19d50d3676bae6a0e30454d6e4c2020cf620073507329a636a86f8a575662233

Analysis

max time kernel
150s
max time network
163s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb/adb.exe
Size 1.5MB
Sample260804-pd7ghszckf
SHA256 19d50d3676bae6a0e30454d6e4c2020cf620073507329a636a86f8a575662233
MD5 073b831e08aaea9ebcae0a8fb38fdf44
SHA1 b453c5c7926944cbefe2b81a8b282cb17e16d5ed
SHA512 74b3486bba450052dba940ed47a8d9127334ebc9f5cd2dc6ea7f4828698e4bf663477a50ecef400a6a6a4e73b0770caf30691e5aafc0e4ae06ba09cba13404f3
SSDEEP 49152:HnBLLPqsP3ibg9TPfjBXz0EQqyDvfax4x8EVep:hLrDP3qEBX47r6ix8EVy
TLSH
T1C3758D98FD8755F9FE6B1D708193F73F0B214A01C431CDE9E6A8BD85EA33991111A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2280	elevation_service.exe
4412	elevation_service.exe
2496	maintenanceservice.exe
4280	OSE.EXE
4144	PerceptionSimulationService.exe
5708	perfhost.exe
4780	ReFsDedupSvc.exe
5416	SensorDataService.exe
4060	ssh-agent.exe
5792	AgentService.exe
3268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	adb.exe
File opened for modification	C:\Windows\system32\locator.exe	adb.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	adb.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	adb.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	adb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	adb.exe
File opened for modification	C:\Windows\System32\vds.exe	adb.exe
File opened for modification	C:\Windows\system32\vssvc.exe	adb.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	adb.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	adb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\98542949e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	adb.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	adb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	adb.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	adb.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	adb.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	adb.exe
File opened for modification	C:\Windows\System32\msdtc.exe	adb.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	adb.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	adb.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	adb.exe
File opened for modification	C:\Windows\system32\wbengine.exe	adb.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	adb.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	adb.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	adb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	adb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	adb.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	adb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	adb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	adb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	adb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	adb.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2eb83150b24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac5826d80a24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000594f6ad80a24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008af441d80a24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048a50dd80a24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011996fd90a24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1584	adb.exe
Token: SeAssignPrimaryTokenPrivilege	5792	AgentService.exe
Token: 33	3268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2280	elevation_service.exe
Token: SeDebugPrivilege	4412	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3396	3268	SearchIndexer.exe	100
PID 3268 wrote to memory of 5628	3268	SearchIndexer.exe	101
PID 3268 wrote to memory of 4400	3268	SearchIndexer.exe	103
PID 3268 wrote to memory of 5976	3268	SearchIndexer.exe	104
PID 3268 wrote to memory of 1784	3268	SearchIndexer.exe	105
PID 3268 wrote to memory of 624	3268	SearchIndexer.exe	106
PID 3268 wrote to memory of 2468	3268	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\fb\adb.exe
"C:\Users\Admin\AppData\Local\Temp\fb\adb.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2840 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2848 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2848 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2840 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4dd0e511f2280e16c3853ab4a125b19da799902560c771c04b6262c7df6813ba
MD5 21403a387c89fc4468c36a588c373942
SHA1 f43997dad48e5ee9426b6cc8ac846e45c418610c
SHA512 61dac2011aca00d02dab09ce6b76c7c04303ddb99b96740b4f2739368a5875d59cc6006661543936a60a08f15ed14a311424bc0c181485df2145dc768cc5e139
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxx4x8EVep:p3q6HjB2ix8EVy
TLSH
T19CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a099c72ad7bd8107df59335c701c953fd1e119f0657370902e04b79623d8ea28
MD5 3e58b13196650df335861be02adc9f83
SHA1 bca3e31e8ec86d90a3dcd843732836cd595f500b
SHA512 8d80ef8cd7d0eb0f74a30aad1e285ee06f7d6b4310e02440726778fe8b3eb84151c4d67eb2c03280708d167eeffba914158c0a743e2b6888234bf96b7e4390a8
SSDEEP 12288:J1XLsswWkxy2lRq2czA/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:HXYfDtczA/yxknw4FYnshx8OfVe247
TLSH
T11575F12877D508F9ED6B8139CDB28512E633B8514770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f9cbf545477ac7f0acb2fd12b00ecbdadcb68fbdb3971b20371b0479bbf1c13c
MD5 5cec01d243a98055aeac26b7be5e3d8c
SHA1 7d30503d5b977770c2bb1e96d5c8f549dc16fda3
SHA512 7551afbada36221372819b7669caf69577501f99487b0f4f77941114b77600ad931eb84411b7221a12b8f69d900d79990e5ad0609d3e056b0d4c387ba2a8db45
SSDEEP 24576:P0Le5ji0hmxFrMWyxknw4FYnshx8OfVe247:PPji0ArEx4x8EVep
TLSH
T1FF95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 de99f8c3a19f9c7c335630db62cf435ea3467baaf13282b16cdb3b7bf85ec8e8
MD5 23f048264b39134c333cea5f0936fc8f
SHA1 7b87c87d3d79afce79029a5cd457bb1a7101a300
SHA512 a12bc562b0250c1454b46481562a86beffcc7cfba4c322988e095b29afbbef8a16d848219a6b5b0ed8e54860b1931c6117ef2995631f067ce863fa366e94a25d
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyuMyxknw4FYnshx8OfVe247:x/ezSC6vUzPvxHjyox4x8EVep
TLSH
T1D2756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 503397b3423f10ae8a3cadf40be0c0984c583ae7ab136e39e8abca48e25d2d7c
MD5 3f7959efcd68a5d7e8ccb6132122f994
SHA1 8b7c1ed2a9fd1cfc959f082d227e09997c77c463
SHA512 45dd36629b9f28dfe87116946072f2594b75874269e7b326bc7bb0a537b641622d51339067ca83e3994538f0840ed88cd0915d6dc12241fbbde38e9abf5d175e
SSDEEP 24576:5VbqPb88hv/l+6Dyxknw4FYnshx8OfVe247:5VO88hXl+9x4x8EVep
TLSH
T1C5559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 29557597b468af33172efb2161274d8ced3125ee9aaf790b71d69ec74e629b23
MD5 d17509fa96d9268081ef9ede636e2000
SHA1 d9fe4ed5359d3121ee94bfb17caf87c7bd57f447
SHA512 774b88569a042be9db5751e86552f57f0004c060d48717b9b69b33b6172b8b15b4f7fa4f331a1226da908d04d4e42ade0ba5305e76c996f007eb5c481131e7c3
SSDEEP 12288:MNK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MNKyxknw4FYnshx8OfVe247
TLSH
T1C165237CA7DDA4E1FA5E14331B7572623616B9A0DA74C11BCB79B14EE0F0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 b6cef6f3a7db5f71aa5267715d94773d0137184e2fed2657a02844fe39606cc0
MD5 28b0d8b7a72ef546dbcacd18a5625aac
SHA1 3fbf4c7dce642924961295aaca46241ed95eaf2e
SHA512 75fcf1f9f0f22a62e12f136d75f4ad88557f68dfadc3cf36e2c7ea31132ac55e5744acf564be992f8d2ab2518528980238ae9910f97a0a122f787c7bc4f723d7
SSDEEP 12288:XeBNUbTVO86Ub+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XJIUbyxknw4FYnshx8OfVe247
TLSH
T14675CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c8da6d0ec826b7af40e8ea549ed9b526cc8ea10fd0cc0b5f0ce0db63ce3c6a6a
MD5 3e336bce245e475154ec286adf81ccaf
SHA1 63f9212105d4a6cc4e283ce6ef14ae0ccb82b33a
SHA512 59606fe6f6153a00886b3a85c46e732af4af451e605240f15cbf5fd030c018bb586ae0d32dcc7ba3a8d0c490d47b21a1879d5b48f97cea1becf37c328d99587f
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:jQvGAdlCEL8c/yRNw5C3ix8EVy
TLSH
T161267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 29e812e4dbe1984a3b1e8ceb103345959d1997d8380d7d2b441e2056457ff261
MD5 f9733ce9dc25802a873103ac400076c8
SHA1 046ab20b4d4de85f19c81511c889ad095bbf8f20
SHA512 648d5ed9ea9cddec1967515c0aa331232fe681a22c9d7c79b8d29a63f4e581d34364f8fda2c40520974db338906373607cc278e42066e813d20cf78ce7b60e85
SSDEEP 12288:IAwSfxL/2Dc3LDLLmt0LDQewsAjR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:t6ewsAjRyxknw4FYnshx8OfVe247
TLSH
T10985E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bcc90f47fe2d8cf7799612bb7b0a27a47be4daf28670b0f6e051282741e0f676
MD5 12ef4dd032337ab2513957be0ece067f
SHA1 7378ba9f3ace9b428b3428841ed38cd1ad20d8fa
SHA512 3285ac2f81510922c3300caf719cc499c337ac827d7311e4db3617437643233d76f700f00097e7e1f3b9012879b10cd05899341ccaa09a4b25ea36b5db125b10
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHR:hUEtQevvqc2W1cpV2EI32
TLSH
T1B9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9f39db2ae9b775445c55c60ff81c6614fbea915b7f18e0bcf92a6ef4dc94d60c
MD5 6284ac606a23daa109118137332e49d5
SHA1 b2ab6777bcffdc495348d53dfa583a365c309c78
SHA512 f200c1feed4a13cd227f284b2a0d51948386184fab781272c41167462f22c992ef93679258e89033f5c7d395613ca197bd7746a496bf488259a5bd70ed700975
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/z0x4x8EVep:ZoqtVjnmLix8EVy
TLSH
T14BD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d8c1ebd45cb7c6993ccb05783592cca9a370f94032ce25a32984ecd80868daa1
MD5 0a51c9aa8a5fe63e04da7083833784dd
SHA1 db5f35596894b2c007616c1706a04d8391428bb5
SHA512 24855e943f0c65e9930daa646796855c8d5d940e39c68ff2b3b31f851c23c4ecc44e84ba04a784dc44a6ef42f86d60492db849923195351785a340af62983a45
SSDEEP 24576:GAhGLJIFoiwtA5l7S53Iyxknw4FYnshx8OfVe247:GAMyFoiq5bx4x8EVep
TLSH
T1F835AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7b4f0674aff25bbc065008354f0ea074af163f25141f53893a0aec12d90531f0
MD5 0da1354da4db8f9811b81c334b33c376
SHA1 cf56a59e91a471f58c6dbe4909523b2b46541d87
SHA512 0e2626f3134c0bd18d96122aca8d0464ad893f7a2df6c105f247ec69f7bc8c8819e7533cf110c837bd317940c5c4bf3ba524cffd4615c2eb6daf6173500dc9f8
SSDEEP 12288:Hmw5HEjsChNoBFgl0WDm+Cs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:GwuFOWdyxknw4FYnshx8OfVe247
TLSH
T1EC75F14977E91CF9E9A741398657C132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 9f4057bbc8084d11b30be4f5e3b179e682f511f7e37bee9354cf12daa9f0e09e
MD5 0029c299b1fa2166bbdbc84d93eb4ede
SHA1 9585b5d001dc1524cee201a6de03f824ff2bde65
SHA512 81f5eb6e490cbac7140d8fd1e82bc4f21af7e33385f3191b974d2baad141b2d249f60832a8542110c597df034dc71cd2ca5685579424e78e165760d7258abbc7
SSDEEP 12288:3FZ1Iyh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1ZuOyxknw4FYnshx8OfVe247
TLSH
T1C76512AC33E860F1E1A7113A89F15205E76274A2677183CF4764625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d14aa15735b5e6da7a7f0ce67071a235e1db068158314a916b15f7a5e1d65b8
MD5 35a1c9ecbaac02c5be957ba448ea45d4
SHA1 5f4b4a14efb6dded6e269c4105689d661ba0f478
SHA512 cc58a88de0de9b6b2e536842b181e6161cd6dc193eff3a8467e73306aabfaae224ea023b4bd379a4fc46d23e375d840bba5649fb90a071b34a9afb30cc7a7fae
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:8QRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 51c934459888f8399271ac7d57c6f41b68408afe17919e676a68807efb5a7284
MD5 52ffa91d896e9e7a2626a26dec44ab8d
SHA1 f2b10b43908ad6cdb9509c9a773fa8ce88d72329
SHA512 c9f277b7f526aa953a560be492c6f6bdac5d7af83fc05014eed61d16ac6694a9d652184e3878fe5da10faa8fe66238bbf9bbaf307a776913711126438af658c6
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:IQRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T1BC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 afc26c270dd887112f02e74e6695ef87d975074dbf3711d5fa4b93013fd513b3
MD5 d6dd907bbe61067e8c920be4585a856a
SHA1 3a5ffa463137c731b86ff7af1790532493e0c7fb
SHA512 efb5a8e8ff760ad7488e52c28846c9c4954218008560b1f9089b4782bc41390520bdcde3b077c679ad0189eae8d34bd185206ef493680e6215c670f22a425079
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+yxknw4FYnshx8Z:068Qg55nhheWu7PNU3/Ex4x8EVep
TLSH
T194B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 67ba211991bc6b4f1a1d515e63157b0c2e3633628933fda7498e77e5d1c89281
MD5 432ffab780b56e6ea57576c42d553b8f
SHA1 33663f6dd7a90dc9d24a4f40d760d5bed26fd2ec
SHA512 cb7e6806c491a14866707f3f48a5e70c70e6b3afac232186f182728b164d8d62c8851e757daac53789599d82157a43158c5ccc4d2882d07dff85748c7d29f786
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:Oy5112gYy5azzVvL69nLKnhZlix8EVy
TLSH
T1FC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aed53e333da9d2221cc03d99a2ccb61cc382bfaf3fa96dadb27a2e5cc3bdc000
MD5 dc3d1c2e0e7db63310656e3c1fde7632
SHA1 628561da7f22db43ac12fd07c7b9ce7fee5074d5
SHA512 bb8a8b1acd91c38913dda8f06ee624135425ef4f2d6abeb604d8641b02cf2a3709bad884c5818a79f95328a3c14b82bb22427a14184cac7c24b68585dc040cc4
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glax4x8EVep:Qu6JmVxd2daix8EVy
TLSH
T177D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e0cd5c0e0daa9d0d9eb56443c898621f5c6581d91d6442f05e178f00c8d3a61
MD5 01df5eca29e04781e42cd76bcb77e41b
SHA1 c06a93783a15a853cd1a7f1d89251fc3098adc2f
SHA512 6d59f52a724a1d0e76fabca06d2c9fa5c2fa68d863c03a584708b5c01226bb14d900006012604ac43d5c0bacc6a37325a2df3dab7cf098f66b2b7dde4068ea6f
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xex4x8EVep:rmifPbRLix8EVy
TLSH
T1AAB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 18898e5e0a9ad9d41236325dc5de7ead332a46af86312530686d458ab23427bc
MD5 2c26f598996561b09d30dea84cb4bc6f
SHA1 ccd3296140beb0bcc1421030ec45cabf830a12cd
SHA512 e297b8354790cfd748ff96670397b2cde7841c58bedfd1747b75f4d213add08f728fc5f69c6e6ef3f16ed47c6f6c3fb0653333b68a841281c9dc50b88e50dd0e
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqBx4x8EVep:R5dKTi61Bix8EVy
TLSH
T142C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c945923ec6233daf99aba560338b7da7468af976e121f2adf511857152853c97
MD5 3dde0abc142c9d7dddec438419a86809
SHA1 a1bdb603e57bbe9713fa4785bb147e30bed29be4
SHA512 95c250d5b60875c5156f20924637e2e56fa782fda421ee17a45f1819e5cb7baa1cb2f648b84105bab97e75440115dbc8be61ed45f77115613840057a37e9f2b8
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wqx4x8EVep:oX2iyph/ix8EVy
TLSH
T17495BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 18da0185e55cef997258c892860c68c5b55282b1ef0c79868ee2f964138cd34c
MD5 84ad8a1160c73f208e9cb3fb8f3c5beb
SHA1 feeed5ec298add426e0a6ac272d5db7331d1c512
SHA512 6687615f1be07320c2f9b2d85707b858378a97ede490eeed4c8df05506b1944f8c08be966b5d6bcf152977cb816016be93b550a4604e9c536e1821b3187dcf79
SSDEEP 12288:oC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oCyxknw4FYnshx8OfVe247
TLSH
T1AB65237CB7DEA5E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b267255e4110738908a5750e43a476d51bc81483e2476d68b31d8d066029a3f1
MD5 140f654bb431e1d9b3713d5096569fe5
SHA1 7d71becdc449b92671aa4b0d763a60e867b97bda
SHA512 29bed4b63101a6a82df57c91d1fe27bfd048305cf146672462f0ca0f8b6485a51a9bd5606415a4019b6ce0cc656e140c71dd075527d548ffb3a620484b507fec
SSDEEP 12288:/l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/lyxknw4FYnshx8OfVe247
TLSH
T1206523BCBBDE95E2F50D10734B7162626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 00a783b14ea3ac97f75e85d4272bbab0f5dd715848fe25b9f78721c5be2efca1
MD5 6b08b9f1ddad2d52a45074798ef1f0c5
SHA1 d2929806a95826a48d95fa802c36bd9f2aaa9cf6
SHA512 93e59f9ce22f0a72b8df3a0b6217442df99fe5e658422f1e31928eee5040ab84e81c4f89bdad466a07bf372e7fe71498127fa01f9da5b947405a5fa0a621d616
SSDEEP 12288:jz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jzyxknw4FYnshx8OfVe247
TLSH
T1396523BCBBDFA5D2F50D11734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 49d8096cd9cec104a337f49c9a7f0c52b32a08379f832ee548b56ce6452bf728
MD5 8bfcfc339cd916b2a88765844c1d4490
SHA1 b20a0b1bd2c87d08f5e23b433badb00e273df4e4
SHA512 bf9eda1c87d6631431b94fc0a2387f124a2c848e6af2f9c1086bb4554f9e0d71b6ef47cd17d225b79a997a14f8d807e83a14a459b96e2801f2ab63ecef0ae7be
SSDEEP 12288:TVo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gyxknw4FYnshx8OfVe247
TLSH
T13965237C77DE50D1E85A51738A726222B365B8E5E731835FCB24710EEDB08A0A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 80b1c364fd6710a551a412c86a53227607f120e4defa9879a393a0ab1938636c
MD5 19024d247923881c54e047878d7ae38d
SHA1 e324d4d93ae9a0e76c129341b0e0620e22f63f39
SHA512 2dbe324cdeb21a2af06c622f5a0da7a23fe598f1717e5062999bce552cc190cfbe2b837127b978bfe838d02162f9da67290e322fcb2906aa9983500ac7966f15
SSDEEP 12288:KQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KQyxknw4FYnshx8OfVe247
TLSH
T1936523BCBBDFA5D2F50D10734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c7bdd12fc6493cc271d405e9cfa44224e5b76df4ee56b072dbc9156051495cd7
MD5 5efffe0248b552d37519bd98fcbfb696
SHA1 778bf35c092f7bca0a5fccb648a16c482feb1f19
SHA512 1047b2a949c3240f6761e07025ca53349d53b505f3c78940f4b38433ff5360ea136301d3808cd42df58adb0fce8007d1acb3de0d1d0c1aa6ded3c4a2f235df8e
SSDEEP 12288:cJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cJyxknw4FYnshx8OfVe247
TLSH
T1CA6523BCBBDE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5f72dda48b5ee0b47d102e91e8b788fcba58f75266e27930afec49e132b56b79
MD5 6e185377aaff1f5cd13d20f44d5d78ec
SHA1 706a6fb03073477840e65ba30589051d8e0123e3
SHA512 bf75abbd9f75ecb78aaef94ffc0add896df0595bfa626b48480814c1bc8e3b453a044cbf07b752c747c7ce515c0fbdbfa9790b4dc1743b337c9f60a05bde9a9a
SSDEEP 12288:2N+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Nyxknw4FYnshx8OfVe247
TLSH
T1D16523BCBBDE95D2F50D10734B7162626609B5A5EAB5811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3d5ceacc6dd64812f7de1a36442c75ae1961435f884822e328ee2b736daedd1e
MD5 9070d66a2189aece4158b5fe789c19d8
SHA1 2058c34d27d12e80f78e18282b86e4c76ab3bce4
SHA512 c46af61e16f412cc7e4c01f1f086b01d55095ca58efc8f12b47908e09c4ef1bdb05386106ecf038aaf34692e3965be4eda15ef79fa4ce0acaea95c478a962ddf
SSDEEP 12288:uiZwbZzzFEoS2cPvyF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RZMdzFVSOFyxknw4FYnshx8OfVe247
TLSH
T18A7502A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 99b757ceea9f1c6b796e61712c332c1c6147a5785c988c9110c78083ad6574b1
MD5 774e6ffaa185c16526c549a9d7bd4eee
SHA1 9b8a73ff36d146f2a4303f64ceaf952cdaf0aef7
SHA512 0a4f46e279f29f906ad4bfde9006f1a51cccd8e24ac763eb85f6f3dc5ad6bb6a161abfc5e33b1eb9c81a5f287ef56384a105c636c42fb64aae0ba87106c48ba7
SSDEEP 12288:Te+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Teyxknw4FYnshx8OfVe247
TLSH
T1CF6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 26a79de70957d87e02efe2b36866777ba726830da22abd04fedf66de52921825
MD5 f79296c36377fa302dbd605ebe680f76
SHA1 89468fb85fc9f82f6ed11e9f10b11a4cb60c1587
SHA512 667c4b8d8c59772cbf7cbf7e87a0076d51994f77948335217b198a08d859ba28466a30e515c24cbd79d224864fb007d18b1b2fbf5c4ab3cc98cee7fbe7179743
SSDEEP 12288:ea+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eayxknw4FYnshx8OfVe247
TLSH
T1CC6523BCBBDE95D2F50D10734B7163666609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3b4dace9a94ecd2332bc9d00ba3c8f1170f93160854986ebe882cce287a054e1
MD5 2ff5b79d938086d646699e1cf7190add
SHA1 2c5510e151f9099d0d7686a20b5f737a554ce6b5
SHA512 bcc86865f0aec65be1148b0df43552326d6235e064bb16ac4e656eaf9ffd1d829caa8476daf3e746a07baabd79310677acfd5cc475f7168b55a3efa2831b1b12
SSDEEP 12288:UyPz5L8h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nzyhyxknw4FYnshx8OfVe247
TLSH
T10C75125B73E530F5E12A4236C9621612F372B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5cb4a3df35dabbf16999db094d85facc531e4fd4864b3e5b94d29a70b2a2cb06
MD5 5c629b62d67bf73cd9f57c7b926ac411
SHA1 9e9a16f72347713cd3c755bb146795b948026249
SHA512 966b390c5fe68fc272728b9a876a762cfbed8d0e8efe155e55989680fc737ff09e2e4f721a1e520b7cf6e43070ae966b7f28cbed753f7848cb046fda1f1fbe8d
SSDEEP 12288:ze+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zeyxknw4FYnshx8OfVe247
TLSH
T1FE6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 7c51e0baeb481a107e4fa3e0160f1d669aa648e857dc8eb85b968c5bbbeb7f20
MD5 90f764c58b5faffce26cf6de1972b29c
SHA1 40a372b81c05911d3b4c3f6de26a6fd44c710144
SHA512 312680b8eba7b99ff4e8cc2c1ba3c8faf4bb61787b23ce33588430b6776feb69e5686639f8e4874ae3659c81d5fb9f390e3dd304690e282a7a3bf83507aa5433
SSDEEP 12288:He+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Heyxknw4FYnshx8OfVe247
TLSH
T1336523BCB7DEA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 331517b7e1b6b9cba6524879f781a75816cfe09d6eb5b683b083d44e4f413ac5
MD5 1e1b38f0b13db76cab036f4e35765051
SHA1 40ecf7f85c072f0bc60a8e49000be5d122d2e290
SHA512 68bd9722a2d01496b06e0ebe9a1851e189fb79b147f39532e9190579766f7dcbabc5dc39a3e098125522f9e2776e64ad88181602a605a381a503b30267e8037a
SSDEEP 12288:7yPz5L8h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2zyhyxknw4FYnshx8OfVe247
TLSH
T15F75125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E725E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 8a537e51888d2393403165533c6a0ed77aac24c2ed9ef7b187c04dddd757b53b
MD5 b06b4f62139338605902d15a23254636
SHA1 d678dd06495dda509f56dc4fc039849f65960374
SHA512 ec61e8cc9420dcf47e4d457df9164f04e64825f29574d9782435b79c70ba95bdcb5f7e5e26a3b37dab52cacb430f181ba2dafb78da0db58fbf898e3f4b8f3e02
SSDEEP 24576:8TGaLl3z0zDjyxknw4FYnshx8OfVe247:8TFLljnx4x8EVep
TLSH
T1937502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 9ccb5707663b88680158c772c6909eb9bdd3444a93746677433c4a2eb6d5eadb
MD5 75c48cb2a78f79501c61a815d1aa3e4a
SHA1 774207b515d5c8c0bf888ab9c8842c1a9b1b9819
SHA512 c37289a4979a198063b179fc09bbdfc67c98226373384163a90abf8085d1805188ac1eabf66266af76f62d9255304b5c181a7e848d8d488ca01c8e4375e692ff
SSDEEP 24576:83nd9CHKy7GZXyxknw4FYnshx8OfVe247:mnd9CHKyacx4x8EVep
TLSH
T1A595DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 08139d679307b0eb313737e3faab240959d0e5888cc544894fd44e8eb6d8bd9d
MD5 6bc5f75f2799a58cedea568f49bc7204
SHA1 528d39f9e11b636ebf3d27237aa1d76e771593f1
SHA512 3fc863f5147c1fb6a46b21eb96f3cbbcf33f01852439da6dc1e13bd62aff86b341b1c2fb043c14be905159d7199bb797a8a8f14efdc32d6c2bcc6a362c0f4bd6
SSDEEP 12288:FT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FTyxknw4FYnshx8OfVe247
TLSH
T16A65237CBBDFA5D2F50D10734B7163626609B5A5EA75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b9c084d56d801e3a38e82318505a601d9195c713bd98e9380b91d951907f6388
MD5 2eef389dceaa8815c706469c0f172912
SHA1 fc0fdc8d2e9cc7ca2c86950bba5666354510a869
SHA512 b2605dac554a8f03a045d78b32a56abe66f11ea2332a8da740d1a18e6cf85fba9eeda57a783dcb9e0bb439138445f987f384aa4783418fb2df243a5724cf8543
SSDEEP 12288:TB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TByxknw4FYnshx8OfVe247
TLSH
T14F6523BCBBDE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3d89cbda4f22134353f33cc5e2a7e7f15a450dfc8f3393a3e3687ddce8577729
MD5 fc701b497611c4bf1aa9fa2005c9ae25
SHA1 dae3000dd73d6d073759cf166d27a18a40ae4e0d
SHA512 7c9688dcf725ab9fc89409ef1a1e9315964075c589836cb16d767096a6572308be058780b3d089fc5397b868f26b6b7be155d2d6fdc8a3b66ab9386287bcad8a
SSDEEP 12288:C0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:C0yxknw4FYnshx8OfVe247
TLSH
T1046523BCBBDEA5D2F50D10734B7163626509B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 254f1d83183f040eaa4bda895d03d64188fb0bff7f634443767d0d78f43938db
MD5 2d69df146b7089d5bfcd3afad1218c26
SHA1 6f896c8b1cb47f813599f06dc1ab38da32283221
SHA512 0f2eb8ac9c07fe49e349a67169126faec1e33db86af2a27a44d1fe5a8892f42412bcdcde3b7c74d13577dd3fb3654cd2b527daf68e934a4e5680f5c0b4cc54d8
SSDEEP 12288:3e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3eyxknw4FYnshx8OfVe247
TLSH
T1376523BCB7DEA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 fb0df3633f5a76abb7c4b2805329d1c545c271d041c733dc22f894aaa0288a39
MD5 5d686a7e8b5786c2ce1ebc304cf4a01f
SHA1 1659ce60984d451d8cd26a621eb36b32c9f1d6e9
SHA512 d3913f0fce69ad2a5515102c68b004dea53675a6b3efb4e5c6d2cb9b250981a3b1923a7ef62a0432085a3c56123450b6f6ef5d872033e9de3c83e19b6b6a49c7
SSDEEP 12288:lT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lTyxknw4FYnshx8OfVe247
TLSH
T14A6523BCBBDFA5D2F50D11734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 118d571387827d6edf062e565427a6b78c5c4610dfae1ae2009bf4f8939a212b
MD5 189074c621a7f548a5e3fa52f71305bf
SHA1 874a9734eb8cd478feb2190ee08eef1c073f3d73
SHA512 1ac31b9e159f8c233bd249fc7d078ddd64813395ddf0ad507407d2917ba0ef5c65612fa4586bc4680fd921c5d326b57e02f537e4b61e3559e203a156c4784475
SSDEEP 12288:xG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xGyxknw4FYnshx8OfVe247
TLSH
T13565237CBBDE95D2E50D11734B7163626609B5E5EAB2821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 7318516577d114654bcb5523c4361d1ce3b85032cccbfc291781b3e8e58def2b
MD5 83c8136e1d15a6c54355ea447764c359
SHA1 1da57c2e3b74168a7be95b930cfffd2f4149121c
SHA512 668c164f13823d582b64085b07a0f586e6d0d0d944871942e517e7c3665977b99a1ae77a5e93f3d464f1f5a4b3245b7b6850dceda72f6ed376257d6cd2fbda11
SSDEEP 12288:NQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NQyxknw4FYnshx8OfVe247
TLSH
T1496523BCBADFA5D2F50D10734B7163626609B5A5EA75811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 58702f3d248ae5457ec46d5eb85c9e70b4f580c687cd98c26c02e9f694a56f59
MD5 d50d2389c639d51ab0a7320eab9ed21d
SHA1 da95c05bd2b092feca865bec567450ee05782ab7
SHA512 9d807f24656959ed11f6c7e84a48f9ac47a87c450feb8966132946b4691ff4ff64dc56f493be79fed0542cdadc84b9c5d65a9495fe2c905f976f87c84c51f1f7
SSDEEP 12288:Qr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qryxknw4FYnshx8OfVe247
TLSH
T10D65237CBBDE95D2E50D10734B7163626609B5E5EA76821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 6f970b3af7bcaef43e1a80be02bf0e9ac84b3b8344fe7c9b49f3b5e78e12fa0d
MD5 ae48861e9fee8b3f9a17bac39ab3b1f7
SHA1 b531bd91ba829c0c0ecb61380000348c500dab0c
SHA512 d5b9daf9834eedfa20141b09d3eac48ad6020a88ea771aa2d53f6305e5f9f6aefca41bd2ef553cd442e92aae66563ca31b52a69d731c7dac94a1ccc9ec706e81
SSDEEP 12288:rQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rQyxknw4FYnshx8OfVe247
TLSH
T15C6523BCBADFA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a3e3901c491abdd749a28cf2c663d1a9c7e35670ae49ba1d221a609415772c23
MD5 47f6f93bc8f46f682fcd5f1a8f94651e
SHA1 780bba98765fa0a9ec6c17297c25a7e675b78584
SHA512 4255ae68fa5eebb02db0b37e2272ab4283bb613266d0ec85ccc7f9d2eedeb4068bcf5caa0c9754ff52179dac9f39d67c4c929678418f7871db48437bb9805f66
SSDEEP 24576:1fwvJk9RX6wkyAIqyxknw4FYnshx8OfVe247:6MnYIFx4x8EVep
TLSH
T15095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 13b9c407a256a36d961d652f4b68ace208b88d8b04dcf9b0b94f117925c1d3b5
MD5 311bcc30f6141a5c24485d3ce95bf75c
SHA1 d18ccbdddc1e5a990c9254177cab0dfe5b636841
SHA512 e00c46dce8628cbc75865a4303661fc5057a258ece6e5acb4ef3b7d4954e21861d6efce9c47cb7903ab320f7d6ca089c0f7be484a3d94a51ce14fd6a1a9d178c
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Kx4x8EVep:HySzPiix8EVy
TLSH
T19E066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1d62c2a23eda7f700fb3efd6acd92c307ab3e74aae84da34a50362feb04df038
MD5 673a1439338b4d3c8325952eea45a1e1
SHA1 1b69b6fd8bfdea84e1d6df954608e682d5c19174
SHA512 dce3f0c51d29f326a9776e13e6c1941c0b61d0c7821b6a06695466d4bb932c8d0954a2d1148cd2bf5f186a303ddc1956cc916b7c72f9ffb6192299f495063238
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYVyxknw4FYnshx8OfVe247:k47JUQj1irIhCnDHUPfF/ax4x8EVep
TLSH
T1FB65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 cd27b39a0317f4ce3cff65581865da7a617d8c36255821140e5cf479f3b17d08
MD5 9fe002a38964cc4c156ed809bcbad826
SHA1 c9becbd51d663a3782425e7a244e78f961cf624c
SHA512 9d2de9537fca17d2c6cd84981d9d49619d015ff0af67b83ac456f808a2562d2a592f08bb981115976e1e557683c62aace2647a97dcfa1e61e5378b99830fba0b
SSDEEP 12288:q+sfO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KOyxknw4FYnshx8OfVe247
TLSH
T12F75F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1d41c096ec513647bd9821681649eeacd25d6b8f75442453f9e022e3facf5e7a
MD5 cea1671162712c52739ecd2950bdc95d
SHA1 33744ba4a9c9476b5f07604bba3b743fa266d4dc
SHA512 6e0fd56a31fb996d56dee254dc6733f99fdea20a26dd4493d82fa062316f744a4b8285b2aed822a6f6cec246b9326717a747f85004b25cb6a7bf0fa95601eccf
SSDEEP 12288:YfedgU3fLwZuZXRSpGj9xcof5/h+0Ma7B9EzP9ziARMQ1cx:YfeaUPVTflhNMa7jED9+ARM
TLSH
T128552740762AC79FC6A980325E72D6CCA7707D01FE056F1773C8873E9476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 5e9f700f491d9428a870de0c0166816b5eb0eabe41481ce212df2df83de11e0f
MD5 72dafdae69d66101d3b593b651d2393b
SHA1 af89e2bccd0b8eaadd03b78cf49164326b84ceb5
SHA512 92f7b62965855b755a8a602f714f9ce8770dc8bd04fea5b8bbee69d16fec8b60ba23e4d46bb2033b8590e8e3d5d764ffb7122462e2f8ff14f888adc6022b073f
SSDEEP 12288:zhH3gdL5Dp45jTVz6gy+phczkFhMDEu8lVARsAgHaA:zhXOFWt5fcdDIqqPaA
TLSH
T173450A41A5A7E75FC9FD90370732C68DBB745C02BB453B0573808A3C9867A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 479f9a3691728a903d75c92c45f5e644ad9c7c6b9237ce6652f443c4d23a9eea
MD5 f50a01977790198912891d8e2bba4796
SHA1 10f133da7e3c799770313b8d1d690aef893de50c
SHA512 ab26706a30541b874847145e9f95f0fed8f7b62ed6e169e20d17d05428349d63f8c3926b537e7e85939257dd6bc450a1224989e8316983a505af692f17ee28e0
SSDEEP 12288:W472+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:H2yxknw4FYnshx8OfVe247
TLSH
T15C65237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f95341e7409b90b6301973c846239b31bdd554707f0d521e56caf4813b9e0a21
MD5 fca2edced87d126197eee1c93321b784
SHA1 2247dca86c3c124c9c685d918745a10b34d1636e
SHA512 49bc98f0abb2eb621d7854bccd3bdf5b546339f8d3d5d36ff90971bb3691c37543de9be197af81037fabe8344c446e9d0531f6b926519309935d95bcd68b44c5
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYMyxknw4FYnshx8OfVe247:Qgb4mBIBhGFgx4x8EVep
TLSH
T19565AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 3f27e26628eb6a1e9b55bf239ae68b340f7678f2f92368ccbe41e668ed63fb58
MD5 96a226e6ccfca76f795fa92ef71c3ac2
SHA1 91aa0c512b01e7e3eaccd7ae895aa52ae8cd499b
SHA512 5478664ec1bc1eb3806b8f4571b491f1d3192b681cc1fcc5a97d94deca8c616aacf6db23286583d53d67bd5ceeb8f48b72732ed4bc8f39d7b72d8a4c607a5c3c
SSDEEP 24576:qG88u8FpJqH1Kzria7/mFyxknw4FYnshx8OfVe247:R7ZFPqVVa7/vx4x8EVep
TLSH
T16095F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 6c14e6c65e07e8cd016556221e99d2687b087fef7fb16d486255295ba362f702
MD5 b2328a733a64a514b7cfacbc0ba9ab8f
SHA1 a618948cbea7eaf9a753007040b74a1896682543
SHA512 2ea0db5f864cdf1357e263e18d42cabbff5f64fc9992b5687a09fc4866055fe5359b6eab65e8d02430109b046ffa320b3a4151211314da0e6b84bef905148667
SSDEEP 12288:cHvUrBFrEjwaQZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cPUr+NQZyxknw4FYnshx8OfVe247
TLSH
T1A675F12E22ED18E5E67AA17D89824319F771B4621712D2CF02E0917E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7bde2c61470df1cc1ecd28c126ca453bc4acb0f3c3b4acf71431ead12fce314b
MD5 47448e5401dde5ff4a87fc03aa224b92
SHA1 e4a74565c99520aff95a6892daa6ab0ea344b990
SHA512 773ac354157aa6dcf0760e611a4fbc362ceb0e3a930421423642a8bce7c85b2d2a3df0829e9c68780438d5dd60923eec9140dede75b6f5b4c0aef560100d2ab3
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMx4x8EVep:dG05lO43bNix8EVy
TLSH
T144D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eeb409f108a5b836c7851e7fadb747cafc007cace1d526ba2657986d0f974ebf
MD5 8990f9b44d90326dce8dcc950286cad9
SHA1 3896e0b4cf6b102613d81b341153fa94ada4f8b7
SHA512 a660d4cac2ab35ea3a26d5b3bb666eaf236f2b697a5b26c7cbb8b8ecfa37a61f0ddccca97bccd387bae013197d292c82b3eb68184f3028342310382d5c863cb3
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnfyxknw4FYnshx8OfVe247:Va5POZ3+Jt2pasx2+mEx4x8EVep
TLSH
T19765AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 76602e5378c9ac30760f79842ea3dbda39f7395999c039b37399851b43c0f028
MD5 04b7c507c43f4c3c1fc61ef81257bc78
SHA1 dc4552a22f10d3c8b036825a836c016880f0cd66
SHA512 7028aa654d7466ecd1a7ab449db66f1ed82430a513d2a47120e1df7edbb7613cc93859fe3f31ca7998e661ccbfc6916732ebe0d13bd098d51ca8de251cbdcbfa
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fk9yxknw4FYnshx8OfVe247:tNc/zEOVHFPx4x8EVep
TLSH
T1C7857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 57787994e65144c0e6f2b37707a3a8671baf3b7b0e38fdc5ddfd7c915ff9d649
MD5 7c752549f135f73837c83dd062c2624f
SHA1 90747e396824dfb3c89250f3e427aa5bb7dd0d7d
SHA512 d1ab1fb6c9d8de83e11a016926bbb6e5a89795d54797c691ebe2fa0e3dc82199515c63d6cc7ea56b8a3e762c7a6b7737db55f0768f57c70955545bd5b7c18cf1
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmryxknw4FYnshx8OfVe247:n8MwBtOmOx4x8EVep
TLSH
T15D55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 13910c283fd9119e1cd50ecbd843abb273e0be03e2241ae3398cbc939f6d3f32
MD5 d626916a68f82ddc11aaf14c04b4f769
SHA1 c09643dee231d84364818054def954ab37ce09c4
SHA512 305422ff285c10313be9a06c828e52088923d7f80d4e801c6ff0780a43dfdbae032f93dd495903d07f984fbae26fccc4684cfede9a1eba5184eacf32c970b0ae
SSDEEP 24576:aD3FHshBIYQgAiyxknw4FYnshx8OfVe247:aDVHeBIAAdx4x8EVep
TLSH
T1D485E17DE79C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-285-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/1584-0-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/1584-8-0x0000000002750000-0x00000000027B6000-memory.dmp

Download

memory/1584-66-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/1584-9-0x0000000000506000-0x0000000000507000-memory.dmp

Download

memory/1584-2-0x0000000002750000-0x00000000027B6000-memory.dmp

Download

memory/2280-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2280-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2280-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2280-16-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2280-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2496-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2496-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2496-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2496-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2496-61-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3268-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3268-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3268-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3268-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4060-370-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4060-123-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4060-115-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4060-117-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4144-262-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4144-69-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4144-75-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4144-67-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4280-51-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4280-213-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4280-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4280-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4412-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4412-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4412-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4412-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4412-102-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4780-352-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4780-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4780-374-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4780-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-367-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5416-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5416-103-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5708-80-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/5708-85-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/5708-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5708-336-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5792-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5792-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5792-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5792-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5792-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download