a34919fb6a262efd1293a0abe558fbc47d80f1f7f51a2d0924b3472f9218955f

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
Size 1.4MB
Sample260629-2rm19ag14x
SHA256 a34919fb6a262efd1293a0abe558fbc47d80f1f7f51a2d0924b3472f9218955f
MD5 41a89f528cb1925ee045cca83ccf5301
SHA1 1df2dd5e69b66d42402c63bbf27b0fc52795fa31
SHA512 3ec1f75348031f95cb418a4325cdc228fde6be6ee64e41c8636e4289a2e4ee8f867094ef42c453796c4248e6214d2dbd5153e454d40717ff7790d70e10d3a555
SSDEEP 12288:/cCdevEmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kEmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B065F1AB735475E5D0264334C56192C89B237C758B607BAF17A37EAA2E331A08F3F611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5856	elevation_service.exe
6232	elevation_service.exe
1924	maintenanceservice.exe
1648	OSE.EXE
4832	PerceptionSimulationService.exe
6184	perfhost.exe
4428	ReFsDedupSvc.exe
5168	SensorDataService.exe
6912	ssh-agent.exe
6824	AgentService.exe
1484	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7df79ff9c8b6c6e4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_90781\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008163dd841908dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca8852841908dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075bcc8831908dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001798f9831908dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae6b99841908dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b07c6ac71908dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
6232	elevation_service.exe
6232	elevation_service.exe
6232	elevation_service.exe
6232	elevation_service.exe
6232	elevation_service.exe
6232	elevation_service.exe
6232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6120	2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5856	elevation_service.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6824	AgentService.exe
Token: 33	1484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1484	SearchIndexer.exe
Token: SeDebugPrivilege	5856	elevation_service.exe
Token: SeDebugPrivilege	6232	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4888	1484	SearchIndexer.exe	103
PID 1484 wrote to memory of 4852	1484	SearchIndexer.exe	104
PID 1484 wrote to memory of 4976	1484	SearchIndexer.exe	105
PID 1484 wrote to memory of 3184	1484	SearchIndexer.exe	106
PID 1484 wrote to memory of 2376	1484	SearchIndexer.exe	107
PID 1484 wrote to memory of 2876	1484	SearchIndexer.exe	108
PID 1484 wrote to memory of 6840	1484	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_41a89f528cb1925ee045cca83ccf5301_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6184

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5168

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5429b7338d63fa08543254f8285da97a14bac9c0c205aacd2a6c0707a2eeacda
MD5 27f18d6ac19a04f9d728c2e3ad3a7574
SHA1 50f93252391246e8eb97a148c141889306a1ffbb
SHA512 b481f07eebe33a9a65ba87d26963cdd86bab486fd60c3b8908c5f103d9b9e720149bd3c20f5269e1fdec9c13e0b58632729c5aafc85a8ce41d66c399550b00d3
SSDEEP 49152:Yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnuDmg27RnWGj:y3q6sjBhD527BWG
TLSH
T1FDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 abe3878449a403bc2ef1fa2780e7989b19cf0adafa42b7b5ffbdbf7059114181
MD5 6c90e12a52f4b3c2dc3ab6b9927e3804
SHA1 de4c8bd15a7e6a8e1f27d35cad2ceac7bcdce946
SHA512 8e3df80549aae6dc8ef76b15e5cffe36590dc0acab5164033079d644af02bb6fa31d53270fbe4bee8f72f67932d272b4ef29b80ab5a9727cd93b1aab8aa85d03
SSDEEP 24576:GXYfDtczAysqjnhMgeiCl7G0nehbGZpbD:ltc3Dmg27RnWGj
TLSH
T100650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ddca1849e78b4a5b2d9df02076733aa795d7d157864390882125a88eee441aec
MD5 aa5605a502fb512d942e6af17d9f4201
SHA1 543aa7663a3623f91426ff42394b6d6c72c55cdd
SHA512 b8e48b1b58e3dba0fbc22e652f9e04660846bd7bd9850bf734e469e5323f164cb3cb7b66dd4d2460b5807f70d084415a02bf760842259b1483dccc8ee7e482f5
SSDEEP 24576:z0Le5ji0hmxxrMRsqjnhMgeiCl7G0nehbGZpbD:zPji0AjkDmg27RnWGj
TLSH
T1C4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f340dfc9b647d5b4fe2cd04b2a521386ad951051441ad0dfd269006b2bed3ffe
MD5 938de1c0ee77c5b98777bc251cc9f3f9
SHA1 589c01be647d74b2f3a95010147485ebe35ba83f
SHA512 34296c0383ce3c0cc5db2fb295edee93d7d535a1fc61b09c69ecbdde136ca973b0f51cbffc623762e76a7d2e3b0a8292d9bcae942b48b30338388fe008d107ce
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyujsqjnhMgeiCl7G0nehbGZpbD:8/ezSC6vUzPveHjyIDmg27RnWGj
TLSH
T1C2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 763361992558f713060d24e2cd8b3e8d70c83a3fd4e4b5c83a09b0597873846e
MD5 feb271c68206df26d4c3ef2d8f84b9dd
SHA1 31ae48ad6938c768b27544ec2c09a443b504d059
SHA512 96ec87dc034406049bca3637240eba84709fc305482953f5614c7ae5e1f8fdaf4a970ea0488ba986cd8ae22f5e9eb0092b8fbe0eb1f5db7de65427fb401e052d
SSDEEP 24576:DVbqPb88hv/l+Y+sqjnhMgeiCl7G0nehbGZpbD:DVO88hXl+PDmg27RnWGj
TLSH
T154559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 304f86836c0f4335cbb34c0466388f2a8527a22ce3c98d4fe5127f93c9f352ee
MD5 c2ee6ddcd01067fc06343d8518d8cebb
SHA1 43a0c09736e56808a27fb6f0df02c5dcf10c1d50
SHA512 bfb3aae099ff39153e93bcf696d251995011c2f222073ec783b5e4e64b529a4d1393d3588da836710c3832aa2db7c2e6793d28926915fcfd913a813cc2c10b0e
SSDEEP 12288:aLdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aLdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6a6266d37c406587885c5ece1302b0fc40effe5872f7786c8d1e3caea5262470
MD5 2cbd202bcf125afdb78b019b85e83bd1
SHA1 d053bc8ddda9f873388d90faa9137e685c1295d9
SHA512 8abda3f7ea51a11ce512579fe42c90f04555198a9bd2d6e3d82612ab87dcfd5a7e0dc6e3ecc45e1a0506ed2077df621add2be2b0046fe533ae243e5db558efca
SSDEEP 12288:heBNUbTVO86UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:hJIUGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B65CF7BEE28FCD2C27A4DB85791C600E76278314F61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b08525bf2993469c11f4f489e6185ea30489ced51639d16616684fb33fc7d53
MD5 a0f57f56bdfe28ca817b9a82988b1927
SHA1 a10d58aa893fc8b198201ee53920664d0ed49b0f
SHA512 713ecd7d46cd2fb3085b6632283e31c1fbdd73fea0389d31fe118b0043036c654dad00312f9b12c5578deb50a086e25a16e82f7c538534cd2b28393621d8c21b
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:SQvGAdlCEL8c/DRNw5CXD527BWG
TLSH
T1D7266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 85b07adb586e57c861c114e79bc44c76058e917098034f01be9359bb4b0997f9
MD5 d8b44f0ee6b9235f3a7e2d625c1deabe
SHA1 99ab14eedd11a18f23f63ead76d10734e2f45ff0
SHA512 04b746f744634a18656a2de3f9badc40a3d1534cbc82ffe9d3765fa99b1bab48a7a926868c32c3d995a7ad252ab55ae597adb7dd9641ac96034ee25cf7a22382
SSDEEP 12288:pAwSfxL/2Dc3RDLLmt0LDQewsAjoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:a0ewsAjosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D275E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b4ae70f7aab01aa50a5faf1f1e2968a2052ef80a43cf14be546f24e315d95897
MD5 abcddd92fb659b779e56d2d16c0f9344
SHA1 c3f10e566f03b6c6ef79d54fbef9a3ee4cc2f76c
SHA512 a9845cef1dca0b10cdbde39d9657266874ade2fbf3df9a21950db57b0125fbbd515938dc5f9ef78324c312e8e268c96d35c3e7e4f6b6966818fd3b158ed3319b
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8VQBWG:SUEtQevvqc2W1cpV2tI32DB
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f89520b271ba68282b85f7a9de0a03e4799584e19c2ecf708075860878dc94ea
MD5 45b0c1616e67c1952aa2b0eb3cfdd021
SHA1 fedfee972a61f3a762b1b65452b70e4f9f02ca46
SHA512 3c1576ce594348a7c7ddff0751ff46cc0e692a15b5457b897934e4a92c4bfa4db4f2b5476c928cae8c4fc483681152c92b8449ff44ef24e45b8c94e3b53b8b82
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/z0Dmg27RnWGj:woquVjnmrD527BWG
TLSH
T134D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ef6fa310911b24480e37dc577b6a00e0df2cfa58e282d01e239e9052aba5db5d
MD5 c996acce190b693b17cb2ad3d6896fac
SHA1 685e5af627c64e10add9d519244baeef49c2c1bb
SHA512 32784b81d0492cfc335aa67e7683d49051e1f9484d63d1d121a2f059c17b7d6ed5b5a2fa3b217c3335f2d7d62268738fbe9793a896a9bb7d664171190b4029f2
SSDEEP 24576:xAhGL3IFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:xAMUFoiq5bDmg27RnWGj
TLSH
T105359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3b4ca158ea1b604d2df670a196d877672562a3d6b4b0e2b5563645c302696062
MD5 3ad5696dd49e28c21545e7deb2345d93
SHA1 efcfc22488a8dcf3735616ffc3f4732331682587
SHA512 7f2d6ceeb0bfe5a794396a6d550ec03c30b65eaae546b164169bf6dc0c5339430405e8931f56140aa5ea1cc90c4d2ad4ff05a2251f33768bc949da34bb1a2e3f
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+CDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Jwu4OW8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19965F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f195e24a62598d216cefb53e5a658d2fe8bc799a369a48a2f49382b0db03acbe
MD5 26692c71e679fd6a35727618306f0e8a
SHA1 cc0a0acaa19ec19fcf89dbe95fb002dceb881e51
SHA512 5d0663aa9c2040b021a36e7cee3bb2954d19ac7d0812df0dd7e5e7e16b6c724eb0de56cb854b9d72daaf234f5fdd88ae5d22438fe4455935e2d066fcdce64970
SSDEEP 12288:xeZ1IyYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kZuZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D65512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ee211d39854a8df73c920f1c8077c0549961b1d592d1fc92613e4abe3dbb340b
MD5 5bee2e711250101e8b1b27dbe4852b36
SHA1 3ed85e14ebb5e438c997e1bca1b9778e042dac44
SHA512 f1efda982aa12f75d2687d4a085f3b360a0e59973a0810f7da5aa235103b0f938675d75de29e013cb09bc714b43909d587d623271a48d8ff5690f012cb9d6c2d
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3uD527BWG:XQyiKa/X+PN+VQBWG
TLSH
T123667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3d3465b2f671b805613a2aecc463407c5439e7b290464788746a1fdf3b100ad5
MD5 8a8ff693088826d9f32e617d595d6ff8
SHA1 0e97f934290057044aefe27a19ac7e256ab1c80a
SHA512 d7854bf99beb47ba012f5be0d5472d2f74b126b7b96be1725ec83a14164b1613e2c245c7ab01569d35acd5e9bbc70834e4028d26060e582302cdb9926cea6d54
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3uD527BWG:aQyiKa/X+PN+VQBWG
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 724f39ea7caff49053112f61228a99fafb1b4f9fdc19202683d93a95274b538a
MD5 782e9ea42658e6522ab57f2097b0ebec
SHA1 aa3c570ec5cba82e98bea3b917d4795e10db9c3d
SHA512 7cf874ade49e0577a22fb2030c33d4aba50501cf5c285a45001b0efac490245a8781cf7ec99d29bb00a9980fdc950f798f881f8132449ef98c02d2872bfc9e51
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0psqjnhMgeiCl7Ge:N68Qg55nhceWu7PNU3/kDmg27RnWGj
TLSH
T1BFB55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 156050d486c8ca63b0339bb969049b9c9f6ec976a8fc39d2e0d71c9bbe13a826
MD5 901185cb0a36b086fd834cf40d94abc8
SHA1 32d12396f493e4824663a7d391e7429b0395925e
SHA512 09154216124d202e64091b44d085d549cef8490c8117dcc0259812ae3fe7d314847bf2d9b95f876e535e0472762cff7b098014c32511fb8e2c4918fb25fb612a
SSDEEP 98304:xy5112gYy5azzVvt69nLKnhZBD527BWG:MLIHEWhTVQBWG
TLSH
T130167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b79732f3b5a085e1e261c20913e887bc91b388f9aa9633a140a67b1919e2f6e0
MD5 dcf14b1649c655df7b1a1b0364dc513f
SHA1 b16532810688e94051444710a85d13644f209140
SHA512 edba0a8f8b01e9bfa2b43da9062aece14f4a0999090ff85a4eb469f4962a35fe6cfcc027270e3ead4546ab26bb836adaaa08bccedbd3a3dd4b0a9b55697df0cc
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gldDmg27RnWGj:fu6Jmdxd2ddD527BWG
TLSH
T16AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 760ecf1cf7d554745a93ce2dd4bf62a7cb4155639cc70a48320053a5ab511c4b
MD5 79ca6c89d4ce920ac2b7e7b1243b4914
SHA1 315d2abde01fbef5bcce263ae4597220326fc95a
SHA512 9c74470fffd026f948f84b6b7bc9dabc6af8a31fa96e2dfcd786d4439ca4fa4c6b4a76934a15ef930ce8dbc9f56ee3e904755be70979d13fd70e801b4a58dfa0
SSDEEP 49152:V1hpsNoJpF1A63U44CwH7R4xqDmg27RnWGj:VmifPWRrD527BWG
TLSH
T155B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d7a3a6c49f7780414ae9e41aaea3b782c1b165ad8efb8c208462cdaf0fa45708
MD5 82a16d8f3e63066e92cb7eb65e4a3f90
SHA1 7c51fe0aa3123d06539cbc56e5c2b3b05a8ad3c3
SHA512 452aac00d772320cf8e956d6424be6626ae621850aacdc5f8639c68a282f13c8c2c7aec80f3af0c840bb95a3cf0fbe38084fdf48e5f4f7b0776ff0bf006d1203
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqdDmg27RnWGj:M5dKii61dD527BWG
TLSH
T1B7C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65fa097de2bbd980e292205b25b6dc26edc6f6b5e6e1e7cd179a8a8563e288c3
MD5 443d863df6778d9058d2ae1ef3342232
SHA1 9b3a3c79028ad948610f926607ddc0b828c01b63
SHA512 1179d980490e120ac3a92d7aec4c37904f7d05103d0998ecc3faecd0f1c2a6d0b84f28f0be5679419c6328857c9af772cbcb4c5713c846f9c3e06faed456b318
SSDEEP 49152:UhtSn8EApI0fig3giDn0AP5w2Dmg27RnWGj:1X2imph/D527BWG
TLSH
T11C95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9deea671d16ba2ff8e4456402be68da0cf731ed5bb66d2a8a0273f06447e3f0c
MD5 15e1565e36dbb1b921405a96d26f05b2
SHA1 728b5337d9d0011a04b8a5e261d344ee0dd94f2b
SHA512 bbdeeccc131ae3f09a59add719e09dde9c84f2d1cc500de267d00d48529c128c3de933b3ffafaf600440f07e4430154ca1e46b51b86a0a32d110842b6b41bdc7
SSDEEP 12288:PFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0f42bea5c40d6e521f4bd0bf32a662f44f83581bb7d7387283ca873e3c244641
MD5 4cd6dab99b82f93947805237da1ca7d9
SHA1 20a64d87cb93013506ec5b7ab2f51f5119071e59
SHA512 0f1c927c1a7db246f545657fb5e8fa4363065c0408c86e39631dbdf943ebe63048a99d5b077bbca808a67e348c14be0b3ed4d2271c5f15e2bb5948f27280bbf3
SSDEEP 12288:X0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d0a5e896848d0c0697bf1fb6a939136275f65354221ed4e7047123b5553e82d6
MD5 334317af4af923225c34744eccdde91c
SHA1 9cbe1de9939c868b1c0e2c93f8671c259a77577f
SHA512 8e7bbcbb83d42af053e087566acb032cd2a6369ff187ef5a6fea7413a3c3540fece721600132cb248b28c345d9395ce6ce3afa35d2426174975e76f58b98a075
SSDEEP 12288:iOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 475941f2d4e8b12e5c9ea83f0ba5cfa6ecf8ca5e4b79d2bc4a7fd8460c305cc3
MD5 63f45e3d4d6452913f672ca896f632b8
SHA1 e26b22dcedc6736acca511e854b560838d964a9e
SHA512 bbfa2c4986813903cc12af24cee427e7999843e2811294639375a01e28269b3832268a1e3b962b7e99876f14f7694737ee07c9c69fdbdb02f1680ff9d9017a7d
SSDEEP 12288:OVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D45236B535C01CAD83285B5C2F5E11DE8277D56EB3005DB6B532CBEAFB12944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 16a1e2deaa79c80317df6ce7cfb6018c858e1ec62a03c397d0bde183d648784d
MD5 e08063df42ae3aece87b0fd826d79649
SHA1 2b9748ddd8ded6516302863bd41d7a338e27931c
SHA512 e0873a54a668e8cf82f7100cd35330898fbd49ba02d9fd7aeb201a44c6b52848ff8f512dfa49ed412d001cf9c60e7ce1aec17c6b0e4e2657b3190a9c521bca77
SSDEEP 12288:/PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 21e7f0df1cdde5426e0c4aae9194637737b8872832e19d3bfb2c62009e681c02
MD5 cfba5cbe143dea414307e9aa95836162
SHA1 5bd53a341e2d3dad4ca1d9d7b378f5763607844a
SHA512 1550478183ab48f53e460034498a999c9ec1dca42050d93c59ae0b44542572db83ce7f29d8172d0976d2aee0f0ef326f205d59fe862ab8cd8d59e8f9b0ace4ef
SSDEEP 12288:QwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A5B7CBAFBB14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c629e0b822fd89e811b6f40f8f4002f27231befecd8a7f59a7763f63cb979a93
MD5 84d5e0ee581f9fd8a013d15dbab9735a
SHA1 459465f578826c1ba508b43fbe0a9fda586208bc
SHA512 409ca4ba76f5e58bf83cf8848066571046b1a856e2f5921b458a4a51b95b5c99ccf0fcac88d43f47c4fa0242776151d5cb84416053235a54c2d6459a650f1160
SSDEEP 12288:xMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BF965C41CAE52604B5C3E5F11DAC073E5BE92004937A677CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9a0898ac10fd2c84e66eb3a73e6c074d928f66474dee943bb33a856edbb99483
MD5 d5e1d9a1037349967fe90fd50726e774
SHA1 5bb86ac83d38ba9fc171e947e0843677f1ce70c0
SHA512 ada990c9eae315c6cb699181b04e27e8f56439e24a6173117cc213c98ffcbf38fc6f21abb0a377b874928ddf9bd074f7ec3caa5ec1971eb8e92078dabf892fe5
SSDEEP 24576:BZMRzFVSOUsqjnhMgeiCl7G0nehbGZpbD:BZMRzfcDmg27RnWGj
TLSH
T1846501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 998d060bb10f1f13388bba5cf032c5d94ccf4fb267dcc34aef802d93aac3bf88
MD5 4a27a264eb9da9c7caab07bf7c39f980
SHA1 728fbbe36e1ad6004dda0af788117180a3a45ac8
SHA512 a57070c214785d2b992e31a9e3a7a09fb392be950dd204199c340e1366d5a30b5167580574219b24c073ff9de59fe9a46515dcd6f7c89fa76199a10a57f7ebfd
SSDEEP 12288:FJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BF965C41CAE52608B5C3E9F15DAC073E5BE9200483BA5B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f737ca3feb15029d6fd36aa7f6c6da5547e87700ee2bbd4b5132207e77ae1ea8
MD5 eb0c41c37629d52d79f0145748f575fd
SHA1 fceea241fab3c48b429a4b13104b8ecf05d0385e
SHA512 a3307f637bb672e72ad4949b06e87f7c48ad854be39c5fac03e12c3f622e4a184b93dd26f91c5f85bbd5e2aa09bed98179eab2152ae67b6846bb01c665a26621
SSDEEP 12288:qNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a547615a1f2dffddc2892a80c4a164a69938ee873ee7171073f3ce38adf48ab7
MD5 08eabe61978d8a33f4f0baca66896e5c
SHA1 289228768b474ab227ff57508eb37c8969f9ae10
SHA512 a5854f42aeddeb3e56ca72191d9f042fc37be2efe9a6b0fe1cf0129e3a549b4a7dec3700733831f09092dc01144cf4538d1156e6d07d52c8f8fe3dc196a4ce26
SSDEEP 12288:ByPz5L8YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QzyYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5d7ecd14b4edd3060798d932543b06c3becf8dd0ab51d82ccedc11efcc00dd29
MD5 6db9ec93085a9be5a53725f7609253e0
SHA1 c1d9196b5cf570210ebd9d4fabc37aefee6eb0ce
SHA512 343357f99ea14270971ebadfa5c6d2beb692a34194fcaea4517ef4247d72c201f3b80868ea63a2f023325ad1b84fb92d1ddc4d775e20a9e6790b673241a0516c
SSDEEP 12288:iJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3510aa7ae72a724360c5dec86f78a551a21712c498270966849a0578ae1d1477
MD5 74b12286b798c5f9ee3f10b9918c7724
SHA1 648242f71ab39b83360bac425fbb88dfbe604166
SHA512 a90d892072d945919b5ae6a6bd26dc46d6843a6a01a4b01e4731911a512a595ff8194636a1f11fe47076f49c9898cad5568222828bcd749f83d3fd5bc1cd01f5
SSDEEP 12288:hJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f506331475c6d4505663cb30db05e59e54aa78cfe6126d6533d1c6c30224909b
MD5 63f2a0c9028d34241d6b94e01787688d
SHA1 56488a6b9d6f1b89ec430185a2db396de5bd4537
SHA512 337cd641910ad890cc91a53839b0e47fe15a03c8f46e37e8a2deb6e11091c43a27d33f0e9cb2a1dc00ac23ea97e2abadd3231ce30af853fecbe09e6fa201e620
SSDEEP 12288:MyPz5L8YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzyYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19955125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 56618d940a08e8800ef591981c8d48440466ef8f3fedc91d203772fe5d4d0682
MD5 7a03f4ef4d4a3d2a9382fbdc1b0acfa3
SHA1 1532049aeb69c7c9da8bc3c2112ed4e1654ff893
SHA512 4f5066c8ce7aecd1ada0028cd1e12a6ec6fc6871a9f7f31ef18f81597460ea99dec0b96dc6d261bfc52bd579badae90da6633645db0b5270b6790b66567aaac0
SSDEEP 24576:GTDaLl3z0zDesqjnhMgeiCl7G0nehbGZpbD:GTuLljnDmg27RnWGj
TLSH
T1E86501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0dfdd66366e591a33f06ca5beafcacdeeb7e815aeb5ad839144f51dea9566720
MD5 e4250a45d90404c04f014940c88705f8
SHA1 f35225c2dd8c264354734b779f10cb47a540bd11
SHA512 5ba2842f1105a4665469336585391b4aba8c027e4ce6e9017e5654898129478b39834821bb46b18591693f36771f1c897154aae84c18c68d79e4475678c957de
SSDEEP 24576:+3vd9CHKy7GZ6sqjnhMgeiCl7G0nehbGZpbD:Avd9CHKyacDmg27RnWGj
TLSH
T13075CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 48c4dc4b399fc0e6b70d00e6808ac5de8dec2646ee1c6c79327101727dbd8e9f
MD5 82e04e117685793ab1a25e9200d31ba0
SHA1 ed0089e838f3da08c13bae4bd16be7e7640406c0
SHA512 546f409d3c86429d82087a27d174a17cffdf0804fbb0c3bed2848d25cb0577d293f68f3dab7fd2b0126afbdb64a43a9909f21b177503c38ab9c1c7eb59ba7077
SSDEEP 12288:OuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OusqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BF965C41CAE52608B5C3E5F14DAC073E57E92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4a2f11e40f7942f6cab7c19118bb9eb8147b57ee1208b971abd7059316001e6f
MD5 3c91171e24c206d263d623e4fa9ec476
SHA1 267b4c7e1b71abf0d6a9ec3cac6bff7b1bdac358
SHA512 b7122d9db9ad59e13d38ba216cf1158f4dd166f8b784262b79053206faa40f196fd5a28e9666db9bb9965a1cba8b3c3378ce4a60ecb1b255220da58ad16f3164
SSDEEP 12288:M4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE965C41DAE52644F5C3E9F10DAC073E5BE92004937AA77CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 063a8f00e28f1ba224087a0639096072ac09dccd4a581433588ec52486728b94
MD5 9dedce947c0a7d39802846eac8a89333
SHA1 c0a62eadcea24ed38fd04de096eb7735b8f4c465
SHA512 0e9b77d5169134d89d47c91e289ca3acffcaf72039922c8bfa654530c1fa9188e5d5318963c0115262221c87afa6425b44c7cb5f274b3e481bf970dbfb894c25
SSDEEP 12288:i7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1994523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2827800fcf8d3582f60cbcde2b54c7c1f2b5e5b3dd6ca430f456ab79fd85f9ff
MD5 16dc9b55ac1d667d4c4ae06298f8723c
SHA1 3c76a6c06a03b859648ff19f34656569460e9705
SHA512 c258fd95a3fbf18ba7d53cc76a9c275498a841371ed002785da95c7b9686ddfa55b9bfb4256cf22e1f8a01b4ae892f9647d4bec1b5775f4137c92f48fc1b4761
SSDEEP 12288:uJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9f98d14393108503fafa2f6046aecff3db2a21670eba3210fe0efaf88318488e
MD5 e800b6c071aea80434fc2298798006f8
SHA1 a3b8f9b2d62488d2aee36ece846782527dfe2909
SHA512 e649d6d6813036519f1283a7974fdfaaf37df5d8494e48214de77e35492565ad06b0761b523d8e459c542f938bee85e11b2671d61d67cfb5f2544eb4f9291cbb
SSDEEP 12288:vuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0cbe5ac4ff37aca866ff83353bd07d8c337e9edb07e698318d3f72c14d303355
MD5 c9a62d42deaaa9aa5602d3edf88a7862
SHA1 02c3ac9802366d98931a14528517d4b51ef61f15
SHA512 75934fbb6e8947398916e8c60eb7cddba293180ef5123c08969942ba98c212018dcd8d697dbcba5549d4028b3944c5c56e83b3a07faeebfe9a01cc512b4ef8fc
SSDEEP 12288:AhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE965C41CAE92648F5C3E5F11DAC0B3E5BE9200483BA577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 050fe3dac409250a0a33ff99c73ebfbef6d74559d6c88f736ed95814a061f20d
MD5 a9b499b99c5b5cd0abebbbaaec92d213
SHA1 ae12727c6a7b9cc0324dac2cb8f190f407be1838
SHA512 2d88193587210ac1dfa4eb9fa2d268ab6a5a0d78dd3d5ad13092bbb5d8824aee39133ba676a1663b3180c3d0d1b09368011a9a99636af6b84524ac61046c74c7
SSDEEP 12288:xPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BE955C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a11a1912b6a386b8435e95cc298a859e67582cdbc493e4dae3f0e5d23408a4a3
MD5 d6b218d19cfb9cad8fc81c22cb1dc286
SHA1 accfe271965e63c67217d4dddb59702054d2d385
SHA512 a0028da28535a4358a19ffec9ca102ee1582f15a9ed7a3d313033478b29134f2c5dfa911a5ec33d5eb87c0d5f3c6b5c7e1982bf17f9d084bfbf7b2c43f9b290a
SSDEEP 24576:7fwvUk9RX6wkyAI9sqjnhMgeiCl7G0nehbGZpbD:RMnYIhDmg27RnWGj
TLSH
T1A485D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ad1640f2fee40b529cd47bccc20b4cf3deae5633311f653561877816384a5f64
MD5 96f97be702ab03542dc075661541ecc5
SHA1 57b7670f52ef3cc87cfb454a9c1616aed6919951
SHA512 eedb23be4cfc8f7a527dea92c77df9b528f336d2fa66284ceaabfcee2374a40abec67370034ebc9e017c9b215170a38c478e93f8442da10c80399f41a684eb51
SSDEEP 49152:wYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WDmg27RnWGj:XySzPOD527BWG
TLSH
T1F3066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1e1061200ee4b6affb4915ed9f351154d284b0b98ccd26bd219d422701cbdf25
MD5 e7105ec3229e7d7d72f73b959322ee95
SHA1 435ed8008b29b1c2d6347a71b225c76555a79c41
SHA512 8e4dc8cd9ab6126807d4984734231f91f7e1d68eec049d31a6b67b7a3ae4c49cdb195b07d024d8ebfb3001c4a1099a167f23c7e2f044abc2e847d6a36c480249
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYEsqjnhMgeiCl7G0nehbGZpbD:w47JUQjTirIhCnDHUPfF/GDmg27RnWGj
TLSH
T16365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f05aebefea601f5e1af22cf77560c08f98809f1d4d1fab5b7ac351195cf74a95
MD5 be8c9f66d4a9906ef558225db87be2f1
SHA1 1df02af6ad1cdbf3300cac032fb45069794c3052
SHA512 9c6f9bb989754d1df7c2e804bf04136b45612d4ac7afc71cc0bb47955216e48ec44d4e179be7fe105ea3db9814b6f90ba5001b9f1948234f4a85f635a94bca11
SSDEEP 12288:4bsfZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 686171cac66a3f0628db92d8d29755abcd8bc912495ec05960d90077e8848ea6
MD5 110659908d65737875423a1e02db671e
SHA1 8a2974b32b728ff441611d2a535a9469133396bd
SHA512 fb3de7eee2a54f1086a470b22bcbbfb128e6361160fc348c9baebd220915cae05385322426ab2dfbdfa8b5f8e04528997940a48e307ed28703c7d62569bf4520
SSDEEP 12288:tO6IU3fYHgI5bFCQuQNf9TK4apDxAt+J6HtM:tOXUPJIDCi5K5pDu+J6NM
TLSH
T187252801B666C75FC6A944321E33D5CCAB707D51EE44AB0372C88B3FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 309KB
SHA256 c3ee06a243da5146a95b1b2e7c7815b292682e98edccf7366f77d888ca27f83f
MD5 d985edd0697ddd7b8a38b722ddffe546
SHA1 a290ed6a7990795b89298eb4f6acf55dc47ad7c7
SHA512 13076d57400a0a354b44ad82b963cd5b926a780ff4918069c2d395cfd682526a5fb6fa11daefe3e6e298f1bd78125d9ea6f7894ac9fdb6f9f6c51cfb4793377c
SSDEEP 768:FU/TbdlTPBlTz2+EQMEU/TGdlTPBlTz2+EQMdU/TIB0IJoleJadlTPBlTz2+EQMW:LtheICeb10llF
TLSH
T159644111F714F329C0BA81764CB1D5ABAA39B026DF2343033FC82B9DDCB62563676A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e8046b1388fb0b8cc5a99c469fb02e86e1209bd6bdde69c064f1912075ae3119
MD5 8bb4d793955ba42d167ea24e64a5637e
SHA1 d9d2ee24f3077ad4448588727568758e9a7db75b
SHA512 50d333d970b423c473d0468304ea44cf928037885ffe5ac755c3123cb7dd6d92027511084863210c6ae5e90ac6206b5fb018ee71209df63951e2609e9b5a26dc
SSDEEP 12288:q07xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D545237B934C518AF93605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 448b1b989b4d71eb5f3889ef5e931f9eb4362c33916a8ed6dc10fd9cf6569563
MD5 782e1415b9fb4905d6a9d6cf8ca9eaa5
SHA1 ca3621b6e80a9803710eb54b265b6ef4cfb29b4f
SHA512 f6f5a5415ea6dbe45f58e5380e915b83554231c6c9334a8f8e7d95d9165ab24cd2e4552cff259b6eeed11dca5e1ec882517070671e691572cc423f7b2b10f637
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYjsqjnhMgeiCl7G0nehbGZpbD:Zgb4mBIBhGFgDmg27RnWGj
TLSH
T181659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8b204a29794d822cee715db64f3d433587b43553ec596b02bd795fb243ae286d
MD5 f3f05daa3edbbe7de0674106a42b1f05
SHA1 12b9e4461b72d8d8e0ccf7c04e5f1f69e4155ff3
SHA512 aa2810fb680cf7a7d608415ef2afd0e61f8812ae0e2d5fba5154b063b9ffc16610898704e3022e512d90b7c2d70e728f1081ab8a764d7c76477d8ade4e20e852
SSDEEP 24576:aG88u8FpJqH1bzria7/mUsqjnhMgeiCl7G0nehbGZpbD:h7ZFPqVea7/PDmg27RnWGj
TLSH
T16C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 200ad8d4c8d4b5399d80be70085fcd128a931b0ad5d0e79e543a1b0bde9c93ef
MD5 bd0441d1da4fa5bd12529eea95733337
SHA1 044ff5b3aa6ed7ef989d5d7130102e63a11f06e9
SHA512 9b7ff7985f12f33a066573ddda46e82adda3f54602afc9bbb59af849c6b0453f433f56b5035f84dfbd4838a675abc84e11f931cc0690d5569bb17692c0661688
SSDEEP 12288:BHvUrBFrEjwaQgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:BPUr+NQgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17865F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1187db448a90ec4891fcfe7a6c18818e5a3f3b7e468c24b85a64df0bd7e111e8
MD5 08e2bb16ac9fceb59f2d371ffe1830ed
SHA1 f790f672cdb04f7ed82f69afadc4a9a072912689
SHA512 595a97778a9834009a28e0072bad61f803b51160ba262f2b7d129b455003a88abedd3d01152de0c564016c5461bab47ebaaa274db4f772c09f8c2d48e8bf8e7c
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsDmg27RnWGj:wG05lO43bpD527BWG
TLSH
T1C7D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 612cf0c63ab07396347719d78b1a7a0f07fe4e1c6c35c9d80686f089dbdb8031
MD5 04cd0e5706aad041398b973ce250c074
SHA1 1b0f6ec94cc4d1f099f81e4b953e2b4468dadf4b
SHA512 e9a1a6345d43cdbfd1118a1c66e78c117af153e22b73996a95cff8d363095cc4169be771512970405c59b31078ea8a6989d750dd767742fd4f13d4d6b39381ae
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSsqjnhMgeiCl7G0nehbGZpbD:Da5POZ3BJt2pasx2+mkDmg27RnWGj
TLSH
T1CB65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6cb921a3aaa198d19a51025f600d2033cef9454f1947e8aad05bf66dd0dc1a0c
MD5 4dc5959c687d4f45d11576019bb2ad18
SHA1 91aefe7e6e3d6513a816fe7541fa27c9ad3086aa
SHA512 67e3806bd296a1cd1b4037f2cc7753da7ae2a4fcb25871ff4c74ceec5f99f238515b574c78865cc629dca6350eb2ccb40bf7586ec175abd064a40f7eca83271a
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkcsqjnhMgeiCl7G0nehbGZpbD:eNc/zEOVHFvDmg27RnWGj
TLSH
T163857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9f3cb131559ce79375b555fbd12f11df7c62b465747726d855db594e7716b37a
MD5 c2ab1d43f951af339b358b44ecca9109
SHA1 0b512affefe8a6c83d324b3be7802936344ddb0b
SHA512 7159689dcf4eae5e5427d1885d905d8203f6261f3e3c09fb46bf50e36351bad7c3f27b25d9d161da2a3499da0d25ad916720998d367e23da72246d62ef4b369e
SSDEEP 24576:pTkNvNnaFeYhJNtmZBm1sqjnhMgeiCl7G0nehbGZpbD:pTMwBtOmpDmg27RnWGj
TLSH
T1D155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 71bd304bb838dd5ba3537b4450006ef106eab67ac2f08060d855e94b6c355ea5
MD5 77ea38bcddd36a4369031e15df5a4384
SHA1 a5b7acebc8a7d5053c7238e38943feea095eb435
SHA512 a0ce87d1f79292c591af52b68f79fcb640bf3d8065d9b72469cab390ec1a72ab610c009017826acde7991bb28d5c69cc61f6d381b820af3ce6ae28d63a4c4588
SSDEEP 24576:fD3FHshBIYQgAlsqjnhMgeiCl7G0nehbGZpbD:fDVHeBIAAZDmg27RnWGj
TLSH
T1D275E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1484-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1484-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1484-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1648-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1648-292-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1648-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1648-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1924-44-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1924-52-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1924-55-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1924-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1924-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2376-411-0x000002E02EAA0000-0x000002E02EB4E000-memory.dmp

Download

memory/4428-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-334-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4428-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4428-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4832-77-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4832-304-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4832-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4832-78-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4852-410-0x00000162D0170000-0x00000162D021E000-memory.dmp

Download

memory/4852-313-0x00000162D0170000-0x00000162D021E000-memory.dmp

Download

memory/5168-309-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5168-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5168-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5168-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5168-105-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5856-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5856-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-21-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5856-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6120-37-0x0000000140000000-0x000000014020C000-memory.dmp

Download

memory/6120-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/6120-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/6120-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/6120-0-0x0000000140000000-0x000000014020C000-memory.dmp

Download

memory/6184-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6184-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6232-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6232-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6232-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6232-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6232-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6824-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6824-124-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6824-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6824-130-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6824-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6912-111-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6912-118-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6912-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6912-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download