44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
Size 1.3MB
Sample261102-ja322aed85
SHA256 44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc
MD5 7ac490ea13019e1d1fe9c79eeaf4ccfe
SHA1 d1b36e7d7632849e5ce45db815d801ed94d16f28
SHA512 51d56e2f863b71b6cf4ec53c67caaa3411d068b23dfc5fd7120783ea00d56ce91c21e2723300161d56455d0deba54896c45f6a3a0c24d29a2bd636dea4060b3e
SSDEEP 24576:lI52lSz3ioXPpFqgld6bEd8X+biNyBo4kx929bL3Hnx:lIFz3vRFR5S+bhB+kn3Hnx
TLSH
T18055E117739A01EDE16BE23C46879A02F1BA7C451B52CBCB2390B57A2F77AD41D3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5668	elevation_service.exe
4420	elevation_service.exe
4876	maintenanceservice.exe
5156	OSE.EXE
4136	PerceptionSimulationService.exe
4196	perfhost.exe
6020	ReFsDedupSvc.exe
620	SensorDataService.exe
4552	ssh-agent.exe
2180	AgentService.exe
2224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3721c57f227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b11c5db9b6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df3d7d1b9c6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095f1b0d79b6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e4783d79b6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4296	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
4296	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
5668	elevation_service.exe
5668	elevation_service.exe
5668	elevation_service.exe
5668	elevation_service.exe
5668	elevation_service.exe
5668	elevation_service.exe
5668	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4296	44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
Token: SeTakeOwnershipPrivilege	5668	elevation_service.exe
Token: SeBackupPrivilege	6020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6020	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2180	AgentService.exe
Token: 33	2224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2224	SearchIndexer.exe
Token: SeDebugPrivilege	5668	elevation_service.exe
Token: SeDebugPrivilege	4420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 696	2224	SearchIndexer.exe	103
PID 2224 wrote to memory of 2600	2224	SearchIndexer.exe	104
PID 2224 wrote to memory of 1896	2224	SearchIndexer.exe	105
PID 2224 wrote to memory of 4312	2224	SearchIndexer.exe	106
PID 2224 wrote to memory of 548	2224	SearchIndexer.exe	108
PID 2224 wrote to memory of 2596	2224	SearchIndexer.exe	109
PID 2224 wrote to memory of 460	2224	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe
"C:\Users\Admin\AppData\Local\Temp\44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4136

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a6804507fc3fd048263ec00a58c61d270e3806dd0c1e924cced2302370033701
MD5 b9a9fb4bad725a8d7d4bf48bd3bc6146
SHA1 a50fa4a47fd039da4c389fdddd45fbde09d9a673
SHA512 513fd613d306007cab5ec3cdd5e338ea27e351429efdbe42b69d68abba63490806a6310993c8b99a5428c68d2cf957dab5d228ef90e9b5a261f9b473005b9b9d
SSDEEP 49152:Wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsB+kn3Hnx:I3q6mjBn+k
TLSH
T163D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 0cdae56a81d59731530dddc8bb9cc589866a684021845d7657f801aeb30b5fe8
MD5 0bbe541ff355b4643558e61494a12baf
SHA1 13a189ce69d9566a7a39ac08db8c6b5a2a5a9b55
SHA512 e17910a7a3dab132d2de6ff871360c25f04ac3c0f55729d1c7f2eedf40a749c4f6c9b0092d8d7d237bb2a7eae5e878e2617aca1d9a7e9b1145044aa3f6fb67d0
SSDEEP 12288:O1XLsswWkxy2lRq2czAgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:8XYfDtczAfNyBo4kx929bL3Hnx
TLSH
T14685012867D409F9ED6B9278C8A2C511EA33BC454760E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 843ba1d8e08c326608968e2622ad3bdb06a4910c9cb00e805277be94a0bb66eb
MD5 5835bcaa37c42ead3c8ca56349ac1ad7
SHA1 b437b6ee2b4ae8ad2f050cd57ef2d9d20edf7d5f
SHA512 f21cce94e1f4e9bb8dc643614a8ec29244442c29bea605e6caae09aa7239b5c8fbfc994bbfaf1d36eb4c79935b965be2b421e9179dc83072c7cb984bf187bef0
SSDEEP 12288:iXZNYVLeyUji0h90ZD0wxpGZIVuIrHsNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:m0Le5ji0hmxvrMSNyBo4kx929bL3Hnx
TLSH
T135A59E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 06c1e841f9108ef9e2aa0bc0226dba24a4ad22a9daa61057a9e9f0ce640ba41a
MD5 e31bd11643338e3a3ca97eccc6711541
SHA1 347cbf15c7d6c807c0e78099931ac9473fc45ddd
SHA512 582673f77e4dcb1c251ae5f6dc395f4035539a6cb9ad5c456e59f193d683ebf90ba12a4d3cde1bfa8a1f60179bde0a5912869a5be9cd01cf9b4442add4868527
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyucNyBo4kx929bL3Hnx:+/ezSC6vUzPv+Hjy+B+kn3Hnx
TLSH
T181755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7bea70d4ede1aebaedc2ff6980cfd069c563d0d3a476e53ab484299852ca8f89
MD5 9baa5e1c0ea44569c5d7ead8b409c0a7
SHA1 68950f06221594c57388b3633cb48a0495a20524
SHA512 46fb9c061f582b5ab71dbe62e17661f6b2b0539da34c3f760a6ef876871cbb86039441449462b5c1a0d5f6d8a7fa8dee7f683ed8c39984b4f6762d90a023d75e
SSDEEP 12288:tVJjBq33vb5O8M+l1D0hwsEBoW/lx4/f0Im988LDAptNyvUgXZ32dT4ePc7N29CD:tVbqPb88hv/l+BjNyBo4kx929bL3Hnx
TLSH
T1EE559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 2c895159bd9c88fb4ddc37d9f89acd66c54e2333080fa3d151487d8fdacf724b
MD5 5cdc3ff90484ff4822b2cf266102d92b
SHA1 3a0cda6bca8a84c9bff9ca05cc0c3d16be11b5df
SHA512 3444028bc75f0390bcc991311871c9625dda2f3505b6a18cbd3a4f4b330f600f4cfe85cf1d40e042534fc188fe0b54619efb05b5f468551f386707fc36a53aa2
SSDEEP 12288:vU5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vUmNyBo4kx929bL3Hnx
TLSH
T122652312470C627AFBBD3EB0755E8454CC35BC8D0D95DB94DE62ACBB48BCA92DA25103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 43381c838507729113d07f3178d97e1041b436a2f48446e2ec576fcddf225926
MD5 c160138736be28e1f21ccd04ae1fe333
SHA1 fabaf428d936538a7a1389d42f86036068a8134f
SHA512 ecdba4142980f0618d25d04a02132e185db62f02e43603eeca3f42f7e0ee5f1f46aea6a522e49908b832712e26714a2851f651783e9161d8150c9bd2f4a5f874
SSDEEP 12288:OeBNUbTVO86UULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OJIULNyBo4kx929bL3Hnx
TLSH
T1F585CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6a966a4a842fa86ec7ebe18ea49ac3d132158d8a693e4960d24ce26406a2226f
MD5 dbbc317eac3d9a2bab4853d06e1d3240
SHA1 fee3aa4311288f82471552194a167f92a7b7df5e
SHA512 8391e0d76c7371d7f5066fc446272164467ad5c43fc2df2d8fc46590f20e1a60feedd98c08167c3a94ffe17f8ee60abd31f2692bdfb1c9fdaad695f5b27fd4a9
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THW:VQvGAdlCEL8c/WRNw5CR+k
TLSH
T1E2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d678693b42628706df450460dc2409d79e21f061e76d1ddff1d45bad14a3a31a
MD5 43f871fbb938725c84d6063a546792ab
SHA1 20f7f0aa80307590615c9241aa5822e88398272b
SHA512 2bc4e71ed2db160fa163e1375759389e5fa3919e413a557f6e65e82fc31604b877191aa9ddd6fd47089da6966526df1714f333373c38d7d063adda123f10a3d3
SSDEEP 12288:IAwSfxL/2Dc3IDLLmt0LDQewsAjuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:ttewsAjdNyBo4kx929bL3Hnx
TLSH
T16E85E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 13a73284bb5059839a80016b6f38d3b6cb7a7f9195575c7e8a7517fe3c48e8a7
MD5 a89a811d856eb353b5b7909382580b0f
SHA1 6981436366fc36ed025e2ab2f615a249badbc49e
SHA512 fe3e4066c7c248aed68210026a39ecee6c3aafbe242c27091c9a0a836155e4450ca864ac4cc84b72ffb55bbcaac2f22415920bf35b619e35af70e4365649f40e
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHK+k:kUEtQevvqc2W1cpV20I32K
TLSH
T127474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4516a2af42297bdbe661f23597fbcd1ee8e53bd8f22d29da7df9d0cf913a0d52
MD5 4f6728c5502433541c8d563bb457d889
SHA1 aa33bd4d73025bb250a445ba77adaedefff98931
SHA512 1269980df2555057f23731fd4191efb9d01e1dac0a9b892085acb1b9e4420560def72bcce19010db910f5b768e900f124c2368d5b4a0276adefa043f2d5fa0c6
SSDEEP 49152:TCbRquA/m2yL5zifFiV+XenmE3/z6B+kn3Hnx:soqHVjnmt+k
TLSH
T197D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 74c194fce22596ec70b5cf324ffe808ec642536012b8ef37443c3661a56dc628
MD5 7c27e376f8b87a913df79c4c94ce0e13
SHA1 1499b73cb4f35e9de0ccf2d2cb0b79050b473323
SHA512 6a1d765f90bbd03ae4290d58fcf0d35580e45d021961b428b29cef9035c4430c14086b43c279809a67f99e589d46e34534ddb169f4ee5d4402eac1016d92567b
SSDEEP 24576:UAhGL6IFoiwtA5l7S534NyBo4kx929bL3Hnx:UAM5Foiq5rB+kn3Hnx
TLSH
T121359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3036202274bf41b014f876aea794efc303f583fd57d66e015ecb64c4c6eef92d
MD5 4a6280937c8675c49b0a3b500f22b930
SHA1 8ec4598a680ebda2706703506e0a8aa413bd9e10
SHA512 5feacb72e50d19f88176d49301ec0044b0dde329f495d75313ac9fd6692a6598f408970e03a8eba40ffffa04ccadaeebadec7ee6d8f2f2f1ddc34259969f3248
SSDEEP 12288:omw5HEjsChN2BFgl0WDm+CHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:FwufOWZNyBo4kx929bL3Hnx
TLSH
T1C885F10677A81CF9E9A75638C547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0f71d94d531f7f18d3f367b5dfcf83a8ee673707dc7817a93892e6175c0981fd
MD5 7a7db6051d34c944223e4c8474db8a3b
SHA1 5274ea7701bc7a52a9ba59b74479c880a1289e99
SHA512 66d8f19443390d2a12faeec4a8865843adc6d93da735e6040e364b9d7ae913a8a2d7d030954ef19570843b5463e95eb761aa42ff86c3e705988d6490d930e459
SSDEEP 12288:EoZ1Iy+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7ZuaNyBo4kx929bL3Hnx
TLSH
T1E4751216239831FAF2BB2678D8E58504DB327C461B7183CF5A2185BA1F76ED25E39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b76737a7265418c574553c913c5ce60edf14e969bad3a260e345ae1b58a1c367
MD5 c3c220f475839ff4f6a84b6d9a13de2f
SHA1 6b1c9f19e9420172c396a85a9294112704dca15c
SHA512 e7e0db7b6ef8f6e990b589e9ca2414b1969b4cdccbeb222f67e7b0273891be98b524094f706a23fa7d3b3f92409782c25b0c60a64a2546f02931ecbacd6e5fa2
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UC:sQRQyi36YOcPDLvw2gAf+PN30+k
TLSH
T15F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6eef556d5368ea6e7edb44668ed575ca6f19b8ec58683937765de3ad142e2ee9
MD5 16584f20402c215f93d4c31e419f284b
SHA1 c36a870826d2dd27d4018d3d1d67c673c38d2d4e
SHA512 c367b91ac43f5934f86e14e2983c6d94df205cb1f2f170edcb18f1d206c9d77bab0fd639a07c7bebcf35d4ca46ed8cbaeb87bd2df04389d77fa82332c9c61892
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UC:AQRQyi36YOcPDLvw2gAf+PN30+k
TLSH
T145666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9849a6bcb9682123feb5cb37e48881137ea0be28858774516f66f7dd9d589097
MD5 2416bf3929eb3457764d201e351afd58
SHA1 72a0ba3a0c70f89807c44ad3db453d43dae2ce13
SHA512 383c8bcad36a8057eb210c04b427bbd14fbc475069da7cdd5ae170c97531844c6f6e91e7ea7057b5be953c7dce05a4052f8ba07b66e313b5c7505dafe174dee6
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0qNyBo4kx929bL3R:D68Qg55nhkeWu7PNU3/KB+kn3Hnx
TLSH
T1D2B55933B2F600A9C44DE1769F4A873196E17C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ccd8cc6ab8398bbeff5c0864dc022fade9591884d3516dd8f0a0aed05cd9ec52
MD5 ac92c952b4adc06f271db16f338cfe67
SHA1 d992d122ec6a2691277fdb40ed18af8716a86193
SHA512 ee724e2bba69265b25e906ca33a734925d4782e85d006e5e9302c5d48441f3f23067cc08f17b6045130717ca8e48f76a4ddafcf66e47283593ba3791626e143a
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99U:Xy5112gYy5azzVvU69nLKnhZr+k
TLSH
T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9d1a48f1e967e3253b71dedeb1d90c501f40e12b4855432a234a98bd2a9bcaf1
MD5 9bc67c57f3cdb24f25deb3f1f1c8a38f
SHA1 79e5780f4958e29ddf725423d1c11752cee8dfbe
SHA512 de722de5d622988ff801d82b3f2c58fd975016d07085c47556cb43b3f89ff35ccb0009775c48e19ea768fc6f71f34d423e2b51f6aa3c19b731730a25a4ea052a
SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gltB+kn3Hnx:bu6JmIxd2dL+k
TLSH
T11CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 385d5755bdd87849970c6983f130865162547d32bd04aebb21ceb081891b67e3
MD5 750cd71b73c1ea51e561471843c9f067
SHA1 587973e8701d5ee57c33a041855c526e633bda94
SHA512 fd102e2b4bdcf091d92f4eaf297d0c29d8df15629a910ac8476122d858eb239906c48858b38c6c360ec01f3e4cf7638909b6d02fe91454555246f76668b8b691
SSDEEP 49152:n1hpsNoJpF1A67U44CwH7R4xkB+kn3Hnx:nmifPqRt+k
TLSH
T1FFB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4de434b2964db9419e13e21df9532c8b47eacf9379c99a9fc0bcd44d61e703bd
MD5 35eeaff29f6943f6480c13d55ef2c42d
SHA1 4b859274ee2026e79b535f427ab4afb133ba5377
SHA512 6a9a7601f073a063d35566afaf44dfb3aa9f242760b3e11dd030ea5a7df636ce796cdcd7edb91a0128fbeffd5d816c376c095bdbb5a7410e5de81aa60396babd
SSDEEP 49152:nSuZQIY0Be2KkRVtOnks6NMHqJB+kn3Hnx:95dKqi61f+k
TLSH
T183C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7743bc7290a2d89d1748df08a15daf95f43ccf8bd34c6c271de93f53182f4abb
MD5 bc73b36e5c501258ddce7bfb0ae30384
SHA1 17f6d307af2030708b7eb2a11b969b64fcb46996
SHA512 c678777b3a5a3f4f9bfe6b0dc287e50f22d3ef6b5c5463d0e3e581815800bdd5d511d30fb9f754144f9f441dd7f4cf021790ef67463ccfebbcf3e17194399041
SSDEEP 49152:ThtSn8EApI0figjgiDn0AP5wwB+kn3Hnx:SX2iWphJ+k
TLSH
T11395BE13F2D901E8D06ED174C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f096f71b90975f87e222d0f181455b15104ec17f4faf177383960ee7a5fd8f31
MD5 6c333188ba4e6892773e99d2c96a1d21
SHA1 6b2f35cf0e5a14bd03a6ef5c790b254caffe3dbc
SHA512 286964892353ac8f9256f9d16078350b6e04c75cecdc566fe0355d9520b57e33e784af49bec6237b314df955d848e6595eb97298e6058a6ad463f481fa3b1c12
SSDEEP 12288:YxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YONyBo4kx929bL3Hnx
TLSH
T1D9652302590C627AF76C3FF0A54A8058CC34BC8F1E9593D8EF26987759FCEA35A25107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 34a40de6799a4491a0e6af4a95d7aef6c640d2afb4a5eb0833f9b0428e8ba5d9
MD5 6cd4b38136b9f53b5d5b1684f2c74f02
SHA1 860d84a6cdc230f3868aad9505eccb30348724d0
SHA512 558d99b1a61d49829535b899f643c7ddf5f814a65f7bc6e51eb5649d8f92cca89521d96cc6618da29f8fc89f3329a1626cb2e7df2eeb87e10a62fb81e2caa1d0
SSDEEP 12288:X6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XRNyBo4kx929bL3Hnx
TLSH
T151652312590C627AF76C3FB0A54A8058CC34BC8F1E9593D8EF26987759FCEA35A25503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 702ac2360340cf070d6a7fc9a3fa59071dfaa47f3f157a5b3dedda4fb747973b
MD5 5c369c37ce15d8e5c68f3fef943e8338
SHA1 651d642de252ffa0ac7e41cb4aedf6e488c49ebe
SHA512 4e98369272ddb2d3d06faf606e96ec78d7c81aa35c6ce94a91b87430ac449df29105e57852dd65974576cea0196eaeea4f622cdf2d75a357d755b50b99244aab
SSDEEP 12288:asLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:azNyBo4kx929bL3Hnx
TLSH
T13B652302590C627AF76C3FF0A54A8058CC34BC8F1E95A3D8EF26987759FCEA25B25543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c2843b108322d07fc898ad9b8a56a26c3a4ac7a5dcf4ed326a5e27b95481827c
MD5 f7f62b791a885ed0bb8e2298b346166f
SHA1 ef8c89e5685adb709f275ec7a60b4405b5c550e8
SHA512 4203056a54b4235cedbd4d98bd91af7ecd5039dfd346421861c96ee1700d363b2f398fc262e76d6c7c56512b822bdca7790d9e86f0f8189bba71a43ba24eb6d2
SSDEEP 12288:8V7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fNyBo4kx929bL3Hnx
TLSH
T18E6523025B1C12FAF9797AB0D9568054D834BC8A5F72A7DFDF1148BB0EB8B915E34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 e8e4da9f50de87f7178bd51279a0f8d37b7b6dc1413e49594e8afb6dadbcf45d
MD5 e2d01f54972cd2e2df12d9e5fd479057
SHA1 dc22fde736cee942406209b327f5533197fc86ba
SHA512 9f383ebe5bf482126ce28f7203e08a1cbacbcda57cd1e1107fb426e5d6979eb0913a921d2f0a4a29d46aaa3a0903e76ef2ea423de49dab9b9d39e37b2754a703
SSDEEP 12288:zDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zQNyBo4kx929bL3Hnx
TLSH
T140652302590C627AF76C3FF0A54A8098CC34BC8F1E9593D8EF26987759FCEA25B25143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ea0bfca1bdccd53ef150ca6ee1e69189bdf031e5c297d83d06624ed6867f4686
MD5 297271b9c610cb79056669053774ce93
SHA1 b04179c496cb272478b9fe64a6b1294013662d20
SHA512 3b4b89fc8e50bd81664a7688f6b6c8ac55f786d2eec786f12cafc53c9f5a6d52db10c6d2b0ef0ba0da231d63ade5efd50f148a8f82e7cc7f72e4cae565d6c531
SSDEEP 12288:sGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sFNyBo4kx929bL3Hnx
TLSH
T121652312590C627AF76C3FB0A54A8098CC34BC8F1E9593D8EF26987759FCEA25F24507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 82e17b698f6ed844e0c8cbe1d045162e9487f284e322de880fbf14f64d011f17
MD5 65c3b51d952fdc9579b14a0c20fe24bb
SHA1 cb55b565e9d094cbb0599195a9da3289b32d0ee2
SHA512 b0d255983d1a011ec9e7b4b3fbf5bb1368dcba55da85dc2f47b595138dfe99b3bc88a0bc2e2c4ada93b45ce51d09b1955a7bdf939ac2566bc1bd3009f56c0fd7
SSDEEP 12288:6iLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6pNyBo4kx929bL3Hnx
TLSH
T1C7652312990C627AF77C3FF0A54A8458CC34BC8F1E9593D8EF26987759FCEA25A24503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2549913e52c74365d7497b8f197cae77160e800ab68e3867c8f250e07949f6ad
MD5 0df09ad31827c73533c2e24a881d748d
SHA1 afd922f8d54573b5288a152f4d30d5652808b4ab
SHA512 a1a4777c7e286e20a1f8f8ba5ec96c09be87b47762a384ad17a47a58cebaba345fa645250e1a707ef249e80842cb660b28ef8ffa83cad6fdaf6a171bd880384b
SSDEEP 12288:piZwbZzzFEoS2cPvyaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:sZMdzFVSOxNyBo4kx929bL3Hnx
TLSH
T153850195B35418F8EC67823DC8168906D6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 325df925c25b0842ae89d4b0194250513be959b86a7ef51480db1d1bed3f6518
MD5 b406e21b164f80690743a232775c9fb3
SHA1 2997457d1e03098e1c4053b119a722657099910c
SHA512 2969a2d2ddbaefc44ce18a358b1613ac0741ea365453800bcd6e28529d566e97e228dfe9654aa339c4a309d720f8adbfcce13972c758ad8ac08ca80e94d38d14
SSDEEP 12288:2VLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2KNyBo4kx929bL3Hnx
TLSH
T1A6652302590C227AF76C3FB0A54A8558CC34BC8F1E95A7D8EF26987759BCEA35A25103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 1268ca09ed7b1af5dc6669a41f259ce6234f2e78d5ed81611ae6b04b1dfa44ca
MD5 8be0e2aab5e59e5ecf4338380ae690c3
SHA1 bb22484dc5c2db7d4c36284d26b902e6f2ceea25
SHA512 bfaa457b7d377fe3eda842864946998c8cf844430c166e5f3291199621a4a6558e0ac6726d08d7317a336c4604454c4cb5ba4f4c450b979796da96cc4bb0a6ca
SSDEEP 12288:CJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CWNyBo4kx929bL3Hnx
TLSH
T133652312590C227AF76C3FF0A54A8458CC34BC8F1E95A3D8EF26987759FCEA35A25503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d6e0f822070028ad1e87c1b33f841e390c745d2403498fd8543ada10b9a96f98
MD5 0e6cdf99d0f1797918bef87437d5cd00
SHA1 0e342526794f845948d5603bb26d9fb412a97751
SHA512 b9cab9f5b1f4afdb99b557c9d63b8f45c226bf88092969c35decb2ed16726b085d1b23e07afe80b06ef76afe6922be5023076e83e767db8bc5a5c5a737968c60
SSDEEP 12288:4yPz5L8+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZzyNNyBo4kx929bL3Hnx
TLSH
T1B675120773A431F9E17A6274C8920A01E731BC360B609BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a8396bdd031480e051a7b2a044b7fabebedeb0063f648459a982dcf2712133ff
MD5 e2d8b1c15fd7892fead894a6f4b5b5ec
SHA1 f7d9656d170c2a39986f3c1816fb33b9f90ff181
SHA512 e9109660516ce28cbe2423117b40064eac3a2adcbf94ecaace7110923d5df092d75c2d3dd05f19cbd3baec1685dcfcd2d05ce6f6ca8eeed0a3ed82eb27974ac9
SSDEEP 12288:iVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:iKNyBo4kx929bL3Hnx
TLSH
T136652302590C627AF76C3FF0A54A8558CC34BC8F1E95A3D8EF26987759FCEA35A25103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a5eebd3ddbefa6a49505f89dcb4813612c1cd8b3f71e6f63717ccafde83f09e8
MD5 6388e7ad9ee1f859c5cc2a97faacb51b
SHA1 edc4f77ba2f2d9855078e7f90ec973f0a9a12629
SHA512 753ae0f5faeb5dd85eda27fc5a05b274b7615a46d1adfcc618382488a3d708c7d04af2d05940c91ccfa8e354fd337acfae199977cbdd4b5c9fd35a8b2532d306
SSDEEP 12288:DVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DKNyBo4kx929bL3Hnx
TLSH
T1C4652302590C227AF76C3FF0A54A8458CC34BC8F1E95A3D8EF26987759FCEA35A25107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 637f8bdeaf069ece2d2cb84c09b398d027fa329809f46f84da76befa1dc5f850
MD5 481c4bb48617a531b436bad158c3f144
SHA1 2fe2abf5d4ebbfd01dc09a4c909fbc7b0a38d10e
SHA512 b0e3cdc9ee8b4e0bfb80d9448a95fb750077978c12d74144b0b69dc05c90d85b3a9e2b963c7fcf1ba6fa775eda4066bbe5d7a88b98bb3c358afd2b23c899940f
SSDEEP 12288:wyPz5L8+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BzyNNyBo4kx929bL3Hnx
TLSH
T15575120773A431F9E17A6274C8960A05E731BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 bd87840cb0eec55cb6357ed61d0e555d1d98f0ec84c5b1fada9fe2f7f7d5621f
MD5 d9278746e61989b6740470debd99ce2f
SHA1 9ab62912a26b6cd26c0e68ef76d6e869c2d0f6ff
SHA512 2aac31410e2629077f6bbba26cf04a906a6321f2711b3ff32e488ede5a4e5bd0b53bf00179b3a6fd4aa76498072977056598824c0e7da5eb7e928498565c807c
SSDEEP 12288:RCd97WYoaLHF3z0z04PDvhcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:sTKaLl3z0zDDNyBo4kx929bL3Hnx
TLSH
T1C78501A5B35018F8EC67823DC8168906D6B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a6273cf402c8882130c9820b7ac8a876b2297bb6a90db8276af4ddd5cbbd0fc3
MD5 98a5d66cc06ba7bfa672589e4637bc95
SHA1 5283dec96439c463dfc572ba25d4087a0ee9b384
SHA512 e2729554d5456b903e90377ac489df5ead2ec8c082b1ebaacd5eae0bdd2b376004ab6f0b75fb9ac4d0a922be59c8604e1805cf6c18117386e70d26326606bc46
SSDEEP 12288:Ji4e7cRdTfgwCHKy7GLbbdIvvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:J3hd9CHKy7GZnNyBo4kx929bL3Hnx
TLSH
T16895CF90F3E810E8F1B79A3489764511DA767C9A1B31DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 91b1ef361fa36f0eb03f294f8191db61e6f333d90c473740c8a472d0e560de5b
MD5 1534efcd2ee8126414dd93464dbec9c6
SHA1 86ba8f87446116ffd8e4a0e997d86b6cf1c9bcff
SHA512 cf3dd9c8c393fc496e0f174f81aa765befe2aeefe71c78e047567d5a22b2aff4b270b80df8a6ef872001c734f5a4a9289f8e6219881fbff053e89ffdea764612
SSDEEP 12288:0MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0TNyBo4kx929bL3Hnx
TLSH
T15F652302590C627AF76C3FF0A54A8098CC34BC8F1E9593D8EF26987759FCEA25B25543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 66df33ef91bd60348a715d389f96b0000a83caec83525c1830b18d96327737a4
MD5 ef0f5d31c555cd35c5e37575403ef109
SHA1 8ee4dd42b9f544de1107c0c2ed2a05318ab4c3b7
SHA512 71365770941ff78efc4b30d6f6d7b755fabcc6c128ae87aa8d9dff70146995aa5b9f246edac95bdfe3e5070ff807f38e347013654f2ac301653809901770e554
SSDEEP 12288:CeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CtNyBo4kx929bL3Hnx
TLSH
T1F96523125A0C227AF76C3FF0654A8558CC34BC8F1EA597D8EF66987759FCEA34A24103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 e3b64213cb053d8e708eaaa202a1cb1bdbcc4041ee3714f4de960ab23a780da0
MD5 04cfe72c2a8dbfa48ecd95708ff06e9e
SHA1 d6e2e3e118b539b8b9e0ba4a5d99a416dce2b6c0
SHA512 99be9071705c29c95e56a7b3070e611f7b2f2956575a80cff9eeadb8938ed15ba8a7a4343b1f0b6783fffc95a3e4e4c52ce7be675dba74bea1eace3b4cf40552
SSDEEP 12288:nvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nUNyBo4kx929bL3Hnx
TLSH
T189652312590C227AF76C3FB0A54A8458CC34BC8F1E95A3D8EF27987759FCEA35A24107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 928218e0cd0ab4f31d5bdaf4ae24b870a63e1b8423207d6c5fc778f4d8eab9a8
MD5 488536eb13dc158ce260adeea86639b3
SHA1 e558df953933443ccd902e3e793dd211c0697b42
SHA512 ebc8aff285f27f2e25b97bd79a83c094ea68e5eabcbb306ab333219a7c5a5b4bc335eefd23f55cd1f46530164576d06f5e8ae505a60b2507a54649e8e46969b5
SSDEEP 12288:QVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QKNyBo4kx929bL3Hnx
TLSH
T1AF652312590C227AF76C3FF0654A8498CC34BC8F1E95A3D8EF26987759BCEA35A25107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 0c5288aa72bafaed6c70a7f16675661cc7b046f86c5929cbeb6cd46bf2a73ef3
MD5 6ea8cea8dd7909795634a57ca9425d1d
SHA1 3f2d90749537fa6b6eb781915913eff87eb04ace
SHA512 0290e11a674ce71b58d7e441763564eb11d10cef40496656d94e88570d091b414a75d2139409b5eafe86c6855488ea376760834e199e9d49eee7f2fedbf60753
SSDEEP 12288:8MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8TNyBo4kx929bL3Hnx
TLSH
T108652312590C227AF76C3FF0A54A8098CC34BC8F1E9593D8EF26987759FCEA25B25147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 0869db5fd076582c3344c5c637f90e8dc000048f709b59d247239d547077fc7d
MD5 bff04816746b85c05e5f988f595e6efe
SHA1 34ed90b5cc125230136692005cb61e114841f3c5
SHA512 ba57b8ac0302a535929cdcb51775bfafa10c3b012303d176333bd1dbbdf214c45c7eb6e2341e5b8866777ae529eaf5dd5208bf26909fbef41dfa004e21a8ffa9
SSDEEP 12288:d9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:diNyBo4kx929bL3Hnx
TLSH
T1B0652312590C227AF76C3FF0A54A8454CC34BC8F1E96A3D8EF26987759BCEA34A25507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 353aeb96d71830e16ec24f746c2fbf5eeaa2e7848db56e869b85d69f3bb9b8ef
MD5 098ff2ca46af44f8c63085c97ca86db0
SHA1 df64741580e11b9962f5d28526a646ab7a0475c5
SHA512 d189f4ed25319d522f1196d2e581501f890ac8268bdbf64a12279af19a8aebe829bc31838b031f816b2a017b1a71ae3017f1bb5e074471cbee58478522194366
SSDEEP 12288:wDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wQNyBo4kx929bL3Hnx
TLSH
T1DC652302590C627AF76C3FF0A54A8058CC34BC8F1E95A3D8EF66987759FCEA25B24143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 edbb6701d24886d922a3f139bf21b7fe376bf5efb033e2d7520daa2e1b35a95e
MD5 7effcc2f03ec0411e5270c87ad75e05e
SHA1 69634ad3cc59a0b527c97696566898926f4201bf
SHA512 2bdb560e414bc786325e6deae88f005bd94d6cfaf61e9b42ff24bde31f3e5114ad3dacf403c1a141c7abdb75306b1b716c26a93dd954f6fb157de6f299513669
SSDEEP 24576:Gfwvqk9RX6wkyAIGNyBo4kx929bL3Hnx:IMnYItB+kn3Hnx
TLSH
T1C395DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f0d298938890bc51fbc18e0d1b50bdb403c8ba6c743646e832d93cbcd0d5f379
MD5 5ac474685555e432f8c3f7666cbb9182
SHA1 0798ca50ad014e73677237490a963eb3100c40ad
SHA512 43b63792fe16150e8b415db6871c3c439a589c039894e8a19a603438df967bcad13a58983fce13228eb88887f8d3b22143422cdd903daa975cde3bfdba07688f
SSDEEP 49152:bYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QB+kn3Hnx:mySzPU+k
TLSH
T100066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d41f2ab5ab020afbd3f671b6db10cba1f7ccee6dc3913f1dd8d823e27f66fcea
MD5 83faf558e50866c8b96ca8503acacc62
SHA1 e8296795446a7d7148e57809add22c2be8287555
SHA512 ccaeed5b1bb883d26d1cf25dc01a558bb19fee981880b4d721ed107626bed019aab77ba1bf759340ff310c1771cb2ff8e1de2b044995cdbb42611aef002f0aea
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYhNyBo4kx929bL3Hnx:447JUQjqirIhCnDHUPfF/gB+kn3Hnx
TLSH
T10B65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f8920ea2bf6b4c6b588beb549885cdaec0f71d10860ee0ebbb5a435071b055d9
MD5 650ebfa81f53a1a8bab191024a87b05b
SHA1 40e3428f0ed8138aec87560fce60e558f54c0568
SHA512 7fa37d3af8286a101a23727d1f62023e37feb87822d5ccdbd4a5c5d8bd4458225e410044f0c51de66f53f447a3f5537d6aa383fed20342c6faf9281508466db2
SSDEEP 12288:QjsfFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vaNyBo4kx929bL3Hnx
TLSH
T14475F00AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8d008551ba460e7dec9b08b6f588b10c36e14cd72e10d3503dd3f4c620089204
MD5 862d97aac1c817bfff5a296b3f029b33
SHA1 7c24c4ba1bdb90a6d6a8caecbf2d0d96771a3b87
SHA512 3827bb5123f4d4ff9f9143f7b94be9a975f8e0bd36e558cc78b2da0d78735d3130f2e75303a2dced75cb107d827173d4451450e1fea4814b78280dc8ba26adca
SSDEEP 24576:zk+oSUPwSCPhjVWdg3Ro6J7wBIBjhj3kxar:ySUISGxWy3RoI7uIBjhj4ar
TLSH
T1FB4507407626DA4FC6A940325E36D6CCA770BD12FE046F1373C9873F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fdfedf7a112f904bacb4a7e3855d9c45d3df5e2a36d8a28a12b4bf42d8f4340e
MD5 fc0fe55c69974845b03c62f2ee6afb15
SHA1 4e251ec5917914846f5c9921709826a7d55e03f6
SHA512 592b574f3528f628aacad4621067bc44ed71f92dac1556229a68e2b44ce901fdfd28699a4aaec9e3b0c6427317cb0dbe47625ec79420d1876e0b32d6b2f10ddd
SSDEEP 12288:GHtw35+wQKyo0tjUHzGi2I6FTdQNnr/j9OBQ+cWwQYg77tLYBkeW+iQfxmm1c0CP:GHtwpJzGi2I6FRyrrAs0AK0J89ZWtyd
TLSH
T1FF651800A5B7EB4FC9AE9037563296CDAB74AC02FB453F0173458838986795FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 a7bce354357f00c210f38b71bc049e42e6913c9f54bac27f1bf35a9cc00e7a5e
MD5 62b091ab810cb5ffce23cf489e5ff10b
SHA1 4c8422d80fd34a66e51bd4455a4c508f5f8100a3
SHA512 9abd1bc959aa810547ad1853737c1de31d19c163d2a5226d462b21925a42b86e0c32cad3148ac00820750074ba684957c1aff74a93540dd23c2bcff441f63bf7
SSDEEP 3:OlH/lpnQllmLK0vJl3y8jK63mCllltGlslslslslslsl6nR:KLQmLKWVKcmCtEEEEEEE
TLSH
T19681925847040B54F972A0B4880C0B295352C69EB2E3C397130664C1ACD97644C11B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 86b4bab668834ae2f033c98739919f31af598dadbaee36edf2a4be8edf2a89be
MD5 a793e798770f8d9dab7292c31c05fc64
SHA1 63d0d0289f9cbc631a5d79c3cab9c7961587aeb9
SHA512 978dacd8d9e4ecaad802955ebcd2fd9f1257a017e7e09b03ae645751b7659469fc6de22c7ed356a357f1a3248620e52db40301110e357bb561ae97bd4cab3a9d
SSDEEP 12288:Bt7tLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DyNyBo4kx929bL3Hnx
TLSH
T1AE652312970C623AF67D3AB0644EC024DC39BC4E0F50D6D7EE1298BA59BCED29E35607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c454a6c317b0336b3aec84b410429ce9af05e975f16893aba6961cf404031dbe
MD5 696fef229649dce37a04451788c991f2
SHA1 9942644e61645b9bc351c4dbb3a49f53eb6bc85b
SHA512 7b60e632f7141be27735820aa6fcf878750fc690441e1eddcb69174eaa792a689752ff461d164551136b01456b974081a1478dc29293aba6ae9d2cdc0e1ee5e8
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYcNyBo4kx929bL3Hnx:Hgb4mBIBhGF2B+kn3Hnx
TLSH
T10065AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 da0967bc87050de9977c4c9862b74280a8919f82e57098cccfbb77e464fbc123
MD5 0801c4bf9b6d5eaf0917024d13e86da5
SHA1 c37dc592b4ec98214a3cbfd91eb4f802f935a4e7
SHA512 d4aa86657e78509284f44cdc1c686dd5fd99034498fcc3b7c9e804dbbaa3bbb05c9de99fc94948c59168926d6200c33507afdcebddca7c945ebe265e167c1c01
SSDEEP 24576:SG88u8FpJqH1dzria7/mxNyBo4kx929bL3Hnx:J7ZFPqVEa7/PB+kn3Hnx
TLSH
T188A5F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 45919c35eb3ef536c1ff2c6a7422f9584c852abd1f162cc215185b411825b4f3
MD5 9990246fe7ec9e3109266a47e62569ed
SHA1 5bc2b26e51e88823d44a697e4edf39b97b429659
SHA512 e92d7d9c9f48fa7132505980f975ab574ab137b8e86aab50f2b342236858ec7e749724582dab7546a1296da2a1eb557f7fe065bee06bb6784fdf98310c28a2c6
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSB+kn3Hnx:bG05lO43bj+k
TLSH
T1E3D5C06A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4b4ae96b309c31ca5c24caad7350860313cf8e0c5d8c7fbecf506ec09f68cd59
MD5 e62f83bcdb221fdf92870e32033bc933
SHA1 0c0d5538b323308a42bccad43937caec7bc8057b
SHA512 99d1ff58efe90693862ccb61b8f056f299581124a2ca7921a2ec5ac0d473e025ddd25863814b31d24cb83c5ae128fbc3b6b966d68284cd3a20ee56ba59b36fdc
SSDEEP 24576:Vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn/NyBo4kx929bL3Hnx:1a5POZ3lJt2pasx2+mKB+kn3Hnx
TLSH
T1CD65AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ae1951237b90479d39dc9f7fb0fd6a7cc5b2ab01ec5eeef626d0999d7cc72fa5
MD5 0375658c672796350597638b23651204
SHA1 f128a3fea9abb679b9ad473517d9b861a93f3201
SHA512 a1d7f34e75ba29a161eb05c3dd427c605d81fca315eb389ce6a6a14db66857311b8e98eefd3b4b9106203e03a5c3f7f531a900b4d4c381ffdb5bc9184b1fb432
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fk5NyBo4kx929bL3Hnx:sNc/zEOVHFvB+kn3Hnx
TLSH
T185858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 60169f29db8cfdda1ef20a8481b1424630a0ca76a54b319e79567cc3825704a9
MD5 e7208ed6e584e5b4e7895cb5638b0a5e
SHA1 ef0b5d4af40f5c873efea580719ca6b01be883b6
SHA512 4c0ac023c0be7800688a64738d7880d529e6fbf6bc7df296d5d0974d898ab5ee64f83cb7ae66ce464c54b759589a0d0342e61cfd5f61abb301034d43e80fc5c8
SSDEEP 24576:fzkNvNnaFeYhJNtmZBmqNyBo4kx929bL3Hnx:fzMwBtOm5B+kn3Hnx
TLSH
T1B555AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5f8f98c345835e446a98a08d4225b16d27cb9a26f8c107459e48d3fd553d6674
MD5 e8c827778a967f698d642b9170014f3c
SHA1 c0280dc53a31ad2bd56456cf08975b17aae08472
SHA512 d078c659c43c804e93e58fea3a522d0d9cb43f91fc3045737c5f8315ab03ecef0b3ded84cec924bdc28129e7bf07427d24d7f679097b6a289e771d86b2a04703
SSDEEP 12288:zHvUrBFrEjwaQWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zPUr+NQ1NyBo4kx929bL3Hnx
TLSH
T1AE85F11F22AC18E5F67AB17C85868609E671B8560712D2CF02E1817E4F77EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e529209a1e901e14bb7d0d7512ac2253490f65dcc5a4040ec26af8f98aefc850
MD5 1166b7d3f5bb9c0f14e3e7b5b23c17a7
SHA1 e0dd9dec572303bfda04431950b5a17ced5bf62e
SHA512 3f17337aba8f1f5cafe8641d0825f3ca8be6f0d058bfc307aece0492175c6bc83b522d840c6d37ac74e25d21043f02d1c1a584b98faea7e9ec39c8b919782558
SSDEEP 12288:pQcMxWDXN1Dp/fshBItT1IQgARLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:VD3FHshBIYQgAuNyBo4kx929bL3Hnx
TLSH
T19795E13EE75C00E4E57AD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/620-112-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/620-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/620-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/620-316-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/620-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2180-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2180-132-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2180-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2180-140-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2180-138-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2224-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2224-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2224-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2224-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4136-72-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4136-70-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4136-78-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4136-312-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4196-83-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4196-82-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4196-88-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4196-313-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4296-29-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4296-0-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4296-1-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4296-9-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4420-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4420-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4420-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4552-127-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4552-319-0x0000000140000000-0x0000000140220000-memory.dmp

Download

memory/4552-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4552-119-0x0000000140000000-0x0000000140220000-memory.dmp

Download

memory/4876-57-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4876-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4876-43-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4876-55-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4876-44-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4876-52-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/5156-59-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/5156-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5156-310-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/5156-66-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5668-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5668-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5668-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5668-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5668-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6020-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6020-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6020-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6020-332-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6020-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6020-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download