ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
Size 1.6MB
Sample261017-eze92swyd1
SHA256 ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d
MD5 57300c139b0bb2a397c1c00b88b149a9
SHA1 411c938ef18fd42a666b59391d856c2fb2d6d32d
SHA512 b6ce1ffa2dbc6ccdb1c552a538c936b68344c777c081a794e163565fe5ed9a8dbf75f94a1722b289ffb704e21b7ccbdeeecadd6a02228aeb7d44f2ab1bd70ae8
SSDEEP 49152:aWz/ClXvt32W+SPYrDHH0a7jRK/AMN/j2U4FH:yXvt32W+SPADHHj7jyXj2jF
TLSH
T18B751268F2B514F9E4778178CE429906FA36BC264721A9AB13D047172F277D09D3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3412	elevation_service.exe
3320	elevation_service.exe
4376	maintenanceservice.exe
5792	OSE.EXE
1196	PerceptionSimulationService.exe
4856	perfhost.exe
5752	ReFsDedupSvc.exe
3500	SensorDataService.exe
4832	ssh-agent.exe
6036	AgentService.exe
1152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b0e218979600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\System32\vds.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\locator.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5020-0-0x0000000140000000-0x00000001401A2000-memory.dmp	upx
behavioral2/memory/5020-193-0x0000000140000000-0x00000001401A2000-memory.dmp	upx
behavioral2/memory/5020-75-0x0000000140000000-0x00000001401A2000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\ConfirmSave.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ac2e16bef5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8553b28ef5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b0ea227ef5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5020	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
Token: SeAssignPrimaryTokenPrivilege	6036	AgentService.exe
Token: 33	1152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1152	SearchIndexer.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3412	elevation_service.exe
Token: SeDebugPrivilege	3320	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1176	1152	SearchIndexer.exe	100
PID 1152 wrote to memory of 1788	1152	SearchIndexer.exe	101
PID 1152 wrote to memory of 5652	1152	SearchIndexer.exe	102
PID 1152 wrote to memory of 4520	1152	SearchIndexer.exe	103
PID 1152 wrote to memory of 6080	1152	SearchIndexer.exe	105
PID 1152 wrote to memory of 5748	1152	SearchIndexer.exe	106
PID 1152 wrote to memory of 5272	1152	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
"C:\Users\Admin\AppData\Local\Temp\ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4856

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2784 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2784 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b022fdfdef1963411906c3b34dda49cb27340b290ac56a34188ddf0767d05b29
MD5 58d557e0ae55b57335498ef5b30f86ad
SHA1 b900c04dd6c432be376f19b51238d82667d4567b
SHA512 f56fa1d93ff97110195e3de202ba2d5079dc08e8b1158e7e986fa1ae0ee8cb1511672129482f81257a1b3f15d3d8085140b220a89b5b9b1e7ccc1f51cd0b48e1
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPN/j2U4FH:73q6HjB0j2jF
TLSH
T167D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 390c14448a8fc03573a862d0c60b63f03ebd14c24cc0a40b63f81db799516b6c
MD5 2cdf53918e796b4901998a4c42f95d61
SHA1 c81d6947ad26cbdf50973392a9b4da77e43445cf
SHA512 e82a44399d8b50ec1b008afcf3b52baca5a642c4449300c55ead96d7587950f7ea00a11f5cd5aa9a8f9390964d9ea59035a481c9ff87fa06ab49309c526f3b8f
SSDEEP 12288:x1XLsswWkxy2lRq2czA3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/XYfDtczAXdCN/j2GLl3iFSE33b9
TLSH
T13005F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 67690ecc11842a08d58a1492c8d63188c724621dc18f62f4f9e685ba1bd942a5
MD5 8f81df879c841fe5f20ae6c50c4afc9a
SHA1 494c8ab14a2786fe54ffe8719d67722b6d38deda
SHA512 579d2232a5cacbc98a46363a42d9482e54ef805e558763e0e42f33e5a19b331fb4ecc2da98c9d374bdf8bbe3a535bf87edec8689fd35dff9fd7d97545022d3a9
SSDEEP 24576:X0Le5ji0hmxirMcdCN/j2GLl3iFSE33b9:XPji0AcKN/j2U4FH
TLSH
T17835AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 45d312242d5352c6b121f549efb98d26dc1f438926be6619fc62c6abc22495ac
MD5 ae00b81206827473e265ef0c078e7f3a
SHA1 129eb53521248ca5ed2da0bd57e79b31feec2748
SHA512 fe11c3647e6af44ffaedab01191baa19b2ba4bad92178c65caf5f6bfed9fb9f0af3ef1664a713f77cf870893ef6892178ddcd9e525371cc40c73f1c89fa53366
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyuGdCN/j2GLl3iFSE33b9:U/ezSC6vUzPvxHjyGN/j2U4FH
TLSH
T178755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 db2785a0758c9cc0b1983348a5a9342fefac88da1dda336d83b0d20120cdd78f
MD5 e45ff12ed64de3372efeecbffd7faea0
SHA1 8cb4f6dcbe88b97e0da62063e2ec2e818da246a6
SHA512 8d554d149a3428e220bd1db9c93a5dd0e2355b1093ff4742d201ecf50a713581dec908ee9f644d33d064cea3658803586eb59a276ff43effe180c3f32c262238
SSDEEP 24576:aVbqPb88hv/l+67dCN/j2GLl3iFSE33b9:aVO88hXl+DN/j2U4FH
TLSH
T197559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 eb64926852b2de966aaf6bbc8573ac36e4f059b4f214c9a8745a822f10d3b93c
MD5 4add31b298dc271447a8298e7c34981e
SHA1 cf0e8e956e41d8da9ff60fb3f0bb261d49f36501
SHA512 da292a0cd3cd649a5ed2518a79566027f318cd357c498ab8f3eac7b323940f188d173b7286b5044c74794118b4fab757ef231ffef0bcdc7f151f3d38856ca340
SSDEEP 12288:qRwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH1:qRAdCN/j2GLl3iFSE33b9
TLSH
T11BC42364DAA5B565F66F837903ADDE615200FEE8E525884386917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 aa0a7c4283afd7f42e7718d4ae4c98e683b653a53f36c378d713683984b85106
MD5 86a8f7cdcf5d54e99082c439508bcdbf
SHA1 ddfa2cffe15d6de349cba2e57d4ed0f9662ecff1
SHA512 05bcf956bcd0835c28a7bf4d4278532875d95177b41a386635b8750f03e5760f2ad1e872dd1b88889f297e2fe162fbb764e5913d1d43fcf8404e325d104194fe
SSDEEP 12288:ReBNUbTVO86UrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RJIUzdCN/j2GLl3iFSE33b9
TLSH
T1EC05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3981b017685bd095e50d2a455f657443eac40ba89cacae0023b24030302d2525
MD5 b1fa82126c0545fa04becb39f5b860de
SHA1 26bcc58deb921458176bd2d269c995643e3687d9
SHA512 309e1670e219d3b5841119047ba29b82970590b83afbe73ae66f53b8cfa4a10a42bef8c8b0dccff444cc6ac7a088bc93495a491f47e20089effb4d756e1b0329
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:WQvGAdlCEL8c/yRNw5CXj2jF
TLSH
T134267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f1bc8e48789d95c1911e80557f965714f7b8d61a86a469306b98f2f9e1d64c73
MD5 d31302da05434ccbe87b3eb455bbe422
SHA1 d4def76ff611301dfb5d0e783f42c24b6bb1f7f2
SHA512 d19de262f8ef39b6bba0463ac3e022b10e1aa11efda96a422cc61cf65a4c0fe57bb313e71c396f8486008c796c6293b9928b7277b79de7de87ce23002c03cbc0
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAjRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9z:bdewsAjldCN/j2GLl3iFSE33b9
TLSH
T1F615E031FE74E036C2BF0DB61B35C716142CBA608B6119C3E3E85E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f7e452eac6f3399740f931081ed5a56c28276ade5f664f3ba8c9e37284ceab0d
MD5 9b4a6b0544c53ab6ecf0a91dfebd86fd
SHA1 4199d13dac5d4a72c5b19eb64967336f1517f650
SHA512 0c2ffa61d7cffb8d04630d83f5af088dbccbe002678ed04f0a79365114a4891a21f37940d98e7c32eff4540ab12445bc80c81624c81454d5b3a6deed1c7bd9aa
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS8F:oUEtQevvqc2W1cpV2EI32S
TLSH
T150474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ab7ee765045c0adc93d9cbddec2ef768b7f3d9b561c6bc653db523bf8906e61e
MD5 6c2b417ca4cb3054cf9d29a829ba6b13
SHA1 38935f1575a9e6f1753b9ab7e17080027977d34c
SHA512 c1e83977f9580a445df602683d24fdcfcd17a99f80df53fce41ce6d5b3e0647d14440f962ea64212fc9bd39bcf6d0177fd107ac9025fad3c25e4739624af07c6
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/z6N/j2U4FH:VoqtVjnmLj2jF
TLSH
T1D3D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 192902672f64856d9fde53bf54b06f95d55cfdedb4ddebc87f832e853a91dd89
MD5 2ce56848957d76c67528794939f4733f
SHA1 852cced0b990b8e49b6c24cfd296e945a272e0f7
SHA512 9eb480f6fcf24b631dec9a292f833a28d4b02168055a946766a605b4a9466d6ae6d3c68e88a4b8e7e1f7a35263ac06c717ab949bbc19d8ee2760d785db265019
SSDEEP 24576:SAhGLJIFoiwtA5l7S53CdCN/j2GLl3iFSE33b9:SAMyFoiq51N/j2U4FH
TLSH
T1B935AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2c7e13591dc14ad1675766fc522b36898cca58e1d90ee901ae1bbedf25b91a70
MD5 58f3e6a3fb8864a2acc267db75eadafa
SHA1 f3dc710c649cc8d834a09fdfe069b5c64d25541c
SHA512 787412a0b4647f553feb23ff85339a954045507700b8363aa727f29570c3014190f3ee0c3c19b1bb16e0c1d794881c6f52573204495cbf293e46b9490260cebf
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jwuoOWRdCN/j2GLl3iFSE33b9
TLSH
T18705F14577E41CF9E96782398697C532F7B2BC512A21CB0F0760C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e087cf77bf27c1e9dc4c8839c0a44d90ec71fe13e1cb401347a8f44ff3c931aa
MD5 7848e8c0514c3d6b76440947b7cc762f
SHA1 f32db26b5e1c2f3eed965376b5cb84b5c7189518
SHA512 fb53c517303e488914b69bffdc3febe735bc8eb0b7286f9eac24f9fd00c0caedb5a67f8f86e4f8d142fa060e4e9b72a6f30f74e2bd089e481a9622757b9de105
SSDEEP 12288:aBZ1IyBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UZu0dCN/j2GLl3iFSE33b9
TLSH
T1A5E4125933E471F9E1A7823C8AF59A05D321B8A5A73243CF026146EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e4cb76a78463299c76de8af0f42dda8b742a27338726d0b3780008af4b11b322
MD5 f037b08ed1d016c7949fd7f6cca353c4
SHA1 dfceae1468e61304fa55125147e3186a15b92f6c
SHA512 0d9acb6429ae5a0f3610b217a2dfe09952de911e961a623c96d65011ac9e4b52e7e2f4082d6ec86e1f9c8776dfabd0f9320ac92affe2d0b175eae8b78f609481
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:FQRQyi36YOcPQLvw2gAf+PN3Qj2jF
TLSH
T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c6b097a6bbcbabb2447d838f282c4dfdcfdfb6ac6f25a5dec946d7ea56a25fe7
MD5 9f5807d812c8c58b53b23db19eafa2bd
SHA1 e23b7d110fb10c63b1b5d81e023b431788fb1f9b
SHA512 b1f12a929e6fc4cf10c9d79d4e92553905e032c96cf88428238ba4876a76ced21c7bbb2967a8705eca2a3d0afd979febc617f0ac075a93a180d3447c49df77c2
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:dQRQyi36YOcPQLvw2gAf+PN3Rj2jF
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a39f7c3a2a6850327df90b92405b0647310c5bf64902e057200d74400e85964
MD5 4ff3abe404f938e97cb74927f00addcb
SHA1 e554a9a92f13cad8c57d9093a92ffb4754191ef9
SHA512 0d7fff0544ad25e68efc0d7dfbbe1200318afbb82459b63bb2eb3f36bf6726ee749cdb85b117bd187ba9bc31e655ffde1e562f7d691295d4091533fbadfc6991
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0kdCN/j2GLl3iFS+:d68Qg55nhheWu7PNU3/KN/j2U4FH
TLSH
T101B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3427ca684f9d8205258bd9b253164b6563f956cdf601153b0cc54e3408fbdf75
MD5 640cf0467c773fbfc660d586dbfb5e7d
SHA1 febe25cae4a98170e44f7ea28ae568b085b8cce1
SHA512 a767c8fcf38a2a98a016994d65333bd157b35b7eb191332931130d86458abe685aa7121fe7ad150bcc7a1b0a4869aaaa5040be577edab81b9c7b5b3729f56183
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:dy5112gYy5azzVvL69nLKnhZFj2jF
TLSH
T19E168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 040852cec79e9b99b13ea44cff7b4a6b4a188f18a56705d3375626f8ba3c575e
MD5 b1700fd9f824669a52faf5c30904e642
SHA1 8d81343a200e5fa22c43ab745fd77d4fdb387949
SHA512 af3ec17d5eb35831e8e1c1caf8abf2136418c0a3e2138fa32450ab3f070e68c479e8e4f968b3ac7d99621c2146215c4d4e5e95460eb5ad89f4a00ae00c56769c
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0N/j2U4FH:wu6JmVxd2dYj2jF
TLSH
T1BDD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 755f87e08055fa17b78856ddecc92db928114550110297b8dd6598ba8a97adc8
MD5 46d73bd3d8016655cf7063afa57391cf
SHA1 f54d45640e5e538f7354cf3f7b2f12737c1b8523
SHA512 6f5420334510bdfe0d64645b55e6798d8843f93c87ba824cb558590b99f49f3ead27673d7187f1cd91a7c58d6ba336d606df76990bb331a38bf5b8307603c864
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xTN/j2U4FH:XmifPbRmj2jF
TLSH
T11EB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e699321a6146e58168c9039223c158c01c89041b0f0235be043af5e23bed0f0b
MD5 3a9b0bb4c3a0ad00c0073b780c72b333
SHA1 109b3d642dae3fe5d2dc6625689b3129d82bad94
SHA512 f8874a072d40cee0057bb32d8e763cc8c922a08259e2beef10aa0592f4b8b62129e29f25fc175632ee0df27f7833458e4dc2d9ad2444eed0772f0a69a7db6e58
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqUN/j2U4FH:I5dKTi614j2jF
TLSH
T1FEC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fcbfa50d5e863860c36c145dc8eabb64d983fc14d7bdee39ac592cbbd49d2b58
MD5 a230e0587e274ddb2737e88fc6685652
SHA1 398a6aae04dac3cc2c1311046b78f725c33966c4
SHA512 bd5e67b30d4c76b3952e1ce73bb626c7179a1d6f831f29f83ba16a0f69131b12f2d2e7e4a70e947139ae8aaccd2d670dc89eb9be5364ff323e5ff7141ff537a0
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wHN/j2U4FH:TX2iyphaj2jF
TLSH
T1B595BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 953f3cbaed3bf9bc2b6e9ec705fdf9ce4696ff10058bbd4b55cd44e8fa70a037
MD5 033750e0b0f83a438dd71e5b53de4fe2
SHA1 83605e75597f0377a726d51caa6403819fabd56b
SHA512 97c5b31cbc8511d7bab76f90d32495e4c3494ecfb74159202536ec2a13143f1d49e9e56c65e334f0ec96a5c581ef84a7628ac14de13df6d52ac74f464147c6eb
SSDEEP 12288:ZTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZrdCN/j2GLl3iFSE33b9
TLSH
T144C42364E9F6B669F15BC37943A8DF515100FEF8F6264487828566EB237DFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ff7d6a34e51b5fd169bf2fc6d22e948ae0b1a559c45f4cbd2c56568f89b6011b
MD5 94a98f7c4c3c8697c7ed7f81f3d6a39d
SHA1 a2a8fc9a6c9b1069e83a7d4e2f8e7d9b32f3e2f2
SHA512 04cd799e842b18267c9f233ac834dc4fe07ee52c51e1bb675299513da78f71a65071fbaeb09c4bc5d063f5b0c6409347d96253241d386983cd11102ff404f541
SSDEEP 12288:oGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oqdCN/j2GLl3iFSE33b9
TLSH
T17AC42364E9F5B669F15AC37943A8DF519100FEE8F6224487868556EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 72b724d8e972156b7571b66ddac55e8999152f4f0373f3e2636e8df7ca7bb40e
MD5 28274edf3a9c939af4fe8bf862649409
SHA1 00390a6d1a2dc0b3bb36c259a20774e2145faf45
SHA512 13e85e039a39e5d1c1df6f99a09262696f3d4a81c793867b28e3988b9f0d28ad683748547f74273c33be9f6f0583a4676cd775479dadd46d12f93bac5967e8cb
SSDEEP 12288:5AJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5wdCN/j2GLl3iFSE33b9
TLSH
T1C4C42364E9F6B669F15AC37943A9DF515100FEE8F622448786C556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cbce3b73aed47cd1ef60a1b3319f9297420367b1152a1986fca2ff210ef25054
MD5 063dba4b4b06ae997bf3f33073e29de5
SHA1 c04af525834f1312ddd7ac2beae40aba9b419e8e
SHA512 f8c2c8dda4f43871303d35d2d96930c5081eb5588aa2e3e062be79239759ca8bed154b9cfc96e054f8cafdb63efd461026789b4a064f07e56b12be2d9a1ed0cb
SSDEEP 12288:2V9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OdCN/j2GLl3iFSE33b9
TLSH
T1FCD42360A7F561D5E46BC37C83B9DA11E220FDE8F732458F87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8c11595a121f1810f0132916bb3b7a589f0417f7d13c3ae1db801f9432de2678
MD5 a5eff83d04dc7236f84f1524f93954f2
SHA1 94c3118efceb7116ec57d015fa2c764309a70a4b
SHA512 636a55a7ecfbdc72beafad5b7cce354067580441ce5265902e65e1ba6754e549e3aa845a5bdf47936978641cbc6f9f1b4a51c99ec582a782713125c71b44a0dc
SSDEEP 12288:klJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:khdCN/j2GLl3iFSE33b9
TLSH
T155C42364E9F6B669F15BC37943A9DF515100FEE8F6224487868566EB137CFE880330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6d3e63afd4543a8f8bfc7bcce000f6b4ecec035b5770694f5a04a072904ea3c9
MD5 b5b0bee804feb43f3c48256ee3262a48
SHA1 84ec497dedd26a73177c91ea99a8802ab87bae8a
SHA512 05d63b296f571aa2a6dd22df4e60c3865053ee2d42407f117a5fe4dae54cc765782c7d2e88c2bdd5bf27e4e34d9a2fb5a964dd2adcb90e0c6403e328d8355e97
SSDEEP 12288:7iJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7+dCN/j2GLl3iFSE33b9
TLSH
T18FC42364E9F5B669F15BC37943A8DF519100FEE8F6224487868556EB637CFE880330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e05f7dbbbdb2642ff8266933c589b5dd24096e3b546c256a071078887e9fb92e
MD5 a87d06896e9938b79287be27a7a5325d
SHA1 a49cf376e0f851d5457072bd1fe860a3408e2fdc
SHA512 99708f258f1acbfa76322506c75efb888c16fefc09b17ef3d16ba0cc55516f4dbe8f50567aca2e5ba4850467128a08d0b373525f03f5129fc2760b9e6ba7c84e
SSDEEP 12288:NuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NCdCN/j2GLl3iFSE33b9
TLSH
T107C42364E9F5B669F15BC37943A8DF615100FEF8F6264487868556EB237CFE880320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3d6038ae1db783cc88bba93aaa025d376fce845f8752fab2bb4fcb0042e7b7d5
MD5 6bdec3a427e70ca649cf7aa3e903eddc
SHA1 5c7cb44cc5c99bc9db6a07c602553332a95529c5
SHA512 6130ab0aba73ef95f7fcab1aa83be71f0f797e1ceeee2a15100a239b891bd9f6f17a22d3cc75da054706df51dacb59b64a05aef8249d5b318d6432bdd890242c
SSDEEP 12288:6iZwb6zzFEoS2cPvymJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dZMSzFVSOKdCN/j2GLl3iFSE33b9
TLSH
T18A0502A4B3A018F8EC67823EC9658915D271BC695770C60F03E4366B1F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f0e82acda68843c9ff96b88fad090fd3cc2fd3dccc935e6a20290ce7f2b67be3
MD5 85255d8c078f15f64ae04b89f7731689
SHA1 2f1464ceb2f83cfb0e21a47b57464c4490a8926c
SHA512 f67b006e3c0031236fe13ff2621dd204a889a4e0bc1312c7f444cea22d2fe6fc0a73e55189837a749e0039dac569e8885beb3fd542b80136268054d9795bf9ba
SSDEEP 12288:vXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:v3dCN/j2GLl3iFSE33b9
TLSH
T102C42364E9F5B669F15AC37D43A9DF515100FEE8F6224487868556EB237CFE880330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b7ffe3587909eb1bb1fb1a7f619ccbf5e310452db12cb0aa68cc434692229bae
MD5 3f08697e42c4394946be0071a7a49206
SHA1 ebcfaae8bc9fa19a509f2ce9ec75b19c400b0576
SHA512 924599af5877a7587e7d26ef13a7f65ee52c6421987ede0db12b63c647a6654dffab41d5b744546060c5a8506ca52912fb197bf926ab4cf247b5c41335f124c1
SSDEEP 12288:GLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GTdCN/j2GLl3iFSE33b9
TLSH
T110C42364E9F5B669F15BC37943A8DF615200FEE8F6224487868556EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 dd8fea533cb2275f86b591069195f1fdb9aa2e139f48c799fc7c9e82f593c068
MD5 ea8d9f66711ec85edd99b86ba8cc5101
SHA1 c98ebc14d5e711cb04303e77f9c5e4e9a8763731
SHA512 d89842deacee307e3a290e2f02e6db2450d08d2b76377d94a9ea0466734c46b84719fff54964d1b135126bb05da43c5e3ecb042c1cc5fe498d657ee216b42659
SSDEEP 12288:ayPz5L8aJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HzymdCN/j2GLl3iFSE33b9
TLSH
T1D8F4025773A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 079a796cefb3adf2ef716a8cd8c38693ec55d3e893099ba330c0378c3c02503a
MD5 b9dd55706a3962ae3fadc539a808c958
SHA1 bfeae0721db965866ce1da2c4fc005c3711f7b2f
SHA512 3fe94f6c45f469425cd6ebd946c11cda30165ca3fbc0d9dd69541e5e91456692f8a488073c0359f2eedbe34f92b7c4d174e199d1fa6847c891943b434b9f4c53
SSDEEP 12288:XXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:X3dCN/j2GLl3iFSE33b9
TLSH
T15FC42364E9F5B669F15AC37943A8DF615100FEE8F6224487868556EB637CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7f59e8b6e67a44a3c622e5818620a1447854d85d4f7fbe68bda336c510ce1eb5
MD5 2112ceb1111475e2d77f7ee5c86a50e0
SHA1 cc5a7592f0c5be17fb2a1bdd5164be08ea83c374
SHA512 6cd2f46786d7aec65a7475f92ea25c582e3c7d4bd9948f7bd85233e5dcd9c349462239b66fbec55b1684ab167809308cc2f48c974c5778cf5f5bceb31a64602c
SSDEEP 12288:mXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:m3dCN/j2GLl3iFSE33b9
TLSH
T135C42364E9F5B669F15AC37943A8DF615100FEE8F6224487868556EB237DFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e149253af8c4f18e26e9b90813b8e3cd678d0de856aed4fa0422e51737430e03
MD5 e1299692d8eb219f5be6c15e20935c27
SHA1 875bbd7358f3229d619aa706fe73853e6e00ceef
SHA512 f78b69c1d315559dbbba2880c6f1f3d7311c05c0e45269586df86e30acd042ccfdecf3b7c9deb9eebfdb9d861f4750d25c78488cba838afb5cf7056e8e06f0c7
SSDEEP 12288:GyPz5L8aJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7zymdCN/j2GLl3iFSE33b9
TLSH
T1CEF4025773A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 fe9704893d12c1dd64cb09e8aed3860dc7515a1683c60f626282e1fe87c7bbe6
MD5 1fe1a2e83f9843a72c86eb2d1f97dda9
SHA1 b2047c2d602f1f60d8c1ba421fed298bb9e50111
SHA512 de552b8fa10ba0c816f9f521b0fa94c6f9f4da457647f815ce848482f84b4bb58e1b8da96f926ff2756024654593a95fcb40fc3c41c4506390b629594283e370
SSDEEP 12288:RCd9eWYoaLHF3z0z04PDvhQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sTHaLl3z0zDgdCN/j2GLl3iFSE33b9
TLSH
T19F0502A4B39018F8EC67823EC9658916D271BC694770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 86af1c8f45f05b9f5ef92e0e6bd5910b3d3f3a9e45a981cecca0dfa6caac9022
MD5 512ec6dd31c8cbd4e8a22054dc8bda1a
SHA1 c4c631080e79aa1c2a634de450cec705a666bd8b
SHA512 5b7ab7175b336e2f61346683b8e9acaa36193abc980663df24a47361ddc03c3b492af8efc13fc99b5c951bb24b9ed0caa4ffde3c63e857aea0c91d72c652be04
SSDEEP 12288:Bi4e7+RdTfgwCHKy7GLbbdIvhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:B37d9CHKy7GZEdCN/j2GLl3iFSE33b9
TLSH
T16725CF90F3E414E8F0B78A3589769511DA767CA95B31CE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 36cbec967e4639079ff63cbbf21c65d32bb18eb3460dd67a67ebcda0d7c7b223
MD5 1063c6be9952d67f11c2f39d5eed8525
SHA1 60124b1d2723cab0add4e941a927ad05f9a812c2
SHA512 b22401811f853a6b7fd083e5aa62fde24e2bb42a5f8b371ee8bdd180113e9fe38858ec933856a399bbbc62170e3165fca68e592a0a9d5561629df3b9d38a9a87
SSDEEP 12288:vgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vQdCN/j2GLl3iFSE33b9
TLSH
T105C42364E9F6B669F15BC37943A9DF519100FEF8F6224487828556EB137DFE880330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 a6dbd614389c2f5a15946ab93bac444844955bed7be943894729a49dfee7c9e0
MD5 f4e1e4459374b74ce9b56b33072981ba
SHA1 9e9aed1c4b553f68720a4d576d72bed38c75f49b
SHA512 047354c31cd77d2c00bcf060467fb6771da1e05f5fc4633771142423aff969a0f41e9e3f62c6ca2c65091abf8dd5a6bd240f791f6051f81f87f82d81661a154b
SSDEEP 12288:j6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jGdCN/j2GLl3iFSE33b9
TLSH
T1DAC42364E9F5B669F15FC3B943A9DF615200FEE8F6224487868156EB137CFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7ed5cbae050de2870cc438e4019ca9679bbe667168817d9cbaadb2d6fea18d0a
MD5 463a668314e6f32a5f853723402cec8b
SHA1 04e9bb494d320fb7d946a0aa65d2514b393e8a47
SHA512 d5b45d771bea54a9c70f3061896e5f4c82b787e9c51ff942861f9a28e337eb66e4afa5ac065c377d883620c7496ac2cde68a9999131c0f54cce5d8d8f290b926
SSDEEP 12288:3hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3VdCN/j2GLl3iFSE33b9
TLSH
T1E8C42364E9F5B669F15AC37943A8DF615100FEE8F6224487868556EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 53210f46eb43d9d270afab6dda1194ec3e826792225fa89fa3f65c29a626b944
MD5 1cb89a397fed880d7e1a2cd5bf76a63d
SHA1 9010317404e83a3ece6345c71eca0e3617589ca6
SHA512 5f9732bd63e9e765fc473b3fca86fcfc63496e46d2bd7ab0893aaa5251b3a5b325b27d29e1a2b8f2922431339c9fd756d577bc775aaf4ee282bb2dea99fe7137
SSDEEP 12288:2XJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:23dCN/j2GLl3iFSE33b9
TLSH
T1F1C42364E9F6B669F15AC37D43A9DF515100FEE8F6224487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b38b6519701db9b08b94b9a823cb42499a35d0cc28559b42000eb598bbd647f9
MD5 2af46337f3cbcb476733882e912ad3ed
SHA1 93744388feda4c99a6468bb67fe137aa1614fe61
SHA512 db3eb4ce437b945751e42776b9aa321659c9e8f318c8669b55d292921c17e2cb2804aeb96b4ae7f661aeca01a1e04a091c37f8cc1f934ffe0e88d6d6f1b42636
SSDEEP 12288:bgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bQdCN/j2GLl3iFSE33b9
TLSH
T1DAC42364E9F6B669F15AC37943A9DF515100FEF8F6224487868556EB137CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 223cc1d77f4ce3325207f8a75294f47bbfc00285ef764b61384d27f8c30044bd
MD5 ff4107a2734ae56940a07b94e04e076c
SHA1 26d614e5794918f66d11200c2b58ed36bd3f2b1f
SHA512 50fde0b96275711ddd79dfaae46373ac330a7838083e9f87e4d2d1b26e2b32d921616903353e7d362399cc5aeeccb272ab85cc64573a7d82a62b009be9f22c0e
SSDEEP 12288:3fJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3PdCN/j2GLl3iFSE33b9
TLSH
T11DC42364E9F5B669F15AC3B943A8DF615100FEE8F6264487868156EB637CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 76f6f35fdcf750e6691ebc37ea71513bce79530d4032dcb7f48040597c833877
MD5 75ec0c03df70bc1d0009d8e0bef7f395
SHA1 4730416e76ba62fe67a3878e6ae96c58c6512886
SHA512 5ad797052a84bee828fb70d768e7db23c703e4f2f66b16a56f363bea37430020d209f798c3d9ac27bd8bf037a6979b474a5adea9586e4d98d7623d12fb8a354e
SSDEEP 12288:UlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UhdCN/j2GLl3iFSE33b9
TLSH
T15EC42364E9F6B669F15AC37943A9DF615100FEF8F6224487828556EB137CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 bfb0a9cdb4e338ec58d8a0a819794dcaf9e02cf5f865428a79443d55205c250a
MD5 55cc517c7bfed409902783e380457129
SHA1 2249228b7ffa0b209df78602dbe70b263048e867
SHA512 446ac3756dda82d4fde526233287c01a4d93812c0de4fcfcad90f9606dbf299bc29aebec2bba094152fcdbfa12afc49fc3518155bf1186334441050e3ae5dd5f
SSDEEP 24576:cfwvok9RX6wkyAIgdCN/j2GLl3iFSE33b9:8MnYIrN/j2U4FH
TLSH
T1BB35D029EBDC44E5E177923C89B74606F2B178685B31C6CF029A53AE0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cb5493a7d05e05c360938d9f37e792d95c04ee245d96f309f75ccbaaba404adf
MD5 51c19168f9be1d1996bee932fff8c76f
SHA1 148097ae08b6b68c85be56199f6862f8815a73ab
SHA512 1bd4f47651dff72c1dd7a80fed02fe1c6550e1f4e7e6c2e817888ba8a2d94763421ca202d682a2451ec246d42537345e746a3f25d111cfd8e88bc60c5b2557fb
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kN/j2U4FH:iySzPwj2jF
TLSH
T1A9067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fe22401d7fae51ca25bcc6b7c6c8c209610169e32a1115c519dc4ad0175c9ac8
MD5 f72df5b3533f0ea757992f0302b977bb
SHA1 eb56df8bf0581e9cc3b567ee5228529bc9c765ce
SHA512 ae26d50426044ca3602978641b5344ca19c2d7833550ed645a2cc7d518b90e223e555d532fe651a2f6057dd1b4cb7112557cb475876593d6c9adfe04b945ec15
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpdCN/j2GLl3iFSE33b9:v47JUQj1irIhCnDHUPfF/0N/j2U4FH
TLSH
T1E765AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3fb1c163f00b423565c7a7281fdbca6c7d0c2db5d0e1937ff6057c7d09973e75
MD5 ec7e140ea365ff209aef00d19b584af9
SHA1 6b89c2d93ea7ac192b9556837631e043c350ae68
SHA512 6e9cbc7c2899bcbc5830a78bb7a1cf61c7e33bfa0ee5015d5ef17c4216174000d46f112a6f021932b580abddc81f415c1a5a2bd5df02d61bc59d4189b5a7a9c5
SSDEEP 12288:+Nsf8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:n0dCN/j2GLl3iFSE33b9
TLSH
T19AE40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 cc4b89685ad325b8137887122fcda11ae7be6037c056dfdbcc4e21cfc6b409d8
MD5 73b63e2f5da022a3df30be5fa7801996
SHA1 264138b6c1829e086a9f2abb4994fa17db2aba0f
SHA512 fa12ae04ea26354cbe4648cfd1b36c38d6f24f866d3472885f6ee1096daa64c25a739074c266110b263e49ab69c57e39c4c0a49b4b175a181aee4c2ecb2322c7
SSDEEP 24576:6ru3gUPFCxIExuvpFFJkZkuvwEnN7pKwJkfZ:ngUkxIExuvpFFJkZkuvwEndowOfZ
TLSH
T11B2507007626DB5FC6A940322E36D6CCAB70BD02FE059B1772CA473FD576658B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2436e2269cb8c9780064ace91d018117e963f9b9332bd30bd5b763d901adac3a
MD5 4a462fdbd609592a1048b30fdedb0c45
SHA1 fe8d2df29ad0324b76247d3f12694573c30bea06
SHA512 c83d207270cd6d478caf822b950c18ad141497a35b0085d632cd6b34c8625332c8eb1d060db0170ff114d4a1fe143e5b0144f90f5ba27d8a560b03e8a616d32d
SSDEEP 24576:QiWBUBkZkuvwEGQc/uiAD7lbpCD/l+ykZkuvwE9kZkuvFkZkuvqv1QklkvnsMm1p:/kZkuvwEGQc/uiDkZkuvwE9kZkuvFkZ2
TLSH
T10D652941A4B7EB4FC9BE5033133286CCABA4AC06B7497F0573458D399867A1EB5E13D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4527675dbf03dccbd09e69c95b2fcf20b53a387d775427fe2dddf4820b9fc1dd
MD5 db4f5b5e2c7865171e1f975e98479754
SHA1 7ae4da1f73d375f81dc81a102990228be585ae78
SHA512 0881aef866ab5113df09697fee131560eed92f09be1a35cb4bfd43364719c9659f27c8d91223f9d1392db8d3607de42b311848b7dc31d96663c97310fce6111a
SSDEEP 12288:5M70JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHn:S8dCN/j2GLl3iFSE33b9
TLSH
T121D42360D7E9B955F47A837803ADDA216200FEF8EB2184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 43a17046913390d4e56692770dd21f446202564745ebfac332b15331886c9d7f
MD5 84a906b5a2ee69a373098b08f4ef59e5
SHA1 9b6a95d0416e7536f2ea4c4bd11468361d3d49ed
SHA512 9568759600bbbdc27110e4784eaf8a8fa84e3aa62d626b2255d7cbaa5a6f79c0cc7e531ebce45c465b944ddab8cb7a9664087ca46f706ecb772b6ef18a996b18
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYGdCN/j2GLl3iFSE33b9:4gb4mBIBhGF+N/j2U4FH
TLSH
T11665AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9f4d33ef1029f5a6420d1fcc79d52459a56f244f53d88a7061e7ff2a605058be
MD5 8d661fced69dc9e6f6d1dca7d17eda15
SHA1 633d7f860fd5261415d7c106f5a595b571284cfb
SHA512 c56a34d5c703c90c9a5a3b836b42aa0c7acdb41085bdaf9096c5e405d3ca557c05de82299a8cd3ac9cf43f89fab2b46265b61c0d269a5aa8069e4f1825640578
SSDEEP 24576:KG88u8FpJqH1bzria7/mZdCN/j2GLl3iFSE33b9:x7ZFPqVea7/RN/j2U4FH
TLSH
T1E835F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ec2eb4eedc9c72774bf0b05e1a2332fda6b2e69547c9e7af6807bc989584dca9
MD5 033f877ed02b22be9b423077d864dc2b
SHA1 dfd2e3a93353812cade7a9ffad141cf01a423101
SHA512 8d1b967c1d7ab628956eab919fd3afc4a10f53be35781b3464b2214c9167b7e2ee276ed347e97f1fb0e72a17a10e6681478f6750e49c0689ad49c2709ab86b2f
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSN/j2U4FH:TG05lO43bdj2jF
TLSH
T180D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0235b13e5d16f836a54529dc02183cf23b36b1d2c26c2d41d38dd8935e2cef20
MD5 f9f6340ae152609b12b0810e8cf8a3ac
SHA1 b31dced486f428dcfe43f7155aba10937945177a
SHA512 184bd6ef2964bdff76f3914396866563eef5401e64f5f6bfab1daecc018ad1f7f2d20bc891728bf1a0aa6a792eb9650cc015ed7c9700418356be0688be5e9113
SSDEEP 24576:Afa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3dCN/j2GLl3iFSE33b9:4a5POZ3+Jt2pasx2+mKN/j2U4FH
TLSH
T1CD65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 227c57c8b030313deacaf65c176fa2cb89ab38c228515d74c0c4cf10028deb7d
MD5 c6781554925a89b06710a85cc8c3e752
SHA1 19f445666d051cfefc866bc1fbf00e615a2b754e
SHA512 4944c243abe5293624461349a1f5788dddadfcccd65fba36f4ab4b063773c706840fa3903895976579f7b6ddf4219cd33b6f9803b84e3852da30827e78d492ac
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkxdCN/j2GLl3iFSE33b9:HNc/zEOVHFxN/j2U4FH
TLSH
T1BA857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6e7f4876ccf00d765422413916d2693592265b562aed9e9227319d419f15125e
MD5 70260a69776cb3eced52b815807c25ca
SHA1 36944703a04d747831e5cde884f6962aee196290
SHA512 1f715bae3a8ad9029b5292b6c708fed2360f668d3050b1e5d263b557317deb803240c715c8639a8531a80c375334276c1a183668b87da123e88285aebc81e730
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmDdCN/j2GLl3iFSE33b9:R8MwBtOmAN/j2U4FH
TLSH
T16D55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1856c3d5e9e780b8ace9a4957b35f14d7ed826626e0f12ecddc7eed834e6e98a
MD5 01f2027c5986b31b8bba18405a31c6df
SHA1 8e47c8562ea5a409533283adc02cdf5d23670f08
SHA512 f61622c9babb2e078e4b5c3b823ec3564901d7dd475c1130e7813b202eb0007caac513bf36b2667ae4984d40ca225728cdfe06d2caf76b7db9d15eb22f9426ad
SSDEEP 12288:+HvUrBFrEjwaQJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+PUr+NQNdCN/j2GLl3iFSE33b9
TLSH
T18005F22E62E918E5E67AD17D86868719F731B8615311D2CF02D0817F4F67EE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ea0194b12ba8daf5d728184f0e3a2b2b25f222c02dd9ed732eac6b1c13452721
MD5 37b7560d1d5066349a756a9739f7ca77
SHA1 60737673997416dde6e0465d8debd43a63abae20
SHA512 34d66ba23401a91f674425b81e93ca10fa28808af1b7c40e80d6a4028f8c0809570d9d31507cda792cf044436cd6a53cc0f5251ceb77152ac807f7e17ca294d8
SSDEEP 24576:ZD3FHshBIYQgA4dCN/j2GLl3iFSE33b9:ZDVHeBIAAjN/j2U4FH
TLSH
T12A25E17DE69C04E4E57BC1BCC6638A06E77178A8433255CB02D481BA1F6BEE46D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1152-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1152-355-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1196-345-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1196-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1196-76-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1196-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3320-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3320-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3320-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3320-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3320-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3412-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3412-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3412-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3412-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3412-32-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3500-112-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3500-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3500-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3500-353-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3500-351-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4376-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4376-49-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4376-56-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4376-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4376-55-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4376-60-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4520-366-0x0000024E078D0000-0x0000024E07A9A000-memory.dmp

Download

memory/4832-131-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4832-125-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4832-123-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4832-354-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4856-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4856-349-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4856-94-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/4856-89-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/5020-11-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5020-75-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5020-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5020-18-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5020-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5020-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5020-0-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5020-186-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5020-189-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5020-193-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5752-105-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5752-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5752-369-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5752-370-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5752-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5752-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5792-64-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5792-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5792-71-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5792-334-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6036-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6036-137-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6036-143-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6036-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6036-146-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download