3ac123fbca40f92c66328a14e9da8d1a06d5f6a8eab9457991430df56a631cda

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 4.2MB
Sample260707-msfagads5p
SHA256 3ac123fbca40f92c66328a14e9da8d1a06d5f6a8eab9457991430df56a631cda
MD5 31d660a33f31aa0adce30222c3d2e111
SHA1 61d08b3a6fbbc8e1321d6463a5df6bf3589c38e6
SHA512 a3333233a99ef5cde254edb2d1f6c9347fdad2685e4150fc3d8648506fc921b0085f800d4a6fb8679db00ed1af905a308e95353fe00ca0cfa1c54e023d244ec8
SSDEEP 49152:jTmKl3AudBWzdseP3+B/c5KgGR+3Dv66mG:0ud69KgsODv6V
TLSH
T124162B12F7660DE2C99380B0CD776B22CBA6BC780BF007736B7246CE697A6D03566745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5968	elevation_service.exe
1900	elevation_service.exe
1848	maintenanceservice.exe
2488	OSE.EXE
4148	PerceptionSimulationService.exe
3516	perfhost.exe
4248	ReFsDedupSvc.exe
608	SensorDataService.exe
3688	ssh-agent.exe
5132	AgentService.exe
256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7bbb472af6ecc35.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b0ab8bffd0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba3cd5bffd0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a423c77bfd0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035a3cb7afd0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1272	2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5968	elevation_service.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5132	AgentService.exe
Token: 33	256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	256	SearchIndexer.exe
Token: SeDebugPrivilege	5968	elevation_service.exe
Token: SeDebugPrivilege	1900	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 1332	256	SearchIndexer.exe	102
PID 256 wrote to memory of 1892	256	SearchIndexer.exe	103
PID 256 wrote to memory of 1428	256	SearchIndexer.exe	104
PID 256 wrote to memory of 3244	256	SearchIndexer.exe	105
PID 256 wrote to memory of 5980	256	SearchIndexer.exe	107
PID 256 wrote to memory of 2996	256	SearchIndexer.exe	108
PID 256 wrote to memory of 3624	256	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_31d660a33f31aa0adce30222c3d2e111_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1581435544-3586420778-2104125077-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1581435544-3586420778-2104125077-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2656d500de65e5d46a110151427dc2a04e4bd5358f3228f247d9fa9e64920303
MD5 1c007366449fc9fd0ecb14c0858c8b72
SHA1 d340875950f2b28fd9cb167ea71fa73ca60808d9
SHA512 d288be017c9a87d79c43492efaa2c0c91a9be6abe182f01c75909a2e64d3727f901b8235f4bdf66de844d54d10292b9730e09b38bd0d00cd7de111e2c9c8e9f7
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn+Dv66mG:x3q6sjBlDv6V
TLSH
T1A8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7aaa490bed9937c248161bd77fbab68a9294b2a385da84647c8285d22fb7c72c
MD5 3052d66d4f44e7543e0a18371ca00ee6
SHA1 5155f74201b66e81d0660f4b7fb9e94217a1c9b8
SHA512 ff9d8b0c8c32182784a9ef58d24f4a0ca63697cf6fae31d0f2a388caf86997e6310e615ac75db3623ebbdfe6f5c9ccf9057f176e90f39676e867e4c821721bf6
SSDEEP 12288:V1XLsswWkxy2lRq2czAjXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:7XYfDtczAk743TvRk6NwG
TLSH
T1B865F12873E408FDED77827DC8A28512E673B85547A0EBCF03A499251F232D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c14853db6277e98404301853798bfe13fb0694175f76a97aad3db0444bded8a2
MD5 606030bf905b135b52ea19c828f0a25a
SHA1 b2bbeab43843872b0b4d95ec1fd329bf64fb46cc
SHA512 e60267e178894ff446bfc33a318e73c27c56a676cfb9b06ebc3b7f8fb5349f1b52b316f4d0241c586b7b4b3197bf5b333c1a7141d7eb2201b39e1e1eb1c96059
SSDEEP 12288:0XZNYVLeyUji0h90ZD0wxpGZIVuCrHsAXI7vgbrWVQhTCYHvRktx/aICF9flefu2:00Le5ji0hmxxrMb743TvRk6NwG
TLSH
T1F385AE16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2677531869520be527f194032b92f97270fe3a69ec7a1073bc83dadcb8c36ad7
MD5 e367c604651b745eff8dd2bbd1ba0b3d
SHA1 aace351ca59ef633f135554c898158bcf7d862c1
SHA512 8769d7775e1aa86e2f63cc214077c96af1a8f5241eacc58c8a3dc6b4f16b856a3a53e9858ac1a96962371d5f722e6c0512b82fa15913d800bcc1b04edff63aa8
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyud743TvRk6NwG:q/ezSC6vUzPveHjyRDv66mG
TLSH
T102755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 75c4ab2eca45ab3c1e164e8403e696310f6b1cbb0915ffc0fb78d67e71c3fa35
MD5 46dcd98baa84662d856afa8b6ecc6033
SHA1 3964d5380ccb2a1e5a1b4e3d6720dcfdcb85aefb
SHA512 3ea32ab90e8e7065add0666997517a2859a9f05e9687c05952f495e2778b2c0ad49d18c2bf1365db6ca1914310ed0e9f57c3d4c2452e95a22b3d37f8013c7de6
SSDEEP 12288:0VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98NXI7vgbrWVQhTCYHvRktx/aICFu:0VbqPb88hv/l+YW743TvRk6NwG
TLSH
T1BE559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 70ba6a645dbedef139546fb108a2fbdae66be8260e4132ebbfd160c0143cc32e
MD5 bba16c45522db96b9a48c517909f0a1e
SHA1 4ac5aaaae2724a44e320e5135efa51c477d698e1
SHA512 acb2b04cb0463961b5a32a741401d02351ef32c3ad47c5642f8ac9cfa08b209f3571555080337ccffdec382a53b2b78938baa40e8d701ba7f904e9b43205ee8f
SSDEEP 12288:VL8XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:VLX743TvRk6NwG
TLSH
T1024533087394010DE7B3BDBAE889E0C380A3AF6499C59CCEC669FD6558BC1D0E765B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 25db94830f5d961cedf3b145e58bdfa42e9339d0999d5e52041150aa36802f60
MD5 11c2e7062d4784a4fba33ba43f1a8a49
SHA1 9d9af48ab9ed82037b8794ceae288f52a9fba8d0
SHA512 bb5842aa83d903303c43de9c8bd04942c32de7429d98d7fd655e5f79342f6a4ae1f5dd8b7cccca314a3381ec49e26a5b3030447b291f498521d77be183fabe77
SSDEEP 12288:QeBNUbTVO86U1XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:QJIUO743TvRk6NwG
TLSH
T1D565CF3BEE28ECD2C27A9DB95A91C240D77278304F52A3CBD165C20EDE235E05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d2a8d5e29dde43380f81aeb53bb74c503de73e7de5900a5e353975ac270b55da
MD5 53692f3694e1a313466428278f5d990e
SHA1 baa5960a10eef724704eeda5fbc94ab77dc12da5
SHA512 57fc84cd2cc0811e6edb97423eace0517fa55e4f5f3387bfbfdfce705501410c83e33cd80255b08341f19ee6dd74788f31657c7d8797c71753d23588ca8aa875
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:hQvGAdlCEL8c/DRNw5CuDv6V
TLSH
T1C2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 022afc39df7044193b37c394447e6d020f93355360ad098bcf9d4ed1394a0132
MD5 4e3685a1a2374523cac220a6340d69ec
SHA1 c32f79eb204786438c46834fff992be794fa8120
SHA512 c4ffca037520b997b5f8ce361fbe563d5d5976669c7eddf25f9c01bfb0cf3fcb839f7174b885ecadb20f874c829f299421130ef8dd51fef12806679ebab6685f
SSDEEP 12288:iAwSfxL/2Dc3RDLLmt0LDQewsAj3XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Q:n0ewsAjI743TvRk6NwG
TLSH
T10175E030FB74D036C3BB0DB61B26C716546DBA204B9119C3E3A89E9E59742D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5133ab9cda1fd8fc521547c043a577c74ce447a4823d7fc6b7abb4d21d94b5df
MD5 50280896c83edac290bca3764f0fc713
SHA1 89001105450224898350a67d06ac9f85856b7c36
SHA512 9fd60295f5c62ee52c9d6620bb69e9a7c0da7a4d9f1319c264d58113f01f6402c98ccb3be42241cad059e6c8317407329bd849708035d1afa8778e10184b794c
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtD6:VUEtQevvqc2W1cpV2tI32
TLSH
T197474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e8a48567185c591756a978760ed3e7c7621693fe09149861ffd7c33134e5f570
MD5 fa0e50c88511209645ce294f70cc33b2
SHA1 9217137c6b8a01172953b063c7f255fabeeaace9
SHA512 84ebcd003a31a5426a09e8b89292800df1be6679b56248d4309bed62aca218ff361a8d934536b9be3e17a97f39f81e3c2b64affdd342f29eaf25febc47d87e9b
SSDEEP 49152:rCbRquA/m2yL5zifFiV+XenmE3/zFDv66mG:0oqHVjnmaDv6V
TLSH
T137D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7df84bacb88fefe8676d0a99f27714621ab932a8e50d8553110364bf5a2978e2
MD5 3f1e787c798b1b7cfbe4044eebf96c91
SHA1 bbeba7e8327eb1abf2203c6b2eb000e6b50b893d
SHA512 c26c8c7f822e1c7bd55acd6d8debefa35224347c3cdaa507b7c293c3715d9259264fcf5f111b3aa4cbe79c2df411fc3ded47a842be5bdc80874d80cbcf87b352
SSDEEP 12288:mAZ/GL3IFoiwtA5qy97S9uaYFLq3O5XI7vgbrWVQhTCYHvRktx/aICF9flefuKaM:mAhGL3IFoiwtA5l7S53R743TvRk6NwG
TLSH
T197359D80E7F945D4F5F3AAB899B69171EA76BCA65E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5ab92cbcd9b55d44719a146a9de7f0396ac782c6439e0a5a73d2d6e9a91012c1
MD5 24d2f4a95090d843d8d533165103fe12
SHA1 be7098c34803db2a5688bdb12f0997aefb52679d
SHA512 e94bc52eaefb312a25dd0d4cdb8cd49e2b3a97e40c623492763748acd0d547aaeecca5ce4002b924ce32da188730de83ac77f062cca7b7762d6c971fe47631d9
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+CyXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:xwu4OW8743TvRk6NwG
TLSH
T19C65F14973A40CF9E9B39639C597C132E7F2B8112A61DB1F1760C65B5F37260AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 82ba30180995de004142f93b84c0968c1a2ec1578f94f4db68a74df7189592e9
MD5 c2e052ca31aac8b7f87e81123067fcac
SHA1 e6e47e982956289338e6f6f06c6610e2d3c9b9a4
SHA512 a0e659b98899d0030a85316a9cb1a930abd713d4a98426f1e4514960b0fd0fffa96355510f2572fdcd5a76510762f64e1be1f4ef76a2be4103e8b499eaedc75d
SSDEEP 12288:TeZ1IynXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:CZuz743TvRk6NwG
TLSH
T12855235933E410FDE2B3A67DCCE59282D3B37862677287CF12248A651F766C05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6896dddfc312bd60a5b2a1a0a02f6ad8eb005e2bbb35426540690178dd944e20
MD5 3ea3641216a8e119740a9289ebdcf53d
SHA1 142335017ca7970ee00dcc23c09735a4c562e6b2
SHA512 fe12369f446af08c3432e1389a0d665483bb814b9693ce65ce17834c012c743147e6e7ce28277e66ca86d51c2d77b1923a9b94184decaac878e9b48c89fe4691
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:BQRQyi36YOcPbLvw2gAf+PN3bDv6V
TLSH
T194667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f3e1a5a30da5b17b22f814d39c35fb6b75022d3e6ea6a690834a7dade9f7c6aa
MD5 ecd2bcdf774d66e0bd5b083b7eb45ae3
SHA1 1386ca792f67db0117d4197e353cdaed8c4d58f0
SHA512 f0ff4380b97bfe90f78df419fc58ebcbd2441163d02068bb13e0e1508980d978f8ae307d52f5bc490ead41d53590de6995d0342563ab81cfbbcf3548a4a2c508
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:HQRQyi36YOcPbLvw2gAf+PN3bDv6V
TLSH
T1D8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b985124b0695ce712def9841994cd8793bbe0d7716c12f7cfaf0ceb389f19a6b
MD5 d42e5f99d5ba492683cf95f164a23038
SHA1 7196dba834f3870c77b099f2b78d7fccd22a8c55
SHA512 22da380da93244530909b7a035e984f9095b7c47c5a3ab98ab3b39a52c00917562e362134c2c0f26bc2157c7ee1e3747c22fbf158f006c1eecf8099f4b4dc9e5
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0j743TvRk6NwG:N68Qg55nhceWu7PNU3/VDv66mG
TLSH
T103B55933B2F200A9C45DE1769F4A873196D27C758FE0E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6f105a278a71dddb435a4740addc68a1debef78d2d0bf368a9ddc31b5e45cf7c
MD5 c38ad7794efc6fa84667af4a99cdce8a
SHA1 db22e7986711f639cd330c3d3b2348c2fcc8a317
SHA512 6100798f21dc523615f9adcdabdea60b5353510ce1cdae477d38af2ce5882f7db03d3590d4f8c909a6ab729a2fdc1fd5cc8ce446cda9f5170126a0794fc32e38
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99N:ty5112gYy5azzVvt69nLKnhZkDv6V
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0ec574490a4f9fd5eb3f939f0a24c239ab2765bcc0c31b2c0f2828d3bae8c533
MD5 a2ab7b926268e213f43b4c151392f982
SHA1 a090942d9654c7134b91dc4c1aae199542e456a4
SHA512 14ab7f3b5bf17501bbac31e4e6fa46d8dc760976b97bb0780fe7eca1788ad0b17d543e0d042f53827bf2c38eb8bddb5f8b06615565ddaeed52514fb05d709dbc
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJDv66mG:Wu6Jmdxd2dJDv6V
TLSH
T12AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fe252a6db36596b41732b52254cf13ff0e9a191f57a92783e9dad2ad752e4cde
MD5 d4ccbdd8e7161066622d0308f6b7bb62
SHA1 31b5c402f505ee0f47e0d1d1768dd48f9af014a9
SHA512 6e084d8c6ab07c33819c5084199e94ccfa2fe1a4df18b2eb68a4a666da7d2647fd21c25dd83d160377a7a18e8b118fffbb69e17a9588863dc10dce50a6a77475
SSDEEP 24576:Yhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3+743TvRk6NwG:k1hpsNoJpF1A63U44CwH7R4xPDv66mG
TLSH
T1EAB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 740085eb645e02d6b2a80f8ff4b6db9f5281cb77c55944dbdd5807316565f81b
MD5 87a4dc999f3a761d8b53f295f9221327
SHA1 3275e5c1bb6011763b52864816e48795034fc08f
SHA512 95484b9984abd9e9fc0d2bdbec3a600e62ea01edd861e887ed40e308bad23ca6348854e440a12f95673a93811f3affcdcd9bbb1e52415e708deb3ec5bb14b769
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqoDv66mG:Z5dKii61oDv6V
TLSH
T1F4C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6ee2761b35cc4102dad08c628082d971bfc8e8b6bef3a72e353dfeff80055bb3
MD5 3bdff9f152057f2923d7091186d78b48
SHA1 6953b3d5ebc4616305b21cff281916d81c3f7f5d
SHA512 ee8a88be1fc076c538de8bed40fde4a6c3fb35600e1f05b58988953d6fc66914bb2ebce62702f9d4ab7df43f0229e530eedd703258505528a5f296d948ba7c5f
SSDEEP 24576:EhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QL+743TvRk6NwG:EhtSn8EApI0fig3giDn0AP5wjDv66mG
TLSH
T1E495BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0a7688a67d535ef5863e79d273fd1ab5039a910454a72847bb04c0c24453482d
MD5 94c8b60311868a7c6092529070685ca5
SHA1 10435621e306ce879aff69cc4097f0da9dfc4f6c
SHA512 adeeaa85c9956a705bc392bebbabda4378f1853300cb5f99e069e14db54400976e955f4f062cdaca204e87e3d8785f9793798494c5bd3cdf4b2f5a36a38a85c0
SSDEEP 12288:gkXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:gP743TvRk6NwG
TLSH
T1464533087396020DE273B9FAC88991C39093BF66FAC65CDEA75EEC2159BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fc4f10c2bb57bdcd3c14c60746e878e47fa76981ca78984b4a4ebd857fb4ff61
MD5 23da08c5f546be4106e0b88f756fea4e
SHA1 74d3a6570b695eee37793025709e30d393d50f75
SHA512 aef32c1da0bdaf8b3851f53e583d9d0084fe45569e1990f5f5f8b28e90a16b21e57ad32d9e6e86d5b61e41d0431799ff1298c840f8b08293bf4c822631671df5
SSDEEP 12288:ajXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:ak743TvRk6NwG
TLSH
T1824533087396020ED273B9FAC88991C38093BF66BAC65CDFA76DEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 be32b689b1b91d56e7b53da146a71290747b1e955870eebe44954b2071218f81
MD5 e69b7430faaa60c1ac722faa50fb6536
SHA1 b78fde7876ecc5abb298e026650888176fdb0e7c
SHA512 bc2770fbdbcb22462cb60bbf104e49af01cd47e8d99f53a6bb31584e6b769392922598bb166070d08c293c3ca7f28b99552a09817f2c642694fb19f3e5951d6d
SSDEEP 12288:wdXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:wG743TvRk6NwG
TLSH
T16C4533087396010ED2B3B9FAC48991C39093BB66BAC65CDFE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 34a382d0d5f646edba254f4fa715f6b223d089793156945fa4e5402691a4811b
MD5 0bb46221853f42f996d6c01ab373e3ff
SHA1 a6b49ac1e15b808744d636fe92765f7616612f27
SHA512 d23e1e68778e6bbb654b4a676c2d6a38aa66c8296a3ff34ad7d15f773ac090978a69df08e2419266c4f021f32e1b6ad6442fbdff4f620c99e294bdad19de0da6
SSDEEP 12288:wVWXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:O743TvRk6NwG
TLSH
T113452304339A018DD4B3F6BAC89590C2D1B3BFA5EB629EDF97159C650DB83D06A34F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fcea5328bbd4376c2c730733c1a278f4eb1408ccbd608c30b1fca63fc9efd241
MD5 4867d44e9d1a5d1fe6180fc7e1bbbe20
SHA1 84689fea88470bd9500866c36913a7cd3359ba4a
SHA512 4647d224ac7b829219866e22c1d1608748690830caa91cb957f519212b12fb7a48e3b3b7bcf7ce88d5971bd23fc42f3902236898b84768ce1cd9bb194176c9c6
SSDEEP 12288:NuXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:N5743TvRk6NwG
TLSH
T1574533087396010DE273B9FAC88991C39093BF66BAC65CCEE75EEC2059BC1D46765B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ec74fe7dbec5b6f999ef231c0aafc42ebd26c837531f3b692c415627089b7e64
MD5 8e541c756c9ea758eadfc5e3dcdc05a1
SHA1 df519e83afce6c7c83e9f8ea63bd87c5b3ba283b
SHA512 4233fc9967fa47326565a5b7bc68493c013e6d7d5c3c891e06a55453f41ac9349245041382cdd0c8c9e8b960f025e9caf5dc5582ce42188b229c257afbde850c
SSDEEP 12288:H/XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Hg743TvRk6NwG
TLSH
T17B4533087396020EE273B9FAC88491C39093BF66BAC65CDFA75EEC2159BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 386808789b6b05b6496dde486b54cf4148ba933feefe72b67db9fb62aaca81df
MD5 b139583a2b8c6ef8f3cefa352f5030df
SHA1 df0cf38cecac66ec04acd337776b70db0a7392da
SHA512 4ea4dd69bc61d24a287f66dd3360ab9286b8fbf570a1a4b728c1c08bf604d9c7adecb51285125867c3338ab5f43318c6568362021debacd12cda94ec1ee33025
SSDEEP 12288:UbXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Us743TvRk6NwG
TLSH
T1D54523087396020DD273B9FAC88491C28093BF66BAC65CDEE75EEC2169BC1D46755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c25ffb929808a47b4a208880d851f7e793d08e2d4d82eac3d1664fa9e49ef64b
MD5 c2496480de6fb13a039bded5501a0f2a
SHA1 b8bcff92e61b755e1363792e42e628e1d609d7e4
SHA512 44f5a927b6bf13106c91b858d14ea4deb0fde4f3c64b0b6f1518e3b4c8750a348c2c1a685ec506bb98bb1820a07e446d90b4e7c09c5964362d647d3cb58687ff
SSDEEP 12288:RiZwbVzzFEoS2cPvyDXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:UZMRzFVSOE743TvRk6NwG
TLSH
T130650194B39008F8EC73817ECC558946D2B27C5A4BA0CA5F13A836665F773A01D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5e491070c4a7b2ad2040a8cfb8dfd2f0b2751af22414d04cf8bf32ea2b56468d
MD5 a3f61ba1915936c31b170b4acd65ca66
SHA1 2d72171f481c6d60db3fc708f1132cc4b83350a6
SHA512 41b53a4b1f9e742b442e417dc6413279ddc5247255bcef63872cc5a5119e6ff89ab4a445374b78eee27dbd407516e47f693d7ad444633b7de3e8b5615c9af30d
SSDEEP 12288:i4XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:iD743TvRk6NwG
TLSH
T1384523087396010DE273B9FAC48991C28097BF6ABAC65CCEE75EEC2059BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a670841bbf1b1210eba9f8b19d3a2c1726ca4316737b54baef1a506ec0d52b5a
MD5 9103fa0005b435daaf7a17c20a959827
SHA1 49cdd7bc894377d265e569d192f38afde6a0f65e
SHA512 fce089dbdc19ddf03cc4dfcd7a0ecea65b7bf8938a463c171eb2479373b25a6e716ed034bacfe928556432d44a3cd2d951a7bac1b0fb4698c86f474262e2d7dc
SSDEEP 12288:asXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:an743TvRk6NwG
TLSH
T1CB4523087396010DE273B9FAC88591C28093BF6ABAC25CCFE75EEC2169BC1D46755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 42d4064c09ae9d0fc3cec2a609e11c3fa6e2666d1817a234fd76ad77b81f83b3
MD5 be515f05d3f119afbecdd98a8550db99
SHA1 f42da1e5c381eb3ca18b5116b8ae88d2a2dc6970
SHA512 a6e691bb19fa4ecc1bf01a2f9b56c6b96b5e5989a2eed2ee99dc616cb250b08ca23b21c213c0177765ca7999acbadd44845d2873a01b1bc6494cde5c0b02d2e3
SSDEEP 12288:MyPz5L8nXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:VzyY743TvRk6NwG
TLSH
T15355120773A520FDD1739279C8925642F372B8365B608EEF576446762E372D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 70bb5ae6ac254bb9134ed98c6719299f6a6e76ca36f887b501dbdcdcc6a836ad
MD5 3179159ad786b87753416311d1f28cde
SHA1 2ef45a6be333530c7b016d8e8ead3857659bb2e3
SHA512 556733c72bebd178539d59e69e2ab585479ee8379650f00eb188983fa633e59b5d9bccbb4aedb437d9a3f54477c92e32c25216f2a03333478ba944615ac74d7c
SSDEEP 12288:24XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:2D743TvRk6NwG
TLSH
T1544523087396010DE273B9FAD88991C38097BF6ABAC65CCEE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 21cd16cdc69c0382b7fa28861ec6dd6f73812205f8ab0d3aebf16d2af97c7930
MD5 3e1b49360c2332dfb50566e2bfaba529
SHA1 1b35b1f07f5df674a19f8dd7723f6c628376d623
SHA512 8078a925943a3e84ba7b582df71fd0f897c1bbc5a9c3e210e7b5096db688a995b75ad53f2713d1e7cd94916d8b69338c0743e3815ed16d891ec1143a39f86350
SSDEEP 12288:g4XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:gD743TvRk6NwG
TLSH
T1004523087396010DE273B9FAD88991C38097BF6ABAC65CCEE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b841a0e13367ebdcc26630122e9323487ef6d3ee24e23fa4fca6ebb3333b6882
MD5 8cebcdcc99eccf0606a1c819df5bdb7f
SHA1 250a86d0f89c13ed4310bea1acccf247f071da1f
SHA512 161bc16ea652f4bb2f291418ab520fc5b32719bf57b3b4a94a73efe610ed4c2a8ff120a04ed8c2dd023e3a963beb044efc06d106f2b1443ef10df4be7a7fb1ad
SSDEEP 12288:+yPz5L8nXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:jzyY743TvRk6NwG
TLSH
T17655120773A520FDD1739279C8925A42F372B8365B608EEF536446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c1235c9a692e6c66bfd68012ed2bb841db592905ef8bbb2e214e5772e032bb60
MD5 53e7b090a2d894aab9e5581a58134301
SHA1 46d9629d1ab985cd5714fc99c8e53d1c761e8c94
SHA512 328635b71f8bd8b34a4e2d717a44098d5832eb7dd4e7771f3544ab5c899a943070ce749d6d696cd2fdf8369fc5608691ca983f85b7e9a1176c890cde661e986a
SSDEEP 12288:UCd9CWYoaLHF3z0z04PDvhtXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:tTDaLl3z0zD2743TvRk6NwG
TLSH
T197650194B39008F8EC73857ECC558946D2B27C6A0BA0CA5F13A836665F773A01D3EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 59f2f69689417d8a7792390c318b48eb201fc1c1fd4b2815d9b9472e63ad3e1c
MD5 8d709caa9bd29a5e8dd5197031664030
SHA1 381e755062c420865aa92630c6f79e3eb346e525
SHA512 68e98efc6322ed8f9fa26985e1d3ddba83d0dadc8c30773a1dfb6166a00406b01b680b69ac98c136bd88bc04507fe9d9186116df6b7a747e45164fa867654e46
SSDEEP 12288:ri4e7KRdTfgwCHKy7GLbbdIvKXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:r3vd9CHKy7GZi743TvRk6NwG
TLSH
T12075CF90F3E410E8F0B39A35C8765512DAB67C5A1B61DE8F03A8661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a27748e5a8b5fd839f4f863c0eb506c56fcc6f5f0beac0d61a64c8508099c333
MD5 5e259ff9adfd1ee3e199c9e4b251cf79
SHA1 e99bc339aeb7851a47b2074530540d98c7ff3041
SHA512 0499b3f9fd8de1317da5354e92ca6b98fd4820e4de3e06bb759a7df7d8fa9037fc8c1e510adb003bff2384efe1792685ddd9e5158e02d374519f228d516afeae
SSDEEP 12288:s9XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:sm743TvRk6NwG
TLSH
T1754533087396010DE273B9FAC88991C39093BF66BAC65CDEE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f28976dd75d759997605bac7a5401695c6238f63f6e1b1d38b5f57c0e6f6896d
MD5 6af93a1d5dfcd325f0314bf562d15b25
SHA1 850714ebd1011bc0c140286b5d699e648815a4ac
SHA512 692cadbc2b70abb0570d89d0fe0594d7903a52a75ae2836644031345de7f93e425dfac8dbc39c8e023781f206fe49736120e0197f75d9833606e8531272727f4
SSDEEP 12288:YHXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Y4743TvRk6NwG
TLSH
T1954533187396010EE273B9FAD88991C39093BF66EAC25CCEE75EEC2159BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0bb9b493c9783d99c75b20f965ab69f5135189be97eb48fff5972b46a3371ef8
MD5 693faf802b432bb83c53de9f1d953d06
SHA1 ec7ec4dc60083aaf9ab7109da20d075cedecbf9b
SHA512 30f09efe68553e789cfd1368dd7b6f7e2c8afdb7655e11f883648056855dc6991e68f7091960277a54b34095535e5475884657e960d14776fc7aca881b7bea47
SSDEEP 12288:RKXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Rl743TvRk6NwG
TLSH
T1184523087396010DD273B9FAC88991C39093BB6ABAC65CCFE75EEC2069BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0b396296f8ae30e7271e0f73dd01d3104eda8ed2be5ca5e2445e3005c7913ce7
MD5 5c0ea071e791797db99396c13633bef9
SHA1 6c327ad814bf60bc04d6bea180566a1b3bdbb4d3
SHA512 d21a1ace724933930b4129de1279272665c10bdea9df64d1671d5c4f2226b57cfa4104d27defa1bdb0c004ea121ad1b5400218163595c6b61cf7041f7316a551
SSDEEP 12288:D4XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:DD743TvRk6NwG
TLSH
T1C34523087396010DE273B9FAD48991C28097BB6ABAC65CCFE75EEC2069BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f9135d93b0e365ea76308fabf6d02d0283337ee775d33d423f89f111473346ff
MD5 c2f1450fb6992e44eba792306d077092
SHA1 854233eecfb96c11e90e9399996a23c76dac65df
SHA512 9bb12d046d34dcc5ccc1fa46e6292b1b9eb8aa1aa5c852fecd351685b68070d8b4aab829abb3d7fab5ca1e9e4306d7daff32e3bb076cbc87403631233c9c3b97
SSDEEP 12288:39XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:3m743TvRk6NwG
TLSH
T1A74533087396010ED273B9FAC88991C39093BB66BAC65CCFE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0864485be5e839bf258f030b1a7f4c4e9bbcb4ef91b494b8fa4e258317f9823e
MD5 66dfe017ec9e979386bd2f11837c5a32
SHA1 f44aaaada126dc98e3bae045e5edc63ec02ead05
SHA512 d1ada4f4dd4cea1c540ece959435aab4302420bf8e3d76ff621c403a2b579569dfd833bf4c738c51a342bb9dc7c336729cadcec530e86c3cdd5c06a0c403fcf0
SSDEEP 12288:HQXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:HL743TvRk6NwG
TLSH
T1124533087396020DD273B9FAC88991C38097BF6ABAC65CCEE75EEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 77cbea5e6ecc9430418b2dbab43a6e6ff93aafb33c170691f0249f5586a93dcd
MD5 6d8ac6d422a071a1193223d87c923af1
SHA1 aeb7736576ab0d45f1634b60cd1453d97500b6b5
SHA512 81c165db925bc07536fcbec460c20f8760a63319a02107e69de1bb272f8d1ad5291f5b1fac982bf07ad50409ba1dbb04ae79bd560228bfda9121158ea61b7adc
SSDEEP 12288:nuXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:n5743TvRk6NwG
TLSH
T1D94523087396010DD273B9FAC88591C39093BB66BAC65CCFE75EEC2059BC1D46765B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d04890ff2d4b3484a04f2f77c6b9a272e9c41139545a58f3f574457769efe197
MD5 124bb5dac2727e4465e938638a723d78
SHA1 aebd43458ce180a78d91314d51f515e7f2456167
SHA512 ccfa407da56d3e6db2cce65ccf19a0a985389badcde8ac63ea965c24faea4d03e2c5d5d155b4cff05dc91030dffe76800c3ae90b0b2734be204a1144b4054107
SSDEEP 12288:2fwvD5ur64Lk3tRX69qkyAI5CXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:2fwvUk9RX6wkyAI3743TvRk6NwG
TLSH
T1C185D029EBDC04E5E1B7923C89B7464AF2B178691B31C6CF025A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dc88b656d1d11fd9e16cba446c1d2aabde3114d9295a70db9f3a707a524cad05
MD5 74ad74a6fb64d9155e9adea5b80e76e6
SHA1 a7df1bc1ef517f47805c64a492cbd1b011578a57
SHA512 869c88ef976211fdf180e98c7e574b6ecd79de2bbaf3b2b82ce8c69f8acb4d0870ca55cd56040ac839c626b8ae32c2b0434bc3bb2a37b545194ebc1171db6f03
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DDv66mG:+ySzP7Dv6V
TLSH
T13A066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0788629b2b4f58967829eae182cd72cb395711c07f62a459d954dd18e2c1c8f0
MD5 3f25db69198e823f410143b894245cfd
SHA1 6dd2eaa42bc97af1fbcba63423632d7d33765ce7
SHA512 e50ff4bc553152c4e6556297bc16b6e290d9b3960eaf59db8fdebd82cab2ef7d154dc2234c119d96c3d7de31cb37533715f85d25431ebce867d5b11a16f9379c
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYU743TvRk6NwG:U47JUQjTirIhCnDHUPfF/TDv66mG
TLSH
T16065AE1DA3EC01E5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4e614d614bf8420cd86a2bed4da5abd7432d0235e857e2c937560cdef7e3f439
MD5 13140c153fcd44c9f09f3a862db275ea
SHA1 30b62bb5c877b044bf0a1f42e9529777ec238fdc
SHA512 f036712fc37a01bcfc2afbcecbac1464b539e53119dbee3a7b93265c5bcbc114088f8ab019dcf215bf6f67c5794f449d3f557afa54006a7300184c849541d3f0
SSDEEP 12288:+bsfIXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Fz743TvRk6NwG
TLSH
T17355F019E29802D8C06E6279CB458681B3637D2597E1D7CF52D0F93E1F792D09EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 1df603449081747e95834a4fa2a9f172f6d560460f955bebee644a66fa76bf20
MD5 e2c499d6baca1c8514b962797c3a2c49
SHA1 a65283a9acbb6cb20ff29eda782939a0f9d0dd1b
SHA512 3c3a3e795e81d42f99bfd19d649793ac55413d133495c531b837bb54e65f09960678c42b8093578fab3cf6ddd3adb0dc83df2761038f14b3e0358526807338a9
SSDEEP 12288:fxze+Q/U3fyM8dUzQay8HdXQ+XEkGR7aRMSgnPiRDM:fx6+aUPyjd6y89X9XGR7aRMSkPiRA
TLSH
T13B25F5007626D78FC6A940721E36D5CCAB70BD42FE49AB0772CC473FD576658BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 2.3MB
SHA256 3971c0a20bfd353fcc9082ca13cbfc85fbbb7492c8d6a27dea1c3be42b99b0bb
MD5 7f2751f2af3374fbf9269379b523f4fb
SHA1 f790b74e20e5078f3a2db95eec7b508d44c6f114
SHA512 14f56c6b36b560c592ec55f1ef7f6cfffba258c9c174c022b28509f1927cd4a9b629268109767e226833576331402747bd0c7793363f30156ae40f24f0255deb
SSDEEP 24576:24jqrv6lj4i/e65R7sZ7Zt7UB7Z276s7bGh70z7Mb7YH7uF7i97oZ75x7o07qY7H:Tjqrylj4iivV08nFnN
TLSH
T192B55A815577E38FC6BE80734232568CAB78AC16BF456F01638C8C7694B7A5DB4E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b90aac982b8ce1a5cd4b8aac3f88d37f444f5f61ce40311e0e1347a8f324a211
MD5 642c7e6942e5fddf14da88e652fc1acf
SHA1 157f169db0ca5a187b0a26326955492a85f27d96
SHA512 df7ae662f1a669a069f1a2b4674fa33a635bb1934144465a97f9a15db31aca2e98f45ce47bd1a6a2964e1ee7258d5eefc3c4a865065699bdbf27fa2d1b55e449
SSDEEP 12288:ez7gXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:M7743TvRk6NwG
TLSH
T1694523147399050DE5B3BAB9C48DD0E2601BBB759F809CCFE609E9A168BC1C0AF75B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8dce4d73239142ab37e310b1877df7f7af798061314187f6926b3bee196bd50
MD5 79d2e7f4f078ef0dfa812a75aa15e7f8
SHA1 09dc9fa85c532a701169e605b80ff3374193f17b
SHA512 af4829e6d8bc07111c6d282248e8174e218fa79966086b208593985ff1fd14cc654f71072bd3cbbee9b1056c324bfb48d9d56a4b6a389e7de76e7963ec263db3
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYd743TvRk6NwG:Fgb4mBIBhGFJDv66mG
TLSH
T15F65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D6DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4d8bc951fcbda4aa4ec795dc52e1dc5d70c19a397d1b1f3243b5e2620deab424
MD5 311f41feef8466ebafc2105583c6fdc7
SHA1 cb97635451955418dd6d6c6189095c21f206fa2f
SHA512 947ba959a01be47d162df7055f3ac323da65ee342fcc0d196fd0055e4a01b6c1ac7c4b5b643269555f44f028ea99f385597a22d44d47fe08a69dfd2b894992c7
SSDEEP 24576:JG88u8FpJqH1bzria7/mE743TvRk6NwG:c7ZFPqVea7/mDv66mG
TLSH
T14985F16577E102F4D477E138898646A3F6B2B8250364EFDF07AC8A511F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 963ded3a4c475233c9e6c7b42ba77b2485e7f33554f59f08f311d57c12c418f2
MD5 b2b1efa470061044310c742f876c2f66
SHA1 93a4b54717f833d4a5c008e2e9b2afc459da48b1
SHA512 147be6ab2b80befcac797b517675359e27767c224dbeba704f29fcbcb4278352dcaec99b25bebd262184d4073cffc77905adc274a0a48afa25e57fc1b208740d
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Dv66mG:MG05lO43bsDv6V
TLSH
T1B9D5CF6E62EC01F9D1BBD17CD9C6460BEBB23415032556CF02A486A91F27FF46A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a85a28751131c6698b70c4363175af21d456ad3642e62d3a56ca0d2645aeacd5
MD5 364564262936f6d8aa9b78aca9dddb16
SHA1 a9c8db97eeb54e07f21ee1621b1e0e5c90ccb9ea
SHA512 d69667c9839db8a323b6a418dc159cd974c90b6dc4a124efa44373bd847229c43e54fb2c7599fe2877c71e34d08cd4d761fd2e331c2cacc19d8e451c0f1b2f69
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnq743TvRk6NwG:8a5POZ3BJt2pasx2+mVDv66mG
TLSH
T18D65AF5DA3FC01D5D5B9D17DC583861AE5B1342653329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 759f6e60abed0358d5a7a3a2aee970e0c69b8337983828019c0256d77c74eb56
MD5 efcc01ef0fdde6f2c5adbae827f4bb70
SHA1 e893dfd2385f026e4e233904e90076b9188ce24d
SHA512 30cc39004fa51ee1ca550b5798ca274ce49a150e63a3529e853567f99bbbbce2d23d66e7479f447039d4ea71a1eb268d5fb615497cf4054d68a961f16b443380
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fkc743TvRk6NwG:SNc/zEOVHFGDv66mG
TLSH
T1CD858B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 63a297812583d24e983b55ddb8b87db8b5bf4d525becaca423efb9b35231f7e1
MD5 ea4a7824a369438acf4cb8e39d4ecc9e
SHA1 fa1ba5bb1cc464b895892eafe40155b28bf65c73
SHA512 62752ee7c78bcdc741f12d4e702edefa48eeaa91113e41fbab79d533d7c20846f2ad5de3a2d16549156ea79b9617042941868c24ab372bc350bb0ba619b9f190
SSDEEP 12288:aQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17VXI7vgbrWVQhTCh:aTkNvNnaFeYhJNtmZBmg743TvRk6NwG
TLSH
T17855AF2EB7B806E4D1FAC6B5CD238512E6727461173293CF5290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 05a3d9e0468e8b969b2dd929e8077100fb4e2b8631fdfbe39a0ace905ef9cc81
MD5 7f6a736e7b1521a4fa0430ad75b363cb
SHA1 f4415b3d03572fc9b3efbe1c9a31e05539f25303
SHA512 7213ee8f502f5176baab6a1e691a5d9a12d83a7a052b58be47b0f3e70899ad3f7ebe5f9bb5b317145edef4fdbf2cdc8d80833758cc0719c799e19e3158d50930
SSDEEP 12288:iHvUrBFrEjwaQvXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:iPUr+NQw743TvRk6NwG
TLSH
T19865E11E32ED08E9E677E17DC5828649E772B4621712D6CF02E0817E4E67AD8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b0d5df918d506aa16a3add6c5eecdfd841c25d83007c8c6c65da66080667f6d8
MD5 a8709b25d65a28dfdeb18fb2931c76b0
SHA1 01eca5aba8dd66193c97ff39cc8b1407d641ba89
SHA512 bd2ca7d4a4579b492d5c9584e4eebb275960fef2a4912acbf31fe66bb90d6065aeba4ba17ce0cd08d2c0cb3ab5ec182217d62180e49cecb82e4eae9c4aaab6d9
SSDEEP 12288:hQcMxWDXN1Dp/fshBItT1IQgAEXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:dD3FHshBIYQgAv743TvRk6NwG
TLSH
T15D75E13DE79C04E4E57BD1BCDA538606E67238A9032269CB0294C1B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/256-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/256-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/256-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/608-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/608-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/608-109-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/608-315-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/608-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/608-103-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1272-48-0x0000000140000000-0x0000000140436000-memory.dmp

Download

memory/1272-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1272-36-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1272-0-0x0000000140000000-0x0000000140436000-memory.dmp

Download

memory/1272-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1848-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1848-43-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1848-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1848-63-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1848-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1900-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2488-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2488-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2488-184-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2488-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3516-85-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/3516-80-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/3516-297-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3516-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3688-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3688-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3688-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3688-122-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4148-75-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4148-69-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4148-280-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4148-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4248-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4248-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4248-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4248-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4248-329-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4248-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5132-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5132-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5132-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5968-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5968-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5968-19-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5968-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download