707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
Size 8.6MB
Sample260807-kknkrs1bme
SHA256 707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9
MD5 49755f7bdf487cfe87ccc01ea4ed49d1
SHA1 b11a16b0c9169c9c4f38d20337d4dca4c0a939b7
SHA512 038732bc9917a0babd3fa9ef85b712dbf1bf371bd305e40dedc9c12f03c9ea48b721852019666a3a38fb0ed1a2b4f87a9e2e9db1479385c23f16eff7ccac5324
SSDEEP 196608:7ClFEjT/SLQp+CGIulFk556hSaWzKu1Q8:7ClFS3+CGIV5AV81Q
TLSH
T10896232162AA412BFCB2127078747652057DFEB18BF164CB326CB45AA73E5C07E64B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
6092	elevation_service.exe
4460	elevation_service.exe
400	ESETOnlineScannerBTS.exe
624	maintenanceservice.exe
480	OSE.EXE
5768	PerceptionSimulationService.exe
2720	perfhost.exe
4780	ReFsDedupSvc.exe
1732	SensorDataService.exe
2060	ssh-agent.exe
2740	AgentService.exe
4328	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ebb545b2238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ESETOnlineScannerBTS.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3260f594826dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c94917594826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003ef619a4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c54a77584826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6135c564826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034b3ef5a4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
4460	elevation_service.exe
4460	elevation_service.exe
4460	elevation_service.exe
4460	elevation_service.exe
4460	elevation_service.exe
4460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5368	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
Token: SeTakeOwnershipPrivilege	6092	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2740	AgentService.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: 33	4328	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4328	SearchIndexer.exe
Token: SeDebugPrivilege	6092	elevation_service.exe
Token: SeDebugPrivilege	4460	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 400	5368	707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe	91
PID 4328 wrote to memory of 3716	4328	SearchIndexer.exe	101
PID 4328 wrote to memory of 5164	4328	SearchIndexer.exe	102
PID 4328 wrote to memory of 4464	4328	SearchIndexer.exe	103
PID 4328 wrote to memory of 900	4328	SearchIndexer.exe	104
PID 4328 wrote to memory of 4428	4328	SearchIndexer.exe	108
PID 4328 wrote to memory of 1232	4328	SearchIndexer.exe	109
PID 4328 wrote to memory of 5472	4328	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe
"C:\Users\Admin\AppData\Local\Temp\707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe
  "C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe" --bts-container 5368 "C:\Users\Admin\AppData\Local\Temp\707face59f2465a17dcfaa2943327996c7b4c8c722b9c6f54674f58a996365d9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:624

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5b45effd6e5c8ae65b27169ddf474e1a86c066a7f64a66547b9cbfaa2214b9a8
MD5 2bd84267e3a8b4c0e78b76beefd0bbb4
SHA1 17ccc4954af6cfef9471780ef24c55ae1444ca15
SHA512 ab4156f4120c091cbd62e250dbd584b094f857d4a83574cbf889a3e3251909208d987618c0080e8dde41779322457d6a95ee4136f0873446ab80d24bcd7614af
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnM6SR1ZWzY7m:13q6mjB3p1ZWzY7m
TLSH
T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 5de9e04494eacf4cc62a3cfd2ceb3bf2d841b332292265399b784af975f1f105
MD5 73c9266eeb0cfc5aa1f9e66ca8b09c04
SHA1 acc492a3dd5df08ef2fbb0326a9bf05b4e7308be
SHA512 337d7caec48db14aa71b75b5415e1857c91147c41f01700c02b424c7fa50e63a133238662dc4d057db1d84125551e30aac58267f2fd190142e59a5906cb8deaf
SSDEEP 24576:NXYfDtczAr6lfdxQjRX1Z5YrEoY7zOL9:Ytc26SR1ZWzY7m
TLSH
T1C405F12877D509F9EC67823CC8A2C111EA33B8554760E79F03A4996A1F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7793da276ee647ac054cb429985b4b4256004e94a326e5063850b29f9a33c917
MD5 51a1c590d6c31470066c3a44b56a1c23
SHA1 2b0a1938fbefe665e10da09fde9df7893326f636
SHA512 5f6098e4943d9b259c3ea6b7e03e0fd83cb3b85a97bb3f5a5ee0ade0ebe08dba7e216d8c8ab6e15389a6005d47f90ca3dd094baa0eb4383ed6d7dcad7e94359e
SSDEEP 24576:I0Le5ji0hmxhrMk6lfdxQjRX1Z5YrEoY7zOL9:IPji0AzF6SR1ZWzY7m
TLSH
T11F359E26F6784331D073C0B9C5D2A69AED71308657308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 55a6ee17dca9bb3edfe8cce89afdaa1dfc4c7cf874112d363a5de668f922aa57
MD5 26f0536503267daf6f56d36ac25fec0d
SHA1 d80426cbf827e8459b09303da3ff8351ff5ae46d
SHA512 4e3c9181b2f74efcd0d6e0dd8be61e81cb8b6ad600a7905f377ca66913b41789f871a950d836d152485f3a65189ec69634e8914862629006d5404ecb6810bac7
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWj6q8wyuW6lfdxQjRX1Z5YrEoY7zOL9:0/ezSC6vUzPv+Hjy56SR1ZWzY7m
TLSH
T1E8755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 219cf67cfa36aa190a37266871aa3bf8f273b3e9f586f04cdec79924d42c3cfa
MD5 e34093dd06f21a2abbca48a12e912336
SHA1 f8f717e3a6d3944dcfa73479ebd66a12507985f3
SHA512 3546108a0438ffededb1abfe1bedb0365c6aa69a0ff3da6e4ed752aede452b8339c74eafe368ccbfb1f87bdebf7e52c0f51d090efea28b4bf87899e016b9ba9f
SSDEEP 24576:+VbqPb88hv/l+Bz6lfdxQjRX1Z5YrEoY7zOL9:+VO88hXl+l6SR1ZWzY7m
TLSH
T118559E66F5B48331D073C0BAC5D2A69AEE3234425B31CACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e2e815e19b1f593a66bff75bb84cd81bd522d6af9e66ace695b3b14daaba2fe6
MD5 a58dca125fdb874df7b4197abfb0e6eb
SHA1 8290fa98fcd4ba206783de4a1488eec1e9803597
SHA512 3c7f83503117a0318c27534d4d0829f29d23ff10dc46156b0cf92a4f54ddcfd4a0a302abbdf88dc3b56df8188bb51667662ee5876b196089f11370b962f12cda
SSDEEP 12288:+GQ6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9y:+GQ6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T117C423212BCD11B7FDB7E738F93CC2E59E2DAC0C9428C11D8011B5AE5AB0AD9DA4D653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 350d0ea7387702b7fc949e6abad3dbb542cfcb5dda6b67c11dbaeee1e393f628
MD5 5dc75434c09a0efb1fc877d09f8e7f4a
SHA1 6a01b361f9b687a8ad1c03189763945c275740b4
SHA512 8b9141e73c184c60aafa3ebd224edca4c584b65456f3ce857df800bd85e889f2b7230cc997d662167b06024555b42b3bf71dd269c3418bc32ba40482fcbd198b
SSDEEP 12288:GeBNUbTVO86U76loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9F:GJIU76lfdxQjRX1Z5YrEoY7zOL9
TLSH
T16F05CF3BAE28BCE2C67A9DB85A51C340E77278304B2193CBD165C30EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 644f73b7e1703b5ae9375c882ea04cda4eea209f1e29327ee29b78c1cd14a4d0
MD5 8450130c6ff289b802d3bc0f0e45d7e8
SHA1 30d5c16a25e0566c45ac6bec2b63d94e9927367a
SHA512 5f5b1bb7a036539cfe0ed83408c82ad8abc5be98ab49584781147e29d11b50b15db88738b3cdd1b8796e02e4d0abd8c12bd5efe729b4ba828d0052f76a04c7fc
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:iQvGAdlCEL8c/WRNw5Cmp1ZWzY7m
TLSH
T16E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 74a19e14184b2506d1322c85933c8e38d96908be7ccad75b5a3189462ca0ff36
MD5 ea6086b40f2a862e98348b3d24987828
SHA1 2b1cc29c9ef537e261236cd677e1d5f41e96142e
SHA512 1b4f3326dd5ba92da02ee3ca6f10b695902deffdb2f6424d31120b69c79d31dab0bd5eae449501368f00dd6dc04d1073a969aa2b221c8b6ca7c7d57480005a4c
SSDEEP 12288:5AwSfxL/2Dc3mDLLmt0LDQewsAjV6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOLQ:qfewsAjV6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1DB15E031FE74E036C6BB0DB62B35C316583DB9204B6119C3E3A89E9E59702D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 52d3af71d6299bd6ac4579cf9a4c83cde7accc211206e99b5431080610a00006
MD5 a4b291c0cd4c10320ecbbb7d577ef281
SHA1 6b12c3e7e8c57970f6edd82f03f45d853a38ad07
SHA512 e21c71b8b46e195e9480c73956669151f9071ed71cfaa089b41de4bb4b66dc88fccd66f392838b1a051d2f272ccb6a09187a7a4938df4cc111193e3dbb8cf559
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHK8:+UEtQevvqc2W1cpV20I32K
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 13eafaee0621dcb3dd229c2da08ff61fa5e860358155c98dc6a242e0c988f122
MD5 e4928581a163abcdb621b591a2d3149b
SHA1 49a2e4ed70f50a06dc6b092f81f1efaf4de015cf
SHA512 495b0d4ac70b7c14bc0604807a1284e2e72443d27a0a84bdea9147d0c762978383a35f4e07378cc051bb1778dbc54616c858618610915b32cdf297f3766534cf
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/z16SR1ZWzY7m:poquVjnmqp1ZWzY7m
TLSH
T1C1D58D0976B882E4D1F6C77896A2C647F37178154B3097EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 01c4076b5f67063da6e16d9352e86720694dc8157a2d98a5072295afbe760abd
MD5 33d49783c8f2fad145291737d7404052
SHA1 fb8e73b140f6220787817c49abec3f4a364380d9
SHA512 42aa074953a062128b76caf1bc951c7a9d174a22a000e9c7a3fa9fe8d241192378cdfc8487d8ffd586ae69e4483542c22eddaa514fc2a3aedc89504529fbd328
SSDEEP 24576:IAhGL6IFoiwtA5l7S53K6lfdxQjRX1Z5YrEoY7zOL9:IAM5Foiq566SR1ZWzY7m
TLSH
T102359D81EBF915D4F5B3AA78A9B68171EA76BCA95E31C20F1150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c670a69593bae381b81655c03fe8da74d977af86a971dad8ac6d14f8d6fad8e8
MD5 7e2dee3426b006b3de5ebbac4799487d
SHA1 f363853634efddebd492d355a6eeec419ab39e82
SHA512 d20ca253fd18232633ba58070e76e1df80547915fffa842be43ac2a1c47511adb5c99ef04c25748baae412b7bf867ea49af937914a15b8a145ed628e0d0af987
SSDEEP 12288:Nmw5HEjsChNEBFgl0WDm+C26loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9x:owuROWZ6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T17D05E04637E91CF9E9A79238C557C136EBB2BC052A25C71F4360C65B6F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 adb17dfdc0cc17e8bcfae0663307fab4d96cd00ca96956f669a7035f08ddb26e
MD5 7ea4b0989e61223ccc091ae13c55718b
SHA1 7007441f7a744a2aab808749dba16c9cf9f15402
SHA512 8016cafb4e13ddf2fed9baf1c0da926d9319cf906e8dfc1a93e4ffa2658e833fc74ab5288167dcda1d301fa4be1b570cffe1e3a362e2cedcc0a42876cb04b7c4
SSDEEP 12288:LyZ1Iyl6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9F:GZus6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T102E4121637D821F6E9B3923CE8B58245EB32781A633583CF412152AA1F72FD55E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5035209529d96f4f3cd3d62e7e59374e03e55d8dd71eab2a7f3fa04a1b888722
MD5 fdd53615ad52bf34443b10b7e48b9fa8
SHA1 61cac9a1b5807021c8535716a37e8db11329801f
SHA512 8091da62700db10abf25e7807af96b60a6c8db55f5c418ed89458ac8783988205e075c4455dc6c56f79e57d7004201700c909672eef0a122154727ab6e4d4e0d
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3fp1ZWzY7m:9QyiKanX+PNM8
TLSH
T1F0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d1fbb1e257414c478029b30f5d099ae9c8659b18e00394c5d69ffcfeb2e58d15
MD5 57f0941d9f6ab333497d8ae51bb9ae7d
SHA1 f49d4973d789fa1b086157cd92e733c15ddbe451
SHA512 5fe6734ae642980e6c9b255280f8047db4b3c363b07bbd425b4df441651be4423c19a3770511645e7108d313c4dfd362a05cae0cf078e2de530e5005ba79f9fa
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3fp1ZWzY7m:kQyiKanX+PNM8
TLSH
T1D2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4fe2691072693d9ae60041ba696949db6a4b14442f3f17c868a60b1fe79d6278
MD5 f1b4f3fe28d1f98315eda7b59b28044d
SHA1 1ecb2aac87d86d23012e93f3dda1099860c2eaf0
SHA512 61c00b4af79170635bc68069cecfa2c67e8a4ec23132f5d7056f529abc8c2f777060f3db037f4ba910c644d97ddd4435d9bf39c51541743e68b52c53c70467dd
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0c6lfdxQjRX1Z5YR:168Qg55nhkeWu7PNU3/F6SR1ZWzY7m
TLSH
T142B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 53a909736a053734939779d6e0bfb3a4d5a4ca4d6a11d3483439e2ddb5a8c23e
MD5 eba28fdcc8a21f10dd2f459f9fd8f184
SHA1 8bc979cedb4c39674807978d84ca6c63877dbc74
SHA512 5f6028acd26cc34e2c09e1155595973db8b551a0c94a82befae7df0a47116e3a4e7077b1e5c847936d3f1e50744ece2ed98748b408c93f1292bd7c8f303fa2e6
SSDEEP 98304:qy5112gYy5azzVvU69nLKnhZQp1ZWzY7m:TLIHRWhz8
TLSH
T160167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 91a2611138892a18bcc7bf32a0a6dcda0179df39e81ac57919da7dba39f6df51
MD5 8878d2e46685ff91985a97c58c88057f
SHA1 4e1dd6b4c1ea2f5d950b66ade05ca7067dea4d7a
SHA512 7303fbcbb9a0749abc295197b61db600f2a308a8cff54dd8076193b300aee4be369c68fad121f28bbc695eb509960d0ee2d0717154bdb6f7b65a4c15654feec6
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glb6SR1ZWzY7m:Mu6JmIxd2dbp1ZWzY7m
TLSH
T19CD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cb2ee311ed51a5603107e1bc2eadddfc8018ac19551d10dbde914f8942264020
MD5 2ea6f02db5c59e6ca9e54a8c7e313fb6
SHA1 c1c68f7ea2f3cac21b1fe4ba60b5bad115c6dc08
SHA512 4c2de9733045be65fcf71b34b9986485fc93ca0f53e29d1f780f035c5515230101b45c00deade335dd629a533dc91eeb812508570581cb233a884d742a45183b
SSDEEP 49152:01hpsNoJpF1A67U44CwH7R4xb6SR1ZWzY7m:0mifPqRqp1ZWzY7m
TLSH
T1E2B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7c3c973c0dc534c3b5b0ab473f7a0e4cd5d20b0aa069b9a5a1bc60d4a580eb95
MD5 1956f1ebf322553002745e1cbc0ec7a1
SHA1 90549df93d64edcd000fc539c5a2b03ea6d05dd2
SHA512 1385c1a6ad9894a397999ab8b05d46a7b74282d23ba199f559653a8e6b5431c35beb2ef7e088624c69e25b299fd4f37d6a56ca700d14d02e1fa4727d044c5e6d
SSDEEP 49152:hSuZQIY0Be2KkRVtOnks6NMHqs6SR1ZWzY7m:v5dKqi61sp1ZWzY7m
TLSH
T1EAC5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7be4ecd1b777aa8b7852d48513d83db726b1219f67236a9843a46f1c1393602f
MD5 e2d28f57614c4209f74a3f39d93a24cb
SHA1 ae70b8782a63e875541b95325bf55cc01b7952dd
SHA512 f9acbebcde791bff48cbf0ddf6bf2f4ea3385d457e828e5cd731e29f2cd3b3dcf3ee8641218c6cb05209df668622b3a62db2fc11274c4da5a4f4e8a6a1d15e8e
SSDEEP 49152:khtSn8EApI0figjgiDn0AP5wX6SR1ZWzY7m:lX2iWph+p1ZWzY7m
TLSH
T12995BE13F2D900E8D06ED178C7568632EA62BC150B39A6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 272ee95eb4c1ebdc5f7460fa1b6378c167c25379a3c560e6345a30ab9443ee36
MD5 b5cdb3b1db1ca5a7733ff780fa66b413
SHA1 0c8a05fd2bc2632d08fafc053da2496e2844ce40
SHA512 5708b9ea55c10bb494c16c46e3153ebd27ed251c080c8c83a7c0eee17bcb1c4b7e194cd92495162cf46bafda16c27d8d3c031adb27f8fea22e210f4df1bdd79b
SSDEEP 12288:XY6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9V:XY6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T17CC423212BCE02B7FC73D778F938C3E5DE2C6C0DB529812D8112B16A5BB0BD95A4C956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b93a3ebe620cd57e4fe7d7c3ff703e0cb7fabb776b0586570c5eb1f8f3c450bd
MD5 6b74e0d0515b4815a1335259b2d87b6d
SHA1 3ff540003c105d6aa5beeb5a9d4c2771a9a04438
SHA512 d10375703a933dea5aff5f4e8360f8516379dbe9ab8a26aa306bddc113cc5a0c3210e1a3186e6967c9851e6a6d95d214be3bfa8b828f9075d0ebd2a0067eb72a
SSDEEP 12288:3R6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL99:3R6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1F0C423213BCE06B7FC73D778F928C3E5DE2C6C0DB529812D8011B16A9BB0BD95A4C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 32b8e252dc94ccbdb782d504363e119796b829954a3d9accdf0a39768d33d981
MD5 07eb3a7a84bbba40f4657bac39fdc352
SHA1 24beec2c39fcb4359364b0e4a1ab51ad0373a935
SHA512 d88110e4d2703bc3a11c0e35813d97f6dce6312c27e35c242b05b346fbdf48fbbeb2459ac06bbb5e3f878eba2385abec58109ff6712691d9dc877d1f52ede950
SSDEEP 12288:kj6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL99:kj6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1B8C423212BCE16B7FC73D778F928C3E5DE2C6C0DB529812DC012B16A5BB0BD95A4C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ad020646e5a05ce5f593814dee474fe37d9f2d589d370728c4bc40ccb0e4aa6b
MD5 3a542464081d3bd30f5d7829221aa200
SHA1 97dad38bd1d2497c58a2112bd11f019ab6053771
SHA512 c614b6629647a6fa0498785d0a8f130dd0c6f661bd065fd740611548dc619f65acead1156f171abdbb5ad4e2ee48775a5e3aaeaecd73561376030768ff74e427
SSDEEP 12288:oVq6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL92:j6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1F8D423112BDE01F7EC73D738E935C2A5EA39BC4CA635826F8501655A0FB0BD89D2CB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 31cd60523799f10ad40d896bb0a77a316309c94e94be27b274efbd6eb2b4d209
MD5 fc4394bf5fe6b3cd18bf40c738e3118c
SHA1 34982385d38b6e0f5a75764716556da9e1ba7bd6
SHA512 bee0a29c0b7cbde9e5e14de5cced8313bce8dee19075de225a2dec2262ce878dd4f761971526d5cf6d153a1c01ef46d1f4ae23bb074d8279d8fad6d728f62652
SSDEEP 12288:ri6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9C:ri6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1A6C423212BCE02B7FC73D778F929C3E5DE2C6C0DB529816DC011B16A5BB0BD95A4C992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3195d2a6fc31e78c433dfce72d7147676732660811ce18b6714f3bab7108dd2a
MD5 2cb7af4a293cf5753006eae618926c18
SHA1 5e4ef8184950999458c6f6968be3c7a5ce3bb35d
SHA512 4b513ea289045ee76d71ab767e4439ef6e59fdeb45f4a22976111155c4ee349d4c83d54df964a7d9ae0242e5b5b77478eb967ee252bf912ce3c81439dd0238f2
SSDEEP 12288:496loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9C:496lfdxQjRX1Z5YrEoY7zOL9
TLSH
T160C423213BCE02B7FC73D778F928C3E5DE2C6C0DB529812D8011B16A5BB0BE95A4C956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d2485a02e3a2f28aa4ad982006297c1c2c0b611859aa1560571da2596a0320cf
MD5 0cbc700132f7b445f95b8928d01e3ff0
SHA1 5d44958c650a07c764eb3424a222c8a423a86726
SHA512 8a0636b06b6e0156f175a92e22036fe0686b5caae6ecd651e0a5d0815418b85bfa80e3caf1d4b9ded440424a4ec53756888134a79512cc000a5f9da4d5f09795
SSDEEP 12288:bJ6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9K:bJ6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T199C423212BCE06B7FC73D778F928C3E5DE2C6C0DB528812DC111B16A5BB0BE95A4C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 93812b77d99661eb61d21b7cd587ce808460afac8ade09ed9e93831b0772ab0a
MD5 9578dc6eae25bcca73d0f6885ae066c5
SHA1 ba2434780d0c69b72a2ecab45a0d95670d78b28f
SHA512 ed9ba42b3a25a1e9b6ec056e60d3357940af52a2d7e6bdba618c1fb1ae77122c06d8525a183b982f77dee8a02ec70f9ecab4a9df446137704d3ab7ae9be7acfd
SSDEEP 24576:xZM3zFVSOx6lfdxQjRX1Z5YrEoY7zOL9:xZM3zfN6SR1ZWzY7m
TLSH
T18C0501A5739418F9EC73823ECD258916D6B27C1A0770C61F03A4366B5F733A11D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 19aef3051ce76be488f3a74b0559bab02f60c3ee539b20fd206aa5a88ddb062e
MD5 5ea78eb94f85d86fe2fa71297344d391
SHA1 9a88d98a7b6906d7828ce4d10f331850b89f4322
SHA512 90c21c6616adf067639d13c83c274a2920d3cd8c7114d1794ca6c0537034d9942cafe0ed5892d5d6f9d626158b6dfb48361a008ea9bc71be20c96744e7afbe8b
SSDEEP 12288:X86loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9Y:X86lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1A0C423212BCE16B7FC73D778F928C3E5DE2CAC0DB529815DC012B16A5BB0AD95A0C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a2abf18fd342cbaa8b1bfadf2ed8e04cfb3c09d3269bec84af1308c1f0568bda
MD5 5ffc17b65744954e542dc5ec75f54749
SHA1 f5f848af6c0812774473275802eb003706bd3ec0
SHA512 171bb7205686658af4c94c35ce034bd566c288a933f4b6d80951f4e97d084087aca408bd99e741dee27ae4b84e07cd7b0a7a14d08f57f3cfc7217d97ec7c7653
SSDEEP 12288:Fg6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9Y:Fg6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T170C423213BCE06B7FC73D778F928C3E9DE2CAC0DB529815D8011B16A5BB0BD95A4C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4bfaa93dc678eb54eef0b8e13bc20eb5ae443b770b7645681a2a835f06669764
MD5 4bc0b75ab4d16768f76ab7eb62a700ab
SHA1 70f0780f5c32d3a88e13b6e5f71e77e44c1ff41a
SHA512 203e7cb85df97d1e0cd7d26c5fcd662c97454cab95fb92596e1d25bd9e70a0a50727f9616771050b54faab7f4ffcf21dba038aad90276cb23de19b04f87cc6c6
SSDEEP 12288:FyPz5L8l6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL93:Mzyl6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T196F4021737A530F9E4779238C8614652F735B83A57248AAF4360527A2F337E09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 55150527136ee9831e6e1a735f053c504d2efebf7ff9289fa4ad581ce261c5ed
MD5 ee74a6b60d6a9d03ec947eede2aa983c
SHA1 149f5ae259c0bb6194c333c5085c34e398d6fdb5
SHA512 4f201292d040e36ca27d46a7bf2dceec19077442b5a653b7a47c0e16578866325a772b0eb39afdd947fea0d7c14b516b493aea68167489f0face4da27e858412
SSDEEP 12288:h86loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9l:h86lfdxQjRX1Z5YrEoY7zOL9
TLSH
T18BC423212BCE16B7FC73D778F928C3E5DE2CAC0DB529815DC012B16A5BB0BD95A0C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 04a3df70c5762a2ccfafc906a74d746fc76c6f88ee6d586f53cd32cf251aa44e
MD5 1190dfb577ca4448281925bc486f488b
SHA1 d2e31e0670da47d57b18c494af5d056fa2cd2c76
SHA512 585011d3805ed0bc3ac400b203f083f167c85fc7d75554d9f0564d1b19756ccfeea1b0e5d78870bcc57863a2393439379dbf5f1f2c23cdad2347178d8082b5e0
SSDEEP 12288:y86loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9l:y86lfdxQjRX1Z5YrEoY7zOL9
TLSH
T135C423213BCE12B7FC73D778F928C3E5DE2CAC0DB529815DC012B16A5BB0AD95A0C956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7dbe460014c756065da3a4671c6dc57a9b9401c05636dbcde2811b0676880139
MD5 5dd561ff6cdc63c982b05fc91ce8cce5
SHA1 f98b157c68a7439f4c7df7a3afac17265d54d5af
SHA512 8572efbb9cd61206884a67f51b5748ea67c5d61fda9d7d2ef0445a161b66b7df4f0e9a1e311922acdbc4f3ef68d182c76a3df61ac4ec9696fefd51b0ef6b0a04
SSDEEP 12288:vyPz5L8l6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL91:Czyl6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T12CF4021737A530F9E4779238C8614652F735B83A57248AAF4360527A2F337E09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 53a70a669dbb98469e0c65109d5bea1ca8eb77cacca226c1270a0a395f055ef5
MD5 9107260cc8201c87e634f032b20add01
SHA1 bfd31c35d4211c83b416ba7912c51a43d6245426
SHA512 0b475ce9d9099d809f18a6e1ff4213ea4a395b1d94a29b7f2af2da2290c713a5dd70493c9bb4e7fd41399f731ad878ee3071d827ca4f9d2e2920f6cfe11b6870
SSDEEP 24576:/T8aLl3z0zDT6lfdxQjRX1Z5YrEoY7zOL9:/T7LljW6SR1ZWzY7m
TLSH
T1DA0501A4B39018F9EC77823ECD258A56D6B27C1A0770C61F03A4366B5F333A15D2DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8b2b41a200a62ef1678993d3834695269ab7001953d3285a548ee97de6232bce
MD5 2260e296d3124bd1d69e882a626aed6f
SHA1 e2d29788ad8f2d23ded46e08c8acb89f04410a3c
SHA512 b0aa3edc5e62c8051b772842c166d8ede986abd8b37272a86d7953c9f17ce3fbee31cdf14f372caf14a247552f1179c75e754e352ee3d460ccf19fc1d6393c3a
SSDEEP 24576:x3rd9CHKy7GZ/6lfdxQjRX1Z5YrEoY7zOL9:hrd9CHKyaN6SR1ZWzY7m
TLSH
T13125CF90B3E810E9F0B7DA35C9768511DA767C5A1B31CA8F03A4665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ed532797206af9acd02bbfdd7750edf8bad988d75fa92aa7127ef29443cdaaf8
MD5 240ead8a761ec125d685f9bf82539f37
SHA1 35797ca515497866316082c5929f5000290b9d32
SHA512 1974cfaa273893a5a3d6131b40fe7a939965f30c52f156346289dca49db952e5a3163a768afa227862666393f2585ef0c449d493fbec2fe3dfd7b07b45b76176
SSDEEP 12288:OD6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9/:OD6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T168C423212BCE12B7FC73D778F928C3E5DE2C6C0DB529812DC011B16A5BB0BD95A4C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 d9b0f35eb2d04036026aa7d38f6341e3910a552a160d3797e597051e34a6f69c
MD5 5f96985563732790c2dd4b63a47fc02a
SHA1 1aaafc4b271495a8ba6880e90adba0c6f4951733
SHA512 2d1dfdfc28e7fe29764f4337d4dc281a7958493ad24defd829ccc168eac896b015daa7824048f42c29f25d805543b1f4da5e88b442a9da2a729016cbf77266d2
SSDEEP 12288:GF6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9r:GF6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1B3C423212BCE02B7FC73D778F938C3E5DE2C6C0DB529812D8111B06A5BB0ED99A0C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 44edbb7a368720665be7e2eca20f1548b498f5ae5cd4a7281ef3a78d99a1245b
MD5 3b0f031391341cb7af81185fdf58b563
SHA1 43490753079ea1f9a9796fb5f677f73ddfa4de38
SHA512 f067187c2d4351fd214ae9e39bb440d68294c59af652d9e5e61182317bbceab72d6374b82960dbf0cb9c6807341d74adf52b25b12aefa228df4ed94c939f3abc
SSDEEP 12288:jO6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9s:jO6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T104C423212BCE06B7FC73D738F928C3E5DE2C6C0DB529815DC012B16A5BB0ED95A0C956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 433cf51ccfec761918c492bc8a82888cd1775a99e57b55c3e06d55741b66475b
MD5 1c443e97c09434a46800b5bc693eddbf
SHA1 e05eb4e058d127c1e963b3cb0bf8900228a75059
SHA512 541b635398a469be8b7bf60defad67fa03cfb26f956ed2ade6efd551f43b9b03bd9d1ece83abb4a3aaa0a691141789e6bc88f20c1d5932363fbc5fab2404b94c
SSDEEP 12288:O86loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9s:O86lfdxQjRX1Z5YrEoY7zOL9
TLSH
T143C423213BCE16B7FC73D778F928C3E5DE2CAC0DB529815DC012B16A5BB0AD95A0C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 0ea89c98ae74d12c8d78826e5341e94cb7253b518fd7e6f68c54e0219bba0ec6
MD5 e5d0254c054c435f97648a96c46c0b61
SHA1 a71e6e5dec38560428756cb522f9e49be759a62f
SHA512 2b8b8146884a5e30af249a2adf37c319808c67f1ab667bfcfb0d0248be051de5188e164c3193b880f687501372d554676118c5da0364d31cc80a873f352e52da
SSDEEP 12288:kD6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9g:kD6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T180C423212BCE12B7FC73D778F928C3E5DE2C6C0DB529812DC011B16A5BB0BD95A4C956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 46a925861186364361a96635f7adb4bdf0041ed56a05750e3c364239f26e8726
MD5 ebf02197e48d285fc94989737042e933
SHA1 3e9ba01f80c086f2dcbf234e4afb6b98ec86191b
SHA512 93bd9e0ccdb3d499cffa11269345e3290553f1406d4a46a5b513a6b0df7e4539f0555da4438008e9f13c7074d49f6d8dd9eefc3687092a3f30c6ff4794af4a1a
SSDEEP 24576:Ofwvzk9RX6wkyAIw6lfdxQjRX1Z5YrEoY7zOL9:9MnYIw6SR1ZWzY7m
TLSH
T1BB35CF29EBDC04E5E1B7923C99B7460AF6B178591B31C2CF025A53AE0E33ED45E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f257c79cb55a78c5a0005c3a8bad10d4af598d096cbf8ba5dfb31c8d3399f514
MD5 7811754466e06b33f10d28289c602e29
SHA1 ab27f4ecd8c2b927bfa08c7d92aac221344db745
SHA512 42b052f6ff0f4ff7c4489a0cffdf8f476abd199cfba96e956d9404addf9975e3fccde36229f37c77a98b2b2cc56b3a23f53f1f611f286116cd54c0ac09cac3e0
SSDEEP 49152:uYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK036SR1ZWzY7m:RySzP/p1ZWzY7m
TLSH
T1FA066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 230c6ada8006fc451f42bcc00d75f8be4ae39f9dbe801c80911308e80543335a
MD5 6744c823104c978211820e693b60863e
SHA1 1dda9826e9e8e0ba67991b55c5f808b5883bff8b
SHA512 3c5342e1c5c7fd8c1ab826fb32819173e664427e015b7c87f9b74812dad196c4009fdbbf8bde64cb82cf6337738180ceec49db9724d004fa906b5ac47b2bee34
SSDEEP 24576:C47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYB6lfdxQjRX1Z5YrEoY7zOL9:C47JUQjqirIhCnDHUPfF/H6SR1ZWzY7m
TLSH
T16565AE1EA3EC01E5E1BAD27885158A5AEA71782D1B31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 113420fa997024345363ebdf43f61ef002005ae41b1bf75747dbc497b807f077
MD5 e467ce815b6376fa6009c6a601e07965
SHA1 bfe7f6d4c899a3eb71397e2a8888c8af3cab7abf
SHA512 3d477d98e7da221735a1a81f6c127bea4b8a84752da86ebb63f2154a95fbc4c16913e69ec861f69b8a81f3332d254d4b3597957613b919254bec1828353273c3
SSDEEP 12288:gpsfs6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9b:Rs6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T108E4F019D28802E9D46EA238DB158681B7377C2993E1D3CB52D0F53E1F71AD49EE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8e7f8ed3e5a817501c1f4c133b11bca4277f26efd5018f5bcabca017937da687
MD5 37151d7a75d5414fec0ffe9352c2848f
SHA1 3ef182736638e00523d381634223350591f4898b
SHA512 7aa912cc3695616d600eca41e9f326fb1c5abb20175adce04b8c28a9a7de7d8b750068eafa35c98d411220275aaa4cfc4daead11bbe1ab71d78edaa0c7f65aee
SSDEEP 12288:+j2cvy5ySR9TVUyNXC1ofpJYef0GOSCoYB1:+vvZpufpKesGXX
TLSH
T1E5452910B62BD75FC5A940326E37D2CCAB707D45FE455B0372C8872FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0d4d14d7b7ac7e8c6b208caeeb8337083871f40cca389d91ce19b88a14560596
MD5 515b6fd37c45ec83fccef712347ec411
SHA1 381a6539098e2f223ad18ad7d36408a5425478bd
SHA512 83de01d1a3f4d70624e3f4cf6d9d3f94d6595506759000eb9d16f9d3fbfe753dd945a9c019f5205bf4a4dcd0009020f9a4800132c08560f9fcc9260fc255c72b
SSDEEP 6144:tUrWgf4O/Uj7KPFJuZDUYxIKxUI0Kg2LhXMKpbah23KC97KDexHoBo5/oTiTvE7Y:0WTUYl0KUk3KcZSfFT5bWaMV
TLSH
T15D55D8815137E38FD1F76072032AAB4DAB64EC06B7096E2673C8453AD86B755A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ESETOnlineScannerBTS.exe

Path C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe
Size 2.1MB
SHA256 034b2f4c418f331b849219f154c602108ec324b6e80398dcef701bdc1a1c0caa
MD5 39bee63eb96f24b8b5b5e176a2443900
SHA1 0be4f7ec4ca3faabd5d0b6651b5f3b1dba822cc9
SHA512 92b89d7c72263456d92e3576592852214c3804e8eecff2f41873d406e4aa4ab5c120a95c11756f8fd9e282a1e9d8ee86f374245403488e6f75f4f2e51819de39
SSDEEP 49152:sezoGaU2h/O6YnnGykhGBkPQEil0C6NtAsLum649wFMBRya:sezfHnGyiGBiS0C68Hmn
TLSH
T1B5A56B32B245C022E4B225B2583CDE7B842DBD350B2154C7E7E0BE6E68B55C3663AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d927bd6f103a58ede991fe0664220d3d7df812c0305743ec856a8a23229b9df4
MD5 0faea2a1eea6cb7d9ae174048af24e2d
SHA1 a3877d02d7d4693e7f0d6d8de8d3efd320e7a23f
SHA512 106c69fbc217d2630149d29fffeb720dcb6eca4cf6f6321b4d86f3c5edfb2b815bfef1f322b290f4d28cd5325609b2882402459920ef91f9268da927b60504f3
SSDEEP 12288:g07E6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9a:NE6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T1DBD423212BCD1577FC77A634E82DC275AA2DBC1C6B14C0DFD001719A5AB0AD98E78A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4129bcd16b4a49294e7989ba18027dfc1e64cb5c2a699437d6cb57fbdd2310b1
MD5 5abdeb71409920a7df408dc37450e747
SHA1 ca7c4f45c92cbd156ed2d60b1e5972da2d410192
SHA512 caf480f183d2767260dbe89c5b38ba39b178bb4d52cba86b72d6a293664c9d4fceb573334dcc77b53c0085e0ab4d70b40aa1fa753e092e02f3848ed02c321563
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYW6lfdxQjRX1Z5YrEoY7zOL9:Qgb4mBIBhGFB6SR1ZWzY7m
TLSH
T15865AE1E22EC02F5E0F6E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4fbd24aa41e6ae724246da62766eea68d0b204da1992e2592457271f462a03a2
MD5 62b4659c58f8f11114707df7fd3b172a
SHA1 5ff0f2965ace28dae254b57e99cbc6b702b0cc0c
SHA512 601159e36af798ad5015221d0858ac137f4b04f120465665d1fbb31c0a9828c1c0616c89ef9e71bf662fe88bf07b9a0d2a76d697b0e7591f4e68013f3993de0b
SSDEEP 24576:qG88u8FpJqH1vzria7/mx6lfdxQjRX1Z5YrEoY7zOL9:R7ZFPqVya7/u6SR1ZWzY7m
TLSH
T19A35F12577E501F1D477D138C98646A3F6B2B8250324EBDF06A88B561F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ee8e2fff6d3d53a12ce040e872f06921e673c3d628418966d616a8adb265086b
MD5 ac3bbe264237efd653b6298904e45bbb
SHA1 6bc92676e8b7e433842c12cf5b589ba43d1f1302
SHA512 ee74537dfda15df78c2e3ab6830af26808576a56f5624bce89d91c54d1e24ad9842cf3d07c75b5bf79441e0cf81a4e14f6ca08eb8c60c11a173848462856614f
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj96SR1ZWzY7m:hG05lO43bop1ZWzY7m
TLSH
T1F2D5C06A62EC11F9D0BBD17CD9C6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fac3ddae3e1f2283cf29a9a6d238353e434a806aca49d9947b195ee87d1fb1cb
MD5 e18624a7c0237af914112266b5f46867
SHA1 b92bfcd3d84c6694a5ac217b998bd7a4a98679de
SHA512 d6961075e733d2eabcfc7ce327d12dc7b2feb0569b4385dd3252e9282cb8b51fd233ad9db67124f349563d3387937a529d1f9cad1b17f1a0bcefea330f9fcc6f
SSDEEP 24576:ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidn36lfdxQjRX1Z5YrEoY7zOL9:na5POZ3lJt2pasx2+mF6SR1ZWzY7m
TLSH
T19365AF5EA7FC01D5E5B9D17CC583861AE5B1342553319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8da8d6a60c3f6f4dbb889202f15bf92743f3b13e9e801b6784b843892805c8cd
MD5 c93225913523cdbc6390b993bee57614
SHA1 6d13532c05d3b93ce77ad42c5ca0edf7d0258a48
SHA512 432ed529e28da874468a23bebbecec9907bea7d043430e11cf540a55ab81db555ff6af6a3d9bd00c7b566fa2233d6923b529a668b02649bd017a9675d0a65910
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7Fk56lfdxQjRX1Z5YrEoY7zOL9:uNc/zEOVHFO6SR1ZWzY7m
TLSH
T1D7857B2623E901E4F5BBE1BE89779546FA717869533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c0a83069fd8ac86c6fbd95aee88db452f54826f7be09b8fda8d2c5ffb789fa95
MD5 ce89bd66dda79fb35e683d06689b0ab9
SHA1 19c58801c64b5a2e17f5845d53d02990f0a1179f
SHA512 d2098a7d18fdf4619a9777e2f5c8e2454c0ea1c0993d59242f83c900d742c8d9d90f7e03948f03622125266c2a5989c0896000f482652d39970e48d18aa90d65
SSDEEP 24576:tzkNvNnaFeYhJNtmZBmv6lfdxQjRX1Z5YrEoY7zOL9:tzMwBtOmv6SR1ZWzY7m
TLSH
T1EC55AF2EBAF806E4D1FAC6B4DD238512EA727461173292CF5290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 903d56a87266b3ce70c569177447c30c570b3e1667c12dea96bae8b98becf5ec
MD5 b29cea0bbd4acbc4b0d05707c0aa7792
SHA1 669f4be1220a0993b89cd43dc49c4970c42a4765
SHA512 8d2507384af81b7912aa6a6edfcde7604db683ce978e0440fc13b35ca52e8d3497c3bc5681e2338823c7e1d07dc4522bdffc96f602839847e08fbd4d9d93f1d6
SSDEEP 12288:FHvUrBFrEjwaQN6loudxQFILsRXpLTmGZmmYoaEoWhfzydsOL9a:FPUr+NQN6lfdxQjRX1Z5YrEoY7zOL9
TLSH
T11205E12F26ED18E5E676E17CC9468319E771B8661311D2CF02A0817E4F63EE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 40102c648e8209bbd9f3e9f963e8d4b6568395d0a24e0982eb7e8b5a695868df
MD5 ff9b171ea07a0d16bcd59e992fc1be1d
SHA1 0899a1cadd73e4aa8ad43913483f64b30c9bc6e5
SHA512 09fbc6c304c9f877b03b1992f9f1aba820c83f68dc25ab6a26721747b3ef1c1f7a7f9464fbf299edccea8c25b83a38d28325413047e6e564bbf9cfbf657ec02b
SSDEEP 24576:ID3FHshBIYQgA46lfdxQjRX1Z5YrEoY7zOL9:IDVHeBIAA46SR1ZWzY7m
TLSH
T1B525E13DEA9C04E5E47BD2BCDA638606E77138AD032255DB019091BA1F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-301-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/480-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/480-75-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/480-69-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/624-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/624-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/624-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/624-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/624-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1732-322-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1732-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1732-114-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1732-108-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1732-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1732-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2060-127-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2060-119-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2060-321-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2060-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2720-318-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2720-91-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2740-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2740-140-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2740-134-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2740-142-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2740-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4328-325-0x0000000002F40000-0x00000000031DE000-memory.dmp

Download

memory/4328-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4328-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4328-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4328-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4460-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4460-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4460-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4460-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4780-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-101-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4780-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4780-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-339-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5368-0-0x0000000000400000-0x0000000000C95000-memory.dmp

Download

memory/5368-7-0x00000000039E0000-0x0000000003A47000-memory.dmp

Download

memory/5368-129-0x0000000000400000-0x0000000000C95000-memory.dmp

Download

memory/5368-1-0x00000000039E0000-0x0000000003A47000-memory.dmp

Download

memory/5368-6-0x00000000039E0000-0x0000000003A47000-memory.dmp

Download

memory/5768-79-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5768-81-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5768-87-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5768-317-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6092-16-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6092-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6092-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6092-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6092-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download