Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
crypted.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
crypted.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target crypted.ps1
- Size 8.8MB
- Sample261017-am97faex9q
- SHA256 c88f5af27ceddb2baedd0b79e794c7105b05d04f13e45ac62bb2c1d2b3770d56
- MD5 b15900b4d5155f88e7356d546c9d4239
- SHA1 da657682f794400485746e45ddfbffe9ae160664
- SHA512 cc26bce61d66ba4ed3461c4e5edb398137d48652b206b843b87a191e64d09ac0fffb9402efc2d66ea531afcef9af5007ac1005c353a523fe662395063b6cdfb0
- SSDEEP 24576:Ye1Ljoz4sOXYIoUc1KMoSvZCWvMhJbvsJrkpyI4dFCYqXAwCJclZKIRYHv8FjfCo:1
- TLSH T141968E6F205F897142FA1EE9C7AE253968130634ED0086D5CF2DE14B6BAEF6C54C21BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
warzonerat
C2
-
terrystoner4.ddns.net:5200
Signatures
- Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/memory/4908-26-0x0000000000400000-0x00000000006CC000-memory.dmp warzonerat behavioral2/memory/4908-27-0x0000000000400000-0x00000000006CC000-memory.dmp warzonerat behavioral2/memory/4908-28-0x0000000000400000-0x00000000006CC000-memory.dmp warzonerat behavioral2/memory/4908-137-0x0000000000400000-0x00000000006CC000-memory.dmp warzonerat - Executes dropped EXE 11 IoCs
pid Process 4744 elevation_service.exe 4164 elevation_service.exe 264 maintenanceservice.exe 5436 OSE.EXE 1272 PerceptionSimulationService.exe 2152 perfhost.exe 2996 ReFsDedupSvc.exe 3832 SensorDataService.exe 1356 ssh-agent.exe 1112 AgentService.exe 3148 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\vds.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\GameInputSvc.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\msiexec.exe aspnet_compiler.exe File opened for modification C:\Windows\SysWow64\perfhost.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\vssvc.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\SearchIndexer.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\msdtc.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\SensorDataService.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\snmptrap.exe aspnet_compiler.exe File opened for modification C:\Windows\System32\alg.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c97276f4227843b8.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe aspnet_compiler.exe File opened for modification C:\Windows\system32\TieringEngineService.exe aspnet_compiler.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4172 set thread context of 4908 4172 PowerShell.exe 96 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe aspnet_compiler.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE aspnet_compiler.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe aspnet_compiler.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe aspnet_compiler.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe aspnet_compiler.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe aspnet_compiler.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe aspnet_compiler.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe aspnet_compiler.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe aspnet_compiler.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe aspnet_compiler.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe aspnet_compiler.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 aspnet_compiler.exe -
pid Process 4172 PowerShell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_compiler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b692d9a4cd5ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000534bb4a1cd5ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000083566a0cd5ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cceac7a0cd5ddd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4908 aspnet_compiler.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe 4172 PowerShell.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 4172 PowerShell.exe Token: SeTakeOwnershipPrivilege 4908 aspnet_compiler.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 1112 AgentService.exe Token: 33 3148 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3148 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3148 SearchIndexer.exe Token: SeDebugPrivilege 4908 aspnet_compiler.exe Token: SeDebugPrivilege 4908 aspnet_compiler.exe Token: SeDebugPrivilege 4908 aspnet_compiler.exe Token: SeDebugPrivilege 4908 aspnet_compiler.exe Token: SeDebugPrivilege 4744 elevation_service.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4172 wrote to memory of 3196 4172 PowerShell.exe 90 PID 4172 wrote to memory of 4676 4172 PowerShell.exe 91 PID 4172 wrote to memory of 1976 4172 PowerShell.exe 92 PID 4172 wrote to memory of 2560 4172 PowerShell.exe 93 PID 4172 wrote to memory of 3948 4172 PowerShell.exe 94 PID 4172 wrote to memory of 3040 4172 PowerShell.exe 95 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 4172 wrote to memory of 4908 4172 PowerShell.exe 96 PID 3148 wrote to memory of 6064 3148 SearchIndexer.exe 108 PID 3148 wrote to memory of 4120 3148 SearchIndexer.exe 110 PID 3148 wrote to memory of 5488 3148 SearchIndexer.exe 111 PID 3148 wrote to memory of 4412 3148 SearchIndexer.exe 112 PID 3148 wrote to memory of 2764 3148 SearchIndexer.exe 113
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\crypted.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4676
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1976
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2560
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates video capture drivers
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4164
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:264
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5436
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1272
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3832
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1356
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6064
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4120
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5488
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3048 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4412
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:2764
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 e9b6a43035f2fdb9a133def19a867f9a7121e86c5633ed62a3ab409d33b6c966
- MD5 3a94bd19f8ca95f95292395b30388dea
- SHA1 52ac61f103d0b81a660267f04d83e7f119bfb45c
- SHA512 331f52ecdc123b30ac4a040814c9a23f047170ed14a4b74b94753fe95b48269d755d4fd2ede02142bfd65df4f566bfe13259b54dcf17258bdb7b915ce0561198
- SSDEEP 49152:tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnfgFIDRRAubt5M:z3q6sjBDUf
- TLSH T17ED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 c74837ef0b88e00d10eaecb0310aff042bebf14701dd3da45fce8eb2b0631a11
- MD5 997c92fa7162de4994a04220ed96352f
- SHA1 8a81d94254e7f099170bb676218cd948aabd1c4d
- SHA512 8ade3bf7bd7803bdb9c5b543f685990cb8b21ebc76bec2c234ec711d534146c487fa61edaf5c20942945e6d645cb5a2dfe1ccffff7a9201496d34b7bd4cbff61
- SSDEEP 24576:8XYfDtczAyVg9N9JMlDlfjRiVuVsWt5MJMs:7tcBgFIDRRAubt5M
- TLSH T10485F12873D509F9EC678279C9A28502DB33785547A0E78B03F089665F732D85E3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 3168a46490351a5c7ff1d4dc027c41c5054c06218025d40d134c4ca9b3fe26f7
- MD5 524d6fc98fb883d800ce0cf0d5f5e48a
- SHA1 8017b34c431a6073378b78b1552217bbede1972a
- SHA512 424b4b9217deb081aaf6a99fcb22d7f5d37bae441a2bcb27d55683a1e1c31b3c2b57e6b434cd511fd282d915b9aa198491f738e3406a60d1e1058fc19d6a4740
- SSDEEP 24576:I0Le5ji0hmx7rM9Vg9N9JMlDlfjRiVuVsWt5MJMs:IPji0A5EgFIDRRAubt5M
- TLSH T143959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e268a3c777bdd9d56f73dec7804628d271c2272ac1a20c3d1e3fa0cec77f95fe
- MD5 56a0405d1307abbfe04911953d2a4ea7
- SHA1 23114d8958a53ebaf10064e5c4089034a04b5514
- SHA512 12584ce3ee0dd1769c7ad1e4c1a9e1697ed1b531b07f1b1410e49d8ee9308d030d4047b336ab2f8a15e489937b31f37966f997b65717d88b191ce5df4ebd253e
- SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyujVg9N9JMlDlfjRiVuVsWt5MJMs:n/ezSC6vUzPveHjyogFIDRRAubt5M
- TLSH T142755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 f9570625e636385b3d05785db4744434dca5567ec3be29285bb382b4d097c7cc
- MD5 319913ae7edbe12c1e36a7031b0b09c0
- SHA1 18db7892e6b2f2140c2a74372d84dd2573fec648
- SHA512 5abd42e158a5a6dfe61eb3f1b3552327bccadbf8ae35ef4f205dcc706b788ea7520099845c8eb4f4a8c9caa03aaa375d06bfa6e2ba44a48249169e2a7005fdd3
- SSDEEP 24576:xVbqPb88hv/l+YOVg9N9JMlDlfjRiVuVsWt5MJMs:xVO88hXl+ZgFIDRRAubt5M
- TLSH T14E559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 13c32b8edcd5e9396e5ad4a168c079cee539b1ebcb3b5f7208f3b0ca516e2f1a
- MD5 42b227eee861534adb8ba003a9179ffe
- SHA1 3c62588c2810e1e9345628322d1303305761e069
- SHA512 433c7eea054186f3396f66fcf0e6fa931e00731afe1050c287a55d55f1afef7043040d094065f28ba2938cc3ce7eca09204088e05ee6ec52a1f0f5aafb49b948
- SSDEEP 12288:r9DV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:r9pVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1A46523AA7645A5F6C65B82B1CA73538ACF236E5835C58547C2B019D1C9FC1A2EC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 6893e91d9ed2577320efd2608cf143bea1db90befba3e55dccc07386bc3b5f7f
- MD5 d804a119fae937fca65abd983b7359a7
- SHA1 bab5dc45930070dce45abf2bd9c58219bc982517
- SHA512 cb1ec4d9cc5d9b852f54e1258f486f3977ff06b7483a344db2730f5b0143c519ea18ec75d12eaa736fa5f6b7a026bae5b64024703d4aea8fd12f01e6e3db4413
- SSDEEP 12288:HeBNUbTVO86UWV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HJIUGVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1CE85CF7BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f1bef38030829461377bee2fc9012ee9d483971b3ff9961f5ef64295473b3eb2
- MD5 ff9bc6ddaa3ac4a9398332e3ce44730f
- SHA1 e542fe115787b8620a050c8dd2dcc97dfbe3833b
- SHA512 513cd7f8cb04adbfc95f07702581aef9c508499bb5ba6661555be6d6c3a6cfcc1e1cbc0b1e047424ecb3813399b8b9f2f2c260c00a38e723836f794f53d647f6
- SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:EQvGAdlCEL8c/DRNw5CmUf
- TLSH T13E267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 7f7f4f5c0e3649e3eb1681559d259a49e7a00310f4c98bc01319257f315da86c
- MD5 d446209bd53aebfc645628ccf0eca776
- SHA1 b7c140a334e163d4ee11a1c8931eddaadff351fb
- SHA512 df16d00507cbfe329aa9a698f2b5a5d07a184fb856387206768a5729005d8795d88ccac8a10450d67f4c392e8c10730a4b65c41c50b3cb3959c30ded5d875ae0
- SSDEEP 24576:FSewsAjUVg9N9JMlDlfjRiVuVsWt5MJMs:YljUgFIDRRAubt5M
- TLSH T10185E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 fa86ce71087f2c58df9d7ca671e8d1e7d724959bca8dd0c29fdc87e89f622f1b
- MD5 fce5e2dbf913bc062f26da56f0536caf
- SHA1 85c21c930011ab6595d8e84bf721d04b2ca50912
- SHA512 60278ecf42a64130058da965cbbc0e68be66c587c4bc9b8446b096b5b12283d0355eccdeb05fd6838ff944ffdf41f832cb010d6ed76e2fdf6980b6cacb95d171
- SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHRUf:NUEtQevvqc2W1cpV2tI32RUf
- TLSH T128474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 82d1a818399875d96fa1fe718a304ca776b117ea7b8a73049d0e141ae6990c65
- MD5 fc0aea332de9aa99992038df5c34f6fd
- SHA1 2e960e07dc1b13ec9826afca535d913cfa82a0e3
- SHA512 3e40405d31ff96694ff0edcf07973b3492cddd0ff71e38071614246171c3f279764d6a645386900e12cf892f35cb4ca73c05c038c3f1123e97a0e8079c78ab8d
- SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/z0gFIDRRAubt5M:OoqtVjnmSUf
- TLSH T180D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f7dc95cad384c962be69ea4843aedc5e44c1d5b77105adeacb0b734b5ca80fa2
- MD5 9634fbc507a1b001fbd243ea722bbcf1
- SHA1 72086463968f3623ab51f25cb1e597efe1e65cc5
- SHA512 6685c1c8f0c6c50f281ef268a225d3274362287317bb60864a6f997a2bb955ab0ccb7370dc5c6b09cc4990162ac693421def6c7adfec4f2c058ba06951e044b6
- SSDEEP 24576:CAhGL3IFoiwtA5l7S53nVg9N9JMlDlfjRiVuVsWt5MJMs:CAMUFoiq5FgFIDRRAubt5M
- TLSH T12F35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 dc993f8121fc620c9a8597c02904ae5a35daf6cbf18cb92d9ce9f0dfe2b63028
- MD5 d540b131a83da4f64f365ee44d9cfd69
- SHA1 512cb522f269f358f09d8ef9b87fff31f64dfad7
- SHA512 3a970a90785324a1cd53d71f146f53906c295fb068298b9c0b4f0a6ebc508930be0654174a63e4b4c3d1256a7d37f01ff90f0ac5acf4f9a3c402028b714ed05c
- SSDEEP 24576:cwuWOW4Vg9N9JMlDlfjRiVuVsWt5MJMs:cwZOJgFIDRRAubt5M
- TLSH T18C85F14A32A40CF9E9678239C553C136EBB3B8053A61C71F43B0C65B5F77261AD2EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 e2b2b90397dbbe6393cdb208fabad4cc754bd86e560746189b16a8f5c24bcce3
- MD5 283d38652379e01b305e18dc8c5cb224
- SHA1 9db4cb050efc093581a17f04110704eda71ca823
- SHA512 4be555d673e47a4bc607c52af345f3248f0d83de5c747fde25c3c0107eb64548b3a22890745d4a57d2e99e8742cc51bb4914aed3a5cbe15fa8a83a805ab1f5fd
- SSDEEP 12288:B0Z1IyIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:+ZuVVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1C975129A33D460F6D1A78278C9F24345CB72785633B283CF427006A65FB66D25D3AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 1aede07d30dae5f00f83dffa1dc19be2061cf4a2cf049c71a73703ed18019b2e
- MD5 b623c6c340468456b1802ae18759f502
- SHA1 ed6892dd88b05b2d311507e610d3c0227a2590e5
- SHA512 e1153c6dfc02d9d4b04ef273ca438197901553cad91fd9a5b40bd63423af2d7936a78996fc826e3845fe143c2f520b63686a8dc488cc1a460fbabb9f1460ea95
- SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:bQRQyi36YOcPbLvw2gAf+PN3XUf
- TLSH T1FA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0151df9064c347e3851fac032aa45e93678cd3f323fd87a18e1b1eda55a7e7e3
- MD5 e8bfa8b999ff7a690a9517f02487cca5
- SHA1 1b9b69a0230dd027f1272aca9d45c373b0c88600
- SHA512 a92cdadc3de2bb592dfc7d73581aa5d64f647b19234ecb80612ba364966a19fdc3188d411b5707e32920576d94df063b5ee5c92a6effb82983e461a90103c4ea
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:yQRQyi36YOcPbLvw2gAf+PN3XUf
- TLSH T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 acac3d3587b201cb6731093bfffb079ee9f8dfaa58511dae9ccefc62e5240595
- MD5 a9989437a0c58d6040bf425f887aa305
- SHA1 a01e5d09da1312263597f12f05a7c6f7539fb386
- SHA512 23c3e9e3e36fbd95da75e706f133dcddaae53b7a2e58687d958b31bd6410a99670d2f4cf93c990373edee93e67ea720a4d012a7a92b9ed30d995aa34d1307dd2
- SSDEEP 49152:U68Qg55nhceWu7PNU3/EgFIDRRAubt5M:+thLRc/5Uf
- TLSH T199B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 2a29de9f4af1097b378e0d3de36addc8f579b8623cc26582a7bd1f4e2da5bad6
- MD5 c82a9730ecaca0c5dca71b9b9f2be608
- SHA1 51b6f2a2cd42b3259700f5fdb427897a1398060b
- SHA512 1743f61764a8a428adf7b9ad56069d4528cc4827c52ceec09574c69b090a02c1e4041a335dc2d47431340f32b46c4c90d3b88a782b092a1d7036383614d56996
- SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99D:py5112gYy5azzVvt69nLKnhZEUf
- TLSH T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6e8e03efebd6e6f8082aef68fea94614be3fefa90ed2c17e761a770280837222
- MD5 5083ab556f206fcfe5b316ea9f610c28
- SHA1 5a0f6252696626b73ce442557f67c5b1ed33467c
- SHA512 9f1f235ba49ced860fd5e0ddeaeb59852df3b6ead2da8e5e27c9595470906e16b9b8459982d0c09284a68e3099ad9a550c9ef2edab02f6ea60f2a14c76a05ad3
- SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glOgFIDRRAubt5M:hu6Jmdxd2dvUf
- TLSH T1A6D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 de17302b41bf681bdc4ceddba2414e25212d26d44020ccd97857fc1791dd5503
- MD5 104cf8457640e4d5a8cc8aaf7eba1d75
- SHA1 458fafd2e6f5154fefd6a05cae56d908c175de5b
- SHA512 9e73f4d9fec52dd1daa2e69b8d91f754991269cb7b5326ce48ec59a0a861ee5e132581acaa208e6e89d60a4ef38fa05645451e01a6f49d66ac432753455307d2
- SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xigFIDRRAubt5M:ymifPWRSUf
- TLSH T123B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2892307ae2e1ef43115d23ad70670acaf0e282faaa2aa141ae6c417c39e1e2e7
- MD5 a73a0a4630af99cb0c0aad7e7375c93c
- SHA1 a1ecb8573dff1d31ef3c76dbb05e15dd59564e2f
- SHA512 570b6f408136773a364f0887e7bd77534d9c0695fc63351e432014d3a40d876db938e79b919b2fb6d466398b965898485752138635ff41f1f12b94206277dc92
- SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqvgFIDRRAubt5M:w5dKii61oUf
- TLSH T135C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 2b5d84478d7fbe922c6083d83c1d792353d2b5a0db3710a6a19c46d14a5a8d93
- MD5 034591bcce6a399968c21aeea4bf50a6
- SHA1 0cd6bd057e6a0399856db7202d583b40f7b3878d
- SHA512 1be435dfa1c473a593e5aacfa1c4c174da4aa810fd209a8705a6d21b1f8ef31ac2a99aefa30c97736ab7a0cded408bbf4e79657eb41451565faabf3e65edf809
- SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wegFIDRRAubt5M:DX2imphOUf
- TLSH T1E195BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 7c9ba7efa22f41483b1334c97fafaea71c791f02a152baf4897bfdc8f51bf2b0
- MD5 58db6faef69e1ee42a135ad520188089
- SHA1 aa189da5eb4057db82462943432ca0bfe86f8a45
- SHA512 3745c8e24540a61431547b709376503f907d17c9ee0ecaa78cc98f8393d06230dac028288072c1bd67a6b1b8e35d0a0085c1ec3cd3fa3c6ca15b083023cc4d05
- SSDEEP 12288:arV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ahVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1F56523AE758695F7C50BC2B1C9735389CF262B5E72D68147D2B00591DAF81A2AC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 fc0ed0b6aa105343d91e714bb652cd6ee61b80f32379b7272b250627531cc2a5
- MD5 07032e1d83549556139e306951ba5b0b
- SHA1 105340f92d442e94973a20f80874675b3700c00e
- SHA512 5c77a7837f54552feb6c52ec315f430a9ff7598a29fbac7ce4c9739dee998f514a37faf4cfd8bfa17f353068423268e9389a4dfd6268cc28343b0199b0f43b92
- SSDEEP 12288:z8V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zAVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T18A6523AA758655F7C10BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 b804e23fa747c11d58d0ebdba07860616db061b515bd7bc534692e902cb711d9
- MD5 8a01cf77ce2329937c52e2cb7bf7e839
- SHA1 10972793cb43e6121012d510d318781a35bcefe7
- SHA512 0a238ef765121a99587d22d8b04bc0307965a962a689ff291dce14ddfaf6655374b12a2a2e55bc56b2a9a5a900a2075adc56913f41f12aaf9bbf025f9c5526a1
- SSDEEP 12288:a+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:a+Vg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1796523AD758695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 1bee4c994f283d4e21725f6ca3e23b3a9f93f9dade14d8bc30695ccdc5fe746b
- MD5 68e9d8892ba308f441eab8cdd254fe70
- SHA1 926705de2ebdd4834006ce7190b049bbad109646
- SHA512 401b4c84a1447a963a97f3a1ad11c7f5e60eb545951e0a049365c88a2f143ba18d930fa58c378c5a169a5e9e58f10b70a5866b7be9000dadd9c24c1a20c8d8dd
- SSDEEP 12288:oVlV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:+Vg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T18265236A369645F7C457C2B1C9734345CB727E5973A2828FD27009968EF43A1AC2AFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 2a0a1a0b1b31828b8607a5d7c78ab890fc8cb9672ad4fcf660a8eeee8efe1e56
- MD5 d09c3c7861b36a9d7c28bcb0fbbcf5d4
- SHA1 5724aa2805fb4ea269f06d0a15c915b5919be101
- SHA512 04ad7db5d77dd8cfa7ea91a31d72d3e2edf5e2ffc59701df27662f8e495357b155518c6327afbec94613808819d82722bcecf9c1c2c23e5e2104451e1fe346ed
- SSDEEP 12288:t9V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:tPVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T17D6523AE758695F7C10BC2B1CA735389CF262B5E76D68147D2B004919AF81A1AC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 efccde7ce80b2c16da53a6383c5a996f00f7bdd8ddf2f0c081909acf5e05105e
- MD5 d7bd87bde7a2daf38c13542e646d505c
- SHA1 016ed2a5ce2d3c90c79da3254fc185c25820c41f
- SHA512 b38586f59b1f1011405adcc89b10f40f246bb324404a3cba2b3feaa2cae3e5a6f64579013f2e33c29d543b1ba75b2b08ddb5ae0417ea7f613b2144514ca1d590
- SSDEEP 12288:jAV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:jsVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T14E6523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A1A80FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 64c657a0fcff8905721978eb23e9278a7e2f304d8754544f49d8963147adaf6b
- MD5 5203a6126ebb9893aee39d393125c487
- SHA1 68fad582174fbb87c9638bc08b2a30f30114989e
- SHA512 2d74c4a8f8aba378d138ea235d01a3c5131f34789be94422381cebfd5169fea89d434b78d3714e98faa3a74ccd0988435c01f8c63a676d689c3abdad9dc58648
- SSDEEP 12288:9UV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9oVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1086523AE758659F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A1A80FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 ba795ccd7e2610b72253e918fc49f8d6deb16ef0172a26666ae7bc1041978106
- MD5 cbf8b03672df9d2c7fb848566c525a5a
- SHA1 de1849c5bf66c5f290e1bb13870e18aec071cb40
- SHA512 c706b56f88a2338bb489d512028da5c368954d9690fc5a616ea780dfbda87fcef68921a51fa8dd34fff2ea8ed3532b6efae68e5f1053c2d094032d772cf5f5ad
- SSDEEP 24576:3ZMrzFVSOgVg9N9JMlDlfjRiVuVsWt5MJMs:3ZMrzfcgFIDRRAubt5M
- TLSH T1438501A9739018F9DC67823EC9628906C6B27C5A17A0C61F03F436675F733A15C2EF96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 861f0de021dbcb5448d9090f0028888e0e17c7c5233bc2aa9f13a0e4e6243d0e
- MD5 99f249be414cfb904f0cbd3db7dab101
- SHA1 1af7d292b41302a85d77593006bf1b26660b6197
- SHA512 81b8b3d8b1a4635bde601bf9bdd79cc17d04b9a1c8cd995ac83c8214e4dba4570578f980c482ceb0363c658989e4d66a26ae382c11a7a3eed4122283233be3da
- SSDEEP 12288:jHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:jlVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T14A6523AE754659F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 89d27da66c47fa83d4557553c9ef36fd5ca2e30d4f91d5e03b354a0711fde045
- MD5 5b0f08b2becd208fff5454bbc3c85263
- SHA1 12b45cae32f9d5052750dc089bb6b18f1a4304a8
- SHA512 5d0dba927276cf8c7c29c147c78f43bacfa53fd54d059a9880d1b6de3986d40e99f4cae6657051747511ac86cf25c42fee38584848eaa155439a9e9abaf4e038
- SSDEEP 12288:AzV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:A5Vg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1546523AE758655F7C50B82B1CA735389CF266B5E72C68147D2B00591DAF81A2AC0FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 2c1f4b36a2b7d1377c83b44738f1e32c55866a98140d2247cd5ec76d0d740ce0
- MD5 bb2c773c850a050c0a00048e6754e802
- SHA1 9c62f1e16b81bbf7bf816eae207d53de7911f674
- SHA512 af113df73553ceff5b665cfb3519ffc766af65801ed7d33717545ab69cd56fdd26cb0d262b416864ba945a732bea3264dc1ff75401182a1213209d5992a613c6
- SSDEEP 12288:RyPz5L8IV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:AzykVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1F375125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 ce7ebe8fa92a79408c20c5edbae0eaf44dc51635d2d67df4d21e7a29c8d421eb
- MD5 443e4878fd9e66dc374c2824484fdb56
- SHA1 097512d73b0d1fd87b912709fc467a4a7488ca39
- SHA512 07f60860f3d0b49e0fbab0c065e1e070a3a48d2446bff1a9608c17aaeddf83471228398c4c0c2c687acbffc1d9243b47a47e3b7e9222c8df002bf2a0e7f7a6d0
- SSDEEP 12288:7HV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:7lVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1DC6523AE758655F7C50B82B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 621ee9de4770f182ffe30e53bea53e6477994a62842d4fbbde0983cb94468f4e
- MD5 b9f0674890d61826e449a4be55a43d7a
- SHA1 31f7b9fb4a2c0cbc81b8a74bb4d7cb7d5a1c1a8d
- SHA512 d4985ced6af6c48f05be32f5cc887dc464cb9ea3221b7ccc70e5aeb0bdb4e8ea0a89c71f1a7e0a8f2cdefe0fecbb25b15c0fa3eb98245a5434bd20d7a7d45524
- SSDEEP 12288:wHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:wlVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T15A6523AE758655F7C51B82B1CA735389CF262B5E72D68147D2B00491DAF81A2AC0FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 bdfe96c71638850f72a7ef6652778bdee0aa6344e2f52fddb019d51878219a7f
- MD5 7ff21e61e12bb47e9d9b1f604a4d7b59
- SHA1 799b994617a407ee151f8f78e903763b4f3da534
- SHA512 111b36596456e4f74fbb65ae4fd8a3f3f3935dfeb817bb2572c733608792a2b3e654074ecc41ce81a100d079c77182810fa18029588716d6ce87b580798cc604
- SSDEEP 12288:SyPz5L8IV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:PzykVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1A475125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 d24d5aa895f6623bca7d039b75a74882e61163a9ba5576bb5c9e02bd1604e836
- MD5 5908dc5ccd183b0eae63e1e805fb2103
- SHA1 0a97cd89a536b139d961cefbfb1fc807a344a29c
- SHA512 335e36b2cd4aec6de315330f6a442b166c80feb4d5da618a86b2338cad3b927d5632c52ac6ff6f29787307583ff3e99960511205b1ef481001023ddf94b8332a
- SSDEEP 24576:PTxaLl3z0zDuVg9N9JMlDlfjRiVuVsWt5MJMs:PTsLljRgFIDRRAubt5M
- TLSH T1788501A9B39018F9DC67823AC9624906C7B27C5A17A0C61F03F436675F733A15C2EF96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 ae47a96b8b9f03819ecdcca0c8d3db32e2999738976ce6cfae60846c7fba39e2
- MD5 139618dc2f9e21008d0ba719a2d0d963
- SHA1 f83d59c7037f8b3315eca0604a5dd7c1aa0f572f
- SHA512 187f4d9eac74de1f091e1475db66b96d1e2b6bff13241ad88ddced2cc4c59d042fb8c80173d17d01526fafb1080360d0d610f6db5b628db547312d15729dffd4
- SSDEEP 24576:53Zd9CHKy7GZqVg9N9JMlDlfjRiVuVsWt5MJMs:JZd9CHKyacgFIDRRAubt5M
- TLSH T1E895CF90F3E414E9F0B7DA35C9725602CA767C5A1B71DA8F03A4265A1F336D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 c00cc07934b247af3b724432796fcba451203a42065b7ef8b7bebe4c06d5513c
- MD5 ff340c98fc804be4504e3d45dd86df69
- SHA1 9d1e903175f7a88a6eebde1f40bdae1143b21c27
- SHA512 dbb72182d08f9ac0101fd596dbd9ec19b89c5a3a86a99a85f757bd3b70743a0869bb3dd90b4a55450d989f25504b9917f8ae5ef9e10768203c0eaa76e3e88d96
- SSDEEP 12288:weV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:weVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1DC6523AE758695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A1A80FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 1a96d1f723bf5672f2ddc7703a2a857db2c66120190ab4a0e32c941f1c8eee65
- MD5 d1c55547fdd23ebd6edfa8fe3448c540
- SHA1 a202fef5ebd848664a234a18bb600504a3f32c80
- SHA512 a5efd330c184b53f8e68594dc3de32409cc8d775dbb187aa2f33a7ae9b0ef949b7127579094f2608d48829fb0c05cc19cc6ae0e7cd82a4d0810cca7db62d07be
- SSDEEP 12288:voV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vEVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T17A6523AD759695F7C11BC2B1CA734385CF262B5E72D68147D2B008919AFC1A2AC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 4bdf761f0ec8fd889f532fb1843feec9f888b06fd9d726a49b21a401ccfe86a4
- MD5 7179bd40b547a0db36b705ad20f9bf0d
- SHA1 7813124453f2d761ce293c8d7991f7a0e3a52b5b
- SHA512 7c4f2fbd339d3e2e1b2e264ff386e06e494a821e18d4cfe7c82900bd147d7ac4885ef6657507a79805245fcff0be9f610f47e09938bb2816a92282aabbfc8d94
- SSDEEP 12288:2xV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2LVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1C26523AE754699F7C50BC2B1C6735389CF262B5E72C68147D2B00591DAF81A2AC1FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 1ffe368f6ad0dad26e5b5ffa193baa9e27c81cb3b9742dca687b4151c7bec412
- MD5 89d0805126c8a8c5bc313cabb5248148
- SHA1 d5eb2e4a49077300a4e6bb7e14141136e1ea0f6b
- SHA512 f9b9cea6a29214ef050fa50d2e41dee475dc237ba25ea74b09a15e432cf342c10265fac69111de622c0b28c363d70173bf70aacd840af5d68a9136c4a13a00d9
- SSDEEP 12288:8HV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8lVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T17D6523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 6119faff2a8706e6dcf7dc641ac3f0fb8658159c8c76fea8967e4bf85fc4de8e
- MD5 8dd1f7ae2bbc58094a0ad1c3018e2be6
- SHA1 e286704e63d081fec7fc1bf530f3d2080f8a1943
- SHA512 81a7e59376dfcc28618bda2ae97fac8dbd56e2e17a7c83cf87985a06add725312efa97688912b61d314dc9df55d97b177df92c3a328f042acdb5741e91eeca8c
- SSDEEP 12288:deV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:deVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1766523AE754695F7C50BC2B1CA735389CF262A5E76D68147D2B00491DAF81A2AC0FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 3c45104a5023ef3f0570d2d338585719121649d5066c794e0564149e1c5c531a
- MD5 68807cb0f75a57115ecde356e94616b9
- SHA1 7e6aef1fa67641424c62a8af7aa9082639c88fad
- SHA512 72deaddb3fde8fb319c816a386a6e2118b46dd9b3327b6b26bde996c850b45568cc56082226dce94375100d45b31afc38a3604e769ad60127016ccac70fda964
- SSDEEP 12288:9fV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9tVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T17F6523AE758659F7C50BC2B1CA735385CF262B5E72D68147D2B00591DAF81A2A80FFC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 8e2a8e7f6541d2c3c3d3cbce6456a66c955df963e3f635a3ed9269dbeed6d71b
- MD5 637916e54f0c3011b6223c232053282d
- SHA1 011e0e6968003d2f6bb726bad39cd354ac51c9e9
- SHA512 9c87b7e77ac93457d230866641ca9806eb6dbef4d13876c5fcf5bc4307186ecd6266af7e2dbf7bc22ecb83b0412bf9d40c3e27a291edc1e20f7792d068f20f82
- SSDEEP 12288:29V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2PVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T10A6523AE754695F7C10BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC1FBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 fc85ba942221623a87e10d8f83d9126ebae1705c32d6654dba6d7fb959f78145
- MD5 1b122d5ce31c8ee9639bc48447b2af1e
- SHA1 669fe26b19b77421732afe2f5b0706ee75191930
- SHA512 89f2d87c59860b7ae4a236ca1deec361f236a3cd4bb7734cbe5efbfd93fa57c33d8b0ebacec3aacc902cefc20839819ef3f9c53ba183e21edb912848a99564ba
- SSDEEP 24576:Xfwv2k9RX6wkyAIJVg9N9JMlDlfjRiVuVsWt5MJMs:nMnYITgFIDRRAubt5M
- TLSH T19895DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 4cb42db39201935256158c5230a590c62da59b16c53c3817bcb124b1468e00d6
- MD5 af94263db3c7d132c56112fb8168c1cf
- SHA1 fd97f16aef0e8a47d7f7914b8fb25c5cf18f4de1
- SHA512 2001a942701f57f1ae93a502e2b53d424f725b15c656998a3cb981f1304eee8a9ff7bf4d888cb32f13335b3bb5ab96cbb654f947c74ca6f9cbd48ecc722fa029
- SSDEEP 49152:vYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+gFIDRRAubt5M:6ySzP3Uf
- TLSH T120066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 82c30e2568b4a868f5ecd6ec8cb6c9768f7c9d67e7cfe99e99c2e65f8250e1f2
- MD5 6bc2fde92b578faac1522b99deeaadc3
- SHA1 3c8602720d67a6bd08df4df742b9a5f880b77b8e
- SHA512 7e038790d4973a7af095be00994af99ee18c717dfd0fcac347ca41c304ec8a0612c47d944bd492be33cc7b9932a948272873dcc41c690a448110f8ad468ced40
- SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYwVg9N9JMlDlfjRiVuVsWt5MJMs:L47JUQjTirIhCnDHUPfF/OgFIDRRAubE
- TLSH T10D65AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 dec228436335789b670c4947b248c88702bc2a8b22f20e28b1c8732a0a9bee44
- MD5 952f41da84fbeb82d02c5c53d5df5a4e
- SHA1 7ad88690e28d80806cdd386f252e0eb82bb2b7dd
- SHA512 fc3801f8100e9a144b566201c1a57ff6436eddf35d3ca8a15a12b05797a5e191c23b514eb8d657ef321b9d9adf8069925e051adcb0e4b9de41f556d205254cdb
- SSDEEP 12288:/VsfXV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UVVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1F575F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 8d7d882956ba73e260ef3a86acae4ab8a0763321025e937877e267825c108238
- MD5 c4925948ebba5b1b099e07d730debd78
- SHA1 f4aeade679c0811b81ae0b0ffe57c4d6e77ab046
- SHA512 e7d62bdd91a000881c8136a17961806238c26a5c37fbf715f067b15d945e67c5453e9c9ec94997a40099cc4dd3a1b2f2762c4ae374b0bebccfabc495ac9099a9
- SSDEEP 3:OlH/ltjvoPTkol/xKkv2Zl3y8jK63mCllltGlslslslslslsl67iSa6//:KzoI4xKbVKcmCtEEEEEEEYiSx
- TLSH T1738192945B805E98CEB6E47198084B680723D2C0A59093AB150C2082CC222A84CB3F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 447785101160033cc6f4bbd48b7ed0a0c3194a2dd31d87c12fa5ea9169910dcb
- MD5 1a5fc5f1963efe666fea361d5a667369
- SHA1 f8fcb6dde5217bbdf282fb2daa0488bc954b67e9
- SHA512 6f1a24cdf367d8eaf4588b43f11e94aad2048ee9c77335dc03d3ce816a46a84708b7b0fce528fe9453eabe44b7e4c92c4fef53bcb040cf68321d0e402b3b66ce
- SSDEEP 12288:N+7vV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:YdVg9N9JMlDlfjRiVuVsWt5MJMs
- TLSH T1AB65237A768999E7D46B92B0C57383058B2B7B693BC181C7E17005D199F81E1AC3BF83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 ccd78d1c87db14ad6d1620e8ac5aa3144d8586cd4816017f90a6b0e5a53523be
- MD5 de5e06e1faecb0db5af286fc08924a3c
- SHA1 0f5e16c767e6d3b5df7aa7897371885bcb0d2a3e
- SHA512 4afcc0c3bb548d49c13bdf26369a92db8eb7cca6b0f09d1f5147f9eef7d3b267a309e646378195ad05406ee29257616499787027226d9e2fe61c80cd351036be
- SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYjVg9N9JMlDlfjRiVuVsWt5MJMs:ogb4mBIBhGFggFIDRRAubt5M
- TLSH T1FF659E1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 468811c0882b99565b3515290c3e201394f49d762cce99ebcea23aef768400dc
- MD5 dbe5abfc3445e7af6e9fd354ce43cca5
- SHA1 c469d895e60117b31bfb25688029c2b893ad2230
- SHA512 662d620b8dca8ac25372aac090ad46bd80a19f70cea32a5865054e877b357b398f07e3d3fe9a1a1adfa3bf3ce4110e0049cfec9ac357fa92fcd4830bbadd4af3
- SSDEEP 24576:tG88u8FpJqH19zria7/mgVg9N9JMlDlfjRiVuVsWt5MJMs:g7ZFPqVka7/ZgFIDRRAubt5M
- TLSH T18595F16576E101F1D47BD138CA924663F6B2B4251364EBDF07A88A511F23AE14B3FF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 e92d76cd7c33635041ff2684c72054648bd2a0f42e9d9650b232db7ab5c950b8
- MD5 8b6e0dc1f7e1a78d1f46359113bf570f
- SHA1 66b62d6a288df16766b60ca0759704f9809c1ff0
- SHA512 2ad13618ad685759f30b9d11eea5433f620e8d2683efdb1c07df97671afaf56619751d17cd974dd94556405083da3671c178d6ff25cebd864d684dcdd0249624
- SSDEEP 24576:TPUr+NQ8Vg9N9JMlDlfjRiVuVsWt5MJMs:TJQcgFIDRRAubt5M
- TLSH T12C85F12F32A918E5E67AE17DC9824709E77274621352D2CF02E0417E4F67AE4BC3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 43bc656d87c2dc1cbc4d28ddd83454a3f660f4de71af98aafc0d16b1b982af9e
- MD5 44147be5f611ba183273d144ffc93670
- SHA1 5ae656971bfb34cbaa045b067878d85121aaf292
- SHA512 6730a90c488ebd5ca467f45b4aefd2e5e9962b178ca2130d288b1ecc2e9ef84b6fccf4bc51ba2431c89732528cd5e3defe373fd0c90a29f50460d2c9c3922cbe
- SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMgFIDRRAubt5M:vG05lO43bMUf
- TLSH T1B7D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 8a48db53ffeb09d24243ab959e75fc823297153cd76ca69b45a0b3b170814a2d
- MD5 4cf12e8cbfb37c761d43233ec79448b5
- SHA1 cfe229de2454d8ad297b93960ed52adbdcbcb5f7
- SHA512 eb58f9f21697aac08806554871bd194256c5ae719aa780a7097c99b00edddca06cf5f99d84bf4f23ba6ec9e68fd7f47d96c2b94d2e9cc845ea2b7a9330da2b46
- SSDEEP 24576:Tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSVg9N9JMlDlfjRiVuVsWt5MJMs:ra5POZ3BJt2pasx2+mEgFIDRRAubt5M
- TLSH T1EA65BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 98ad7136340a81244f8c0d99def8a45ab2f5a632caea27165451866bc070e189
- MD5 4a3d6420d40a193159a800d31b43aa31
- SHA1 bab9e737b5d99d46f69bef1f039b754411f2204e
- SHA512 054f084a87432b01a7465d1e198c4c992432bd603a38fafaec94f5a6975b98ee7c11c3e1907b1aea559bd3c4c57d3fb428d639e9fda82042e0168265f09794b4
- SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7FkYVg9N9JMlDlfjRiVuVsWt5MJMs:mNc/zEOVHF5gFIDRRAubt5M
- TLSH T1B8858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 2009ce33c65b90284e8a850cbc37261025bfaeae1d365b66b03fa586bd736099
- MD5 384cb5f733b6290775ca41085cfc7149
- SHA1 f031899476b72280d095259956ca828d7731d1e0
- SHA512 b4a4ebb9f2c3a2773058e755d3517b23bbea9cefb66f0ae0d655b35d1a74d27ff17d1f9eb189a160ce0a2535b4a799c1e1250dad8ceb8770109b06d542de76e8
- SSDEEP 24576:MTkNvNnaFeYhJNtmZBmWVg9N9JMlDlfjRiVuVsWt5MJMs:MTMwBtOmSgFIDRRAubt5M
- TLSH T10B55AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 6283827004496d571855d67c27a9ef2b4a9336333f4ae4f0eb1a6e71c2db7cad
- MD5 a9c9ca8cde4bec3e2abbeb4bcb76f26e
- SHA1 3bb3f2a857739cfd7f22b093403d1f685cdb1e96
- SHA512 2408016c524cafe4f97ded49ef65c9492e1c755fa5f2ab5fbec8b677ae3a4c0d3ad9240a46c7ac4e662ab920082968248ac7ee61fc8746611dc5385ef282e247
- SSDEEP 24576:TD3FHshBIYQgABVg9N9JMlDlfjRiVuVsWt5MJMs:TDVHeBIAALgFIDRRAubt5M
- TLSH T10695E17EE69804E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE47D3EF50
- MD5 SHA1 SHA512 SSDEEP TLSH