9496f7e8a0ba394f0fff608030de657d21e794a94dae4faa27dfffe94b63ad69

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
Size 1.9MB
Sample260701-blympady2w
SHA256 9496f7e8a0ba394f0fff608030de657d21e794a94dae4faa27dfffe94b63ad69
MD5 01041cda28ff891b4b64e0c1fa3f5464
SHA1 592d1ac4ec47a552b370c4e884b50186fed9155d
SHA512 2b62be682cdb4e821a621698469cfd5649999c5e13419730ddc39d454361ed847cd0e6ed796a7f0fd45be5e612e914d803d0f6f830d5f2e915d11ad436558274
SSDEEP 24576:IxDawlOjwGXgXe4i7ojhsP5Lgrk1TWb4AN5:gOAOjAe30jaNf1TWbdz
TLSH
T109958D79E6B844C5E2BAB53881638555E222FC09435196CF3A687F063F77BD4FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1864	elevation_service.exe
592	elevation_service.exe
4788	maintenanceservice.exe
1176	OSE.EXE
4184	PerceptionSimulationService.exe
7096	perfhost.exe
6588	ReFsDedupSvc.exe
4808	SensorDataService.exe
6432	ssh-agent.exe
6360	AgentService.exe
3492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e6907f67c8444528.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021b67004f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f3afe04f708dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf972149f708dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8ab3c49f708dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c1f10105f708dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000204e8405f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000375f9104f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087c2cf04f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
592	elevation_service.exe
592	elevation_service.exe
592	elevation_service.exe
592	elevation_service.exe
592	elevation_service.exe
592	elevation_service.exe
592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5628	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1864	elevation_service.exe
Token: SeBackupPrivilege	6588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6588	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6360	AgentService.exe
Token: 33	3492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeDebugPrivilege	1864	elevation_service.exe
Token: SeDebugPrivilege	592	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 5576	3492	SearchIndexer.exe	103
PID 3492 wrote to memory of 3944	3492	SearchIndexer.exe	104
PID 3492 wrote to memory of 2500	3492	SearchIndexer.exe	105
PID 3492 wrote to memory of 6368	3492	SearchIndexer.exe	106
PID 3492 wrote to memory of 1844	3492	SearchIndexer.exe	108
PID 3492 wrote to memory of 2384	3492	SearchIndexer.exe	109
PID 3492 wrote to memory of 3724	3492	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4788

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2900715619-172032027-1873877232-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2900715619-172032027-1873877232-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2816 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2816 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 beab54f6fd53821624144fb38a4ec9bd2504c65b6c2665d4a833dde47e6336f4
MD5 85bf900b6b203efb159060177f37abd6
SHA1 8d075835aa09d93b37270c0e974967982f2fef50
SHA512 4f35ccce28d3d291f3b37265f8bcb45ce11526d4aacaa29d6ffe0e579146b8c7f3cd1a967d764287ebc8504116dd9c9cf91c4ae7ebdd06d8103a2f0790bfa205
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnfe30jaNf1TWbdz:O3q6HjBGU023W
TLSH
T1EDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b13d75051bde6d603d20a18c5d8c90c7715eea657edfad9bbbcd614a0948f45f
MD5 c9b8f6561371982c7dd87857eef334bd
SHA1 5b0535cf167672b53818fd8b01a8cc6012aeee55
SHA512 7896afc71e47482baee119d48db7ef9c7f3e640b7a5160896b9041a98c79f1118c817349cada7ffe32aa3940df650b31b4a825d703e604acb16af442f86367b0
SSDEEP 24576:1XYfDtczAWgXe4i7ojhsP5Lgrk1TWb4AN5:gtcWe30jaNf1TWbdz
TLSH
T1C685F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 473177a33f139cd0d827d53ed0bbf7846d684431eaca04bf06d71c03689b5ccb
MD5 0cf7d0d37e5dfe255ae890fb7a11f2a0
SHA1 7257a1cc16ee82d80976a2a2887303ba4d63fe53
SHA512 a62fbed2c7376c47a6149105081dd8775d33f4c659aaf19dd8972fc8d2d11476a4f9779f91a7162946f3394e69306d162f31782dff76cbfec5c9f03330c777bb
SSDEEP 24576:K0Le5ji0hmxXrMZgXe4i7ojhsP5Lgrk1TWb4AN5:KPji0A5ve30jaNf1TWbdz
TLSH
T18DA5AE26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0d6ae700a6afddfbde41602c753a079aaa93a3eadb4c8c3f617185a1286b4ca1
MD5 0f639697fed334de5286e21fa38a9f20
SHA1 7c09b65647c6e486d2b8864cdd31ff3e1648e71a
SHA512 68108457b92c37c8d573bc6a049cc13a812480fbae65d8cf797d13e07561952b5b0e67f82b2a9d0a543d9542f8472740eefe1f235f0d2f9e9360cd732ecaa795
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuvgXe4i7ojhsP5Lgrk1TWb4AN5:D/ezSC6vUzPvxHjyre30jaNf1TWbdz
TLSH
T191756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4ec34c099bf553c56ec17cc6d255c05d54e7496b36b2b79f48b5df5ece5720cf
MD5 fc933f9431a4b656d96500aa852fe66a
SHA1 aa54512a7ad8938b5c04c336c9a7892f6e01166d
SHA512 11a6aad443a780af9067ac153b4fb2dae057185e1a811a15bd3966679ac0a2e4d531ca970d0742324460db9358f9ab28914e949939d1b5a2fb7b7683a3244eea
SSDEEP 24576:2VbqPb88hv/l+66gXe4i7ojhsP5Lgrk1TWb4AN5:2VO88hXl+Ae30jaNf1TWbdz
TLSH
T1D4559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 af81d994c60a6aaa8d6ced9c17e3c179e838c2c0993391dd66ec1b2762625eb7
MD5 c59b393683dbf3df98f091abeaf670bf
SHA1 e72f63a50bb7e868943032e3a44f9634c69430c6
SHA512 bda0b730b66d740d6d1e68ce95dcab91719a2cabfaf4bcaff473ad75598e48e0b5009a7b12a5b862f849a8291e7f1c60f8acfbd0b4ab2197fd99d25baeab4614
SSDEEP 12288:o3s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:o3NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EC7523919F5409C6E38FC3F4A0F7CB91E9E11EC061448E6B47E0BA9358BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 ad0deb2d0fed106d9a8803bfd889f16975798c2ad971de62ce0ac2805122fa5a
MD5 b76475cceaa7d5b88d4aab9afefe4b95
SHA1 42f313ce66e95e445efa4ee6ca53a29d711001fd
SHA512 a9e210155a05a11b1051f9d47206e4d3744e7872b1704096a1260d6690cbc9f8ca31850dd77a1b6e68608fb75682edd863fb0110b74a18221b680ff980cc4f90
SSDEEP 12288:BeBNUbTVO86UV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BJIUigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10085CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f7bc33da4f8caab881a921e3497dac77b62ccaf44f539ef06fc1e2b2f74c2d3e
MD5 f96c96390b016f5babe9c1cc967625ed
SHA1 3c667ff25795dc435b03348057ca815a0535f29a
SHA512 5d478c9a86eff94c5d01b7873e15f0476764425cb5eb0287550e269b0396c492d03071e53265df2778db3de3a6d947f7216d9327a79ef65eae3c95756af11ea8
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:1QvGAdlCEL8c/yRNw5C2U023W
TLSH
T125267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 af5ac446bcef07cbdaad39abab0fcebe5c534273f78709547ad88fd3a2c641b5
MD5 0bb1bdde261551a359a55de250903bd8
SHA1 af727dc97e5d67ac152c7da05370ccd8abaa44b8
SHA512 072e0832c2f3878abf27c8e47d32d577cfd2996404a7a78b6e86308966a22eab5987c3e2f2f035f9ff681c71c26b3df0b386082c1af13a6d57ea5f19c2722df1
SSDEEP 24576:t0ewsAjIgXe4i7ojhsP5Lgrk1TWb4AN5:Wlj/e30jaNf1TWbdz
TLSH
T15E95E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 da2f2a87302220a74b21ce664dc28a7876a4e599042061e46a03d8b4c611c17c
MD5 336dd64f200ac7cab1d6d5b250aed740
SHA1 f48f762b35f2f9634c7ac02e233a6e6b9d747f7e
SHA512 fd3d2b760ff58144bda7cf7c9436912c9a670bb8c71a3d96b5b77358136b66408892f33af925deccabfdae48b730293bf6d82dcd1ae3444e908aee0f063cfcc9
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnp4W:AUEtQevvqc2W1cpV2EI32p4W
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0d71d4f0140ef740f2c61bc88bc7dff812cb4a2636042ba4158c223b0c96ab91
MD5 94b194377b8279e73936d307e9021b4e
SHA1 ee1471a1b41d24a201a763704193780b347aa4bc
SHA512 343d319c011e641701043a3db30085f579adb840900a0289c1162b1b0846f3e5944a240cd36a6a36711b82cf6c0ca48880aaca032145d81460ce2108ac39e5d6
SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/zfe30jaNf1TWbdz:zoqtVjnmyU023W
TLSH
T13ED58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 42d81a5ab485c7c999cc82d961e6f9269547291ef2ae3b7b8d4b628da1df131c
MD5 9b42aa9e8b0bbec38ec816560e5bc7c5
SHA1 3f0062ce9e76df968cb1312b889d347a0b10c3d4
SHA512 29e1349af52dce7c1b898dbeedcdf1d612a22f32681bc322cfe81565eaeea3dd322e5ee47ff2fb435238e83bddcacb3707ce3c3e59452cb40b491efb374142d3
SSDEEP 24576:2AhGLJIFoiwtA5l7S53LgXe4i7ojhsP5Lgrk1TWb4AN5:2AMyFoiq5Ce30jaNf1TWbdz
TLSH
T14B359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0df51d126be06caa5cc916ac97476a95efe784e304ad9bef1aa781aeb15d6d12
MD5 f6eaddc2a07de638ccaaef49ae2b5c50
SHA1 0795bb9750791177e7f51d5d71b10fd2f9bee0ee
SHA512 54763f35ff562bc6472becc3ef7fa3d7b1529881211472761574ae987e30fb371dff412f72cd33ab6901a4d60ab350e4378022dd27faaf21da630e0c4abe624c
SSDEEP 12288:omw5HEjsChNCBFgl0WDm+CW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:FwubOWkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18885E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 9d3f0bff1783eb8825d49ba2ec708351c5b3930b94b08bbcdf0c740553eb7424
MD5 e57d785b25ba7df8165f9be78e056127
SHA1 f07cd2e5440335e3c51b25b195ddf03bd8e272cc
SHA512 7d100c8dcdbe174179f4d40f9983864d929f43399eaf3752d98be550c9763dc1ed6867fe329499ee7d6c73499f51813f9e55b6b59c8181eca466bba0eaeed0eb
SSDEEP 12288:CCZ1Iy70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/ZuhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17D75129637D420F9E2978278D4F68741E7B23892233147CF02A096A71F76ED65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3a9acb1c2f10c5ddf207455ca11478709cb6479de5cbed48ae81b1cc0ed43f7c
MD5 005a0df9444e94d2355b4e36845306b3
SHA1 8064cf2f2670b48ac0484c0115919ee18baca18a
SHA512 b69d1b6dd9cdeb27a8d89f84691f34c0e51895ec743e26c62e7868d5c621a2ead8f0b0739cb6591885bea98801878e1371e4361dc07cc763fb6c0c289bc363b1
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:OQRQyi36YOcPQLvw2gAf+PN3xU023W
TLSH
T1BA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8998332030a4ce7b5a309b958886a4184b43ace4f9175da314f3604272f56cab
MD5 511a522ae0e744755bc8e25e3a91ed19
SHA1 76ec559aa5a5061dbaa2c64cf923b67b70596f98
SHA512 82a9043bf3b7def3b40fea307f3250c8fd15ab3e72663cd25c774a0af2f7a50f585d4892e29de4852ea5b8c84d7806f403d893efcbdb649b79bdccb8cd3468b0
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:oQRQyi36YOcPQLvw2gAf+PN3xU023W
TLSH
T1F8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd853532d97ea1a4213afc6d05d642cc77a69a86d57d380b85339621448fe9c7
MD5 82b4dea9384e0b6d3fe2a3195506f523
SHA1 e989f4c3089ad666f5425fa5f233db5c4ffb801a
SHA512 9d9db3d0c69b860679ccaaa6568a25969d4216cef0477f7e43441fe0a5c66fbf16e71ae3d7a3022a4ed8cf9fee9e23b9b663ebbdcee7cc69f353f9aff2e2b489
SSDEEP 49152:U68Qg55nhheWu7PNU3/ve30jaNf1TWbdz:+thWRc/vU023W
TLSH
T1C7B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 26c073c155891994225258debf1be84648225fa7a6a1957e016c184334b1c389
MD5 889d0bb608b18ba57bb423ee36720bdc
SHA1 83b75f61ef001853c9dafe64950b1afcc9bf351a
SHA512 de9558764d2cb3bbcd7ff2bcd2bc8cfe0327a16d03e30c3df4d85ccaf63f9f8c7fde107e7a1f040471bd16ca6a05b0067e65412356d16e7c67f560b7ee02ffc7
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:sy5112gYy5azzVvL69nLKnhZIU023W
TLSH
T19D168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f7a235f2450327f5decac13d084f90e8786d05b81fbc90bf956bfece864bcb9
MD5 5a2d4cef81083a2c96cce948c82ea05e
SHA1 9e7a68053a05c2596e3a8fed065bba4f02230d05
SHA512 4a24517b6ff1894b8daa95f56dbb37eb8d32d2d06027adfcc7b1b6538076cf8122a441aa667c749fc95000a4e8cf3c3569c905aff0243916756f2baf77822c96
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKe30jaNf1TWbdz:fu6JmVxd2dKU023W
TLSH
T10AD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ffbc03a0bee4870c3758914143cc3a72cd57f0159c0da7ac35da185bd3284846
MD5 5e79d2ae38b64bc98e531795a0bdee0e
SHA1 bcdc16c05afc93ecb3bcf2eb19baae5dfb2cbcae
SHA512 6e860d17f2f45e31949b993a80ad3be79c19749e4994a6bcef19ac56cd474b46c1324fac2e12355c9372e9e9d04d9df47fd215961b31f035a1701294d204f925
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xVe30jaNf1TWbdz:qmifPbRyU023W
TLSH
T158B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c7b93f0a4cd681002f150e20aaf01313deb6ac510ef159e36c908175bf6b446e
MD5 a92f404ad56577006a140c48056f3b09
SHA1 ef3c4c30a7ebff5c7abda2eaf4da520eb67fef78
SHA512 69b944fa41ba373550eb457dafb1b5805cbe4ea111ed7cc2a04a2a0d656b7628cede80f3c2c242518acfe5646f5924607cd93ed059f29f75c195a30167376362
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqce30jaNf1TWbdz:g5dKTi61cU023W
TLSH
T10AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c13be26e340756d95e2dd5fee0708c0c5446854468b2c0febc04f49e1ce25c21
MD5 5198eb5337619795f489693601a408f3
SHA1 163d87fbb51c29dca8da2d6c71c4c44dd213757a
SHA512 a52a23fcfe4ecc4d2a5432d68d72a240a0343c1eb744bd9b24178c14850068eb0093de4cda57daac28e3f1996cebc44ba70bc75446270d2bc06e5165ac737158
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5w5e30jaNf1TWbdz:WX2iypheU023W
TLSH
T1E195BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 c1020610b2200d72a063ca98349467c0baa00926a1b8a6787068f5d223149285
MD5 691076f0b5b63b5a2189c439a92aa895
SHA1 9c55b74040bd599f825965a303153685a1360edf
SHA512 6cf20a13b6713ed589c9ef9a718ebc16865ab096e4f8b5009121ba28e178fb0c268192ae137c51aa210191aaf621ae8ec54bdd7400c1aeaf5544db65ac797804
SSDEEP 12288:S00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C3752391AE550ACAE34BC3F0D0F787C1E5E11EC672444D6B17E0B6531EBCC9A6AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 c23eac918ff4920d318c51c03fba67b7cac7507db6ed96ad0a0f40cb09f2d882
MD5 1dec7ee73524cb2927332020f209063c
SHA1 d3e368b29fef2485f10ff2c5127064353eb5a49e
SHA512 afe18a36edab2242ab88122cc76df8ba5537160a2d15f45ffb895621536dd72d5c982793ffbe4c42e73b1da9384017be603a6aef844ec74273a5994ff4436e73
SSDEEP 12288:Dv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:D8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1287523A1AE5509C6E34BC3F0D0F7C7D1E9A01FC672404E6B57E0F9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 6e4f2f5477cc2239b2b82496958ade4b6962ff092df2a9fae3813217da59d53f
MD5 47b78d620d3ca50c492742c3871c857a
SHA1 582bd36f0f41c6d26905b192cce37dbee5916e7d
SHA512 9d739b602e55605b708ebec9e60a919d2b07ccf6e2834e789d54eccd5010f605425779f4d7a22d2c80e1599cb58f821c34ffeca2bfa47f2ec538e835f203904c
SSDEEP 12288:2d0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2KgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B752391AE5509CAE34FC3F0D0F787D1E9E01EC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ededeacf8842d6654fbcacf30e37273504645e80c22f2d8ccc656b1534474bd7
MD5 2468264b435eebe5349d41331b63a61d
SHA1 b2ac843fa718239d35c5f0a4d954644b03efa4b5
SHA512 4aa4984fc08a4c35df83e970cd2f97c281082dfe5bbd328f69296c052d390f6a4f93683bcab74c061cbfa7bd8969bfd189e3534f2d4c72a4479359eb1b87bee2
SSDEEP 12288:/Vy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12B7523926F9905C6E18BC3F4C0F38791E6F13DC173118BAF47D069530EB4AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 4263a01f7c8f1db68a98cd1c9c6d8aa441b5357d4c9de65465ccfe401c8d24a5
MD5 240cda0d90d2c89408640d9724892d4a
SHA1 57f72173113bdadc206967bea9e26ab4328b7e9b
SHA512 8959cd48e27d8996f204f5dff978e1d65ed41c5d33f97c6b16fee12d6addb773da9491860205d7cce9fe1b2fec67367bf8a4dfbf4c1f02310244005f906ecf65
SSDEEP 12288:Vq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T192752391AE5509CAE34FC3F0D0F787D1E8E01EC672444E6B57E0B9531EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 e3680e55e1ab663170dd31e1cc87ad494c88417279fc5ddbfc93060b0e50d87a
MD5 fadb76c827c9a4aeb3c7d3e3553537ba
SHA1 29a210815cb72e5554ee0218012e1613ca3b3922
SHA512 83491845ee78de7524835412818d094f3a29334ad1033d02c74fb926655378ab58f0f992bc4d2794398ae5fef6899eede6e17b13eed4e3ce2380ad3dcbea1862
SSDEEP 12288:bT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T152752391AE5509CAE34FC3F0D0F787D1E5A01FC672444E6B17E0F95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 341e6bb68f75b50dc6211f1b1eb21bd51b0037420196ef9193e982e7dcf49cb4
MD5 c0b879ce0c77d4a2e31c43018d953dd3
SHA1 13d81d78230a3d4ab3b2904915a7bf419252925d
SHA512 314be6e1ce61f6859f6d5d6b0da6627e8fec6f89b7693597263f3ea7f0a0fa3e44454a20dd4e52c81d9f0d894b7a030973736a28c8957b1b5294f9380295a574
SSDEEP 12288:qn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:q0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FF7523A1AE5509C6E34FC3F0D0E787D1E9E01FC672444E6B57E0F9531ABCC996A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 2dda768a798e119186714699bfe25d6611bc8b055d9fb7bb3b5f6210a3d65d7a
MD5 1014d7115fbb9073bed97fa5b8a51532
SHA1 d455cce73471d433726a167a4197eca19f0ec3d8
SHA512 3ba55b9383d76567d949e984b3f5e5ac1feae6ddcb6a06e46256b68047632c4c8e53b7b30b0aaec227919095f2be7f4a2e337e4625baff840e0158dac0cc3c79
SSDEEP 24576:7ZMzzFVSOcgXe4i7ojhsP5Lgrk1TWb4AN5:7ZMzzfHe30jaNf1TWbdz
TLSH
T150850195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 d9d352d0cf2c8d16e9b41710ba364071298a309c9c06116e7656c5cdb54a5408
MD5 26e4d42c4233f5e84a9cd679e4ea5963
SHA1 1ac333d3992455afc8f7bb69eab77dd180616c2e
SHA512 84a83eac883d79686d696b09a3bad5de6aa9f79448a5ede74596d82ba3bcbb704e012716624bfc249e6fee7b41dbb9edf470ec5cf24cbcbd009be5ea3414144e
SSDEEP 12288:Hw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BD752391AE5509CAE34FC3F4D0F787C1E8E01FC672404E6B57E0B95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 f96df8aeebbb5dd0d90df7b1a09481e3ec7deb093e16403353a9c8a9e733390b
MD5 a3ecc0905a50c69e635c4baae37bd596
SHA1 24d66293536b1c2ff728fceb4dcf4610e3baf294
SHA512 7f3e62ff66f67a44aa656ce49f8a21e009a18317d6761ecf650d3abcdb46ec7bbb22239905c164bcb1b9e53443a1fedbce7fadd873bd552542dc12f4d7374395
SSDEEP 12288:U80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:U9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BA752391AE5509C6E34BC3F4D0F787D1E9A01FC672404E6B57E0FA531ABCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6c4845a42964eb97805337f62b300e6dee1722b0561dcad750996e3eac1a8c97
MD5 574f8740afe85fb77cb74ee5c81a2365
SHA1 7c93eee382ceb5df5ae1c2a890d21e5bb05ed3b1
SHA512 92833772d793f6b1c05941a599f2c2ac26d002dd354e0e84b91f399a6040b22491267c5a29bd7637398d88926fc34ec97bc22de8ec5a35081a33ca60a69eeb18
SSDEEP 12288:wyPz5L870DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Bzy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AA85025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 625e0bfc92d7968487b4a1fb2b31e59b6bacc74aeb75213ef5a802246d687441
MD5 dee0077c8f09221fbed5f632bce2c94a
SHA1 9c30322b5b2ff4fce8315aeba9fcebff8c504677
SHA512 6c0e68bb36389f226c97cec80a4179cf565b776958352d19e3e4485f07522e2589ad510c308ad38049ad4e26b387c6eb2670625f69e2736f94776c50ab3e5e04
SSDEEP 12288:uw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T112752391AE5509CAE34FC3F4D0E787D1E8E01FC672404E6B57E0B9531EBCC995AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 7b941fc548524f09d551c3f2a143e7182d2259482e1bcecfc9989f0d2d021f16
MD5 d0eed71fb334408b43c6a17760b11844
SHA1 72a79bea3be578e99062c559a32be9ebd7f729f0
SHA512 105754ca461f5cdbda3d66f5fd630b4529e6b60ef201798c081476848d2f005cb1591dd7cc8accbb59915eb7b0f02712edcc0e8e7ca245a19e6322ea3106920c
SSDEEP 12288:kw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F9752391AE5509CAE34FC3F4D0E787D1E8E01FC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 dd3175cf20180e0ceef17219d70308deb5ddc2758dd6b3950d5e943e510c6e61
MD5 f32807794e20dfe6a012ec266552eebf
SHA1 7e69c18c01c6d37b93ba9faa304e3608aeb8aab2
SHA512 edd7bee83cba5dceadd7501a2407cfb34d86765d09cbf632beb725162d2c5a132de4a833ed8a86093909254530e3928750a1b971b0f0fe065794683d1089d6c6
SSDEEP 12288:hyPz5L870DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wzy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A785025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 2dc40209a50bf18e3662585ba11179b09d0aec7ff66e2831a1fa3ffdf827ee96
MD5 520103b627e8404a6f015859a9457dc7
SHA1 2c70453ada84ebaff7b8128f36cf5c9c65b0c4b4
SHA512 120da50e87645d968f43ebcb7d9109768325d00ac3251c8a26bd3470c33b32b2d0a35dc0e73e336a10485101c22d93766bdc1495f8bd2f316592616868d9325d
SSDEEP 24576:aToaLl3z0zDagXe4i7ojhsP5Lgrk1TWb4AN5:aTfLljme30jaNf1TWbdz
TLSH
T15B8502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 775b36d97c4a08c6f6389d52a799c617a1e733c0be8f07a687b6b5ac14fd51a1
MD5 4347fe0d2b877320d8b7407e26faca59
SHA1 396db29342d5b628dee5d5c09964eeac4af93b95
SHA512 fe6d465b72b3ec6f62bd40448fc05f73e907fe7f095e66eb5c8de47411677bd6562c9e1fe636cf442c3591daf4d3fcc539c3778d3f8d0241cf40186dd8545be9
SSDEEP 24576:i3cd9CHKy7GZ+gXe4i7ojhsP5Lgrk1TWb4AN5:Ecd9CHKyaHe30jaNf1TWbdz
TLSH
T1A595CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 89b294d1179f349e19df2b5e402d32dcb096dbd0b5619904a665f6b32596778a
MD5 7a7d02fd8268aafa923c1688d23179b7
SHA1 ba36d182f2b532655d49846e5ef46a32cdbc5396
SHA512 1ac3c7d24dbc4abf03bc8dbb4494cc7776c5312b0c80bdee9e10e8f62ddc2d8cf7cae1b75f8717222ba9fa2d355d79415f4aec06c2b8841df08dfba2fc28db0e
SSDEEP 12288:B90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EB752391AE5509CAE34FC3F0D0F787D1E9E01EC672404D6B57E0B9531EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 9610a2c9fe829d1f36f938995ab4a5bbf2eb76052476305d0f2ff3e9b13d2ed4
MD5 4ae32a6573d79556b91a09fa55d21a5f
SHA1 e2ba3aa51262afeb206f348292374753f138fe39
SHA512 b42c0a66b31ef7a72b5c011a80ce01c6dc2718b907967a224ee2d852153486c9e274f7f66f9c224505299cbec922860a8a158553a625115825256129361c4209
SSDEEP 12288:2b0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2YgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1587523A1AE5509CAE34FC3F4D0F787C1E9E01FC572404E6B57E0B9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 f4708acce37ce891e044cf19fbade946f7b26b740950482048f03f737b63df90
MD5 db30a975fc86945148d4923f39538458
SHA1 b213ba44c2bb9cbee2e6848de0507bfe70ccb05d
SHA512 f0ae02b6aef826edd70dc19ebad175d6f10b9bb3d897b1c9b29116244233a5681a0950fc51e3129a676eee56c216777ed785d7f956f0ba953f44d726062adb3f
SSDEEP 12288:/u0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/HgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DC752391AE5509CAE34BC3F4D0E787D1E8E01FC672404E6B57E0B9531EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 4d48a66a5e1f49eb85ec4476429e34327301f7c1313945732026fe85bde7ba3d
MD5 fce5cd4a67f96df86df6f3c426440868
SHA1 67fdb5118b5f3dc990da178729cf1990a786e9d8
SHA512 5c489724744a6a85a94863f479f03d6b6d9a8dbaac99dc227715a561d95404612f65de82f987b590a4397d6ba417167d4ea13fa301e3d2b3c1c389f673da0833
SSDEEP 12288:vw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F8752391AE5509CAE34BC3F4D0E787D1E8E01FC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 ffbb258f5b5cb37de5a400983704c07d5e3eee9a4cdbaa1aad8a22c60c2507fd
MD5 07d592503d8c6dee63f40fb4e1d1570f
SHA1 7b0cabdaccf43875ea1da17c90d8c09eb0a82209
SHA512 79fe84fb22a8569b958d171b0c73a6ef59060b1f5322ec8416b7b6be88dc0bbce52eff883d6e65c958f15ad7c970751efb1e1e131c9f94503d2ab6c40c2c1ac6
SSDEEP 12288:U90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DF752391AE5509CAE34FC3F0D0F787D1E8E01EC672404E6B57E0B5531EBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 d368d48701ff44d55ddb5267edc3bfb2e531945fe931070ac6ea5f64858a5580
MD5 712fea6a87aed670b933a0f34d70b14e
SHA1 661dc28c2126ca6bee9688f42df12062032711d0
SHA512 ed69d401a411b96763033934c1bd9c909f5488368ad7dbdcc2d26c7627a4fff8a92c5a20ff5f52e6cd8d339e3502dbd69791cbbd877c8ee9eeea3e840e5e7abd
SSDEEP 12288:AI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ApgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18A752391AE5509CAE34BC3F0D0E787D1E8E01FC672454E6B57E0BA531EBCC9A5AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 a60c46d3eba34a3ba14cec90f8c0e4f51b1fe231962ded45736a60cef99e2688
MD5 7797f71569838d2e046808827dbbd5ca
SHA1 5af30f8b122627d644b5a36b39ccd06de72db4bd
SHA512 c90c2f936565638af2df3b319d2f5b07cb824abf489a43435de949ad12683d0734b2ef5a9fbd996879a53b15b45f9328ccfb24f28650819d5c47109cff13d2f2
SSDEEP 12288:Vq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EC752391AE5509CAE34FC3F0D0F787D1E8E01EC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 dfcd8b116c8d433c57802255a838d8123ece28500495c5c8241d7f966078048b
MD5 a809ce2435f55630ea9eb5c7e7b223b0
SHA1 3a5c9f62e9b1bd60cf3e371364475c2d18808225
SHA512 3115730ab5d3ec859f672bcc9a2fb98e43cdd6e02e494f6771df1bd749d3e7af48591e5cef4acec4931001ee8a8b5284e64f921a88ca8e5e46987cbc5c52ed6c
SSDEEP 24576:Rfwvzk9RX6wkyAItgXe4i7ojhsP5Lgrk1TWb4AN5:8MnYIoe30jaNf1TWbdz
TLSH
T10495DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 11a2e23c7fe6c2e63746cb41adab6a0d17a46a9d4e1d0979a657ad1b1410cc7c
MD5 b56c17b200cbcad912f266c60bb1131e
SHA1 d76a4575124fb72819d7b905ddba8b0bab6a55db
SHA512 945378ed6db0e594642096196bb6056b3e2487b099f2ab5a412eb47bf23b413dedf5ae028a21fa63ad580af66fab8c3bf2597f053826f7ca79cd1dd2027795eb
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ze30jaNf1TWbp:wySzPRU023W
TLSH
T189067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 29206944c56a716dd40a0eb192d18e96ae9fd42dce4536dc51f0fb9be978489f
MD5 a5e62f53fc14c5728bce01588f7aced9
SHA1 3c75877d7606347fde544ba4111e382706aa7b54
SHA512 0b8354bc9bc79614d6912ed97103dd6b329cbababc3b50866427268009bd2b7eee1ec3f7da6054ad541be19acad5aea1b35b49d7d6967dc4f7c8f04f16796fc2
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYMgXe4i7ojhsP5Lgrk1TWb4AN5:P47JUQj1irIhCnDHUPfF/pe30jaNf1Te
TLSH
T12765AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 23a685ecbc4cd3ed82f258af80f642213eff9541027657927c4e29c1f153e0ae
MD5 b99b60a317e9fb229d5bbdfa9f8dc27c
SHA1 79732f68e1dc07cf408d6d5a969f8f72bb045b37
SHA512 d1b5cf6863f9dca0487f5e507f8b76e73d6f824d292cd51aea3d54c9ff5b4af5f1d50e0142e025303932efeb3fcb1037c01270dc7fbd2ecea83afe2690769c09
SSDEEP 12288:t4sfg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15175F15AD29802D8C06E92B5C3968A81F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 de6af4027ea5dcb57a4d602cb841ef2b49d9b65bc0d0a903080ca8363d3b4209
MD5 87e5e326668bd9a99238653b587b0e13
SHA1 4ef8c99835781330de966cf87247214a4a9ac8e5
SHA512 ae8595db8789450acf1729d3fa3b5e5277d1705c222b7d29f410319a43ea6ffc80d09f6a7988cba585986aea205b78dc48163e79a468dd79ea88a762b59596eb
SSDEEP 12288:s+dy+v2U3fOtsjSbDJgMIw1POjyJRMaFOdSihJzkQD:s+c+OUPORDEiPyyJRMaFUS6Jzz
TLSH
T1E1350601B626D78BC6A950321E76C6CCAB707D41FE05AF0772C84B3FD476658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 43a136ede36ecfa1ff74e33b5a01c50d01be8cf49a175c0bf796842aa2e842cb
MD5 526408c312cf19b9c92e59e2af3be389
SHA1 37b6f7a687127c765cf49fc7c10cb6cd0d4615ae
SHA512 811e04f5ea526bdfde7686d27449e39e5fbb904f90706514d4aca43f237f70936ae944f91dc8815ab62f87b0c67025f32b0f4dcb31204b590261cd518d09e1b2
SSDEEP 12288:Fn+3pNwBSQSfx70WicmKpxV/r7SLS171cmOvOvFizVKSFk0pBW9VKtgbSAG63LP6:Fn4AcpxVFZtm+52gGh6tQ
TLSH
T13C551901F5A7E74FCA7E5037433686CDBB749C02BB493B05638449398466BAEB5F22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 35e5cc2c1c5e552debdec9732400cb3196007eeef87497d18f1236ab849bd2fc
MD5 85c038a2a6bd699ae1aac071a3ea0a38
SHA1 f24750393ffc67fd33f7588d87159bf9510ad04e
SHA512 32c033e2a5f4544c24627a53fab59fb53ad64ca3fad441ae8660cbb8414950b51d65002ab3f617c08f5d679059ac1c2110107a64c24063039b3badf4f5ae687d
SSDEEP 12288:Qu740DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:n5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14A7523629B580DC6F29FC3F090FBC760F5A53EC0670089EB96D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 81ce61eb224f3937e9dcad6234f00ea2acc7f56b2c085d0efc4930b664d71a98
MD5 e4030d5a4f51f338d728ac354d795d2b
SHA1 88a6001c952d1296f2e6b25798779b9a47ee999b
SHA512 7f651a496272c03357053c3dc4d31978accc22c2d3a1022a1898e3dee1d873b9f3c240aaf65633b03ee69287bf10d1b68d40b6a9f4da08bd3f235ec67f87131d
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYvgXe4i7ojhsP5Lgrk1TWb4AN5:vgb4mBIBhGFDe30jaNf1TWbdz
TLSH
T1E965AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 503e964a1287ceca085458e68ee86aa9dec0f180c48255f7ccc356fb174a411c
MD5 f5dadafe4c0d8ab647ec36d3ef564e5c
SHA1 1b505c79f5c2b0865a693612be2ef34806c93f48
SHA512 d7701de9f0b32bd2dfdf5fcfb7280c881e203b3f94f53a39f97d04f57878710a062d24c60c58568772d89f1ce075b586b50f11d4c84f7a52a2cb808a65894088
SSDEEP 24576:GG88u8FpJqH1Ezria7/mcgXe4i7ojhsP5Lgrk1TWb4AN5:N7ZFPqVTa7/Oe30jaNf1TWbdz
TLSH
T170A5F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 98517564dd79fc82af5ff280a2169021a236b4fb0a8f7ac4d6caddb0d9566777
MD5 7804bc2d52e1e940ad90a92b959deea6
SHA1 83ee00cd1efd5945cb452139c9d3ec02728b01a4
SHA512 65b74e71929ec289816dd6fc7d7ac4b4ed06e76210d29759ee0dc30ab6c98d8e2cb817f58e6afd3e573dbf2d6b7f897e3759757d3445fa4dc55d85603949c50d
SSDEEP 24576:sPUr+NQAgXe4i7ojhsP5Lgrk1TWb4AN5:sJQHe30jaNf1TWbdz
TLSH
T16485E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 919c2a63b77257f27f40e197be028e6e87e7bb8f9dcb86c1e1bf1ffbe2da5c8f
MD5 c75ec2254df025a1775e18a0452b5aa5
SHA1 255ba37a8c25224fd22118517feba2dd432f5524
SHA512 35898867f0b90c799f2c4d2812c15269951dd2bc161a86222d98870641454429c48529828551b7362d1e2271daba36f5a3135cd235e0295d14fe2c51e71c2564
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3e30jaNf1TWbdz:RG05lO43bQU023W
TLSH
T1F2D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 126c524adb90309d103d1b017dc0c94a52bc407a5bf0fd776e3ed7e5b2d73a0d
MD5 55bb853bfb5c7b04f05e901797db6bc4
SHA1 09d2f66ec2f3a87fc53b50c4c2bfced3217e0f48
SHA512 268988a0a6d349011c22d37e5616e8f702a75f9bb508c1c79adcfe20618f334853d5e398bb6adb009a63844a776c3119b7a33547a25410f8ecda74cbce6cde91
SSDEEP 24576:Nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2gXe4i7ojhsP5Lgrk1TWb4AN5:9a5POZ3+Jt2pasx2+mve30jaNf1TWbdz
TLSH
T1DF65AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6661b025e17d4d4cdf092372d25e3d8fbcab3c9630f9120c269175d26daec879
MD5 7750c94906e0a68ca312e5fc980320ba
SHA1 5ff849afed85da9fe5e3290b7ff7969bc777b5cc
SHA512 ada827660d11c5ceaeb9a077566d8ece806a5b67ba3ca869d699b15f83c8b41c26868ca1501e4dbbaca417238007704e9969c4160cd41ec4fe14388e934894f4
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkEgXe4i7ojhsP5Lgrk1TWb4AN5:iNc/zEOVHFue30jaNf1TWbdz
TLSH
T1D3858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9e923ef19fd3d8b6afee5e654e4528c0289606cfc7a2670f45a94a4351e5f362
MD5 18d072ac569df686860ebdbf445541af
SHA1 7f35109146491559a55636236514f7725da09fa5
SHA512 75812ae45218fb1c906b04aae87df8c7238e62fb6da6e40b2a74c9587df57e7295490fad43638dfe07f5066df8e7eee39e0cfd2cc90e17c3f7384e950163b292
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmXgXe4i7ojhsP5Lgrk1TWb4AN5:v8MwBtOmee30jaNf1TWbdz
TLSH
T13C55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 95de32d247dce36812ddde6807871cf627f6e992dbed221a7cf2d00cf47e1291
MD5 8c56bd620377eef5363f693334f2d985
SHA1 6911b5e4f6d5cfba6382be309ac3cb3952e49229
SHA512 9746930451a11670a0bd00574f98fd3538c5b3251092f1449cc1a202f55ddcc4e5ab3f739edb74351c4fdede133cd16885b62bd97d75b2980a38117febdd841d
SSDEEP 24576:AD3FHshBIYQgA1gXe4i7ojhsP5Lgrk1TWb4AN5:ADVHeBIAAge30jaNf1TWbdz
TLSH
T19D95E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/592-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/592-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/592-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/592-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1176-59-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1176-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1176-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1176-298-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1864-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1864-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1864-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1864-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1864-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3492-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3492-321-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/3492-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3492-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3492-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4184-78-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4184-76-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4184-70-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4184-313-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4788-55-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4788-52-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4788-43-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/4788-44-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4788-57-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/4808-112-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4808-106-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4808-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-318-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4808-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5628-29-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/5628-6-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/5628-0-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5628-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5628-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/6360-132-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/6360-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6360-138-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/6360-140-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/6360-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6432-118-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6432-125-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6432-317-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6588-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6588-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6588-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6588-100-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6588-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6588-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6588-335-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/7096-82-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/7096-88-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/7096-314-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/7096-83-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download