8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
Size 1.5MB
Sample261027-e6mbya1wcx
SHA256 8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6
MD5 a9f822e78a141e0d9286e56760623c66
SHA1 9b22e2988e4f3da6e42c1ad023bdb5fdf3a9ab40
SHA512 8768675fcd9ea2078117be7c95cccfc3ce5905725c4a3ee913127e7c01a3f0858f4bbb14f82210de67c688ccab10b3e2592d0b21bb2dcb14f9c204ff4a2a7c44
SSDEEP 24576:4Slw2U5BOjfShxDbdSgkfxJQqH2l5UBDeiq3ZJWCOWkpNyBo4kx929bL3Hnx:7lfUfOjfAbdSgkpyqWl5Y+GSB+kn3Hnx
TLSH
T1DD75F01277F81639F8F36E305C759B69DA3EBC319D35EA6D2A54219E1C38A01D930B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4376	elevation_service.exe
5700	elevation_service.exe
1044	maintenanceservice.exe
5744	OSE.EXE
2560	PerceptionSimulationService.exe
2756	perfhost.exe
3416	ReFsDedupSvc.exe
2708	SensorDataService.exe
4220	ssh-agent.exe
4720	AgentService.exe
3448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6a429500f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\vds.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\vssvc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\alg.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1676-0-0x0000000000400000-0x0000000000580000-memory.dmp	upx
behavioral2/memory/1676-70-0x0000000000400000-0x0000000000580000-memory.dmp	upx
behavioral2/memory/1676-175-0x0000000000400000-0x0000000000580000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c88c0e96cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d3358d52cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018df8b96cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7f4b295cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000684cce95cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070f95596cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047c24e53cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1676	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
Token: SeAssignPrimaryTokenPrivilege	4720	AgentService.exe
Token: 33	3448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4376	elevation_service.exe
Token: SeDebugPrivilege	5700	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4648	3448	SearchIndexer.exe	100
PID 3448 wrote to memory of 4288	3448	SearchIndexer.exe	101
PID 3448 wrote to memory of 2864	3448	SearchIndexer.exe	102
PID 3448 wrote to memory of 712	3448	SearchIndexer.exe	103
PID 3448 wrote to memory of 3388	3448	SearchIndexer.exe	105
PID 3448 wrote to memory of 4452	3448	SearchIndexer.exe	106
PID 3448 wrote to memory of 4948	3448	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
"C:\Users\Admin\AppData\Local\Temp\8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7fe0537b56be54dca4128d71d4125abe6e3e7d6c19a3901d731d5a709cd36d5e
MD5 fcf10bf19ca47cbcc88f29611e8e015d
SHA1 63d8f7b573d22a6e428cf2b3dd698f8f182ee24c
SHA512 ec408afca5a16cf1fe0b134d4fa9806402b490b8df65bbda1edf74d113c36dfdf9f06bc71226227611babe54998be1b6c01ef70bfb27364c8a2b85aa87fd5d99
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5B+kn3Hnx:63q6sjBg+k
TLSH
T141D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eb186af5e9db5e088cb12d27d75fee60054c193541df1937c6c75a0864b976dd
MD5 19724c42e23c7eb5b0b6a6c4c5e23bde
SHA1 8c50716413c70655eeaf64a9423d062c02750d81
SHA512 8208c55e228c3627a95af6c365c79a23cc34f1b4a414b2352646235f1e40feb0b4687e0049cab5e385b82a8b464f5d4278a8d141afaec319e5c130b26b918bd6
SSDEEP 12288:u1XLsswWkxy2lRq2czA4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:cXYfDtczAnNyBo4kx929bL3Hnx
TLSH
T15D65012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6ce7e8e3293101ecf15cf8dc5d68991661809adb5830890f1612bf700ca71b8b
MD5 3be17e79192f47ec8a64023c600f4b11
SHA1 5d3ada75474399508ff8374269dcbb99c624ffb6
SHA512 a8512c845c96ff6b4ebc62eda2461c2b473b92db0047e78ac65967f6d29447455ffab76e0d0c96d3db5626709f2bd12bdf5d8d86c113cf816e8eceabb69f3c08
SSDEEP 12288:yXZNYVLeyUji0h90ZD0wxpGZIVuArHsdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:20Le5ji0hmxfrMCNyBo4kx929bL3Hnx
TLSH
T1B8859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5583f930014fd7bf7f72a29f39f095d8b074165ae6e4ce6641ca5083dc9e9632
MD5 2675883fa069b8926c20164d586a2c52
SHA1 be247855f55a8d9cd2a0e2af3554babc63acf63e
SHA512 daaa928eb00f2783328ba19e7fa0209504afcb5041293f8dec3c4146808093ed0a64e2bcd088449c5a8ce910bdc7e9e622871bee109b2520b8374238379a9529
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyu0NyBo4kx929bL3Hnx:J/ezSC6vUzPveHjyuB+kn3Hnx
TLSH
T14D755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e95ce4fd89bac531be400d535f3a55dfb8f3e2b09a9ccbd01fc1e445c0043f4a
MD5 c5e6aac30d88aa891ed9177a6824daa3
SHA1 d1e99efdbf8ec328d7948402373784adbe02736b
SHA512 4c3a8373a9d2d72b9d3a7ee027d8d23bb1cc137fa670584840f82ad949df2cd7cf2f88e5c201347eead17b70a64b4ae3cac007cc23f4603e3d49056f04775fc8
SSDEEP 12288:0VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98cLDAptNyvUgXZ32dT4ePc7N29CD:0VbqPb88hv/l+YDNyBo4kx929bL3Hnx
TLSH
T1C9559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8a2ccce7753d6f2e08caa5f32d49e512d28202ba2eccbd870a8e5213492dfd79
MD5 775524c047b90234e982b7c912494537
SHA1 f7b3a57b827c93bd789a0877949224fb919885e7
SHA512 a9e109f1b079007ebb57169ddfb5172df02eba87dfc0d04742768e1cdba852241d3b2c7aac18a81081ed7cb43e18c6cb660723711104e92a309a05f0c39b93ae
SSDEEP 12288:TmhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TmeNyBo4kx929bL3Hnx
TLSH
T1B34523124B0C627AFBBD3E70745E8454CC35FC890D95DB98DE62ACBB58BCDA2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 29c581318bd5ddbcad0d5ead26650ce5614057494e0796aa2ff493ef7d218ce7
MD5 da99f81f1dad64bc37902709244e1dfb
SHA1 2ed4a9d735e246c8a8c4510e69b569918409946a
SHA512 033e6a9c4f5c9dfee27016299d2a91d1e971610a41085b5e1eb1282db337375ddf5838cee38176eb82b131773e64644a9d58d5b5f7b8a9cc967a2ee70654bf08
SSDEEP 12288:geBNUbTVO86UkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gJIU7NyBo4kx929bL3Hnx
TLSH
T14C65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca0ff0061a89a014cdf583a4ab67fc192e5294a9f2acfb756afd0bef1ed69a5e
MD5 1ac2174f7b27f7838ea984e0c2e4bbd8
SHA1 b250a530e5dffe9bd97aee5d5b0d4413245c8f5d
SHA512 ac4d1e87a8cb9afa38cc8db5cf23f32a9704fe61e78c1e0926a8204ab56ebdc4f0757b80d17c1fe2b7dc98c73ddf55a8e15a26219ae1a0f7b8002312ef75f238
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH2:OQvGAdlCEL8c/DRNw5CJ+k
TLSH
T152266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 2.1MB
SHA256 92d37109b283800bd6cadcd187ca397a1d6f4538d68b2547de23f8a56f61b4c7
MD5 916f5399f02fef6eda10b8a69f156f1b
SHA1 f9cd4973f754350ba5cfc8e83a06294286702627
SHA512 f46071a96a34e8dea33e71d7206b3bb2e94ea1e772b029d9418ba74644294fd19ffc0a7cecb57eba58234e7a87a2628e6b255e383c1a99f9c05ff23f5e49a853
SSDEEP 24576:TpewsAjlNyBo4kx929bL3Hnx6NyBo4kx929bL3Hnx:1ljyB+kn3HnxpB+kn3Hnx
TLSH
T106A50131EA78E036D77F1DB12B26C716483CBD500F911AC3E3A88DAE59746D22776A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 2.1MB
SHA256 8700e1b46220e6899225fe285dea88601cb4913e0e92d7c912a1c5e1528e679c
MD5 be3caf1f6147358f130746a501058d78
SHA1 bd551d77f700446c1a76180264bf6eeae2a3716e
SHA512 2f180e675ee63acf3734632ffab9dd4cb72ad99b6798f033a6db64fb1c68b4c582fe979b98d9423a2accf950b1a302c4235296314c27ced6ef19497a89174a78
SSDEEP 24576:apewsAjlNyBo4kx929bL3Hnx6NyBo4kx929bL3Hnx:aljyB+kn3HnxpB+kn3Hnx
TLSH
T188A50131EA78E036D77F1DB12B26C716483CBD500F911AC3E3A88DAE59746D22776A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c116efc442306432b3dafca310f8d262c440dd6a0a2375e001b07d290f91870b
MD5 5aeef84730bae3b2759d6095dfa355a3
SHA1 64731ec6b8be3a07d0e3149904e3b15ad2f8aa84
SHA512 a589e46f34c99dd452d682173aff7faf0380b5d569e5b3c80c1e2bdab102624ab31c9b186dbfba3edd887dfc2b0da009c657f183830493524c7664ef8189c336
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHy+k:BUEtQevvqc2W1cpV2tI32y
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e70d79cb2e201be8e0ed3ef25b06ee5c9faf26b1a7afae805498e2be34b1b10c
MD5 0154a7bc2b8acb1b226f9ced4234ed15
SHA1 d6cca01e9b9b370b9c7e96e4cb32970a23e07862
SHA512 7151d2be972907a0fc76f58c687d992d54fa7c99d04352766468ab9355621fe225a29e2f2183e53f8e96f13b430cff390b99ebc1ecda0de583f3c0520e3e15d5
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zSB+kn3Hnx:4oquVjnmt+k
TLSH
T1D1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1058c1d89c95186b222b991e9891ac8c61a28e233f818d86fca69f19c8b8b320
MD5 eae40661802d5a54f0549887757b2058
SHA1 ecaef231e2398251bf0d41eb3f0152c6dd5cc7a1
SHA512 ad483858ee2375e9b8797bff00bda400899a65d173f0c8513f436e9e9e030b1d04899fc1e173aae31869ec197b02c58a2a32534f39f496d973278d9600abb490
SSDEEP 24576:OAhGL3IFoiwtA5l7S53UNyBo4kx929bL3Hnx:OAMUFoiq5fB+kn3Hnx
TLSH
T157359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 84dffed18e5857ad929d43ade2f8418437ee8bba831b8ec31f58be17b0778b80
MD5 813acc04cbb8f6555b26a2a37c591a1a
SHA1 0cc5fc9cfc85a6bbce61a0acf008e181a8167194
SHA512 4e7b43c33dd7e04246794e58b8eb4c31544e7f4207541188848ea44d090a037d818b4e56469c940a817ae1af848d363727a5106c32b9d160213fd66bfa36f0c1
SSDEEP 12288:jmw5HEjsChNzBFgl0WDm+CvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:iwu6OWpNyBo4kx929bL3Hnx
TLSH
T17C65010677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 548baa367c63e3a1cfd74b3b21548c777d7afe1017c46608e559b29b011b757b
MD5 5c7c20601cf726392bea67e295aa9cb0
SHA1 37d81f74e61f04ae86884f5126a74a1fcffdc8fa
SHA512 85295c2d1d55cb09bca180d8aad7fc3fcc68d70345a992ab02d847b5f7144debc19e8ed3febe3e3b15e12ccb8cd18195e172d5b0a107dd5037cdcf6e3aad63f5
SSDEEP 12288:bgZ1IymLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0ZuiNyBo4kx929bL3Hnx
TLSH
T151551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 279916e638986fefb4fd1e00db675471fde8b435f5f830f259e6c953d218bb78
MD5 f93650852447de9fc1936d44022f2fcd
SHA1 0bb2065c60c78e73019ebc1e150b390734fa362d
SHA512 2710129ece40d0f2618d6056abc55a8238b57943451b515984e32f2f0e22a2dd23b61243557ac235ccd7f38b7471828e9a3274ea5644d0adef5605c9a9de41dc
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UG:xQRQyi36YOcPbLvw2gAf+PN34+k
TLSH
T179666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a11ac293f2d939216d5dd0dc8dd4de4d7872c305573db96720482efe418a3cef
MD5 44d4c97088fa40923c2675057f549701
SHA1 e8515d5b2cbb4dcc4a99ec9ddc36b5c88a7f0dfa
SHA512 277cbf724d9f5799662d9954e38873b0f1b2a90501e15590093a6102bf060ac00caab60626ec9464cdd3205ed4e7b97756922e3df68d5a12ab755834d91e0f93
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UG:iQRQyi36YOcPbLvw2gAf+PN34+k
TLSH
T148666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6232b2694c5bb796f28ceae0f7c360e4344d571e539d5a75faaddf72f2bf2918
MD5 da3549692e85e995795d7b443bcf31bd
SHA1 efb4a919b00eb48de8554b2668de98eb83053d75
SHA512 1a39e7920ea6f631e6687f5a6cf2436262149ef3014b3e4ab9dd55309e7665ee44a70e2fc93bbd7608927238b5888b71cbb917428e5085410e294846bc407b72
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0yNyBo4kx929bL3R:468Qg55nhceWu7PNU3/SB+kn3Hnx
TLSH
T108B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c0b076b67c073707cdfd5bc1c33efc81eb2e008eb61f7d3eacf47c6adee4408b
MD5 94f348717dc7278824f91da2dde532b1
SHA1 ce0a476d5043071bc5be250b77dcac6462af48ab
SHA512 c8d64445e7d30b1d533648598133115b6523d2f16cbafec646079dc2b9869ab01fa5acdfd905c19e480995c469231f9be6faabf01b3a573b851161a722d922b6
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99c:Fy5112gYy5azzVvt69nLKnhZz+k
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8105a74441f48b53fff6a5362c6a817a69d04664f4faee94b27bf65fba151159
MD5 06029a372cd3c8fc1ae4f58f51189dd8
SHA1 91743f405c66a903070ede048e034b02aef9e61e
SHA512 45af1e0f732969143817c0db5f9501df9f890416171c5b3f662e0b343405b1173139a3a85a7bfb050af284b48bce0d0ff177d8b59806d72a5c2ea2c93be3cdae
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl4B+kn3Hnx:Du6Jmdxd2dk+k
TLSH
T159D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8dd37c8194634c3fa9a6175cafe98d660778d91441a745db7bf6fe560abb0925
MD5 fb7ad33a9d1ba9e32e4c0149b97f96d7
SHA1 33fe2c7b9760480e0c20767b80a86fd93d55e41b
SHA512 4a273a3fdaaba17c7d6a4b077880c4f04af8548e9c84b51536b701deded9befd4b99a1acd59d40ee7c9b2e2d81ec0d28cecb4334e8ed2efef145c8640075771d
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4xAB+kn3Hnx:TmifPWRZ+k
TLSH
T12DB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ebbec9ddc06414634f509ea54f3b4716bd7cf0962d5e2fee87c6f954b7d65fe0
MD5 3de23dd8d81cddb241affca5f6cfd724
SHA1 2ae8a1a3b7be85d90dc32f15f3ed4af19851f9b5
SHA512 943554045983c147b1321f90e26ed0ae3e08e2cf8e306f609bad48e8fb2237fd0d8bb09272ae9fe015df4a30677792750fe9c77ac3a6b081a705463e3e6c66e6
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHqhB+kn3Hnx:z5dKii61H+k
TLSH
T1AAC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 34c8249c16dfeb676e94e9b73cec588d6c4dc3d52014f82345c75fa02db887eb
MD5 e6b6c0bc7b2378a0f7ad35c9b858aa1e
SHA1 a2804e27ba0319bee750ea4d9fdb98f915ff7481
SHA512 9c3d0b103847b51dfb5f333737341c16fe5ee0aac69c6968cb5590fea07b943384d7a27aa03a54a63a9923615991c4dad052972cd78ae8518eb055127c71af7e
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5w8B+kn3Hnx:cX2imphF+k
TLSH
T14B95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bd1922598f1d59514962ac24ff31761edffd459739192c32e8309669a00fac39
MD5 d253e3ebeb77807825cbebdd19e347b6
SHA1 0e890491cf6c92b045f563608b3445e79f7797fc
SHA512 c0cdb8a2ee8cca12751d5db45d6dcc4fe119147a663c104a7abb047afb8cfd1395168afbb233ac04bd846807413284b26325e9e6bfe54ceba6d2a41a24bcdcde
SSDEEP 12288:k5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kmNyBo4kx929bL3Hnx
TLSH
T1024523025A0C627AF76D3FB0644A8558CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3550ceb8b29ea0bc22999f4fbabe6ede7e235365ffdcc67de87b288254e80f28
MD5 d74db2ed6f9f26fec5c4c9c71b14d9b6
SHA1 2ebb2e94f6fbb90936ab94bb699ad1d678895d38
SHA512 6522611dad32c3fd0db702ab4ea8a783382f5e32d17214add142cd604c7b96982921a7cd8efba896d726ab3cb44253c56f1eca37eabd21439fc7464ccd1513d4
SSDEEP 12288:xSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:x5NyBo4kx929bL3Hnx
TLSH
T16F4523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f9ac3bb433a8d0181c8d86389ff809f767f91b0ccfa2ee71ce10763d73aaec14
MD5 fe2ed59fa67db01cb412aa28f43e1e08
SHA1 f7d6b5420f1c7169317980bea2f63950b1b0988f
SHA512 58016c64a16a39e9ebb02715707333cee24426b950ded798c1c8fd0cdb711f6db5a37212389c6f9a91ccf4f5d093eddf390afc0c2db9d79928472ca62e08f587
SSDEEP 12288:TYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:THNyBo4kx929bL3Hnx
TLSH
T1574523125A0C227AF76D3FB0654A8198CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8c393d559aee136781d21336c6fc9a65f5ff0ac66aaba3fd45cf7232091f1439
MD5 eb5d05d99999b4477fce5edc42864389
SHA1 9085e0e9a2bb7cf711ed6a5b8c333b270218fae3
SHA512 6ceb8c3ee5fa5bf5d8221a9f963d46af92e945df58b024851d65ae7847f6f0d7119655e55ae5bb0febe97e7fb8ee58bdd6554b4535107e354382d2a172d64a41
SSDEEP 12288:uVPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1NyBo4kx929bL3Hnx
TLSH
T1D64523025B5C12BAF97A7BB0D85A8054C835BC8A5B7197DFDF124CBB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3d343fc02ca627c4feb8e7b54606deb2eb0cfbdcabe435f6583fbfc4b2db736d
MD5 e71c631436a2f8c1cba9bda2fac15b32
SHA1 ce97f9d2ead536a45b2234b71e10d422ef101937
SHA512 998eb5068bf39077f7d37b9cbf2f1d70e53a23af2a9720d20d14ab7c496b55a2a3ea967b69b4d63f0a216ee44f214062548bfcae55222fe8a66c0fa8ba69d675
SSDEEP 12288:yHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:y8NyBo4kx929bL3Hnx
TLSH
T1014523025A0C223AF76D3FB0654A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 86d534d2a8bbd018fbf0e439610aea25c467638460ee73eaa3784cb6265bd33d
MD5 f47575d8968c733e7dca4f01b22c2455
SHA1 d4d0ae937169ebd5138fb711f311406344dde24a
SHA512 7006a6e123c49b6b3134c192a3af4c7c07c44d1db6d9d2dcac899e6cd316766ee2ad0797dfb14c3fad4eb3606b4ff6cddbfafcb3a0e99bc81fefff7bdbe1fa5f
SSDEEP 12288:S+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SNNyBo4kx929bL3Hnx
TLSH
T1074523125A0C227AF76D3FB069498498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bdca75b941cea3bc28d2dea8088244982e140e8a43da8f7fa74ebcb327b722fd
MD5 da722765d42837f4448a44d790dbf658
SHA1 cd44ea31d7d70e21dd5f73bc24066c7f08621f6e
SHA512 bbffeb0b02f7833ee15cc291b51ad233f2f674f774a520cc0b07c377e53fd2c47c01a7d5f7f2da25ff23158fce6da19b91899080d49d710a327c32b3e52dc2f3
SSDEEP 12288:vKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vBNyBo4kx929bL3Hnx
TLSH
T1934523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 99998e79f52e4a287beed08536e349c0dd9db2035a22f667d3169b05b32bdf4e
MD5 4c299dc830f167cc235e1106b630cc15
SHA1 e4ae1e6007e94c01e5f677ec76ea168a097d921c
SHA512 4ee0e413b86d2a58f119d21d6bd0ac7b11c9950d5e662f1179bbb82029d1c4acd29031d9facf60f10909ad2cb4552c4c234e5227d055ec0d1d3410c0dc9314e7
SSDEEP 12288:liZwbjzzFEoS2cPvyyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:oZMXzFVSOZNyBo4kx929bL3Hnx
TLSH
T173650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 471158d45c98cfa273c4b8b9903bd5af74c31c06be0b4c07390985edc043fa44
MD5 981127ce4825a1aa74b9505ae4b5f48a
SHA1 5cc4c465b4c6a89ce82dbc27bdd85a4821764ba9
SHA512 02649a322ab9f143290908eebbf3f36ac57bda54c02b340e1e2fd3b65d01216aaa3531801a3e5729db5a1dfcd8fede794cfc847a81df1c270e602c8c9c3de1a9
SSDEEP 12288:VNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VSNyBo4kx929bL3Hnx
TLSH
T1E14523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7f5a850d50250f351d4b87b2ad4f47266979f646551752ded7269df1d71a9b9c
MD5 79d9f6798e6cc257317ae7107afe40c0
SHA1 b754cee8411c076f6d00862bacc4c520dd8a98a8
SHA512 55e9a915aabe3a7746f9cec3195fc0972770b739b9a6f24127b0b233af351eb53134bda8e553d63daa8c041cfbc1dc03776e28fb02169c22645f07a708bf84f5
SSDEEP 12288:gBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:g+NyBo4kx929bL3Hnx
TLSH
T1C44523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 eaf0b98e2adbac4ddc34352866a1948b2b723969a0b4266038a6f3673015b26f
MD5 8c5678e6cd86777c3b8c22d47d6c5098
SHA1 a4b05357f1f1bfe1a751a581b04767671166c9e5
SHA512 a2b24480ccbe891eb7cbb539b7755ddc5b0a2cfc62acb4af5a92a43cd04e913c078fef22535a583b85885f1e003bdd82895ba650c7239bf1a0ef6e3ab561e125
SSDEEP 12288:ZyPz5L8mLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YzylNyBo4kx929bL3Hnx
TLSH
T16C55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 892176d6920cd1e693e2bc668d9539b2c8301075971869ddf23539cccb94a099
MD5 79311ef7b66de12e43ea2666511718f1
SHA1 50348abc11e93d9bb5c45a160be5950f54636705
SHA512 789495a8c3837dcec2741fa168c4a2542a0fbcaee0618a5248028863054281172999ca20ac6b4f7d96cb76ed9e6f9233004524025745c5cd1a4e14859e85ff45
SSDEEP 12288:wNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wSNyBo4kx929bL3Hnx
TLSH
T15D4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 04ade5a64e283e2e35c5ef6b573e0b1e6f7aa36550f784aafbfb1461c243c198
MD5 e46b614d0301c79ba470fd3d00e3ec24
SHA1 dd190f1ed517e02fbfd2a8b9253510a6190716cd
SHA512 5eadd62942ee2567020f52df7294bf0d34f6a723ebe5564c436c3a756bf992b05d4a3829bd2f4989b97f94fedda5268f62a4dde5a02de3a09296bbde821620f8
SSDEEP 12288:MNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MSNyBo4kx929bL3Hnx
TLSH
T1F24523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 540236e74502d2dc0273383a5bef960d115449bb5230afdef032175168d332b4
MD5 54a6b11479d4c5b0d1a39be24cf98872
SHA1 3d877c48d82215ce465ea947fab46a8625f1f3aa
SHA512 7325c52a236f245a50308c6a913419d43186f89ce9ead2d7800027cba1b74e8129ee0a6a1b96528a283a07f04357931d6fd303747e1c4eab46ea446bb7e0147f
SSDEEP 12288:AyPz5L8mLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xzylNyBo4kx929bL3Hnx
TLSH
T12255120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 193e5c927f028dd4b857eccae565c2cee7e002880bdf8cfed74f037f48dd51cb
MD5 025bf4a923d80b28e0fe8708db7f2198
SHA1 43b665a9811ff76b01bf86c873a0c30aea45a9e7
SHA512 4a97b36b785e22de9ec24b6a2d85970276f0b6db9bbfbfb911c7a6dc7d10dae33b8a2f61ea07b3959c07ec414d3572211c9080b98d841e098daf179e2408abff
SSDEEP 12288:vCd98WYoaLHF3z0z04PDvhILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:6TtaLl3z0zDXNyBo4kx929bL3Hnx
TLSH
T1DE6501A5B35018F8EC6B823DC8568906C6B2BC5A0B70C65F07A4367B5F373A11D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 32276ba533d1a2daecce9977749bc6e88e0395b005d716b5250af433191d1872
MD5 f00d6fa4c15813f89e73ebda86e71fc4
SHA1 84f09a2b425eaa66d25b57c8c010b9548557dd5a
SHA512 6a610bda703e9db290a2ffc37f760740f8152c5b722bf5938403beb2bc77cb82973bd720e0bf76e60f890139a427b793a81043a9d9dbc48d0bf91905b0c727b3
SSDEEP 12288:ii4e7ARdTfgwCHKy7GLbbdIvTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:i3ld9CHKy7GZrNyBo4kx929bL3Hnx
TLSH
T14775CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5df56b931e8145a9aaea16b5d114b5b4e68d1b6f362cba2dfe1c0e95c90f85c0
MD5 1a86dc61d43bb8694d7866c21fdf0639
SHA1 7cf40b140f6f1c3f6585c47242133949058a0388
SHA512 ba573288e68c6992f2956f51d02c78f994a858752254f433909c2e53ff2e0bee3257346880b973c9db2908ac2f688a06a73ce0c0e1666c010b3b6ecf95a94df3
SSDEEP 12288:a4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:anNyBo4kx929bL3Hnx
TLSH
T1E24523125A0C223AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e5c98dad497d342a386c53eca357265a7ec82a5f291317f13a8236485c93e302
MD5 1708fe88a90fd67356bae6974c70a387
SHA1 7baec897ea7dbff5d8a7588b173317801fe14712
SHA512 55b9f33f4345f7f9ba8d07c23d7b9f9faa8852b2cb1c360c55a6feeeb5a33489a0f36caa972fc15714bd7c1cff696ac6a148d8a756898b4dda588f513848c7f8
SSDEEP 12288:tGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tFNyBo4kx929bL3Hnx
TLSH
T1384523125A0C227AF66D3FB0644E8558CC34BC8F1EA597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8060026b14040dc066996535b41ec446b0a3c1d05942a0a827df68e046eceb0a
MD5 cbbd7f7c6cee58049890e6ce5c340f61
SHA1 124ca597e2a84b024f45cda738048cd0d5026940
SHA512 6deff86a1fa9ae8cf2305c0c194d7a47a51c7e318a6362b3165549c7a793c59f2f4e015b9a23163e471dda752ad23f5b6c1a4b7f26896f0b0beb847a6057d2d2
SSDEEP 12288:ITLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IANyBo4kx929bL3Hnx
TLSH
T11C4523125A0C223AF76D3FB0654A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 de6794799053162739c39a4e68612c12a2b06f4a57f9ccc10c764a153cd88f44
MD5 2f6538563bffea544c06fe6ef5ae42bc
SHA1 f5acb8f9a8c8c1de14879d24cbde2a0647e13ca2
SHA512 0d357d3e694b50c07071b603e3c6a7dff5b48e85490641b0e3ad42199721e7dbcae6004dffd496d69f9c147212e6f644412921455a69e49bb20cbde662bd993b
SSDEEP 12288:wNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wSNyBo4kx929bL3Hnx
TLSH
T1704523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3e5552e200dd7dca910089da9c268a9e72eeebb166202ed30f8b4d987170fea7
MD5 e764952b88f63105c600cba3e901d3e5
SHA1 8cca217da0cb0a18744f90e33d6ac5b3852e3ecc
SHA512 adae129b380f85d376ab8e3a45d2bfd60150557fe24c1165f0ee3c84fa857d589a2e8fc3e38a3d665407df2519e6f9ca7d05fc8be57f6fc52f8800762aac1a1a
SSDEEP 12288:14LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1nNyBo4kx929bL3Hnx
TLSH
T1CC4523125A0C223AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9469273cea1f212d01d64ef383052165d0f60f6788187ecd3f36097dcfb04268
MD5 0a8b1ad0b52f0025caf8fd1cf873bc42
SHA1 545fd2fdac3bb95bf42d608f7705f1df8ca120de
SHA512 b05faccaae45201515745f851d7bd21b23bfb924e5a2a5239730272ae8b22c306ac9026c34fececb354271b44b235336ca9e047e0812f875b80f5e7c6f946d93
SSDEEP 12288:JlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:J6NyBo4kx929bL3Hnx
TLSH
T1AF4523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987B59FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 466c341663e8ca8390f7950433e307b6bd92e17150c5ca20ba3b8cab13fc239d
MD5 8a10b4a30fa342ee89104e491f1ec1bb
SHA1 dd80b251c4997b05960b57b0b7b11dd02d808301
SHA512 517f7e65e42846035715880d15ad1154bdd34034c19e56b22e5c7fec794f513858c4c07721d73a8fc7eb250d606cfbd740af695f78b80398eef885f20c6198d8
SSDEEP 24576:Lfwvqk9RX6wkyAI+NyBo4kx929bL3Hnx:PMnYI1B+kn3Hnx
TLSH
T1A585DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53AE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 80015edf95b954c1eff33af9682b53f23dd2434abc0e76e0860e4fbb96f381dc
MD5 7f14c4c491bd0084e1efde9c8740d715
SHA1 fe75e2ce5e8052563946adfa9addbe042b496272
SHA512 ca2c76f578bb1acfbc57a5ed57a36bed99d44e3916ab4d31e10e6c50f7c48928a64790185c8292e3272f70a61a712def56080ed7eb73eb0fe9856959fad10510
SSDEEP 49152:BYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oB+kn3Hnx:MySzPM+k
TLSH
T1BD066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 49310e1a19bcb670daf62f7b1753224086ffc70b6013138a5f0d99653abd2bd5
MD5 2cda8c302672f93e657f63b69a42adf7
SHA1 94082e66ae2be575d0ca233b75bb7bc0288dbedd
SHA512 b3d7c568be865c40d7d96a5b24c463c17b70028e57c3705ef51d3e642e3d580d3405a1694454d301e4266a8753ea4b1c94b3a22ee285628a3aab50c953446aa9
SSDEEP 24576:r47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhNyBo4kx929bL3Hnx:r47JUQjTirIhCnDHUPfF/4B+kn3Hnx
TLSH
T13D65BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ea64e3e4a3ed5598b89aab0d6beb0edec368139b3f13f6355beb8550949d6d26
MD5 3cd627e04747da499aef4b9fcb9be8c6
SHA1 cc3379cd6319f867bba3ce073cf9e930d9782880
SHA512 3f8fb0f66be87a7e44407a660f73614c1dd38ce7b7220ebb0da24c493fa1446248ca4a2b11f3aed6c0fa6cf6d6d1ba8f20ea64664721b50d4464e55b0ccea706
SSDEEP 12288:Epsf9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5iNyBo4kx929bL3Hnx
TLSH
T14E55F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 868d3cd8af034f2de54a8c649b4c4778758cddce4522e344f28973aa08ea6338
MD5 7e803dbac176a9593f3b166612f4c556
SHA1 6a59925f01751202cc7e3d62f69616e8f561157d
SHA512 2d2177a5844b8b75f825bb89b52a5b1cc432dc5a41579f1cd92cfb3960576f4acf6f19ccf30955e7fd951d519f38c9eaec5739bad30092778ae8003bd4af40bf
SSDEEP 12288:u84aUvmU3fvwc8Ecg6Zyh3t9sEeYuy4RMzYzSRwb22An:u8vUeUP6W3tfeYuy4RMzWSRwb22A
TLSH
T1163507007626DB4FC5A940321E36D6CCABB0BD06FE059B1772C9473FC576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 8b7c681d33e2f640ef3ce6079cc4c693e7ada7749126025e1276ffb274cae37c
MD5 401562f3371e4ec635ae43395245cd9a
SHA1 2c3a91173f04275886ef52beffa7d7ee96d2d426
SHA512 7381e539a40e3557fa2dfdadf43729f8b3aedbad2383c1b34d2a5e6904ae00ae7fc79836de19d0a59c24be294ebc9098e4183de6c11edc41dfae4e43a8af0786
SSDEEP 3:OlH/ln266eql/o/l6lTGslBl3yjJ/llS3mCllltGlslslslslslsl6R5V:KE/gtMGcOjlEmCtEEEEEEE4
TLSH
T1C78112220F201EA9CEB598B58299C35C3732D0103184ABDF328020A1DC01E7D4F51739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5a33c65fe55c16484dbfd4e95c3c338bf393681e59f3623fe0e9c36159efb3a9
MD5 cb1d187166e2f7300c4c0f56f4d95e78
SHA1 22b6a1ed7933d1b30bb9e47b08d3a9767206e369
SHA512 32bbdb65bca607cfebfefce643510b602851463e29112a8623e01773834abe2c6730800d576a5ae1a3d86ec66365fe6469433ecd392d61ec1fee2017c88eed03
SSDEEP 24576:SQjAUxGwZdUHwuV9YCym792hgQaKJxOLsZ7P83Sc:PZZdUH0E
TLSH
T141551B4155B7EB4FC5BA5033033286CDABA49C07BB452F06B395C93988A795EB5F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fc2911aa18ef9abe85b4b896af7a237505bece7abe5f76b6e0f2923ef2fb23b1
MD5 ce8996cc66d65cb50bfdb6afd7690a23
SHA1 9f578ddb9fe06dc23b942744b937a3b696b6b8fb
SHA512 b87600a7b128b11eaa18ad5a8514a93f48e669a832ff2d1d5af1c9f7cd1c32efe3f1ca36661353c418ae356c722a733ad5abadd637d91924e0ed6f20202c86b2
SSDEEP 12288:Jy79LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oiNyBo4kx929bL3Hnx
TLSH
T151452312975C663AFA7D3AB0645EC024CC39BC490F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4e9bf94a3c6c3dd2768f96f3d8a2ea6f03e1ac26f559f0a016232cab8f7cfef2
MD5 b0f8452859b4798a41b2583c59068b87
SHA1 d82de444dfd6fc3888fa45b3d4c348b739701335
SHA512 7ec5a6779beca3fdb4baaa18728e0da910bb06820d974345c7db142faf6e25872f457ef033ca2dfda9c50849bbd57cac0bae6927a1a7f18b3f8ace5ab01e23b4
SSDEEP 24576:LG88u8FpJqH1Jzria7/mxNyBo4kx929bL3Hnx:K7ZFPqVAa7/nB+kn3Hnx
TLSH
T19685F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0acebcf1214b8faeb6000b42f15dc44a606100b82e226ef42937e40fcfdf60b6
MD5 4592a37135014ef7e993d7391d7ed774
SHA1 1bc7bcce1d204cf0966c20eeb115b18c21fef731
SHA512 84660302b747c24b7f5981cd7301bbc9ce1287c14c067bea5eecce7bf01d689f171ab9f983b478eb223e793b9adeeb4f7b5fda846bd0c60d67ecc9281ef87a68
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaB+kn3Hnx:7G05lO43br+k
TLSH
T134D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af6de2a15fda1a6736a1c15d0d1e3fc776932793e02d61a56d1adcc9cbf681d5
MD5 e11237f50fc0a9a897bb78f177707feb
SHA1 7fcd7fd1690e4c4e5c96012c139fd1afb8dd0145
SHA512 93beda0ac3692131e73b083c995fa22d00565c5cbb35d4dcd2e37f70d87c34f6f5ae09cb8cc044c16cc733bbf16b01e87334d39bef1134aa36bacbf1432a9ea5
SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnHNyBo4kx929bL3Hnx:La5POZ3BJt2pasx2+miB+kn3Hnx
TLSH
T14765AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fe41b3f20cb4a772500ff28a29cb9be50875fea7a3d016f38d82a79e3d65d742
MD5 80562822d84cda6f626b91da635fcc2b
SHA1 50901bcad935139674e41d61977466b6fd3de649
SHA512 fa0e01e2d4e390a754c30a57b6565fda016487b09c44c495a44a2be5859f2b725bb0597d0a41f5d2e6c1e8cc6095822daaf01b03b9173257f71831f35de0c476
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkJNyBo4kx929bL3Hnx:VNc/zEOVHFHB+kn3Hnx
TLSH
T16B858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 d7ff8120e4c9061e42c98b86941e24e6f06b40637786a157d418fb7ad82411ed
MD5 06d5b33d13ef7c33626970c9ca8c9897
SHA1 eb052095d29e448b96a762fa2710e6dd42d6201d
SHA512 bd6c348afe2532b92cb1e733b48e40e204a8cf7a79e8f530d6d30368b8538d936745246ce2390dcd8b0b3d993c32e45cfa1a0ed818b6c90487410123dc8b1449
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bY0NyBo4kx929bL3Hnx:5gb4mBIBhGF2B+kn3Hnx
TLSH
T1BC65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0665e77cd8c087cc219624160ef997042748a791194b6c6acbeed30a0fe29ad1
MD5 bd672c726fa13abb8fa8bd6d8d68b6a6
SHA1 3d63016764ca7ed61d2a9bf0d252d0dd719a6229
SHA512 30cecd2c18fc104382d6fc6a6af22b375059d393ba802f90525276e0e36697d43e28f965bccd0958fd9ebd0afcb9a61f82f382bb2cb2604730d387d4b659b2fd
SSDEEP 24576:bTkNvNnaFeYhJNtmZBmrNyBo4kx929bL3Hnx:bTMwBtOmkB+kn3Hnx
TLSH
T13755AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 834c3a4f332aa79f8152b8b327322fc573ee7fe409f6854552aa6bb411aa3424
MD5 69a5708dc45a2712ef76dce2856fe578
SHA1 4e6a6c46582d1ea2db2802635aaef68e7dde9865
SHA512 0e8e7d58f8aca0a8208230cfbb6d574de1b5077ae5d56596e0880e1ea31c5ccd83904f71a04d493197abf1c47e82362e8a346de68eaf439b5e6c554827d9f6aa
SSDEEP 12288:qHvUrBFrEjwaQ+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qPUr+NQNNyBo4kx929bL3Hnx
TLSH
T1AB65F21F22AC18E5F67AB17C85868619E771B8520712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 572e594a7c086697a0aeac26a0dab9f2657ae62ca04d742da0aab3ea58dc4b04
MD5 9c4448881a15c03dff00c4671c427831
SHA1 d8e2ccedf20f567ab686afdce7ea6bba117ad6d2
SHA512 7a1139226a9893ce0dd8499006124ba724da494e24340d6a9497d978a858873c14de8ab956cc0d9ca398c62066361f774e149bb4372c03663dfabbd5143a54f1
SSDEEP 12288:0QcMxWDXN1Dp/fshBItT1IQgAJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:uD3FHshBIYQgAWNyBo4kx929bL3Hnx
TLSH
T1BD75E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-350-0x0000028156640000-0x0000028156888000-memory.dmp

Download

memory/1044-44-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1044-57-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1044-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1044-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1044-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1676-70-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1676-9-0x0000000002D30000-0x0000000002DB5000-memory.dmp

Download

memory/1676-175-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1676-1-0x00000000022E0000-0x0000000002347000-memory.dmp

Download

memory/1676-6-0x00000000022E0000-0x0000000002347000-memory.dmp

Download

memory/1676-0-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1676-14-0x0000000002D30000-0x0000000002DB5000-memory.dmp

Download

memory/2560-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2560-71-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2560-318-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2560-79-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2708-336-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2708-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2708-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2708-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2708-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2708-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2756-332-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2756-83-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3416-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3416-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3416-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3416-353-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3416-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3416-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3448-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3448-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3448-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3448-339-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4220-335-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4220-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4220-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4220-112-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4376-26-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4376-28-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4376-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4376-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4376-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4720-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4720-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4720-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4720-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5700-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5700-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5700-111-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5744-66-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5744-286-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5744-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5744-59-0x0000000140000000-0x000000014016E000-memory.dmp

Download