ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
Size 1.5MB
Sample261102-kjc3msty7l
SHA256 ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37
MD5 8616cdeb07ecd1c01a3b4659ff554bfa
SHA1 15dc3113fa3f7db657ea575c176ec5392464708a
SHA512 64ba58d9d64413188183e831cd65b9d78888f6d23a1c5c41ce259c3d8a4ea4db51c969172d2e2df39bf7149b62b225356895630385242ce88239cf87857ccd57
SSDEEP 24576:SBlObd5BO7jZ50WrUCoTkxT7/ovpCGaxDYj6VIGsiY+0AsfJDSsPDYXI0AB9d48M:qlQdfOZNjoTGwUMj8IGSPfJDHPDYY0K6
TLSH
T1B975F01273F84A69F8F36E315C319B2A9A3EFC359D34EA6D1940219E1D39A11D931B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5848	elevation_service.exe
5984	elevation_service.exe
940	maintenanceservice.exe
2468	OSE.EXE
5308	PerceptionSimulationService.exe
4896	perfhost.exe
1588	SensorDataService.exe
3664	ssh-agent.exe
3860	AgentService.exe
6016	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92366f0967fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2028-0-0x0000000000400000-0x0000000000580000-memory.dmp	upx
behavioral2/memory/2028-71-0x0000000000400000-0x0000000000580000-memory.dmp	upx
behavioral2/memory/2028-101-0x0000000000400000-0x0000000000580000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\WriteRestore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\WriteRestore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093d671b2a56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003f043671a56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f913271a56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d1487b2a56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000afdae70a56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093db1071a56add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5848	elevation_service.exe
5848	elevation_service.exe
5848	elevation_service.exe
5848	elevation_service.exe
5848	elevation_service.exe
5848	elevation_service.exe
5848	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2028	ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
Token: SeTakeOwnershipPrivilege	5848	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3860	AgentService.exe
Token: 33	6016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6016	SearchIndexer.exe
Token: SeDebugPrivilege	5848	elevation_service.exe
Token: SeDebugPrivilege	5984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 6088	6016	SearchIndexer.exe	99
PID 6016 wrote to memory of 5056	6016	SearchIndexer.exe	100
PID 6016 wrote to memory of 4648	6016	SearchIndexer.exe	101
PID 6016 wrote to memory of 4436	6016	SearchIndexer.exe	102
PID 6016 wrote to memory of 4928	6016	SearchIndexer.exe	104
PID 6016 wrote to memory of 1100	6016	SearchIndexer.exe	105
PID 6016 wrote to memory of 1124	6016	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe
"C:\Users\Admin\AppData\Local\Temp\ad4789460c70049b679c6818687158ac8ebc4d72f2f99ca67a7152cf3c3f4c37.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2668 2664 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2668 2664 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 34def54d5827a59f7fe4c8a0a44e4de7f2c44df917e480fb11267fada5535580
MD5 3c2071e8e3e02c311e27af475d3434d3
SHA1 26b04a90c908eb4e01b6e3bd3a7ea7f30c146cf3
SHA512 96cae7c0ab957412ac3c3aa353c691a7c540b773b47568b3af04e529abf2fade021850243f20aae7d36ec9093e39eee308446bf2b1c99206151897f1c4a00bd4
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnaDHPDYY0K9y8+fqPyx:s3q6sjBbYLK9XSWyx
TLSH
T111D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 c7bd9df8a61366ac78da5ae6f936fbf08a732eb1b50a83bcc9b90d9162331616
MD5 6df09727de70f5a017fe547589e626f4
SHA1 d317ff0aa47ee3d18e3f41d2347d26028d929575
SHA512 9dec572cbc4d8ba83535c75996621c6ff2d0de318a137cd2a51215dd2ea27b10cfa4ddc8513ed6701411546b6e2d867d0999375d1fc4d02855fa77cd0009feca
SSDEEP 24576:pXYfDtczA/DSsPDYXI0AB9d48+fqPyRT:MtcEDHPDYY0K9y8+fqPyx
TLSH
T1E985F129A3E408F9ED67817DCCA28501EA73B85547A0E7DB03A499750F337C86D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 5c0936697012c618d722b44bde6655e7d0751f61b02fa53bad57ed71fed10447
MD5 50e199ad1d5bca350643435ca723f98e
SHA1 8fd0ed24e1ed1ba7bdd420e251887dcf1bbdf241
SHA512 1d7f2753434b6ad5cf9c2b8f02a337e882503028706be1b60aee518a3caa672fb51cb97755644e9fe652d3e5039883dd20cadfe337fced1c576677d06030db2a
SSDEEP 24576:n0Le5ji0hmxxrM+DSsPDYXI0AB9d48+fqPyRT:nPji0Aj1DHPDYY0K9y8+fqPyx
TLSH
T138A59E56F5748335D073C0B9C5D2A68AED7230865B308ACB4286D77C2F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 35c63f7e09c8b4d20add42ed00fc6c2a35a8e922367722c851fb91f51c457377
MD5 ffb3583851327c39090220eb3b0c0c4d
SHA1 aa104db2c77cd3ac650c716a605438f511639597
SHA512 52b54866e5d855389ae8c8d39e8367866fe0856d80d1a53806a82e0d2f4c22171e8b5847a074f2a0ada7e90940d235d7887a498d71c73cd5c8bd8aa5e62cf240
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyuoDSsPDYXI0AB9d48+fqPyRT:C/ezSC6vUzPveHjyhDHPDYY0K9y8+fqo
TLSH
T1F6755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e74310035adabef83377570fd335f29970cf8a43cec4a051bb045937c080ef5
MD5 47f79ed6148ed25f85b2f37a3e4e34ad
SHA1 d6340ff18114e5f1b1eab7cb0f18481135ce53c6
SHA512 6eda4d17f73e7e7204904d47ef2671598feace52c857e5d41f5770cfcc5bb6dd3a2cf02b0ab8995e494088f486233e48fbd62c1c90797016acaadcfe836f356d
SSDEEP 24576:SVbqPb88hv/l+YLDSsPDYXI0AB9d48+fqPyRT:SVO88hXl+ADHPDYY0K9y8+fqPyx
TLSH
T14F559E66F5B48331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67BD5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 450accf0dbf6364a63371af59e848a3ab41eb2cf58d088dc6e38633e38b046e4
MD5 445dd99bf73a25c931ebda93372a2dcf
SHA1 5ac514cdd2fbb818363f598c77c042ea033e166a
SHA512 72bd3aae80f57e344b7ab8986136325985ee6ca30a994a9c9032375905076b7d8d330018ac50cfdd78e7f58c7487cf76e9d22214490e15b0269977c39092a996
SSDEEP 12288:bLWlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6f:bLiDSsPDYXI0AB9d48+fqPyRT
TLSH
T1977523CBC1ECE4A9F35114B718B276C6CEB2FE5468D0D59B2C4139F9077D680F8A19A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 e86926f5b35e1cec1b9899f8d4bfd0e52d27b5ce940785a5e7f7a8e1db917e90
MD5 fca99fbfc455293a457b7ad4c533c186
SHA1 c2d2022a3342272fedb8da6c70e9e3a02403ac3c
SHA512 1cc93127ef52ad5e60f1f70367802baf63bbfcf5caf5b3d375841e3808005882210a487f4118b574bc3fce3379275f9b5b9b4556f3c35fe958e01406c0a24a29
SSDEEP 12288:4eBNUbTVO86U9lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6q:4JIUzDSsPDYXI0AB9d48+fqPyRT
TLSH
T11995DF7BEE38FCE2C27A8DB95A918740D7B278304F61A3CBD165824E8E235D05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0e20c6fcfd3cded9667fd0dfc3e2b2aa94397fe89d36c09149411f487352234d
MD5 789b97320d19a75a6b1ebe0427f3f2c2
SHA1 cfb32456ca0d3fa8aa77fbcb9fbcb6a5fac11916
SHA512 318951b1b2fe998081edf24410d675048657d6cc7499450975ba820d4861e7ebafb2b462fa52df3fee5a1ab9adca1858e5c96f8fb7e8ec2414b753c741ed8eed
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH+:6QvGAdlCEL8c/DRNw5CYYLK9XSWyx
TLSH
T1D9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 2aa733f4873e07d7425d9c9f6953da150e1b55c321d5a73ecd38f5495e4bd0a0
MD5 c1500a9d51c5190b84f39ab364a9588e
SHA1 c02ac1a2c6a07fbf07b4a84b35f5e6cd475aa14f
SHA512 6f92f64763f66370132b50d73d50163570ee90415b7cbe5b25b33f6abdf3ea26a15c696e314601a0342985ac2ba27f2f7ba8d003cfa83bea1509fd7a90fa5605
SSDEEP 12288:6AwSfxL/2Dc3RDLLmt0LDQewsAjnlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8f:P0ewsAjlDSsPDYXI0AB9d48+fqPyRT
TLSH
T17595E031FA74E036C37B0DB21B36D716587DBA204B911AC3E3A85D9E4A342C16776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0c78f88a99c5dd4c0d9e24ac720c4956a517f326c15e80fed64ab5d0c4557b06
MD5 c25e5666cda5e58382f75472fd7fa36e
SHA1 ab74148cf8a90640d88ee4b916bb232b1bb89f80
SHA512 ed2171a5b8fdfaba852273018a481744444980027e262b38275d3863a48cdf2414343d526aa06327a7183064cb339eacf172c46c878f0d384477d0cd1226d98d
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHBYOBSWyx:zUEtQevvqc2W1cpV2tI32BYOBSW
TLSH
T17E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0ed62c585c94c569a44485981daa2f8bc81545b37bbc7026ef04f7aba7b9bbac
MD5 048ac129401252fb41c0b873bef1121f
SHA1 eea8dbc01cdf7acac5a9a8ed0ed99de40a793f3f
SHA512 e6bc537b667b20a2ffb0b57b5e0ae4d5cf758f8144a24586cabd5cbcc1d9eb55497b02ec69c55efb567b7632f3cfe40f2e734590660add7393e1195675a825ee
SSDEEP 49152:ZCbRquA/m2yL5zLfFiV+XenmE3/zFDHPDYY0K9y8+fqPyx:2oq2Vjnm8YLK9XSWyx
TLSH
T14ED58D0976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266465E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e7a40c71beec82b3de8132aeaea53cae9709de842462f36521b06246fb12a1d5
MD5 7f5e7cc45c47a344cbab5d18810c3c77
SHA1 4811e23fcdab394b62ea6e2db2f36b4c4036fae3
SHA512 b034a513877c12ae764dc3604a2effa750f0db91fc26b3058113e6d20cb6c7a6d4488bf9613da12b6c343297b2df41f66f73932281f59126fd4c32e45e5030d0
SSDEEP 24576:AAhGL3IFoiwtA5l7S530DSsPDYXI0AB9d48+fqPyRT:AAMUFoiq5EDHPDYY0K9y8+fqPyx
TLSH
T12435AD81E7F955D4F5B3AAB899B69171EA76BCAA5E30C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.8MB
SHA256 59c3397984bf59085cc4083cbeea8587f3e15d8a67c365764ce79d7529866eb6
MD5 53847e6c85c3911eaf3e56f208b693a6
SHA1 28dea85512f8721fbff1ef79a9539614b1f2e54a
SHA512 ac6328c2de3ea7b99c3d277d56332d3d25b8d9bbaff9647045a30e62038db6f91a3abb2bad88a86c95216bde1559b4ef8b4be07ffeb8e722901cb55ed0d59e82
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+CYlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2yU:pwu4OW5DSsPDYXI0AB9d48+fqPyRT
TLSH
T1C785F18A72E81CF9E96781398597D136EBF2BC112A20D71F1760C69B5F37350BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 c3027c87cf726a93cfcda6410398c3e4f9287a19b340356932fec2787bd7cad8
MD5 30c703e33eaceb33754578d1e2ee4a11
SHA1 c0dc3cc3a577d7b369e9fa2c2691d4d651e171ec
SHA512 5d1ed450ea1c26ab50e37b141b6834e0cbd84c19d0f047fabbef6a1c29913f8c7f932c6e03a14cbdfd296cce6501836a74d0090aa2efc509b5d114a35b95cf58
SSDEEP 12288:EeZ1Iy3lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6o:9ZumDSsPDYXI0AB9d48+fqPyRT
TLSH
T15E75128B62E870F9E26351798CF15645DBB2B861277083CF185516EA0F77BC0AD39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 53cf43fd5b18ba208062e64b2875899bdcbbb7da7eb746eba366bad7bf6bd32e
MD5 b7c564bfd37f4b0ba2d6505a69059b16
SHA1 7fe986fea31db3522067ee340b299fb03b64d634
SHA512 45ccebfd97cb0d5f6e3812794b4c20c9009ff02030d20f264011b433bb4a3d2e4bad65d9a3701fd33ca0afeab97fd030418cf6937bbeabb9685ac63d0ae2f0f5
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3nYLK9XSWyx:oQyiKa/X+PN3YOBSWyx
TLSH
T181667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2c10adb92edd1e3ca5959990fb6ed3470227d36482cfdba157ee747a6742c9df
MD5 0253f03888440aa23f1907b851e1d1c4
SHA1 f1e28a0286928645470b7bf2c0adbd3498b9111a
SHA512 65dd9187b7bc89b8f2fe170c49b30feda66d2ee52c258a68bf9a6a791e6383aac9c42fef87f2c734620dfb4a2a18202e8229172cd9e02aa6fd7fc94d82ed8270
SSDEEP 98304:VQRQyi36YOcPbLvw2gAf+PN3nYLK9XSWyx:sQyiKa/X+PN3YOBSWyx
TLSH
T118667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0dcbe7a5aeff9359acbf1d3843c4e23cb88957c2ea68bbaaa5b2ee84b58e09f6
MD5 cae7207d303a2ae35d7d5a373fbaa37b
SHA1 4db4bdf6b2f815067f5669904c466e6ba34ae681
SHA512 52dfc17c7398575c2ae7dcef54dfb3624e3ffc6fbda1c7ca82d8897fe7f051c1b6a89c21e0063fa8a698ecdf32965915f2795219e061e6eaa9d3d058bf5452f4
SSDEEP 49152:b68Qg55nhceWu7PNU3/1DHPDYY0K9y8+fqPyx:lthLRc/ZYLK9XSWyx
TLSH
T1C5B55A33B2F600A9C44DE1769F46973196E27C758FE0E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0faef238bb62e34b5e8aeaa0478110380b05de086d79edb77cc7341c9cab64ff
MD5 9221dafac6ede5c6f77950c43de48e97
SHA1 9313e67c4139bf30cf45de4b70f5763d4f5a8bec
SHA512 a083e6ab02145c14e0c4ff27b94c1a5e28a220d780eebbd325d7ac765099d1537abeee5ded9af2bbfbc457a4612297a454c7e3d42aa9b753e124b1a9d23fb486
SSDEEP 98304:Sy5112gYy5azzVvt69nLKnhZeYLK9XSWyx:bLIHEWh0YOBSWyx
TLSH
T1B3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dad92c84757915e8807b72374baeeffab9437238e2ca669d35fd2323b1448ace
MD5 4d21615b29308620871159c5a00bc7bb
SHA1 8f1b939b70fec8331779a465aa61e69cbf8db9ee
SHA512 e4e2ae8edd825cab3a9c6d69bef4d284dc0bc5abc0ad9551295354a3192869f41ff45c70023f7dfc1cb275606936f077db5e80862f284a3b51c7bf6ef72ed52d
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvDHPDYY0K9y8+fqPyx:fu6Jmdxd2d3YLK9XSWyx
TLSH
T17ED59D13F1D901E8D06ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a668774c810e6a251b5fba6c172ec0ddcce71ac0c6ef20b23267469ebe9c13e
MD5 8f9f46b686c5c25f1ada279d501c73a1
SHA1 cc7e1c5326f978fd1976b9a5ea0aa8623285b20d
SHA512 d2cbfa38835f31bfa4699902fe323a7c9bae4ae5cbdbec245cce6066bfcd4e245d615f66e08b5adbf5df1900686625acc61d2bbe05356885c805260f341f7e20
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xTDHPDYY0K9y8+fqPyx:+mifPWR8YLK9XSWyx
TLSH
T1E7B5AD13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b49215a2d4e30962a73b9bdf3a1f6631bde53e7059b69989ed0e111229d2cabb
MD5 6e0dadae4c332de5f8f9e136d9194123
SHA1 0155da4b24b89f41462a4affc3c95e20b00b8b9b
SHA512 b32fc87b37f96cd8210e9891d4046df6c2926a71eb84086a5cec9ab5cc33c8ec256fbb4a80b979e807ca242f6f1f42a016db4f93f3e985dc2876a55115c0e224
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHqmDHPDYY0K9y8+fqPyx:V5dKii616YLK9XSWyx
TLSH
T1F7C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a7a0c540610a0d25f1224aacde105cb3030bb749fd2037d530bca659cbe80f4
MD5 a7398d281f9bb9963ee38fb05c6eabcb
SHA1 aca9a142bd7196e2e7362ed1ff74479b71d88c77
SHA512 44258c91cd0be7c03a4c334535f668128bdb702651ac244d7ebd5313ab3858ec1f9042ce70607392be1df78c2f818adb24db6136f61c1fc3562287b6bff42fbc
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5w3DHPDYY0K9y8+fqPyx:hX2imphwYLK9XSWyx
TLSH
T14795BE13F2D900E8D05ED178C7568632EA72BC150B34A6EF0A90B6561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 be240943ea73ac94fc345c00baf410128ba3b5776474cb6e9e00bf8f83d92773
MD5 02cbdcdc1d8e67615be28e202690228e
SHA1 0e409d4dfefdcc581e7af0c6e3e27c1ad14d22de
SHA512 addd4dde5f48100aee42a17e6bb4d2c2403a21c9e898c8275f261e7ccc3c402774c8bf00329da5256254e6a28066b45d91ed9cff16628ebb6d252d066a763414
SSDEEP 12288:9+lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6g:9qDSsPDYXI0AB9d48+fqPyRT
TLSH
T1227523CBD0E8E5A9F21054F7086272CACEB2BEA579D091DB3C4634F5077DB84B8558E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 2104b8ee553b92e1e1a2ccec8f07616731311e74a856fac879ad4c1fa0dac179
MD5 edc1b681cd388a0309c8a668a1b9dc4b
SHA1 491f0c5d26a8db54295e93bd0f3960ce18ba873c
SHA512 0c1d9f5468eaa500caac1a0bc4eb7daa2a47d816294a8cb8d756c887faab6d6f0ed32c46d43476c0715e24d6c52b7f5604cb4c0d80a42a3c6d6334ed1e78f9d3
SSDEEP 12288:tblDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6g:tZDSsPDYXI0AB9d48+fqPyRT
TLSH
T1497523CBD0F8D4A9F21054B7096272CACEB2BEA579D091EB3C4634E5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7dbc95a169f365e25e3c88313bddc0eeec3a1f905ec14f56545af03ab866deaf
MD5 aaa83762212a13ba548d50472f42c42a
SHA1 c97ee479e73513023e3e1d4e1a77d82909d18934
SHA512 68854040f749c6a3f636b51b1ad63731796b000476979e0b02b4d9c71706fa29bd2de980adb4f8be3a4c879d23ecf045d411d1a7326d95944f2d96f8a4871efc
SSDEEP 12288:kFlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6W:kbDSsPDYXI0AB9d48+fqPyRT
TLSH
T1C57523CBD0FCE4A9F21054B7096262CACEB2BEA579D091DB3C4634E5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.6MB
SHA256 17372db64fa797147a763361b1754e17f28f72a51be77188182af5dbf95e51d8
MD5 b3d0b407db6ee8b4dd3dff04cbf6559c
SHA1 5b5eb672e0e2102d125fdcc9c3a590e8529600c7
SHA512 5ae479119e8f0ac60a07855491b6df0eda2ff40ea0c276a02456258a4dd967ed5763d24b59270ffb896c4d8b05d87d38bf2d790795e644dcbb0f3ca877371495
SSDEEP 12288:ZV4lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6P:ADSsPDYXI0AB9d48+fqPyRT
TLSH
T15975238B91FC90E9E51195B688726285DBF2BDA46B7093DF2C0124E90F797C0FC75EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 eb76d87320f200fedd670ab3c9d80dcd3da897b6e48cbf39a8676c2815aa5aed
MD5 159f983f26b1b1cd2f163082003f973e
SHA1 95fc8c8e105f2d079c8a872b83f80899462ea1af
SHA512 8bacb8e63103ac341a5213edfda3df6805f43cac7690ae764570cddda42299f5fe8aa1c3bff6e132f62ae9e2ce0a74fd505350e757c460b46c68147dca5a81f1
SSDEEP 12288:0QlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6i:0MDSsPDYXI0AB9d48+fqPyRT
TLSH
T1D77523CBD0ECE5A9F21054B7096262CACEB2BEA579D091DB3C4634F5077DB84B865CE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 1eb3706fece0d2de33cce1946223a36136440ff90ae1c2211f4266550aa97b5a
MD5 4667817ad5781eba672a5e7780a09206
SHA1 e8dd229d4e414d49e7059e9de272ae0484ba5685
SHA512 9e8692023ca255d085869331b2d7ef5a39d9ee4bac43b2e35b18fff1dc007bbf3752f41e8e0eba36935b69294a9af383dc94cf0810be2bef2a5bce7b734b3d89
SSDEEP 12288:+PlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6i:+tDSsPDYXI0AB9d48+fqPyRT
TLSH
T1167523CBD0ECD4A9F21054B709A272CACEB2BEA579D091DB3C4634E5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 161df48a63f3a17bb11773f17696da0c595898c84191451bfcf4a9934271bdfd
MD5 3f828baecb4f826e586dc8a2e5068b2c
SHA1 9b7cbedfbd4c8ac072820d419a84f14682c7e0ba
SHA512 d0385d301d862ad9889225df0652cfe3d37c138590975c18d6d4e320d7c99a64faffd9f9f5e5d9ea83e6b15c89ece1113391cff0d9a1de8f459d8a7087f8514f
SSDEEP 12288:GzlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6+:GRDSsPDYXI0AB9d48+fqPyRT
TLSH
T1A67523CBD0E8D4A9F21054B7096272C9CEB2BEA579D092EB3C4634F5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 ecb7701a12f0dd02fe7c88ad412278df9116a15c47b4f0b76781b63ea20567bc
MD5 e222af852f8f1b6f55ef0e8238338957
SHA1 ee444d1b1bb0527ba6116892e8ff2fa0b884c3c2
SHA512 ae2740f5a8dad5cbd7559af4d723ef8215ff6a7dbf826ee8bf2a5f85580a88bf8df71261733b382b1c764d0ac86fe08279fdab08d45da6926593a00d8488e3b2
SSDEEP 24576:UZMRzFVSO5DSsPDYXI0AB9d48+fqPyRT:UZMRzfdDHPDYY0K9y8+fqPyx
TLSH
T1CE950195B3A018F8EC63813ECD619906D6B2BC591BA0C65F17A4366B0F373905C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 1ebb6da8e2184d95314211a11ad1658f66185044a8bc9aff6bee5219cc396e13
MD5 05ab7732d723ea2273bcd2a79f62f3a5
SHA1 1559f0eba7c756f255e75e76558b53067450325e
SHA512 d1ac26931edf63a463aa622fd9903f17d09b331b37d8f6510b24c621031fc0d6fe90f3718d83c15089686765116b61e7944bbd3eef73a7cb46b9e0d0f41f868f
SSDEEP 12288:26lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6D:2WDSsPDYXI0AB9d48+fqPyRT
TLSH
T1C07523CBD0F8E4A9F21054B7096262C9CEB2BEA579D091DB3C4A34F5077DB84B8658E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 043168834ac021b51e3782d4fc403fce3aae0aed427dd0d85a4368e171dd2f5f
MD5 1f9500148cba2815377e9fbe3fae8966
SHA1 dad54c11847863faca434177b7eebf860a602db7
SHA512 110a069236f62c99d66bd8a55fce0157b84bafac6c126d5753f586937086be7aae84f061a79de9b4e0fff3f963f72e5aef65dcbeb85c9eee836226f214ca1fce
SSDEEP 12288:NmlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6B:NSDSsPDYXI0AB9d48+fqPyRT
TLSH
T16E7523CBD0E8D4A9F21054B709A272C9CEB2BFA579D092DB3C4A34E5077DB84B855CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 9ef15f12fb8172fa2cd42e7783c2219cdeff12d29eafcb14aa7d27f6f34543cf
MD5 c434ffc249bb755cb03e0988fa8e5727
SHA1 bc25600363c3dad6bda7b9ca731c3c6b58f0818a
SHA512 d40e3a3e005ef75eef7866437397674809be98783a181f6e5668907c44e170889d1ee5647b3e6ec81050fa916d3473215cc6318c93e7ec670b54540dc5e4ba53
SSDEEP 12288:2yPz5L83lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP60:LzyVDSsPDYXI0AB9d48+fqPyRT
TLSH
T10D851247B2E530FDE136917988A21A42F7B2BC3117608AEF165416B61F377D0AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b1c4a23995a4a45ba0c1303c5da7ca567f5be78f91ee93f8fb6343199385d752
MD5 0eaf2de0d7d80649a24c9fe3b0c8860c
SHA1 2234650047674a122462157ec81d3f93e32e331b
SHA512 376c2dc02027cdaf26679a20bd0b8da06b369086956b8e31fc75b8f14f67961333dc5f2a321d89446d541e31af8ea9c68c42913d6a278c27b1d1fefd9e5804e9
SSDEEP 12288:L6lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6t:LWDSsPDYXI0AB9d48+fqPyRT
TLSH
T1B27523CBD0E8E4A9F21054B7096272CACEB2BEA579D091DB3C4634F5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 6e0acedff70bbcd3dcc7fd840b824c3b86714e6a835c53e2432307f671e3051a
MD5 ed85a1d6e1b9c5ec1f4766306cc83f4a
SHA1 884a7cd236a4f3269d124c5535ca620ca0b4e742
SHA512 a1a9996df35d4ad657b921e136ddaf3e681236bedfff860f25d7a41292233b61fdbc1e08a4d8a485ea7d31fe208222a832199d5d45d9d89a6f6ace1c03fb5ee4
SSDEEP 12288:06lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP63:0WDSsPDYXI0AB9d48+fqPyRT
TLSH
T17B7523CBD0F8E4A9F21054B7096272C9CEB2BEA579D091DB3C4634F5077DB84B8658E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 cde5ed047cdee7f27a099a4b503889ee96b2c1a51b3ef7aac83866108a47078d
MD5 9cc5c789be84a9e968d24d28e8816fc1
SHA1 fb8039dd00fa3871a87a2771e12f731b9a946090
SHA512 60d51fe9ca4f5ef686f82da5cfa203d318fc3db224155b51a4381141ba046f1abdf5e9c56585ea756e2518910b587f4790d68d90fe6628b30b515752d0688495
SSDEEP 12288:PyPz5L83lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6/:izyVDSsPDYXI0AB9d48+fqPyRT
TLSH
T1D4851247B2A530FDD13691798CA21A42F7B2BC311B608AEF165416B61F377D0AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 6804bb536d20d65739e17dd5226f65c9f0519b717c038292950dbbf72734e6e9
MD5 21b1de720021793746ff3ece4a286c1f
SHA1 dea10e9554537b8405ef16c7dd2660d3f1d95757
SHA512 614cd5e539f89d934e58b25e674781158d26e8f7a8545450abeaaa674238e924183fe82d5755e00eecea84cd3104c55cc17a11ca56a2525be1fe71b3ddf42475
SSDEEP 24576:sTDaLl3z0zDrDSsPDYXI0AB9d48+fqPyRT:sTuLljoDHPDYY0K9y8+fqPyx
TLSH
T19A950195B3A058F8EC67813ECC619906D6B27C5A0B70C65F17A436AA0F373905C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 5f617691f9f07ca30c914ab196586526550fcc91bfc1539a566ee045e40e4e45
MD5 988fcd329f9784a634417c82dc062fc0
SHA1 42558c896ddec915720b0fcd9fce67b18feb606a
SHA512 8ca6b21b802fd3876f5fdf1eefeae7c3060c1bd624fb37c9aeae93008c5ba9e85ca70c9a443a85222f2ef3d2e4e937dfe1d6dfab5b432c7dc6740aa5344299d9
SSDEEP 24576:q3vd9CHKy7GZ/DSsPDYXI0AB9d48+fqPyRT:Mvd9CHKyadDHPDYY0K9y8+fqPyx
TLSH
T18CA5CF91F3E810E8F0B39A358D725512DAB67C991B70DA8F03A4255A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 98896f09ce51c50f818d8c16c512006e37fd8f59ede0cd60ceaaa5501b7dd6da
MD5 3de7be7e8d54952e84d301dfcf9f7e31
SHA1 51b48d4a7f48c40a90223572d3ae6ef67040af76
SHA512 4aede209ce31b016ba54affc343144df4f12f8c5873d2db68fe132d9411b680f0f245a296dbf10cfcad834a6a6e571340da72134d7b10b80fb5ee7b751c826e9
SSDEEP 12288:GllDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP61:G7DSsPDYXI0AB9d48+fqPyRT
TLSH
T1107523CBD0ECE4A9F21054B7096262CACEB2BEA579D091DB3C4634F5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 55072220bb417a5cf2f3dec494ddb1dccf5839a198855cec6a55219413bc447f
MD5 8f6f3ba65befe45c0614f65f16e54072
SHA1 b3e1ab86a42dacad811c624adb8c63ca99c44295
SHA512 ef9afd10b24e96af6f74c24c46131efc02efd28fd91561eb3923265df9614dbf29383260a560070a938eda3f17d9a97286bf868109d0f0084287567947005cf9
SSDEEP 12288:uXlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6d:u1DSsPDYXI0AB9d48+fqPyRT
TLSH
T1AD7523CBD0F894B9F21054F718A262C9CEB2BEA579D092DB3C4634E5077DB84F8658E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 4c921d161efebeab8f836e3f642f5385381f461bb4b01c527afb82dcd04755f0
MD5 6ddd2d2c94713fbe01a75a6ff727207b
SHA1 c48ddb31b5be01472dc39ec6e15c65034dd29040
SHA512 0568f80cf0343615ca10f954a9600c8750c2f6abbd2deae816069dc4c6a2a013daf72dd8b5660687099674b46e86f488bfc9db4dd5d18874d6c339f6fc0f26f0
SSDEEP 12288:W0lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6K:WgDSsPDYXI0AB9d48+fqPyRT
TLSH
T12F7523CBD0FCE4A9F21054B7096262CACEB2BEA579D091DB3C4634E5077DB84B865CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 dd0b9751563763f8b6e3009f11494ee340d32dcd092c09a80114ef6d802ed87b
MD5 4d3174709866b6b3470ad06459faefe1
SHA1 9ee910d2b8ee7ebbe49430a445769b94022473d3
SHA512 951176835615fb4bc885bce2edbc18793903503834aabfebec5c07d9333c48eba3f948df4a872d2378b9e27745708e877b0c0e85d4d85ba847380534518f2588
SSDEEP 12288:Y6lDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6a:YWDSsPDYXI0AB9d48+fqPyRT
TLSH
T1FB7523CBD0F8E4A9F21054B7096272C9CEB2BEA579D091DB3C4634F5077DB84B8658E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 1dc294157eaae27ce12b06032d9bb1553278781749dd24e6a8f6cfd58084bf48
MD5 7442ed22056f008a4ab66fa54de41a17
SHA1 41f1487e21a1c63246ef61642f8d4fa263902a9a
SHA512 7b2c140ba682401dd27ba176773662b70721c85a58edb205054a1593e31f0a8f78efe3b5b26c5264923d3a851f2caf30267e42debc9190c0360449cb8ac109c2
SSDEEP 12288:yllDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6+:y7DSsPDYXI0AB9d48+fqPyRT
TLSH
T1AB7523CBD0F8E4A9F21054B7096262CACEB2BEA579D091DB3C4634F5077DB84B865DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 5eebb558843fa61451921aa07afced057c009675af031151ab58543e4fd46151
MD5 d842967279d383d1b7698748acf4c549
SHA1 070ef23ea606f67d1d9e13ea6e11b139d2f4f8ba
SHA512 c873823276d0fd8e7cb0585dab193f4653404d3a057c4a6db43d6345460b659f3e9c491dfb1456ebb47048aa813a45c7f1fff4ac97f70f17c5a6313f9a5ab8de
SSDEEP 12288:XSlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6i:XODSsPDYXI0AB9d48+fqPyRT
TLSH
T1D87523CBD0F8D4ADF21054F709A262CACEB2BEA579D092DB3C4634E5077DB84B855CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 914874c278486744a8ed1d743943f88487d150addc30ef4ed33e88f8ed174027
MD5 a90e61ef3e8f8d733a7eb51d059b701f
SHA1 f05c195c03032048fc584189a67558415421521a
SHA512 26ae0f06c4bd1fbdb40908c01a59c24f50f4e312754abec88181c8be6369c5b2447f40fc887efb3910c0f7c192a2ea6a12d867bad11e0c93d4e68745853cbc5a
SSDEEP 12288:rQlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6l:rMDSsPDYXI0AB9d48+fqPyRT
TLSH
T1347523CBD0ECE4A9F21054B7096262CACEB2BEA579D091DB3C4634F5077DB84B865DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 1d98779dfd949ad6dcbf58e82546387ab9d222cca9e66c3b15fc31de3afe0be2
MD5 7dcc997dcdcb9cc57e4ced9d2ca6c9ef
SHA1 f766c55a568337ac211c22ec049ffc8c178e5ceb
SHA512 b42c7dc215a4ba09e1fcbd4e63c83d001f5640226372583bb4c171f3f009ca9ea0a80f2c4df070838bb9788d8c7c8ad798c479ea281952d1e757743e26ea1d2d
SSDEEP 12288:cNlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6U:cjDSsPDYXI0AB9d48+fqPyRT
TLSH
T1637523CBD0F8D4ADF21054F709A262CACEB2BEA579D092DB3C4634E5077DB84B855CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 0c9bde5b057b35780ac0079b1b2fa9c41a9fc9d34fc41ed72c490b3a0232bae9
MD5 ec99cf86b40765729c4f3dac77a75bea
SHA1 d6ea8c65f40d92c904ec1fedc68fe18ea21ea694
SHA512 4a5b1cc572bb77e4ed10ffc3eafc780b5913b8c872b6b37a5b077a1f743903cc9b082d4872df92dbbfe60c075a94708092d2d17281fff54fc1dd74e4015961b0
SSDEEP 24576:tfwvUk9RX6wkyAICDSsPDYXI0AB9d48+fqPyRT:/MnYICDHPDYY0K9y8+fqPyx
TLSH
T16AA5D029EBDC44E5E177913C89B3460AF6B178691B31C2CF129A53AD0E37ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 381d0138958d54eedeaada5792ecf85e949e11d4df3b14e54310b79a412e33b9
MD5 71c4751d26746527c1aa64ccf4e01627
SHA1 2ca5e9beb111b8a04b6998a6a0a7238875b5f1e4
SHA512 28a4850be3b2e652a8158604f52843a2afd4867500ca09e6616390d4337f3313c2cf8d1e5da6f2483a6d90757932b996cb25278a6f2f1b085e4304a015a78267
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XDHPDYY0K9y8M:tySzPHYLK9XSWyx
TLSH
T106066C96A1A801D5C1B9C1B98F17CC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c5c0f68fb61f4f00b48e3480153eca54a98426f7377ad30d9817e1df1761ca74
MD5 49d7d9f222a5c7e209e754e660375125
SHA1 428c879ec842302c44e1afcdc4b614b80a294f68
SHA512 4af4dbe4177e323e08002d919e0df0c9253055970980d50e69fa980caae479bb5d482d66230b2a984f43fd39749eb5371a85e5ed367a2ebd4d4097e46d897e0c
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYpDSsPDYXI0AB9d48+fqPyRT:H47JUQjTirIhCnDHUPfF/HDHPDYY0K98
TLSH
T14465AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 ab2e3cb46a29bae2fc969f6de4957be8a722fedac15332cc22dc694f4d10e67c
MD5 2a5f3ce686acd439aae1c7732948a028
SHA1 c91f4921074f8b5b233228e3f77ddf2161382e64
SHA512 ce53c202db35dea53080232235da601df962c9841f74f57b70b667e13ea066136df055a0ebd41f4b37037fc59fa8fdb2e1842fe462b7cfe6a5c3f94511368efc
SSDEEP 12288:cbsfqlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6s:TmDSsPDYXI0AB9d48+fqPyRT
TLSH
T16085014AD29841E8D06E6176CB525641F7737C2497E0D3CB26C0F4BE0F7A680ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6d5ac981a978c1c546f1ba0a442b57778f4d3827eab27c06c840050dd319442f
MD5 0923112e9c656c0b2591f85db8a3a7fe
SHA1 b6102db386c0599f34833851f61e3df623f00425
SHA512 a162924351eb2a7b5c6a929f5bef2743a9f7875b8e14de7f5d157ec2a130445f9c4a7632c096c9d69fdf2542f865257036c12cbabe776ff3261e32d262732129
SSDEEP 12288:LYPiphU3fzzO6Mjn/kBIAC/apiMUy1rzWmeQ0I2n:LYK/UPtMjn/kBIAC/3UZzn/0X
TLSH
T12B3539117626CB4FC6A940325E33D2CCAB707D45EE05AB0372C98B3FD576658BAF1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aa56ca4ceb5c1eaebe0b4c617fbbbc86439200d1d0a402cd37d29bdc448de689
MD5 b63bd90b4354e77f26a67cf49e2df74c
SHA1 03c576e15f945561c45065485cc486e4fb4beb91
SHA512 d200bbc61add67f9a829797b344fc692d9651a5f28a6dafb83b519e175e0cf4817208dd0392195e8553d48c926ae8d5c422a957a7c2a8c2223e44ee11d3e1506
SSDEEP 24576:jq/e6zh8jY/kBIACzn5wvcEp4UiX2IaJbPe42aZxU+GS/:jq/e6h7/kBIACzn5wvcEp4UiX2IaJbPR
TLSH
T1986509409536E78FD1B76032072A5F4CABA4EC07B7056F26B3D9453ED826B16B0B93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.6MB
SHA256 89410a4584be172ff3e55199b4c382258d8818a8670dcd556dfbb394b9f02581
MD5 8fd5b3c4f8b6616f1eb75f4e9dc23ae6
SHA1 5826a5c74dfb029d244aa23d74b9fc01b61f09a9
SHA512 e421825d25bb3538871b55f64ac6c0db6df04bc48c350b9d558160e447571d418766b506ce05ca6161440df68de9e13858156a7332ab0e91fa3d98675e94cea6
SSDEEP 12288:3F7mlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6R:NSDSsPDYXI0AB9d48+fqPyRT
TLSH
T19E7523C7C2ECE869F13024B6086262559E76BE646F90D1DB3C0535E9077DBC0FCB1AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f8f26310ac4613b314b6ea50c0d0975ee2418c92dc519e5030f3f274e9da4657
MD5 b0ec7da835392ba8ed45621daa7e4602
SHA1 825c9f622c659e06c07558adb51e6e884f71b14e
SHA512 5736c2478b972ba51706a81686898e41409c47ec32e39c2bca007934efd68961cb1c10741e9d80981d6ac7085daf488b998a11da43f0c13daaaddc566a780bc0
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYoDSsPDYXI0AB9d48+fqPyRT:Kgb4mBIBhGFpDHPDYY0K9y8+fqPyx
TLSH
T17065AE1E22EC02F5E0FAE2B88DA64417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.1MB
SHA256 78c86c63f0339351c550159fe9cf70806f7f7429d2ad5daa92c6845f3c250b74
MD5 456178e576c326058b24ec28dfaca2f2
SHA1 082b790aaff913e0b3cbd9d9d75b1f6d77f69ae7
SHA512 6abba41261e60c8f176724fd2cd0a749d5192080919c29f4c138d4d7f156814bf8e589e04aa12b6177f3f6f1311bfe6574263880a40fa39cbf6c1672a86d243b
SSDEEP 24576:kG88u8FpJqH1bzria7/m5DSsPDYXI0AB9d48+fqPyRT:X7ZFPqVea7/ADHPDYY0K9y8+fqPyx
TLSH
T1BAA5F156B2E401F4D477D13889824663F6B2B8251364EBDF0AA88B950F33BD45B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.8MB
SHA256 435a9ef966cb2f8846015da4fa37c3d02b8652424ea0d35bb48c25c41481094e
MD5 5dfa3c98abfd3fb0816bfdff15b21d27
SHA1 25e81eca436db5d4d85ac546cbddf1a7ce587c15
SHA512 96a3afd48796cc2397e8091e1ceac37ec865d2c3853d4421413c450a38972cc63d71c891a51dd45b4184bd11e2743b61136d3e0387b611a387999753f87ddb1f
SSDEEP 12288:KHvUrBFrEjwaQPlDSzQ6Ea34xOGYXI+Vd+Ma9d48+PvaqtqP8Hll2ytNP6E:KPUr+NQtDSsPDYXI0AB9d48+fqPyRT
TLSH
T16885E15F62EC18E5E676A17D89828709E772B8621751D2CF02D1817E0F77ED8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c8eef12f544a6fd5ddd7d94d9a9a098b613e6969b2c1220511666e89987cb65a
MD5 728f8cd0ead805b783dc78ff395144d0
SHA1 76a45319a9ebe85f251285ae32225b696d14d9ec
SHA512 747d81ccd1ab3a35108f67da59cc581f1e0f2aa7db7aa29b8560cac6ac00ab36f7bdbc338148b41134b7ffa091edefcc14570aaf4fecdacfc0b8c19d5ca551b6
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdDHPDYY0K9y8+fqPg:1G05lO43b6YLK9XSWyx
TLSH
T19CD5BF6E62EC11F9D1BBD17CD9C6460BEBB23815032456CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0090df6669a12bad067f543cdc9258b7e2e81e3c8c4da3efd614cf913d180bed
MD5 aabf8a2b81dfa694070fdd3a483d6380
SHA1 89243a776b34ff794e7e7b6945791c9087ac74c5
SHA512 9f063f82027c25734d3a059129aa5518ceddb9940775a3e90e2f22145e017e9ad76c9b79b03249bfabc8087967d4c4268c6ff27c03ac68e237bf9306d3b2dbeb
SSDEEP 24576:ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXDSsPDYXI0AB9d48+fqPyRT:Qa5POZ3BJt2pasx2+m1DHPDYY0K9y8+3
TLSH
T13B65BF5EA2FC01D5E1B9D17DC583861AE5B2342553319BCF112182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f98d00f99376ce531358c14f9f2d7655afb5470f5c5723daf89dff1b34286bda
MD5 5baf00db469c6899504f41808d16af6c
SHA1 c828bb63f882d605b4ae4debc0d667d7fed72a08
SHA512 f51e675e413582109b6a8cc24624927cfc2779b4511503c7598aa33d9465acf94aff191ae4be9c6203288384f746e40c008854ed87ac327132b0dfb1a461d081
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkhDSsPDYXI0AB9d48+fqPyRT:BNc/zEOVHFgDHPDYY0K9y8+fqPyx
TLSH
T171857B5622E901E4F1BBE1BE89779546FAB17865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bc4ebd3c1fcbb907931c814dce2141f1eac14656307e104a36eb5b4fac56427f
MD5 d7523542f7e0eec85d8654bc5edcf18b
SHA1 d75515b6720613109b35523c8d73250f97dba51d
SHA512 3005c753a516348d3df1dd06c05f1c008080b025f767105a59c3e309b950df568f3a97551e839b834b19853d8bac161cddf25e13e82f9505862e404de8280498
SSDEEP 24576:mTkNvNnaFeYhJNtmZBmzDSsPDYXI0AB9d48+fqPyRT:mTMwBtOmzDHPDYY0K9y8+fqPyx
TLSH
T16C55AF6EB6F846E4D1FEC6B58D238512EA727861073293CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 b7479e8f983829bcb0137deeccc2bf828a75b740dbe5016b1d01c7bb8e567d4c
MD5 7d70382d97f50fe1f5678b3a86e6df87
SHA1 9e2aa255b8dc72941926da84a8e6acae174cbac2
SHA512 4f1b656d48b61ae5643be377aa89061d397ff1ec849b7ce81f6d83ab9d227e465cb77aab20f8c71afbc65c1d83a6b621a9648459d271e148c52835cfded4d12e
SSDEEP 24576:MD3FHshBIYQgAKDSsPDYXI0AB9d48+fqPyRT:MDVHeBIAAKDHPDYY0K9y8+fqPyx
TLSH
T1F895E17EE69C04E4E57AD1BCCA638606E77138A8032166CB05D481BA1F7BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/940-58-0x0000000140000000-0x00000001402C8000-memory.dmp

Download

memory/940-45-0x0000000140000000-0x00000001402C8000-memory.dmp

Download

memory/940-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/940-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1588-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1588-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1588-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1588-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1588-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1588-319-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2028-101-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2028-71-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2028-0-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2028-8-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/2028-14-0x0000000002CB0000-0x0000000002D35000-memory.dmp

Download

memory/2028-9-0x0000000002CB0000-0x0000000002D35000-memory.dmp

Download

memory/2028-1-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/2468-301-0x0000000140000000-0x00000001402C2000-memory.dmp

Download

memory/2468-60-0x0000000140000000-0x00000001402C2000-memory.dmp

Download

memory/2468-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2468-67-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3664-122-0x0000000140000000-0x0000000140331000-memory.dmp

Download

memory/3664-318-0x0000000140000000-0x0000000140331000-memory.dmp

Download

memory/3664-129-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3664-123-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3860-134-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3860-142-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3860-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3860-140-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3860-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4896-88-0x0000000000AD0000-0x0000000000B36000-memory.dmp

Download

memory/4896-316-0x0000000000400000-0x000000000068A000-memory.dmp

Download

memory/4896-93-0x0000000000400000-0x000000000068A000-memory.dmp

Download

memory/4896-94-0x0000000000AD0000-0x0000000000B36000-memory.dmp

Download

memory/5308-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5308-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5308-72-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5308-315-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5848-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5848-28-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5848-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5848-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5848-27-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5984-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5984-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5984-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5984-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6016-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6016-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6016-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6016-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download