7c49f218bd27aa705a7e88011ea3fc185baae36e97fbd6012261e1c3a1e718f2

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 2.6MB
Sample260710-c591hadt6w
SHA256 7c49f218bd27aa705a7e88011ea3fc185baae36e97fbd6012261e1c3a1e718f2
MD5 f612ed249bd85806ffa4fa51d104042e
SHA1 c95622bc98790f1f6e95122a610cce6583b1b683
SHA512 e14618d0f64d567c596321fa2bd73ce17eef2c9d564175a482ed489c6ebb425cb11aa43448e9bb761dd46c5cd3a661cb93cc7d726d357ac39a9d77bdb742803d
SSDEEP 49152:5IRLAzUt3tuFXy0AQ4JKYr0e+CoaYNlCBDmg27RnWGj:5mwrqD527BWG
TLSH
T19EC59E56735841EAD0A7D17C9A429743E371FC4107A08BCF16E00ADA2F6BAF51EBEB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
6140	elevation_service.exe
3152	maintenanceservice.exe
4892	OSE.EXE
4904	PerceptionSimulationService.exe
2504	perfhost.exe
1748	ReFsDedupSvc.exe
5948	SensorDataService.exe
5548	ssh-agent.exe
2572	AgentService.exe
3384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87a0630cd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007877848e1510dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000095ae198f1510dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080b58d8f1510dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061afe6901510dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079d6138f1510dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079fbb88f1510dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
4892	OSE.EXE
4892	OSE.EXE
4892	OSE.EXE
4892	OSE.EXE
4892	OSE.EXE
4892	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1360	2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	6140	elevation_service.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1748	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2572	AgentService.exe
Token: 33	3384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3384	SearchIndexer.exe
Token: SeDebugPrivilege	6140	elevation_service.exe
Token: SeDebugPrivilege	4892	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2116	3384	SearchIndexer.exe	97
PID 3384 wrote to memory of 2920	3384	SearchIndexer.exe	98
PID 3384 wrote to memory of 2556	3384	SearchIndexer.exe	99
PID 3384 wrote to memory of 2844	3384	SearchIndexer.exe	100
PID 3384 wrote to memory of 5980	3384	SearchIndexer.exe	103
PID 3384 wrote to memory of 4256	3384	SearchIndexer.exe	104
PID 3384 wrote to memory of 864	3384	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5948

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d88ae9588a9e735a98b3f738924dc542993d50174cead8979e9e7a4a1e65e086
MD5 a58e07242b8d9dab28c7b115ef5400e8
SHA1 a7b299a19a96146573948f4dedc074416b090efd
SHA512 4e77d3463a75c6c7f1652522c7a296d2b13b8a73f26c53395516bb5405f96418d6273ad76fe188bc848553e1a42c92fc13e87ad1bbedb5e7b5486856cc6635af
SSDEEP 49152:Ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5Dmg27RnWGj:i3q6sjBGD527BWG
TLSH
T18CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bc72662eff4c853020dbe87c8add9ef85d749e3a2562fec64ec57d7c08de5e99
MD5 b4c718603baedb158c8f4f4de4d5262d
SHA1 89788a3c1ef2aa5214f769b6338014ab773107be
SHA512 855f3aeef48eabe6418ebfdca3ecf53f45892101ecccef10dc8248bf95292b49ddd473379938772285d71fd27fdee9d0d7de6a2df3618d12be96d6d8ed7bf198
SSDEEP 24576:lXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:wtcTDmg27RnWGj
TLSH
T144650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9a9a22eb6a0451c9cc2b5515ef92af4c0688dc6a042212545d78009ec4477c86
MD5 dac368ad0690f7ad97d83f1432b616e9
SHA1 85b587f138ed165304501b57bcf4041792ec385a
SHA512 fd914b897e6594e213cd04cdf49e6abcf40c024a6bd2fa6daffcd104eda7121ce927baf8725caa8293209ace15a89760dc4368da4121f6186dd550666daf3345
SSDEEP 24576:y0Le5ji0hmxxrMpsqjnhMgeiCl7G0nehbGZpbD:yPji0AjADmg27RnWGj
TLSH
T144859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f56348fa73671d646b731f36ebb4ba6f4867fe6e311f815cfc57d32a3c44cccd
MD5 bb325d37a024394dd7da8ed8200f931b
SHA1 e8c510c23b3f74b031265843c7741bb0fb763d7b
SHA512 39a5359cc019944540b294e9081838266f8985dc9e90a9108f3f38bddd723954fb0e121795f28d63f1677d92070975a203d06b4e07ea469bec7312db960f4e0c
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyu/sqjnhMgeiCl7G0nehbGZpbD:e/ezSC6vUzPveHjyMDmg27RnWGj
TLSH
T108755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 61d97d1019379b4f169112b3c2c0ee2e1de27cfb2f6144011331094f3c814c1f
MD5 443c60707926963b659548067dcbf1c0
SHA1 e3f06b0085365288618b498a5d7dd293cea46087
SHA512 189307c60878f31909ea456cc867d854c053548644f709c925ec5418f9d69f6ed2f0fc8bfd4d301fdc240651dd7716d1e4af6acfe87563a8daff2e674ed1d096
SSDEEP 24576:1VbqPb88hv/l+Y+sqjnhMgeiCl7G0nehbGZpbD:1VO88hXl+bDmg27RnWGj
TLSH
T181559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6ab45d6493e8f772521e135411786ca6da0d6b06f0c4fbc31ba9701d172b769c
MD5 21c7b83b23e342501415a7a2a3333608
SHA1 1affff619f5d38cee42cf5f53ed2a179572dec80
SHA512 9f6a85750b2a7df477ad276fd6a9f421a5856a5bb427892c93fb2f50f16d463a6ad4ef74046bbc715f59a312ba658be047cc2fa7a29d2630e300fbfbb18abefc
SSDEEP 12288:3L9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3L9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F24523BF865C50CAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9dad96199ff0ab84b73074be4c498563df6a35bf332596f811f4d6191852121c
MD5 2b525ba1456e63ca1133e45272e8683f
SHA1 32fa9ef17a7c1a732481b19bbf2863d397337b23
SHA512 c76206bfefb8c6acd02a540d65015d8c9d8a10707322816c91f64bd2f747b682becda15697d302851b46985af6560532f6a51aed15b5f5453f84ea3df3a8af70
SSDEEP 12288:+eBNUbTVO86UWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:+JIUWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 923cef49cc5d948641df00c40d2cad48a8613e8516db0510b88303ca460a4351
MD5 227cb1f14a03e2db701f20c5cf7417e0
SHA1 f8d3cc6c65b158c2b3b814d28fac73ecac7fbb36
SHA512 6d0a9b5b0cd2182809c79a3d6016b8078893f4552d69550d024a6d9e6d871a5ee9ddf0b735b234102b15577aec72345bffee28df1db0a765eb8441276bc336bd
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:kQvGAdlCEL8c/DRNw5CzD527BWG
TLSH
T1CA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 512f70f5691fe6b14d54292fb639852fb00550575bb9c0d2b6c27bcdde338155
MD5 e21e6858a75a37781111dd5cc4b826cb
SHA1 c3d4e8a1446bfaae49599dff510fc82762aa74e5
SHA512 b053d3ea310e55c1bd9e4c82f8ee596144412fd6a807820b5cd19a9e9f64954f6d7ec562bd740afa67718f4d6964ffc5c861d8cf60423792438db810c0d906fe
SSDEEP 12288:4AwSfxL/2Dc3RDLLmt0LDQewsAj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:d0ewsAj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f321995a071dcd247cf5f9b465ebee2803b9204df9c0b14a0c0d1951a0bcf27
MD5 e51040af85eb3cae95f58e16c7428389
SHA1 7aad17168f0714fc544430d274e89db603fcb73d
SHA512 6a7f57e621362611236a04c8099fac03b40b200be4f124bc9317f9cb4f66feccbf4a12a4dd2a1c05c6f31006fdb1448c8f147c40ef7447f848be4dcb74cf4ff9
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHoVQBWG:tUEtQevvqc2W1cpV2tI32vB
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e63c649ebfb69361c106d66d26d204ec019a525e85ad2774de892e4ec29b73e8
MD5 709ec1ff64e9665f8542f1b1b2b2e333
SHA1 4d607bcf35ca11de8752014a130e4f7ce404868e
SHA512 450c6bae3fc07efdc27f72992b3f602913d25c6508129eef0d25e7a8001cc66ce35e72f643f324eefa4cfc5699f7220ed5ca9c9e33bbd77895dcff57bc533264
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zwDmg27RnWGj:soquVjnm/D527BWG
TLSH
T158D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 55a401531da19a9942a35576428364786d0a62aea582209ee84d0ae27ee8e34b
MD5 9f08ca4b973c529ea9ee06a7c8900358
SHA1 08a86b2880f87f6572d8410ffb51114e0b3bf1a0
SHA512 58b40ffb338627b6740df471d005f9e0011eeee1d8b56097ea5326a7adb684bc0eacf51e67c23401917e6ec3fd221db1171cf14a552646d28d02bcfe793353dd
SSDEEP 24576:FAhGL3IFoiwtA5l7S53rsqjnhMgeiCl7G0nehbGZpbD:FAMUFoiq5PDmg27RnWGj
TLSH
T159359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 845dcd7a5b078da1b7c77d1e3470021deea9deeaf02a7d4506a96c5c83b3b469
MD5 25e33e0d6e70c5f3b366e62428f13653
SHA1 7827c6f8b4355e0cadbe7e5a5f34407eb70c2acd
SHA512 4d03b5fefc17936401b9a514be2a54044635b0676045983b86b94213c55a20cd3d1f5c0f84ec2274048a4c13b5b4e989e16bd92d949dd01f46c32724fea34351
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twu4OWwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A65F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9eff2d3978fe95e7ffbf00b3e17b4b3a4a988b5032011cdfc9616f7f64019ad6
MD5 1a8136b3b94573929afd6a27ce8ea30a
SHA1 86830d18e8544ba2faf3a4b6c125235ae552fef9
SHA512 72dc274105924e0cf5ee267f5c28989e26e5ee2d46ed271aa5bd5c64bce3b5e20875aaea3ca8c8daa18987c19ffa9cdba537967b5ae8cad1d5db85b68a51558d
SSDEEP 12288:5eZ1IyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8ZuBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB5512AA239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b09cc82880774a67c39f3b8d4d8b94bbe7ab60eab690dbf9c9184b559c099572
MD5 fda332544110eeb3186a972175ca4299
SHA1 7b5b59e696dccde9b675eb28d3ba9e7c27f49386
SHA512 94ff213af38553f8ea2187cb669e1386cd94e8e6a87421639d34818510dfbbcc754ab672d0de34d8b1cb9a8725bf6f76a4a37295d112b2f9070c7fb9e5eed0a5
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN3mD527BWG:BQyiKa/X+PNWVQBWG
TLSH
T169667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c05595e8b4e7d099ec18e87cf5ac4011e67e4c126a4bcb8ae79dbd06cc128111
MD5 3c7ad7c13f0f3c402906ac7d83e81e70
SHA1 51ae3211b00b497343ecf980c61feea95a21658f
SHA512 726afd41733922ec6be31bce10bd453ff7ef99a6b01f90f650384a9dac6e7ab26c7bf61b43a858029f3348586eb423c2220efc6a5657b1114beb4e78ac54e21e
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3mD527BWG:MQyiKa/X+PNWVQBWG
TLSH
T1F3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0b15d52fb66c8dba985fd04399a07631744007e172aae35364b2f22e35bebcf2
MD5 6e341aa36c2843b1bbc3629533670be0
SHA1 aa116a52e030cff2a4f13c83446bb85698c2bb49
SHA512 4b7d14d5305c6ea152e3ff7418b016c1cce0c3176f65c6f61fd098cece7cf02b9b3f0c32893b9974916484ac45faeb3455fcb7c3362b12b7e5c60c8a807423b3
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0xsqjnhMgeiCl7Ge:668Qg55nhceWu7PNU3/ADmg27RnWGj
TLSH
T12FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea724165e317c9b4861323b0fe69cd2592fd3b1ef31d608e30e792e85ec222d0
MD5 454aa680c36ba896b19ec746eb68ac76
SHA1 a47d80cfa16691f5b236e5b841c7b54955e09871
SHA512 c7beb0ddd307755f2b53634a074b249cc985da566763605b310c53ddcfdd5bcb6ddea37313a3e7e6fa4fed006b0ad5cdb8c0dd553c4f518c843e6094c99f5433
SSDEEP 98304:ty5112gYy5azzVvt69nLKnhZhD527BWG:QLIHEWh3VQBWG
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b2481d92129d51340e13dc9f168e6bcb41b72d1707ad202eb31f598519812e06
MD5 bd8ee68cdf1c2c7d4c11826f60eb8e73
SHA1 19efdccf939df70ae67f2a5a4c1e12222e5aea40
SHA512 6f1cfcf729cb5fd9c233fd4d701c8a809767aee3361389949505d0f7e27fab8029d248c80821a4fdab2f3e872411f8c84d2614fb77d1dd4d55dbbfd51d6cbbb2
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glaDmg27RnWGj:du6Jmdxd2daD527BWG
TLSH
T116D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a26d9bd8bb0dd60e8ebe8e6711df644ea2bcb1cd9e38bc92b1eb22748699e63e
MD5 3508e7352a2e0066eacf358c709026de
SHA1 3619b72124efb8f8f6049dc7bda48c47fb6c8d47
SHA512 0742ff97f7938c7c88899e61dd04c3305ceec52d29f21b83b014034e8810e3088619eba54b58c2599962780d6767766f24806aeb94d8ca03e2194e5ef5c967b4
SSDEEP 49152:Z1hpsNoJpF1A63U44CwH7R4x6Dmg27RnWGj:ZmifPWR/D527BWG
TLSH
T1C3B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 72d026e8efb0017a9852e15f1cbe81bd328770b9b3c553feccf4353d79ca1df8
MD5 265737ae9568764f56c7b5b200893612
SHA1 6e652e1e83979d002ff5d540b88163cb60f74240
SHA512 6c22e33e3e1366b97362f0422485101ee9137f55b059318473bbc1014fcd26f704c27155b8c30bd258b1386d7448278b111cc3710f1762258c7b2629176fc58a
SSDEEP 49152:/SuZQIY0Be2KcRVtOnks6NMHqVDmg27RnWGj:F5dKii61VD527BWG
TLSH
T1D0C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a61914e42c5bf557c2fddadadfe8ec4e9a8cd68edea5ab95f39619fd3f71b987
MD5 7f8eee0ffa17b549095b33d45d251ce0
SHA1 9498ab2a207efc6cf8296fc4b477cdc28c32abc1
SHA512 283116c646414a691c01cf96dcbcd4d36f722ee162f1e358e3785d9c02e70d9eaf8d269baeebb00e651145aed90686b73ef40cba7ea30f0b9ea3e3b3188c5525
SSDEEP 49152:1htSn8EApI0fig3giDn0AP5weDmg27RnWGj:EX2imphrD527BWG
TLSH
T19D95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6d0f3279eb4567cd7543a5cbd2d6cbc2a877a21eb077bd29d9179504a85a230e
MD5 ee05d99b734f35b962e9585e52612cc9
SHA1 3632443c9a6d9a8a4516b00804f1ddabc91de109
SHA512 3de01dc1e5705d641632067264ca6f686590287b819a42513c2ad3f9cb2a6a4979ec7898829c76f89480f1dff27c37652c10693c85a352d8a4cb0b7a16c4e11c
SSDEEP 12288:9VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BE965C41CBE62249B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 866f4b6142c11bfb2c8faa677bb66e880faa31f8f7a6c4418885e4b7e73b6f61
MD5 6550aa1d1065009f02cdea420ba70d97
SHA1 49d0dcd8463b42f1795bd7086d1c42a35afea94c
SHA512 5791e9b2e9066937ee5445686988fee13d295cd893d3c6ed75abb6d05fdff1d182865572fd75ad105e2e1998d44ea33a1e62fcb315ef2d297dc6733f830710f5
SSDEEP 12288:Q4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BE965C41CBE62648B5C3E5F10DAC073E57E92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e1bf3af94f0038a356dd7f9a8d9f586554c685934d29b6f5c9467f65015d357b
MD5 04399496bd776d7c91f7e34d72aec813
SHA1 863790709f04698834ff85bb6eb5d96927fcb58b
SHA512 40dfee254826d11445b78e56c9c7e5ceb8febce1f0766685595e797badde9c9b7c859888f354868fe35e2aa0166da075ada8d90b3cd7bf04af950e0145af0bf1
SSDEEP 12288:iuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A977CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 968438b6adfae11f2c799a847ae9a44f38c3606f0a4135eceee8e94e1e990f0e
MD5 3cc3b398e4ab97eb4fd62d31476e52be
SHA1 8a3210b15f3b0a4cd7afe6e7b9fa473879206a26
SHA512 3897630f0d16941706a28d1757f7ccfbc5cf6db3da298823cd8f2cf7871de4552139a58467ba474466b2602aa31884a914114470797500a6d8cfe0ee58eea738
SSDEEP 12288:aVLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15845237B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 87fcee4a67bbea10d2b911f7e6ecf6c89c27520f53fb7c849250fd55667458a2
MD5 c8fc3ee8b4ca2b2bc8b1acc7d26fd6aa
SHA1 3944796336e21988a98648890fa646b1c689163f
SHA512 c86a5450e3575d8d00ecba6c180913211ba9359392e97bbc2bd60a1cb8b1ba31825ffa855b44cef380b620008f36da5647deadb9ea1642800cbe8f34029a9507
SSDEEP 12288:OTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CBE62608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5b2b2d579c9402f1feafd5b1631cd8e8c436e94ce861d4c01a744f87773272eb
MD5 5ee7f025ba276eda635eaf62aff15e20
SHA1 443db85b625e3a6eec34cfdcf1161d0482cc6fdf
SHA512 b2de5568191aa60e55e5ef896c45b661d73db0f881c70ebd698d07631e1df042ac23739a1528b0f15fdfc7747d161de67fb586135bf85c1c2f61efd3c6c9e799
SSDEEP 12288:zMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE965C41CBE62648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0b3ba81dae0e535520e5674f7b24edd64086cc5a0a42c8a0c39dd48bad99a36a
MD5 3ab33836dec0d522a5bb0c113d4e256d
SHA1 1065fb5fc39a152104dbcd012b7dffd065ab50eb
SHA512 8de9e318cc7c8778cd93311357ba27b36016b7abf287ff11476e5e5c0bcc337972c829f4e147d07063381e60da174976e0da75dcd8699978c47e9a199c1617ff
SSDEEP 12288:igXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:igsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BE965C41CBE62604B5C3E5F11DAC073E5BE92004937A67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6ea6f7f33b66033cc57ae23cdc40cf66fb71d8b458f02060995edf82cdfe55db
MD5 21473fed97410a4a06213c20aaec0640
SHA1 620dfe7d9b2b8aae3031abdeba3e67b1522e1b6a
SHA512 70543bc8ed9839bd53de2810daca3909b2726cb30b96da8302b02d5a426cfef365bb1f5ee5dc8f11b56718a5d0ce7ba78f0547677737c7f62ed146095f7ae1e3
SSDEEP 24576:6ZMRzFVSOYsqjnhMgeiCl7G0nehbGZpbD:6ZMRzfIDmg27RnWGj
TLSH
T1766501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 075744e1b9a6f928fe9d1120df9e9a64fc6ff91d72a9ce1016ba5e5ad4897430
MD5 980d110ddeb281c9d5969092b450b69f
SHA1 66c430723f1355d1907cb01f6524c778982b8fcd
SHA512 3b598dbdaac795bdc2cafc0354ade6b6b3a3cbfaf2fbd48aed1399ed89ff4cb4bee1418f5cbcbdd02859fb865f28b63d6ba5028a05bbf1314cf26779ca423afd
SSDEEP 12288:4RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF965C51CAE62608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f89b7b8200bf44c3c80b9b8926bf785fd3e66f9c8f0398c94eaf18cbe89f1644
MD5 d278b1827ee2453f9a17899783f7bfdd
SHA1 476c17f820bc6389a61a1de91fd53dcbfe64a4c2
SHA512 82f7d7aacebafdc6d6689161de5177d99c1613eec433d7d7e474703c3656bb2eac5dfc83426be2b52d6005358bbc17309366761dbd2c539357de65b2bd812cea
SSDEEP 12288:pNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BF965C41CAE62604B5C3E5F14DAC073E5BE92004937A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e8fc5f282455e1e09b902584891356ef3a4856c1c6394f0a923da41a54535a37
MD5 9b62e28908ba04c295fa1ea83602f655
SHA1 f7da2b564aafbd2ef6ec3a326e38bdd7038caaa8
SHA512 0eb8b13639c318175dcc96fae23b8465813108e2779b734283db3e94af4b087ce3af0434a8750bf2c76cb1445922ff86048e5ec91ed1e8cc83bee982995c2aae
SSDEEP 12288:fyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SzyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF55025B73A530F9D1378178C5A29A06F7327C3647204AAF17A416BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 071335dcad646b6be5f830ee3ac6380a5a88ad85b893d622cb786443d43a2d3c
MD5 1c97ded182d7ae0fe8eaf548fee6b08d
SHA1 c5459472e5f9244a07fe78b1de2199d659d26e8f
SHA512 043c7d579bfaee03f2c8120f4e75aa5c86a2f52363ea6f3fff66376db26a6a29c9bacc59c7d938f83220f5500724a681729f9e113a0d3b6c57d135fe50c139a3
SSDEEP 12288:yRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1074523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c03b51a27a99f81d241644cf46c807a787700db118d37601d5b372647bf15fd8
MD5 b86da7c03f39e7ad7843354ab78b85cf
SHA1 b1e8a6188fc3a5872b24b74360faa2771fb8442d
SHA512 43665bc12b06aa353a05e180531d4845e4e271d72fc6e47ce52d518738b28482e1148a40e7b81a0ffe78003776d4fb8dadb9cb2db30d44ad17359373b563a803
SSDEEP 12288:ORXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ORsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d3eb3531ebbcf88af15ee6f778edcc1542f23201c12e5c97f0347d44257b5160
MD5 ca8be3722fa5e3452fbef349f3a54a2f
SHA1 fa3317f830910f011402c845add45e1bca977d9d
SHA512 c8418c7a4f67b778836dc9051efb4932ab2e4f52e92a26350e86e602016f8b8258ba6603703fd7e0dd63134c2f97e4a4483600136556389ebf781a67ae4d95c6
SSDEEP 12288:IyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JzyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF55125B73A530F9D1378178C5A29A06F7327C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 92c07899e8e734e99a958dd67efde284bb0c929dd4ddcfb3460db8dea26663c8
MD5 c66d56d4cb2b046130f9fdefe684b537
SHA1 b82b7ad2e56e003fec3e0da7d4d7a5d7f4c3fcc1
SHA512 a7d11bce68a5b9d0ca2adbce7f3306ed5cf4470863a62267b7a6ac04af50567139aa596937370de02d4755b04e2ccb3a17254d6076b15ba1547b4bff87319a6c
SSDEEP 24576:fTDaLl3z0zDesqjnhMgeiCl7G0nehbGZpbD:fTuLljjDmg27RnWGj
TLSH
T1946501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bbb7fee878c5b47af8e244d8de45cd7801d043329243d882b5719549cea3abab
MD5 6ee774abb75075e68696b446c7e0387e
SHA1 eb95a7082015061a0cd7307185c99409a57b824a
SHA512 80b8be9cfeb3b546582820e0e34ccd23d5f4b34cec1aa3c1c8478e01c89476654d44ef86d62641183bc84bd1b6dae68aad049dd1f42bbb692b59fa717615ba93
SSDEEP 24576:13vd9CHKy7GZCsqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKyaIDmg27RnWGj
TLSH
T1DD75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a91abba8b174cd44be0983b51bae3471165df5373ace043eca37835a0b5825f2
MD5 6fdcf165236b76a0b0e5aa1e928be65e
SHA1 9972cbc5ccce4b9f9b780026ee6ea947285eda68
SHA512 0809f7894ec8bf811a133e9078efae7a9c7edaee9dcd58aa9d5010ee0ad86d15152932d674991bbc1fb00f79b5ef780a6c8b4b9b2905531ff412b2ba192bc9b2
SSDEEP 12288:qOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BE965C41CBE62608B5C3E5F14DAC073E5BE92004937A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d4389a2c0cf97919742f4e6848931c40dd5a620b1a32c710142d0007955236c7
MD5 c201c6cc7f012da184e17278aa4c1663
SHA1 2ace0161c945b0feb19ac8e1514f18001c6fc16b
SHA512 7ad0d0f45f956b14f7e8d8aefd9c44f89375a92a684376bce6e1002d8a895d0bd077acf9fc843e0cc6884898c4aa323c1b1ef33658f278481262f4766fb5e3a5
SSDEEP 12288:8kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE965C41CBE62644F5C3E9E10DAC073E5BE92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 16620ac68c061c2cf9841117080112e6addb0c4a7737695e40c773c5476528bb
MD5 33dfb685b8e67b8bc1207bb1630f2abb
SHA1 e1bd2abeb6b8a748bdf3989fac38e00cac160d88
SHA512 fe616fbdaa830a7e07622bf8c0d4115a335067bb7c4ac8209b809662bde4183657925bc88106b7bb671ce22cf6c4257c0d7367705c7b240bc8d499ba3acea07c
SSDEEP 12288:QnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA977CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 042209fc2e95f0c6a50a9331667ea652b95f29103189e14caa523598459cfd68
MD5 5b5b044d4d69801a43c0548d00eff9fc
SHA1 2db23dc793c89703a9f38aa4d88de3b10fa5c9cf
SHA512 6d2d5abbcfc274fe0c0c97c3c311835482cae4b46dc568552ac7940e1fea1630b99de34665a6965ab059dfdcbd54682dfd44b7de0884da2d09001e14e9bb125e
SSDEEP 12288:5RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C51CAE62608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a11b24fdc2bfcd40fc1f3ecafa4697eb5db3900556e1427f8ae603bbcb4645a6
MD5 024557e2d2e51fcce48f450765e76b75
SHA1 f6653b9402483d074e911cb556fad06e3a4a291c
SHA512 c40fed508469606cef8f7650072343fd4c2dda64f2d9d8c92d5d517ebd06e7b1083be3e175c3bfe9d0716bc6b43413b04bf7903c118664c105d4405f7e0b86dd
SSDEEP 12288:2OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ac4bf41f3739586308a8a0d00e8397fc721856770fc86372a83d229f746a7ed9
MD5 267a9007dad820e8210f438cba084eed
SHA1 ea264edb97348e50e38457bcd1b041d465151733
SHA512 1adbebe26d07d78f80f7af0def4c6ed805128b4d6af9580fdb2edff65184ff53bab7aa5f26879bf54b51c98c08bd1ad5e43e7f85faf0006fc5ab977f8586740f
SSDEEP 12288:nZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BE965C41CAE62648F5C3E5F11DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a95c86ebd63438ea7d05c8934ef27c65258bd4ac38efe1a0164c040afccb53a0
MD5 933e3ccf2ca983fb2877ded5dee7d8b0
SHA1 65951b9e720870d2b6d4278eb7c44d1c791c7de3
SHA512 0854081d40f2cadbad54db42fbae71409264798d8603f5726cd96952d708a76311c7897544d976c6fef2ab444611e6aa74c27ca262e477d495277d20b31d5ff0
SSDEEP 12288:ITXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ITsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE965C41CBE62608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 56d13d866ccd320ab43ee7cfc1dd7784b78c724012eb46fb743b001dece47aa9
MD5 0bc65bd75106385dd59508e5d980fda9
SHA1 1d54a3a16d229057c8aa017965bca8ef86557acc
SHA512 86d721b69b8d703f0d8a9ecf8e8f6b041969b0696f2e7d8a07c7e7c53a61d3271387f42662ad557d56310a07ff66adc1c7cb9e29e0f543f2de5f176dfd497062
SSDEEP 24576:/fwvUk9RX6wkyAIdsqjnhMgeiCl7G0nehbGZpbD:tMnYIBDmg27RnWGj
TLSH
T19385D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 65d1bd01b23c907e55463cf98a2945bfa21318a0be1143eaf11db8e5696f83d6
MD5 07e63ed658c7e50631fcade25b65da9e
SHA1 deeeec51f089f71a31ccbe56825c90bf18c366e0
SHA512 e3b1bdd473bca9a0ddf9add41c40e290a75f85b656e0fe6f97d080edf6d5f774e5b2d4f05c24411d6446040c9c61908455115c2ad28fbf4fff77c4861a7b58a8
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:9ySzPGD527BWG
TLSH
T18E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6a21804c221e329c8fc1bc54d7b96c11eafe2f5da1ce00c971ed705154547479
MD5 468719f992905896528edd7e95cc7501
SHA1 7e36a74be7ab13003f4e921acbfb1c21288ea9d9
SHA512 f03cfbd0fd0432aa24814bfeff0b3dc6a8981a4fd8098381a8e1aff42d7f049d1daeb9deb775601d1bd04f1b2b4ae9c5e247345d8bee00ea9d52d8787c781936
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYosqjnhMgeiCl7G0nehbGZpbD:U47JUQjTirIhCnDHUPfF/ODmg27RnWGj
TLSH
T1FD65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a993165fbd5e8aff645ef6769a482549d2e9ca5212733841514350da65eeedf7
MD5 47e91992f98fd72d31f187d4119044d3
SHA1 e82003c982187f27f892f93998c4b391e6a60a6d
SHA512 515c1450fd68395cdf6c8de3935a765e181ceff335506102fa6ee7dfcc3560b1fb5bfb9addf52c21ba19a25b746e86c432b3fcf79374f468ac152ff8ef0c8ced
SSDEEP 12288:MbsfBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F955015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 647e934adde932e15f01c5988b24e2da0e9c1bc08166ae2dcb057cf99e822b6d
MD5 77fc0813571e6365fe362121e6e4b647
SHA1 a44d03989cb916ddc98d69c90ac49e20be510e7d
SHA512 47845c2cd9968bae1b44bd321e88b1870588ca23a9f8d860db732a348eb26417c6f629c5c63726dd395e3513f48b783e22cf62ded9b361534f25059e0f9c77a7
SSDEEP 12288:IPtOFcDU3fcbdcoSyFuLUEodLNBnMnJRMvzfN5naPfD:IPMF+UP8dGgEAx5MnJRMvzl5naT
TLSH
T109351851766AD75FC6A940321E32D2CCA7707D05EE446F0373C88B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 def8303ccf4c29c789f0e73ddc5209f032e7b0c25e6748f0d5c7fc636dd28682
MD5 b7dcce1778ee0a246d014b1d92a9e2f3
SHA1 737ba8bd9f0c1fb92454e713c534489edd12a024
SHA512 eb2f60686b696720313e1c95ee1349730ae1cf1121d2da004e87f777dfa206e6958df4aa19d09a387635139adc739f821cd122b10b46d7f8c77a96dbbf7da93e
SSDEEP 6144:02VBdIBsOR+Lc6afTULYWbYyVxzQoLBJkpJDPetMxkDJwJXfJIJu+6SmiNtWNlNd:02VBW2SfAUWk2j1enpQYrH60yFs1obO
TLSH
T1B675F9819137A38FC1FB503207265F4CABA4EC06B7456F27B7C8053AD86A765B0B97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 49782ac8c3d4e9ca9f14f4341bfa3a9007e122e6c597fa7f168d9bb352730b1f
MD5 c54ddd6d5227d1d824f556308fc610c2
SHA1 d84d41daa460ada24d5820cc4258b1ea35ffc8c6
SHA512 5efca211358f492883f31e070ba003524a5112e36c4c3bcaef830f6f91066df8188e8a473d90397db37487f0bc67c2a5759a30eed016eae1d9e49157bb82f7d1
SSDEEP 12288:C07JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16445237B935C518AF93605B482EAE12D680B7E669F1044C3BA0778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 30168016ca632a16f6a794f9fa67787fbdbdba2633b5a5ed295cd32212475615
MD5 dc4f0df1167a37dc3b44f822599afc70
SHA1 d1534524967f4b36e122bee3e892007308a54cf0
SHA512 99f2cd09d07a3500c2ad379c13861d1140ebcc8f9fe7bf7c93a53e571188865822a137bb81012d435b0dc64fd527629c2876ea491aa6af76828c77ecd9b2008b
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bY/sqjnhMgeiCl7G0nehbGZpbD:hgb4mBIBhGFUDmg27RnWGj
TLSH
T1AF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e7cb18c970ddb1bb2650768575666d0fef446c43448863f98023c0dcb31eac3e
MD5 38b722c6022eca90bd3d14cd60855324
SHA1 7426e2442715ff0a2147a2e21d16fc2af0675079
SHA512 faa72040cc2198b99e9540fb7226295c36fa1cdb41d19a3567c806ba3b8d2eb1c25857a35bbb6532aac9165e5f851c916dc8d8ac19532e718b896851166b044f
SSDEEP 24576:/G88u8FpJqH1bzria7/mYsqjnhMgeiCl7G0nehbGZpbD:O7ZFPqVea7/bDmg27RnWGj
TLSH
T15D85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5c362612e7e47cb40d0771f2cbce1cd62da80c513eca8d186feb3cf613cf4d59
MD5 f6c7fa7be8966f8269a37621687ed982
SHA1 d9a4c9d187ff37bdbc198a4ac8dc6c21ac069930
SHA512 ae4ab24c8d8320847e557d8756dbf85f51d87b9898c1815cb1beeb3135d9682f313f1f0e5ee1701c8432375e4ad14bea66734bcdc5a2352680a6abc15230e1cd
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Dmg27RnWGj:XG05lO43bZD527BWG
TLSH
T1F8D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 65231d8c148d80d65d08e481388777b0fd9fe3e324ba9761b6f0d20805bcad10
MD5 d49dce909eeaaf9b36f34531ca78ced9
SHA1 0308dd462009bbb8000f973bd4c8efc725c668fe
SHA512 4984ca349d886f32953ddcb9ff2bc7abf8fe307804a2f034f163489d6b164778531c0fa39ec0e0b3e85e12649314fe76395a31f0a5b9a694d3669d4033c49225
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:Ua5POZ3BJt2pasx2+mADmg27RnWGj
TLSH
T15E65BF5EA7FC01D5D579D17DC583861AF5B2342253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b103a15d26a0041c8a4ea7c0b115ab7111b412afbc720cbcf4693ee66033b240
MD5 21c31034cf036642a9925f7259f34237
SHA1 85fd6cef1e66d4f6cecaac36a13fda52d5ca8ee3
SHA512 4abf3a8a9426dea4eba7ab9125b270b855a942b799e4a3af7ca80e4958e3ba229a171d95a1155121b51a241b1df2164716b86de9390036ea916d43c1063b83cf
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkQsqjnhMgeiCl7G0nehbGZpbD:QNc/zEOVHF7Dmg27RnWGj
TLSH
T176857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4bb98930eda0be28e6fada9e90b78ddc932730357442a1487278602768d73070
MD5 3338c6bc331458c510a51a960dc76428
SHA1 0697f745f2963e7a16819a8d4e4bd51d07b72eec
SHA512 d3a3eb3c22828e7151726d9b863a8bd5a32c2cc4121e36e0c277aa1936a7529091f18b664f46dc5ead94681db485af0e215248672734c7300263d02b1c5971b7
SSDEEP 24576:GTkNvNnaFeYhJNtmZBm6sqjnhMgeiCl7G0nehbGZpbD:GTMwBtOmODmg27RnWGj
TLSH
T18155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ee77dd481900123e065472599acef0a72a8ebcd8f8afed216e84ba6fbcf92235
MD5 962c801ec0f31498ab60e9c40c85c956
SHA1 b01a3051ea3fb297ca0023dc9896e4a7b00cc268
SHA512 9b602b7ffe629a991a112c4f27345d370c8311743656a7018fa1b4474f5e4cf42e7c0a148fcb43d93b0de52815e1c4367c7dba14f18d332f58d03ae4e618235c
SSDEEP 12288:THvUrBFrEjwaQcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:TPUr+NQcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 25babc32cb75883a0b2c7af8e50678eb79f0e46ab98e6cf6961232713192fd02
MD5 d7530877692db58a18cd01bf59ba8d20
SHA1 7a320eb9063b0506f1518ba5617923e67abc3fc5
SHA512 bf6215cb7dac49b031058477778c865bd8391a5eb332d4809f6ec154f3e12fc0dd3b6330b4fd7848bc8f58935cd34b8d0fdd381508efb21b0fa50c2433456e72
SSDEEP 24576:vD3FHshBIYQgA1sqjnhMgeiCl7G0nehbGZpbD:vDVHeBIAApDmg27RnWGj
TLSH
T1A275E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-8-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1360-0-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/1360-25-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1360-7-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1360-28-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/1360-1-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1748-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1748-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1748-75-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1748-82-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1748-315-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1748-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2504-72-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2504-295-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2572-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2572-119-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2572-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2572-113-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2572-112-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2844-313-0x0000021EAC8E0000-0x0000021EACAAA000-memory.dmp

Download

memory/2844-382-0x0000021EAC8E0000-0x0000021EACAAA000-memory.dmp

Download

memory/3152-40-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3152-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3152-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3152-44-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3152-39-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3152-32-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3384-129-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3384-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3384-130-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3384-302-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4892-55-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4892-48-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4892-49-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4892-56-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4892-261-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4904-68-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4904-60-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4904-62-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4904-294-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5548-108-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5548-298-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5548-101-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5548-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5948-94-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5948-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5948-299-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5948-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5948-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5948-87-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6140-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/6140-21-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/6140-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6140-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download