc183acfbb402d4885727a2459694449d78410c9e3f6f146f20b492ed19b8933fcd383e83
SSDEEP 24576:iAhGLJIFoiwtA5l7S53mSnnrFb4PM4MYgLxEVyGLu:iAMyFoiq5xj4MYPVyGLu
TLSH
T17235AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2424a0a385cfc7197da09c952e43a1f17d743db951f19b2345c006f4ce5ab84b
MD5 239896e564330f88d45a183b7f35c4ec
SHA1 edb71bbad090c9a4236599adefb54d7b40dfed35
SHA512 9b6c6a364b1df71c99116aed74c5fc3afe567f466798897738138e8034a4099e4aebdb70568bc5f80bdcda797e6861968baa9f85fc95fe89f91eadda110cdec5
SSDEEP 12288:Zmw5HEjsChNVBFgl0WDm+CN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqv:0wuoOWzSnnrFb4PM4MYgLxEVyGLJ
TLSH
T17465F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a8d29c9498754becbc56d1bf4a2ad1ceea95750e5983dc528246a318dbe4e842
MD5 63b1dd5c1738bea813ba806b86b8e8b2
SHA1 22b34598eadfe437a3b6429bdf91298036ea1fbb
SHA512 cd4ab6a23e3a1b602f272d67391e263101fdc6338bea93df765fb0852aac216e8dbdc0289e58102cedad2ec4c1aee983497463124c6484b5dcf0f49e16f88002
SSDEEP 12288:lBZ1Iys34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:TZu8SnnrFb4PM4MYgLxEVyGL6
TLSH
T1D45512AA37E820FACAAB4274C4F55688E3227862B77293CF1650555A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2459a55d1c79d54be44424eb504b50bd90e2cc1d598dbfb5e093fa1fa46a9d34
MD5 f10043b1f387416894d49a352ee77677
SHA1 f46b42ff1065622e0b36c7298727dcc6212761f3
SHA512 04724aab3570ac824d8e6ad9f652f1ff7ee22f8a578f3a05ad87196ba78109a0cae5e600f825b5c98397b89ea2a3142d19dfd6db6f319c9748fb9a7f36399bba
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:WQRQyi36YOcPQLvw2gAf+PN3/Vn
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ecb8d00294382337101de3494c663b4b37592094cc48c17848114a33a28232df
MD5 189fd819b52ce3cf64f9334980862556
SHA1 0919a1397ac430848fe3d71dd6723b71d3cd5c5c
SHA512 00050e7e150c67d7e7bbe4711009652601a94791f68c31e7c1712cd7fbf03631f0f73c373a8ef0ffc2074069bcbf947d4031d8eece94e40fa3f94a32ab9739b0
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:BQRQyi36YOcPQLvw2gAf+PN3/VQ
TLSH
T108667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73f2907d5de42bbdf089b971011e87ddeb055b6d3b681bd22467e6d6f9ded4a8
MD5 3f25efb2175c08c21fbd76e6b6d0a325
SHA1 19244979b7fd52c5daeabdfcbcea2e71a374ec7b
SHA512 b94978b6c102ff3e7c1cf79bbecb4040dcdb2118251aa13e468fa3b2c4d19254b5b6bb0bab13b9bcc275d02414ea503a8de7e41dc8b11819ff42e12a4406e48e
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0sSnnrFb4PM4MYgt:d68Qg55nhheWu7PNU3/Qj4MYPVyGLS
TLSH
T143B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5cda2a739203bb5158ce2feb6aeb479eebeaa31b5f1fb75774e9f044826e637a
MD5 70ef87bf8470b0cd9966ca7a4f77ec24
SHA1 15e499680f89dc5d2d7545ab260e87557cb14adc
SHA512 5f1c28e2525da8b7c522a0d98778407252031138afeef4a41d6c73c1894677a906c533e4b076e7c8863535b7db7e06cdc87f9003b4d77cf9207741ffc9a3352d
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:Sy5112gYy5azzVvL69nLKnhZIVf
TLSH
T12C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dc191e6de7495c1262c86f85857d594f29168e863b9966e9c54e12828a5606a1
MD5 41865415b0906540de77c46b8e07e223
SHA1 1448958250706ee938e3beab501d966da06eac0f
SHA512 45356dd63fb9bc80f1895e7eb50cea40f1433999dc9721b5c29d12605637cb08473fdb87308e9b895116c5ab346fc18d3de2a32dc9255dfce2d3c307c29fe4db
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQj4MYPVyGLq:Gu6JmVxd2dNVG
TLSH
T182D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9fb6981aa1388af99d08576ccaeb9a8e8df3ada49cc91201fe58905d0c6b940b
MD5 17da3a28e0ebdf1398670035ae97aee5
SHA1 11542b4d0ccec4331af13820c5f1eee52439f13b
SHA512 bf255cfd45173f9d2047a76e5f4dedcb01fa216146e60139881bdb56698e5bd545e655d274e3845a3d6c32956988ada82f6f8bcf11efb283f09626c8c57f3527
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xyj4MYPVyGLu:jmifPbRaV6
TLSH
T1FCB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 727651c677a97410df66903adb23ca9d92cb20f6a39929fc5622d8e98a4fa403
MD5 5126154ad9a63019ca3f86be987078f3
SHA1 166c2bf1a8af594348cd7c44d2bd615ca1443447
SHA512 161e45cde6238da3000ab3444d0a7800279706d43da191e9ec1783e2aa02fc34b40b59c9d5cb169a71c0a19d6dc086b1b2ee8f50dac88e8635f9198425048fc3
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqvj4MYPVyGLy:85dKTi61sVW
TLSH
T16CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e88bd1980e8cabc2bc643a0f4835fbfe27a291134306249759c1846c0e380105
MD5 4a8a0dcfe915d5720fa2313ede62969e
SHA1 f2b8c63a3299707187c345169ea7fc9aad2a8764
SHA512 91818ff7a7889c493e5b7394d39d39bfb72509c407306e63d56844b1d53a99c3fce5f02c8aed0467eee6cff56942ecb15bafcfa8a750bdbd8e135f46c78b98bc
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wmj4MYPVyGLQ:pX2iyphGVE
TLSH
T17895BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6335d3d6579af1e94c80d4adf34853757a5238c353a53b7542eeb812dd08111e
MD5 72922ad69c88b26558b9240b050c1bc2
SHA1 d1bba5c4e6449b4a25cf024c3bb0121bf0abb1d8
SHA512 16bab266391bb5242233bb2a5cf1fcce33aa9bcde1680d4beb4c035cc3ad61bdaf4d5d514c6981741ba165d5fc80fc5017fe9793d296cba7bba9a0dfcaa260a6
SSDEEP 12288:uP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:uQSnnrFb4PM4MYgLxEVyGLW
TLSH
T1EB4523A62EDC10EECF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B60D9892722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f28e43f30eba995bfe2e10deab6313421ecf965c6cabb192dceae7c032f6a4ca
MD5 4167c7a6d1e4c37ec8a5c0aa9ffa39d1
SHA1 e96d986ae3a2901ead9c04d2d15a705ffa6ac7c4
SHA512 bebd026d618a850f147425347be1c720f6fb7286b3757face5d46151da6b7a414f74c86dff6d76a13e422fa7e169987491dc36f83e1d1bc1058374ffc73380aa
SSDEEP 12288:po34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:p7SnnrFb4PM4MYgLxEVyGLW
TLSH
T1134523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574073B3B60D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a7df8a29d8b6c2393c363bca5ba9046ae2e32b77807784e01e9b8ad92519bc06
MD5 f8e3552a890dd77a1fda3b24af162818
SHA1 9b86729b1e1d435dce6e020f7361b5442b9555d7
SHA512 5a7b9c305700e3c8de4e391c7ea63ee228b263aa00d9fb5eb1bf99019ba246cff2a7db4e534672ca8e7d96a256a21ded72e89a504f060db2c10bec46b8d0d43d
SSDEEP 12288:cC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:cRSnnrFb4PM4MYgLxEVyGLj
TLSH
T1224523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B4574063B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c81944cd5cde54972bc429ed7c1f62d96fbc32e9f9c21061eca469910713107d
MD5 96b01de3ad4c2b904bbe7d5e39bf0317
SHA1 bd2c78b6c408eb0613f6339e21417676f9bd4c96
SHA512 d59dfb1f4a7ddc2f17bb3756ad19e533ead8c3151d5ad053637f93f5a0d8798af7ee7589b1400eeb35fecb8bb27053e547c765be146b9e4987f2570ab1a956ca
SSDEEP 12288:qVB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:rSnnrFb4PM4MYgLxEVyGLS
TLSH
T1F94523662BDD10EACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 201bf28bbf188bda14ca8c69b8d86910d5e3789147e78185bad175015dbf3064
MD5 f8f1037d1a6a24b3e52b1c5a37f9a791
SHA1 c6a18880cd8a2e390e4516f456afb211d07cd63f
SHA512 ca5b473de92a58a82e8fc4d956e9153b219655556f84ce9170d1e98ba443218400540cb98270eb5f10b3ff7aec84bef2da191e83756f4fc18c138cb1eda9f3b8
SSDEEP 12288:wp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:wuSnnrFb4PM4MYgLxEVyGLd
TLSH
T1F04523A62EDC10EECF5D16F0C1A656C8E2097C63F976B20F7B4574073B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b72bb9d03a7ffd2674ab62e5b1683ac8fad7f86fe426c45e43ea7c2c283d3d19
MD5 000aeaaeb9d762a37d20295e180d33f6
SHA1 a12d4433152ab715295b1193cecccddb359b0f5e
SHA512 ac3e1724c8cca0b0f269f83ef12a91012378f16467076c79c10f965453ebd8d1f5cb811517c4c910beaf719adfa58960f8c270920ec7e17d12aa82088f4ad7f8
SSDEEP 12288:bU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:bfSnnrFb4PM4MYgLxEVyGLd
TLSH
T1694523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574073B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 da457973a0f52b92607b9351dd2fbc9dd22daa9f019ce1e3555431884fe4cca7
MD5 e3a045dfe245c807cd16ab306527c709
SHA1 b8baffa11e7f16f44668933f65072e91c16e01d7
SHA512 8cc009097068893e73e1493acdfd996409e5b711001799a11b2f5b6c2561fa29c62b2291ec1259fb25872f39afa88e348e2e6127dd682b817cdb40743e7e0ed3
SSDEEP 12288:iQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:ijSnnrFb4PM4MYgLxEVyGLf
TLSH
T1864523A62EDD10EECF5D16F0C1A566C8E2097C62F976B20F7B4574073B3B20DA891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 60996b192cae5a28efb39209ca710f0852c6cae5a9ec73f8554bb0649bd3b926
MD5 b8126f33edf9fcd9f6f4d2ff99555785
SHA1 6191c9edae57180b8a9b6c0ced251fa1b2866c29
SHA512 68ca0434c7df1acad0c989d206a5574bcbe3c185ebfc6ef890689d9bd851eb5635766cc611770885ef417e58a1db6d040156b81705ea57705977f1cc3b7fc11a
SSDEEP 12288:ciZwb6zzFEoS2cPvyI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2k:/ZMSzFVSObSnnrFb4PM4MYgLxEVyGLl
TLSH
T1486502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 91912ac273386ec79146007b120b8e336806a222779569d04d7df31749d74de6
MD5 e9a5a4c6ae443c8e860dc319e1f7995b
SHA1 a6c6937e84f95f90ddefb9881244db14903a6749
SHA512 8bf64c42f957530e6cc6e5320078f34db84228ff3402d22ac8109a7c35b67f6411d0c2857b86b0497d80ebb0effdd17b4bbae10454291c6047c80283a8669b8d
SSDEEP 12288:Ez34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:EMSnnrFb4PM4MYgLxEVyGLX
TLSH
T1494523A62EDC10EECF5D06F0C1A566C8E2097C63F976B20F7B4574073B3B60D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c0600a0d41e538ee8996f0336897b31af1fc6923bf99268c6f33e0471af33c38
MD5 30b6e81816f9fd574c38fc9352efb0bb
SHA1 a82958ce691fc6214f00b997c8ae95db0fdb84b0
SHA512 36480be7744bf0e0b2ddd74038e3b25a2f204fbece355fbfbff06df3ec28c668fcc3880595f2123e037437da212722800a13d7c60e84e089fa7e14e091a6a817
SSDEEP 12288:9H34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:9ISnnrFb4PM4MYgLxEVyGL7
TLSH
T18B4523A62EDC10EECF5D16F0C1A566C8E209BC63F976B20F7B4574073B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 23648b64d633098daef57926fdce84e4a4905c0802eee8ed6adff8696441be7f
MD5 978b9f1ed08b3bcaebe11c56dec36163
SHA1 70d18a7d62cd102c64160ff26d3bb1504fa52a20
SHA512 5ba00b93e8e369259027d647ff5f37587790c328e788ca4143d20e9db4596cbd1c028ea359122941cfe17a888789148e2b1fe86c76798c410a327ad95c51274e
SSDEEP 12288:QyPz5L8s34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:hzy3SnnrFb4PM4MYgLxEVyGLN
TLSH
T18555025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 001d1bf76656c2421cb7678c70b87699106d3b78cadf63b4f4548bbd892e3b0e
MD5 4bd6e94e819818a7f320c36eb3520f89
SHA1 e01aeaac23f6cbef3359101cf388d67623b0f688
SHA512 3c4e9954c849428986b91d9379f75455deb3bb7104ea4a229dbf969f1ae691bd01cb9bff0bb4ddb9d480e2df126387c22db212026239147189cad7d7cfa58ed3
SSDEEP 12288:Nz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:NMSnnrFb4PM4MYgLxEVyGLP
TLSH
T1454523A62EDC10EECF5D06F0C1A556C8E2097C63F976B20FBB4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2a7fbe970fb67bf2d8c8922685efd1e8f2717d0236b780709c9b681d1a36842e
MD5 3aac45a1522e0f3a14c6b16adaa4a332
SHA1 84ca28b946735f715ae51646109587f1d5768ec0
SHA512 87eea7a9977bca89ed8d0575186a4f8dcc1d2edc6ed7314e7d4de323a1518095737c81c79c5a69e538942caaa7a0fcd42332455fcdc773e5ccb21d7c9f15ae60
SSDEEP 12288:Lz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:LMSnnrFb4PM4MYgLxEVyGLu
TLSH
T1234523A63EDC10EECF5D06F0C1A566C8E2097C63F976B20F7B4574063B3B60D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cae0bc67353b16ee3934bcd7e79a20cd5013112d4945494c7526f78353eb13c8
MD5 a878adca862393dc5997b8ce94b9b29e
SHA1 49afea6ce5f3d3fa409be360efc1e440abce5ab8
SHA512 387f7a665546e448d1cda2899e5bb7d8ef7e474e33dc4013c31d24f167181ef18e449526f40e2935e20a6fe5999622e7b6dcc4e35ef14758510dcefc9faf4bfe
SSDEEP 12288:ayPz5L8s34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:Hzy3SnnrFb4PM4MYgLxEVyGLT
TLSH
T15755025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 bb89a7301f43e6da9191dc42e8015275642bdce0f57bbca6a91573080236e4d9
MD5 45c2d675ed39025f0230fa6c272484d0
SHA1 e39096cb85b7ab9606e9c0d49f702bcd28d2bd25
SHA512 116e09482423aeac31d0334b036cb5c154922021fce6dd8f31bbdfb30dabc1e281ad3828bacb25195ce8854028181641757114f6996b2ec64ad7e61ba0a6b3b9
SSDEEP 24576:ETHaLl3z0zDBSnnrFb4PM4MYgLxEVyGLJ:ET6Lljlj4MYPVyGLJ
TLSH
T17C6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e5d2a712b7170e64bbde9fc0a20dd18a323d12c812bc4fe69a699e8d032654ee
MD5 0550f90f3108eb143ce21ea807f8a24c
SHA1 0b11fd8381e80c25414acfd5f9ef61809ef86ff2
SHA512 d15c21c36cb942adc2d07dc156389d06fc2664e3eed64889849d2dffa55c21f59cbf885935263063a83adbc299a9fb1f236a6425ce3ebb7b03e2bbf536921381
SSDEEP 24576:A37d9CHKy7GZFSnnrFb4PM4MYgLxEVyGL8:K7d9CHKyaIj4MYPVyGL8
TLSH
T17375DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d08fa6b0a491b93f1ea97ce3f9b2ecf3d12fdc214abd52410a40d7949b5cddd8
MD5 4283b54c55460fa26bb72afcd76d7df0
SHA1 6fc787d3414d3cb4e4030caf619b6969e0b81937
SHA512 e9a54c7e91139a904b69e09042839c5df027cc9ee35f835e249ad1449a5fb1573b241e32a939d0d56dc50eff44fe9aede2d732ffc10ef5bf8c0e8408cb0f1abd
SSDEEP 12288:1i34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:1xSnnrFb4PM4MYgLxEVyGLQ
TLSH
T1ED4523A62EDC10EECF5D16F0C1A656C8E2097C63F976B20F7B4574063B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 320eba7ae649ff1eec06531e1ebc377a1bc7737d6aada8203cb069d023839d7d
MD5 6539f88caf23eafe488ff827182aad30
SHA1 e467c0768d939f44950225df72364d4cca07d18f
SHA512 93fde50729ce2a6f36b21c00228fcb279ed3ed8e72aa6bcfbb4bdad567f2e76399d7095c904bdb2302eeb40ce58c6ccdd985fc73551a500c2fda5d1cb5981c34
SSDEEP 12288:gM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:gXSnnrFb4PM4MYgLxEVyGL7
TLSH
T1CA4523A62EDC10FECF5D16F0C1A956C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b87284d0aa13f3436ace2079c16a6e082e38064e74ef944d9ee553e6356be9d6
MD5 6b608c7d08a9ab77e064cb9cf965ffd3
SHA1 c7926f6e574aee5acf4532e82b0737332d10d49e
SHA512 0b716070298948d6aa744c1c7c5f79a038cc14151502954d70d722f497a3b68f72ebaf8b7e34b0349067b5b405c28ef833760da89061b05b84fc4a1510086c93
SSDEEP 12288:mV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:mSSnnrFb4PM4MYgLxEVyGLv
TLSH
T1A14523A62EDC10EECF5D16F0C1A956C8E6097C63F972B20F7B4574063B3B60DA891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ba2f82ce29e1d8f0826f15cf8e6d1322197b2d2a323c63230d9b9d8b4ecf32f4
MD5 cb11f567edb51b9dc7f567c4296e0f99
SHA1 ce802ac66d744e3bddca864ba96232c6d847a67c
SHA512 d97a465694df69f295481b17b9cf0e7bd249fbe07e30ea1d3eb11322b49911d7debbc860983b2e4e2a3318306088e76955e408d735a16552b14d558ee1b77dfa
SSDEEP 12288:3z34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:3MSnnrFb4PM4MYgLxEVyGLF
TLSH
T1B94523A63EDC10EECF5D16F0C1A556C8E2097C63F976B20FBB4574063B3B60D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0d1ec5cd265a85642d7a7d2c26e20e5542ab645979a0f39d5fe59d36d4a3f8de
MD5 0ce990eee428e40f5c77e2a9bb4b45d6
SHA1 906d70b8f2b6dc9c20dd766797c4848366977856
SHA512 8b6a0a55352efd9e129592c227f4a333e161324cbf4b3bc6ae2e5337e792a627ae95cfe621e12900385791d2dfe694e153097c32b1517aad5fb085c6ffe9b3c5
SSDEEP 12288:ci34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:cxSnnrFb4PM4MYgLxEVyGLt
TLSH
T1004523A62EDC10EECF5D16F0C1A656C8E2097C63F976B20F7B4574073B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 67db3d78682947c733b95d608cd2d35cd1b67f18e753382d78158341b902c783
MD5 1a501b591c16e4195099a403e9707333
SHA1 6968ec274398880f0fd7df2294698607c6d94e4f
SHA512 1ab5b37cc4a5f30c5dea889f62dc1577583b1472722dda664dc34f89cd1e012b2ac29abbcf13308c244590de573b0d66b5babb5ad00eaf8e2ae146c712460305
SSDEEP 12288:H734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:H0SnnrFb4PM4MYgLxEVyGLT
TLSH
T1824523A62EDC10EECF5D56F0C1A556C8E6097C63F976B20F7B4574073B3B20D9892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ac45d8fad17c57b420975fc5a6a565b887cb72f96a7affa6ae3f7b1ab08ff432
MD5 2a03e16fb43dcad1986a4b812979a861
SHA1 9de6d0c1d36c34fe345d5f2805ff5eb799df6488
SHA512 20979e5e8b4649ee96d2ecfaf358715d1cea4ca710c33dae62540b2cf3d26e8bddcf787d8784f1d0d7501f0efb695e4df148af57859cfc04d9566870ff10366d
SSDEEP 12288:tp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:tuSnnrFb4PM4MYgLxEVyGLO
TLSH
T1704523A62EDC10EECF5D16F0C1A666C8E2097C63F976B20F7B4574073B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0d6566d06a2f277c4c85739a3f89d45cd13c78bf7eba96457876e11401c81abf
MD5 67b3789c41bd0b01915148f9a5ccad44
SHA1 75f2748189990768e64447d1410cf90a06be34de
SHA512 9178d4bad5eb8976c61426d6c751a780da29b6bb572b69d61abb76af40dc566c5c51141d5c16dbc7f0872bbe32ad704796462d7d4415aeadc789e3cc38ddd0c4
SSDEEP 24576:efwvok9RX6wkyAIYSnnrFb4PM4MYgLxEVyGLT:iMnYIrj4MYPVyGLT
TLSH
T13485D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7dce5c80f895e675b1a093c96c1c78701b3c96be10bd8d39a34508f0af87e582
MD5 c4c318941802b9fb3dfeb4eefc91271b
SHA1 6265b84b8a2584418fa8fa07141bbed66f5895f8
SHA512 7de4347e7f3a2deb6b27ce394b5845a0757f5acc347e92d05c0298af53546f5007c2ef500079e043145916272ec01bc2858fe5a2b02da092cf0d2bf4a370c825
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Gj4MYPVyGLx:yySzPfVl
TLSH
T1B6066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ac73700bf8d49ca75868d616190d4832d684765820930622e0266188d5c6b894
MD5 5787849038565ae2274859cb94d7843d
SHA1 657ea41112930f5dfdfbcb76ff774bdabb862805
SHA512 62e9ae6b881dcbf80ccfb1b43a105c5e8c095cd0edecd7c2b2ac52a11ca864a25c1db52c4dac5dc0014924f0cff48925a1c960b0f4f9e019d5ba1814c3750df2
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYrSnnrFb4PM4MYgLxEVyGLx:M47JUQj1irIhCnDHUPfF/Wj4MYPVyGLx
TLSH
T1AC65BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2d8347a8d3ef65db26371da60edddb54a13fac4756b5b59839072ba516799712
MD5 0decce36989306bebc90831a666e01ca
SHA1 915fa964a397be55d17aa03c193da88a4647946d
SHA512 7ff8c17d1982f57bc814109e271666e4e6154d8f9eaacc5d09a6dc713e750804f183071ca2683a56dc76978adddadbbc8ed34a5b9d34df584fb49e0baa9ac888
SSDEEP 12288:4Nsfj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:Z8SnnrFb4PM4MYgLxEVyGLj
TLSH
T12455F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 97671d083151edbbe04b573a63a5036baf87cb98acefd8b617e40e9dcf7ca418
MD5 15ca9954935f2669541050ec8576abdc
SHA1 8d4eef29ec318e3578306dc4297a7a43e3295db9
SHA512 9250ba4dc30a08fa86680324c34fa2ed50c8cefbc0415601fbbcbcadd16a87e30dd421a6be265f9b0d4da2cfa6ddbbbdba227268bfae8c77868b795383625c29
SSDEEP 12288:N78jIXqU3fVARpraawwzkfZDUb8qt3l4UwH3PIUs:N78c6UPw/kRDYt9SUY3PI
TLSH
T1823538407666DB5FC6A940321E33C1CCAB707D11EE05AB0772C98B3FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e9ad994726f66582f11c0745bc1e35324bffbb23d0779b8714d4b16d7b49ed89
MD5 1904223103c7e57e51fdd1b5a3386ea6
SHA1 c0dc73aa3c7a6b1c930846e6bc17a3f8eb9a965d
SHA512 eb72179692cb32a60278a0d13008c1ddb7287a14f449f58a0eea56b79c3e7a09f7e958dc1a96bbcaddaf1c8a244c2d675c339818fb830359727e31a9e4d3d0d6
SSDEEP 6144:HmV0CN9MRwRnp/JUePwLMegoQytMx7KjYJQytMxWumCHdNd+kS3R5:HmV0CN9xGLMems1VSn
TLSH
T1C665F6819137E78FD1B62032072A9B8DB764DC03B7096E27B3C9457AD82B751B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e822a303e9009c18d3280bcc1c0e65a510dd802bc6e8a09aeddbed61b1fddee1
MD5 bbf7340233d5d5e834d929066db0cbe2
SHA1 3a04239fa4647878a5b51f93c96d5e6523f18518
SHA512 8bb6268a67b61ef1ec340b41ba5222499208963c5dba76ecd04666ea0ec55692dc8b3bfa48216f7fc98cdd8e3ffde2a125978665fcbc1c2e74e00e346bbd08b0
SSDEEP 12288:lM7r34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:ekSnnrFb4PM4MYgLxEVyGLU
TLSH
T1A04523726BDC14EACE7D16B080A95698B209BC31FF61F18BB74074463A3B68D9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7617e23fa3f93d03fa1b083740a88659050dc700b0538bada006fb27d3909c30
MD5 f1a7f99f9ab5616074fcb45a343a85ff
SHA1 46020cc9ebcad71499953ba00bba957c46046273
SHA512 4660ef4d65b136c84c80d8b8f2fb3ad1d488fc8393e0fb2767f66c3f8426a86e064be2207e22caff0008d4d6921f7889a7b632eaeb44d431452fb628c2efb776
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYqSnnrFb4PM4MYgLxEVyGLX:Qgb4mBIBhGF0j4MYPVyGLX
TLSH
T15465AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e47c1775beca7d74241912e2ad19eaae79dd41cfcdaba793f99ce391106cc56d
MD5 246497972831e09722c29a6005c4b4e0
SHA1 f2dd3ace075148357fde8e731f143e6b16d98661
SHA512 3c403b2940409d819beada51f1452120fa0fbe382b57cdf0a0a646483ecb03f1d2415d46d624248f51e7ff89732ad1f4621b7f3f3f16c6917d2b50b82af104a0
SSDEEP 24576:UG88u8FpJqH1bzria7/mbSnnrFb4PM4MYgLxEVyGLb:n7ZFPqVea7/tj4MYPVyGLb
TLSH
T1A685F16577E001F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 66ea08997cdd35ae09b100fff090fcc3b335053a139533c33147766afba6ffd6
MD5 ad8d9dd260d552bb03ec92db083fc726
SHA1 07e500c0993d54c31cdad52915d28f94cc590da1
SHA512 4dcb596bec5bce6a6cf3f0b86ab9cbd8aa7bd86d0bc353a68c2fd14971b14cb1bf7d198d58871585f25d4cac677ffdc1b8f6a79e079f9dad92cdf1c2a161b426
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4j4MYPVyGLb:aG05lO43bgV/
TLSH
T159D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e38297a324b6e7200282303508f9ab8833fdacccae6dc2915b22a537bc4c0f45
MD5 49746bb5fe9724dc585a879846d9ce85
SHA1 e75b4e628c5e0b301ecb44142083d8a5db0989d7
SHA512 6c072f4b9cddf0178fd132f4757c7fbf3a26dab1cf7d453da00b5d431ce0e650dd807d95f2fd8bdd775c83aefe401cb03777a07b3b338788ac3f9ab91159f46d
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidntSnnrFb4PM4MYgLxEVyGLY:wa5POZ3+Jt2pasx2+mQj4MYPVyGLY
TLSH
T12465AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 12469f2b82e4f82afb2fed038e1c87e0353580d0a9188dcd42ed38b9c67fa440
MD5 bb796ffd79c5714f0cd17856266259ee
SHA1 c094adf516acd4f98a62ef85f3270e5433440432
SHA512 acc9e818274109519cbb71fb330782496fff2ce09d406688e98f134332b1278cb1f9216981b727208750167a25bc1bee2d8365cff8933b767c8aac6723735854
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkTSnnrFb4PM4MYgLxEVyGLY:aNc/zEOVHFNj4MYPVyGLY
TLSH
T15E858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ec6327307e342e1373e0fe464ea2a90ab33d52b135b75976e0bad27eb4eafaff
MD5 e81ba096416faebeed26ec6c1ff17933
SHA1 6de7be20d3479da2449a5b182b5a5a3ec10a33b1
SHA512 1dce4b54a8ddf20a8243f14b912dfa36da3efda9183a8aacb4ada97bbd6b943135462fa81183411b747cc8f62185f2b60dd9facdd3f0b10a6694ea6dcffabcdd
SSDEEP 24576:/8kNvNnaFeYhJNtmZBmDSnnrFb4PM4MYgLxEVyGLD:/8MwBtOmMj4MYPVyGLD
TLSH
T18B559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 881df192281b786ebf76bbb88c7167324b96daa8723f6a47afcd06fffc3ac31d
MD5 78b852ef4a663f1ce381b0ccfe66247d
SHA1 658a11f9cf9f21ec6f01729ab67b124fd3e23b00
SHA512 a8109a62444d0a08efc75886359c345d7ecf009e4f2e0d795d7ce2aa1a8fccf54e45a89e392cd457aad7d93db0039f98f0249760d9fcde60c9ea1cdda415a981
SSDEEP 12288:CHvUrBFrEjwaQk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:CPUr+NQvSnnrFb4PM4MYgLxEVyGLw
TLSH
T1F365E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 bc0815e0ac08f9e7791b019201e3333130e20f0f6d3d5f2166016fd161c5b40f
MD5 4a8bfee2c32056eb98dcfe136655cae7
SHA1 a7c7dc87b84248e8f271857632d64f9d2a153352
SHA512 e9846f92676a534c6cefe2790d40e08701035d16d05af310bbdb7b8a1c47c597b800bebadebeefa380c39e6e8fb626c77c6d253971c816d025a3d0b400ebbf84
SSDEEP 24576:2D3FHshBIYQgAwSnnrFb4PM4MYgLxEVyGLo:2DVHeBIAADj4MYPVyGLo
TLSH
T17A75E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-13-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/832-37-0x0000000140000000-0x00000001408B3000-memory.dmp

Download

memory/832-0-0x0000000140000000-0x00000001408B3000-memory.dmp

Download

memory/832-7-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/832-9-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/832-1-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/1304-204-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1304-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1304-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1304-71-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1916-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1916-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1916-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1916-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1916-301-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1916-300-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2036-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2036-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2036-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2036-129-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2036-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2212-333-0x0000020F9D2E0000-0x0000020F9D373000-memory.dmp

Download

memory/2560-286-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2560-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2560-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2560-92-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2560-330-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2560-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4472-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4472-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4472-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4472-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4716-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4716-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4716-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4716-318-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5020-201-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5020-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5020-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5020-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5308-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5308-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5308-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5308-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5804-54-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5804-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5804-50-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5804-44-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5804-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5972-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5972-16-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5972-25-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5972-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6096-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6096-87-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/6096-82-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/6096-259-0x0000000000400000-0x00000000005D6000-memory.dmp

Download