d7080e4cc35c2b27d937a265be203ba1470e84db5a4291862dd1e48a21b05cc5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
Size 1.6MB
Sample260711-2nc2wac16w
SHA256 d7080e4cc35c2b27d937a265be203ba1470e84db5a4291862dd1e48a21b05cc5
MD5 ac74bcf14cee72bce85009e4241dcc67
SHA1 7846b631e56b2cb6122407a374f87376077abdab
SHA512 cb03bc681bff0b6ed55e5e5aa7295339edc37bb5b5685d0ee56367f1276aea8245e08d05581152671eb6ea8e1b884a18d938d823c2c98a5683d6a1cf9783b985
SSDEEP 24576:fxDnwlOjwGWsqjnhMgeiCl7G0nehbGZpbD:5TAOjMDmg27RnWGj
TLSH
T18A758D79E5B844C5E2BAB4388263C559E222FC09475196CF3A687F463B737D4FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4960	elevation_service.exe
4512	elevation_service.exe
4260	maintenanceservice.exe
5580	OSE.EXE
4264	PerceptionSimulationService.exe
4252	perfhost.exe
1068	ReFsDedupSvc.exe
2688	SensorDataService.exe
1712	ssh-agent.exe
4552	AgentService.exe
2804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3ca4697de62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000688bddf98611dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab5b39b78611dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000377343b78611dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c479bb88611dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e24ab78611dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f20f5fb78611dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3168	2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4960	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4552	AgentService.exe
Token: 33	2804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2804	SearchIndexer.exe
Token: SeBackupPrivilege	1068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1068	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4960	elevation_service.exe
Token: SeDebugPrivilege	4512	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 5552	2804	SearchIndexer.exe	101
PID 2804 wrote to memory of 6080	2804	SearchIndexer.exe	102
PID 2804 wrote to memory of 3828	2804	SearchIndexer.exe	103
PID 2804 wrote to memory of 3044	2804	SearchIndexer.exe	104
PID 2804 wrote to memory of 3180	2804	SearchIndexer.exe	106
PID 2804 wrote to memory of 1004	2804	SearchIndexer.exe	107
PID 2804 wrote to memory of 5416	2804	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_ac74bcf14cee72bce85009e4241dcc67_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cfca7f100daacce3e6875c9291b89b915e284c24ae8a0dcf6223a5ede45e941a
MD5 87587e2dae048c5b628352dcbebd5483
SHA1 be8867a7a488443e7d755699e0543c8bf5984d6b
SHA512 ec9e548469524efb9adff9d77098e53489977d3d6b08aad2fbebcdec5baa6f87df1a02107c100fe700a5d3f4d0f85cd8c6938ac50820b8ada66f0332fbf664b0
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEDmg27RnWGj:Q3q6sjBHD527BWG
TLSH
T1E3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eb53fdd3b677df115d185ce8aadfc9c731e80e8b7a12b2063aaa172c2acddb53
MD5 f1d654516a10a499ad21b858cf8084d2
SHA1 fcbed619c7282896ac39a556a897e5c6a9c60690
SHA512 f6d09f872e3638ed639824637474e38cf9870f9951d39b7ae55d0708332031cbcd47b8af0ea88d06b77b07eb40d982d6c1bd61b0b3dbcf9cf15898cedefafa6e
SSDEEP 24576:cXYfDtczAfsqjnhMgeiCl7G0nehbGZpbD:btc2Dmg27RnWGj
TLSH
T1EB650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2a0051e953bb2393063345b3567ef88c4ff4827b0e13c1676fba8918103d7327
MD5 153f5ff74d69fb57c369d5676e514fa9
SHA1 99de2b213ca7522196ab86d89c774c05f62512c9
SHA512 978a892aba05d62f11aa5bb542b0d5db367d64de3d444c0d5cfd25fc0b40abd5d4cb78ee9fbfb2af711a221272aa94d8b4bf4ac92d3212e6a5dcc2276b839973
SSDEEP 24576:f0Le5ji0hmxxrMssqjnhMgeiCl7G0nehbGZpbD:fPji0Aj1Dmg27RnWGj
TLSH
T107859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f9f1eba4e66fc5ea1d00c5a8abcdf02066ab5cdfd57143e694e4bbc3b16870f5
MD5 8fc0195e0a0e23fd150a95201049f7d3
SHA1 8fdd3424b78ba53d8b46dcde3ec9b2a0d2675fe0
SHA512 239a63de9fc7cb37118fe75ab61a42dc84105666c77f7698cf0c751113ac76429e91e366219162c9a784413564db85695ca257909f7f8e021b0a6e91eb14f24a
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWn6q8wyuCsqjnhMgeiCl7G0nehbGZpbD:f/ezSC6vUzPveHjyxDmg27RnWGj
TLSH
T16F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4fb888fabf3c790f951d8034c358ef22c57bd59540484980c67b37fe5467aef0
MD5 d18d3b80367ff275e7b49a8ef3a8efdf
SHA1 e6286f468e7d58f17602db15598015f95400f47a
SHA512 8c8ab34124d1af703d87f48d76a06c52756998bcc6ebe4156add63b9d09d53a34a3de2e19a51fb2292fbb7987dc6acf0bef272fd6c4f48f19aed257f82ce6268
SSDEEP 24576:sVbqPb88hv/l+YjsqjnhMgeiCl7G0nehbGZpbD:sVO88hXl+uDmg27RnWGj
TLSH
T168559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 433252f3f42ed8b8a2625255600786608dad8d9a8066588f751bdd8a8976caea
MD5 c8985322fb779b6fa156637c0f5984bd
SHA1 eb0e47907077e1fd64d680c7085bb52b1d74ef4c
SHA512 a3258e6b84d2123cb807a401609625c826323aabcc928fe2e4438b00596963b8f588dd8a12a12625018a7c84cf903e4421bf8f7823dfd8daa87f1cd1a15a2cfe
SSDEEP 12288:XLgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XLgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BF865C51CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 99f386f95612cb08ea8e6a9973957750f54cce20d0ce636487569f369110502e
MD5 f6caf0c0770bb9bf51c667a17a531f8b
SHA1 d671545fa1efe93cf626d6368242f31246c9a3e5
SHA512 2dce677ee520bb8b0a0080ed9bd68c2e151406b1584372c76d3c1c44be8a3e79091663baa4e283b819c82cb20ee578d3b04475f50ba430ee064555200c7e4bbe
SSDEEP 12288:beBNUbTVO86UrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:bJIUrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B65CF7BEE28FCD2C27A8DB85791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e5377dc671e490e19e79d10c7ca6c51a65f0bc93cc21f65f09a7de07aeababf3
MD5 82d2496f76b597a2b2e889f54dddac4e
SHA1 0b39d671c2f7dbfdca9304ee230ac9eacdc628f5
SHA512 518c03fcbd969f9ab590616f91dd246543fc7272e51d784d63a73ad88496f6fa49909b7997c46a8e27207e8c171c210329bf8ef0f5b113cf0f849d542171bfff
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:NQvGAdlCEL8c/DRNw5CWD527BWG
TLSH
T1E1266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 97695147de23871d834f9574df40d669ab86140199ecc5420a1feae46409237b
MD5 2c41bb007b0a0f5fcdd5229a51ae939d
SHA1 72dfbf28dc95ace07af35f0fd2e49a4debac748c
SHA512 eaed6f8904567aef233b7328feaa3392f97c5b555ac7708aef2fbffe36eea7b8ef679764113ef2b13057b2278754a36ff33e15700b87b4da9e49031dcedbff36
SSDEEP 12288:FAwSfxL/2Dc3RDLLmt0LDQewsAjxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:m0ewsAjxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7b0493ae27b30c7b5e92a522a9ab0735203c8a8ba7ba012cfca7b0fd6946b698
MD5 99e64ec9e7f4e00301e1ccb793670a1b
SHA1 0e744a28e2990a5eadaf78e64fabd7becb97e337
SHA512 1319c67c0d34f97ff957008e1f79a1e780e504ee78eab61bcf26ae951d188a08e8735ad0b4f94b0e890534c875893f72f198abfd271a432e5ac2c74962a66fef
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtVQBWG:oUEtQevvqc2W1cpV2tI324B
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 26b431b2e004b591920ff828449d9fdb36cfcf77d1ea1517583a21d62270698e
MD5 0feda17d56921ec6bfc1b199c4a1498f
SHA1 4028d4f656161fea9591135081379d300731bf97
SHA512 c9b3470c276de55bc4a403b0d45d07f0314ecd1d91cc22ccc6c80da6dcd54f94cfe73db020952d892d7f5bec2532c286c44d9136d7e98caf9f3f182765694de0
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zlDmg27RnWGj:MoquVjnmCD527BWG
TLSH
T1D3D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f9692d899859ee8f4da2b5ff2bfe0916b32bede14082606db361d1b997c157be
MD5 d8fba133c2f5d479a061fe3b9c2b5bfe
SHA1 6d34e498a63b2d1d44a4a78629872d0bf74e87c9
SHA512 7a874d70559209a4bb372c9d87f00a56afa6e9f9f3bda6ff0527769381ec00fe89c987b8e2fdf51866cc7b6d8f02af1319c0fb8ee9e82ce92431bed882dfe278
SSDEEP 24576:7AhGL3IFoiwtA5l7S53OsqjnhMgeiCl7G0nehbGZpbD:7AMUFoiq5SDmg27RnWGj
TLSH
T17E359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b06fd96f6e733356e4df7e3b1b3a3f6cf699586ba96d3db210d03455016f0356
MD5 a25b4a98c0d5dd920b850056a5b8fb52
SHA1 2273ec1e872e0d296ab6bf011c408ae4adb70f68
SHA512 1306b433fc4f4107a5b16fcd1d91a9a778d776daf58a43412b324a157549dc4212668c285d01a45acb71e9c97bef2f98684c165b98b1c9f77bfee3ebc37d49c0
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:5wu4OWtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fac70bfac2ebedf412b0f646e9280b5c85dd69af79ee478dcac2a312a48a7064
MD5 a6701d7d0993148e4c73fef201eef7e7
SHA1 8adbd80a86a94769e56752c6c4ba4635c2c46e9e
SHA512 48e39b8b1d9b3c222a85cac4e60abfe8351f13f09f4a0c4cfa2543e59cd1bffda41029144a44d4eca9414fcf977475933ffcf6c03fcf8c197d1316ed34df37af
SSDEEP 12288:NeZ1IyBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oZu0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1445512AA239820FAE163417CC5E5D609E7337C62673043CF166256AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4736b2f5b01d69dd970b03fc4e632405a6bca71cf0668c72d126ff15e3591793
MD5 a459c42cf00c10a5dfb6e9465ee0f3b4
SHA1 330ff46272de444c0e23689146e6a3466c749226
SHA512 944ecf398e1c262b3b982dca7a20d9530b507e57228226c3011afd5c3c34b6d642f89c625a6ad3638804c1cd79db7f532bed04fd1f58ee6271bb20980289a728
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3bD527BWG:1QyiKa/X+PNLVQBWG
TLSH
T165667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 20fb45c7bd322bcb627fa06cb96ed33eca34151cb1072c80b46153e3e6512b00
MD5 640721ba932edb47a9446fd451e0e81d
SHA1 e116e3ff1f617d161a07eb94beba5f34c577c2a6
SHA512 5aa8f94ac817e78ceed4cd23cc3f6d4cdd227bda819b7492b6020530a8edfa620be5590e4c254b0544f6bb41974a1a3b0a3f7733bbb47a967d9430e9276d40e5
SSDEEP 98304:4QRQyi36YOcPbLvw2gAf+PN3bD527BWG:vQyiKa/X+PNLVQBWG
TLSH
T1BB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 49244773eef238ab57737292139bdc5742647c1de1f3fe2e4b0ad2d8f546ac2d
MD5 c4711148fc9459deef7b7a44f64e46ef
SHA1 b7af101d2c6c4bb4f16715752fe8de92ba3017ef
SHA512 4c6792d166102ee33d0c1aeab016512d7d4c1c61733734e2dde8ec65c2c125752d45af0a2f1ce767284837b6cd92ee5480fea1a97c207153f143ec9ce424fb20
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ksqjnhMgeiCl7Ge:p68Qg55nhceWu7PNU3/1Dmg27RnWGj
TLSH
T1FFB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1eeb6952d23d208081d933c21c8f2102b48a7357d798da752881ea91663f2ffa
MD5 197bd66c7de0556f27e1489de93423c5
SHA1 fd323b7d63c4c9d4a62db0c8dcb8832e1019b22f
SHA512 bac5c0136b06be53c6448aff0bc34da00820d487198a4904213dfd1d770bc5acd3c355cc083c32b17028ef2927f2a9d82f588ca212f7de4d68ca0514a37f49e6
SSDEEP 98304:Ky5112gYy5azzVvt69nLKnhZcD527BWG:zLIHEWhKVQBWG
TLSH
T110167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce53a41e63ceedec44427b7873ff9853f9ea1e5cef1f6543aafdab89b5c39032
MD5 6e33d2511ae8acdaf5419f02629f305a
SHA1 7182bab9a43cd0beecfe288eeae58fdc8f15f4d5
SHA512 617c7f78ed5553b4d613aa2ac4996a2344faf28e3e52028785987c35992aa13761abff4c60066e73aeb55b8ff2b25bf73164bc304fd3e7f51b0c35a8efb9a482
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLDmg27RnWGj:Bu6Jmdxd2dLD527BWG
TLSH
T169D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f7864183b4754f84977053a17bfe1521b4a28f698021d1d115c027b67bb5b722
MD5 777f7df5e653f98745f6e163d4122f6e
SHA1 84662094daef1e6b4b7db4962cf5242fa5ff3b29
SHA512 8c539348d44eacb70608d7005d56ddd0e6ec776279c3be405a691d741b89d4cf68c0775e31eaad96d8c2d16f59b120bc58cb6eb8f0ec1ef21f69d5ef7723a9e7
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4x/Dmg27RnWGj:vmifPWRCD527BWG
TLSH
T115B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8ff0e05865e586aac0c1782789a18145d82be7327bce0c60d3ba61a2c4055a76
MD5 f5bb11fec56146651fff3d383f95d326
SHA1 75c03aeb7601b748fcf0d83127a35e8b46760537
SHA512 c5422603af11e44233ce0c22a6f3b18cc53b87f4b36dccfdc228e2427b0721a369ae844d3cffdc35c7e86b3537241fe8f7362bd500af94bd4129d257bcdc8893
SSDEEP 49152:lSuZQIY0Be2KcRVtOnks6NMHqQDmg27RnWGj:r5dKii61QD527BWG
TLSH
T1A0C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 68a8b38a165aa705dd464a9d1a642fa629b5de0a19626336c08da6cf0bc7f055
MD5 d20a6b175ebfd8c2ef644e6fef0de484
SHA1 5220ce10d871388a17a7bbd15f4f2826a6a539e5
SHA512 33b60bbe132b3fa5cc5b9a22f42af4ba0ae742c2c12c24f4490ca3d7da464cbe72d8866b8f442ae538051dd1a1b38c1e1ead521d26ae7823b72e9dbdb8e8eab8
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5wDDmg27RnWGj:OX2imph+D527BWG
TLSH
T11795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 71a75a943776c59e5f9bd8c164cc98b6a56d44448c6004b869757e4625d62dbf
MD5 3dc28b5ae9f107d53c21bf432df292ab
SHA1 732c936bcd5180988e596de2ebd91e0edc1ea2e2
SHA512 365ea2897880b9dc84779e0f06f28840c3171ec53172bf2b82e67d814b58c75dde956554695d0303fa76331094523e9018c9c75695b1c54723406410ded56248
SSDEEP 12288:KoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A677CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c11fe86bbf1adbf99433498e094a842e7fa7f3627daf69f76e4bb038bb6b675e
MD5 bd0295ed138ccad22786f3b5e90458c3
SHA1 d64b0c9a1238f1cef122875813da295a4303ae3a
SHA512 bb5294005c11d8b4eefff0fa13ddd3daa77c1fd404d3eade3ecfca26c1635010e6652ee68de45b48d882764d550355861df800c3d7287b6b1e97d69fe17c31b7
SSDEEP 12288:mlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e9bc300233bddc9af54237218bb34b7f9eead5f0be84f5c5d407254c181d5be0
MD5 6ba63b5e6dec7e51a7e2c21c1c365d4b
SHA1 38322073293bb1d002125e6cac67bc05c1ca251e
SHA512 0926df3961e6f62c75e005b73ca5085b11fa4722adb39ba2b5774e676ea7285ae4aa3169888fa8f0fd9f43f34c6934a4310943d47aadf0aee25ce6c84cd81003
SSDEEP 12288:QTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BE965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 1d6a3dbe07b38db9144f50385e79d7dccd5269127672ffbec5e37d634294a17a
MD5 f53cb458761271dc0d56053e64d56b95
SHA1 4d230728a86ca1d5c090e90655d8f0f8fe5caf54
SHA512 e1c50d379c379ca78e7081f844556cde40584c88e1d418893772ea92c2690b9eb679382f73118aeb326695c26e2166123e52c8f54ceb2028b7aa0983947068ac
SSDEEP 12288:/VuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B45236B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 945bfd28697ad8b88d283d9cc24cce36cebf0a26cb03087646b5d94eb3645197
MD5 71fbdb18e30ab7f3ffdffe7dc77b63bd
SHA1 a3276d10a9b52a78f4ccf8f22644ea54491e0820
SHA512 60831c3debed6c5b5aa8a4e8d376c44536366ed9cf71454fef1affaeb3c539ebcb0d8ec6c0614f590837c78556c739fc55407b8d234127e4bd483679cfeeb9e4
SSDEEP 12288:xmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bf5fdd02cfec1e3d8ebe6d1af9478fef87e2a866e5b064688e15dd05e93ef85c
MD5 50d84bc2cd2bd532fc243bf0886e3dd0
SHA1 bb0e47b8c5058d0158cb9113031b67d17e81a1e0
SHA512 4257aecad6cb60785d22bbd9c0ffa741e1bd94008a5d4a45afd47aed51649cede4b55a987a0c5093dbfca03f7caeb56b26105379411c734c0130a4c73882e9b2
SSDEEP 12288:+5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e8aada3cc6d7ca90b8da1b14fa0d231ef60397cee006802cb26cccca8b83cd71
MD5 a4d4c864be99d58dfe4e980db262589c
SHA1 b98e59a12bb4e55b185de6b8b626c4c1872b1cc4
SHA512 c924e3e129c9282469679302d933f01533d5bf125ea782b12040b7b95fb968f584be44807e33eaa3eafc2c54719df527cff64ad783e3e5ef277d1cc46d83f30f
SSDEEP 12288:jdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BE965C41CAE52608B5C3E5F11DAC073E5BE9200493BA67BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 76e237c44b217675249e0bc94d5fd8e4ec15cb52352d999dd9e8bb586ed02da4
MD5 b48621a70c3e91c3c615bd33f98f4756
SHA1 4ac52fffec5e697afba7b260f9fddae24155c819
SHA512 849d98e970b8969d2e09aa854d5967fa4aab679a63f970c6d17582c9e55b3b524166d8154da0949ca66f92706cc4765896e8c0fc1ebae9d913dd6225709fb4db
SSDEEP 24576:aZMRzFVSOFsqjnhMgeiCl7G0nehbGZpbD:aZMRzfNDmg27RnWGj
TLSH
T1DA6501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7494197bea3427ab15250108ab9e58cab89b265519d6374e3039361da048d162
MD5 50ba93494e07ec092e50192d5f64c375
SHA1 d11d50c2b8e72b7f50f3a2c7a008512d647664de
SHA512 c702982a0ef24bc8cebb35af026d9894a5abe1f7bac7a3fc71f70bb5783a6ec1bb14e0087f130c36919f8564b0b39fe9f879adf83aa37b5ac3aa47424a8a7d43
SSDEEP 12288:YEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 457c5eaadc3de4d7f143b075cd9f7cad300016e645c3ad988a2bf6ae9f5d85fb
MD5 0190687d6eb4f42865eb5443fb137074
SHA1 eff973606ca3369e214371199554fb0378ae0526
SHA512 6a9d1920ee3fa63fe70fdaeb5aeff934870680dc51d424aabaee2b129094903ad901d4eb2eba0a41b2f9ff0b3ab753e89a4172c2fe177426a077344f6dca9531
SSDEEP 12288:8wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e3452f196163ff5edee05bd676ff15968f968232326854b4c4ad8abacb9e1b86
MD5 36032b694caa3d7a684dad9bb1604860
SHA1 3a2288db909c89ba6d7d73843127064b21207212
SHA512 7b2b8e963b26f1edbe41229bb81573b92297bc2cfc9a83482fd3724bddf285db2bcb6e126b536893d7d369256be1c7215e677be4b79bcf4f65b29a98f2d3ad46
SSDEEP 12288:byPz5L8BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WzyBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12355125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7379176386c0093a0410d9a6275d19ebbc7d1326337c89913929b30b722af9e6
MD5 167e6cfb1a2ac4450e52f38a8236daf7
SHA1 89f50461ac24ba0bfac3bdd226838c4308ed00df
SHA512 7add771bfc535a35d4f7a53e93b8f10679d7386ced79b9bc8aabc6724e28ea3343d3ceb45a18af990f4ca05e56ed977c7b2c4dc2eb9825b0aaa99bba71ea0ebe
SSDEEP 12288:wEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e72d82bd97e8606d0602874eec8c8b4222f47633adf4d780f7a7f76adf484ea5
MD5 ce110c4fce7ed225d51aa4530227f959
SHA1 b6a1de0f67f8e35e417b1e7e06f76eb716ae3854
SHA512 32b6d60db3b9fc2beb81cf00733df4e9ae774ae2c115a562ccaa41082320850a3f078d1fe977d4d4990024b5bce5c24b83e9ab0472b0f5f1fe876bc777a7e89b
SSDEEP 12288:HEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cb599289a2031703015b586d6083543a24c4d5cb01e616e59576f4312743c039
MD5 7895249a8b2798600294ed4eb540d32b
SHA1 c37b2fac0851a9debf2f489e25cca90867046447
SHA512 9c8079df7cc9454dc6d5f317275d1a1eaba7eb815e226e8bd0061c01cf097b7cc5f39e34f8b2dde3da383d0703642d76b7dc134f056c23dd7c101886fe70702a
SSDEEP 12288:ByPz5L8BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QzyBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17555125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 bb7719205f686b41786adf61f7b90ac525dd15e0044f98ec4596eb490e304741
MD5 316f856893fc2ac1955bf5a176333ab6
SHA1 94151a5f32eaa1d39b2b665b1e99fa272188063b
SHA512 09a4e77c3aef58ee4b0b5d0438fc6b565191c832cbd0742d4c7959bfe2dc4bcbb536fb0668bc3701a69a9fe6a2112a167209407893ce58c15c49eee1537774c9
SSDEEP 24576:STDaLl3z0zDDsqjnhMgeiCl7G0nehbGZpbD:STuLljGDmg27RnWGj
TLSH
T1E46501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5a0c3974487bae3537130e4b114e500019d97d041d68796bdc2949e0f766a017
MD5 e35f356a9fe54c6a53c4bc1ffdbc67e0
SHA1 1834a0241ebba082b2ea37ce158bc41e6ea4d96d
SHA512 db155244cd6ed6482c519036ae161daec551189ebaa2181fc9a4c1c38a5cf127c9ab744ec92c4b7a5ef1ad4b1b641f68c7fab05a5eff313228e65b2fa301891b
SSDEEP 24576:M3vd9CHKy7GZnsqjnhMgeiCl7G0nehbGZpbD:2vd9CHKyaNDmg27RnWGj
TLSH
T14975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5df7f5f0cb200c73f2024eaec6e5b5842ff1461d005121cd5932c96c3e7825aa
MD5 55ba962ab79288609ab262aff254b834
SHA1 b377e2ce827b6885924d0ac4fe0badaac5c4b6f0
SHA512 351967549ae11b513f367450663d20f29d2453ba1aaf213ab63c92a2949b39f460884ecb456752eda3f3bd85c9e4dd7663eaea1b3dd70448165c07b6ba30df35
SSDEEP 12288:HzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a1d6728f2e9ca3c7f6665cd77657003181620efbcbfc6eef0b06b7753e402031
MD5 86dd296fe493fd3d8c116b6428212605
SHA1 be59ae3cb40628c1dde7725e2cf198e38f6cf1fc
SHA512 5219628cf64c6a8c753b0f3d43f80a35b8966a2ef42caa3c5d7e04457b9d0a842dba9467f624523148493c20060fadf4ec3e88d0ad45922ae4385a2e9f7d2577
SSDEEP 12288:zhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A4523BE965C41CBE52648F5C3E5E10DAC073E5BE9200493BAA77CB9EBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fac377a3924bf393ea650ef428f9fd2954a9aacf5afa1ff291136141ff02f53d
MD5 bbbcb91de38c9f2f32364acfa1d6344a
SHA1 34354202d0f19ad6b36bbf5703e9f5afccb38fda
SHA512 065ad3ffd4fb64be896a404a935a8a7b40f06f88af653e727edfda9c5af003e492326882be78739b98d1560fd081e25d5df32f63b120d5158c568f01e6f8105c
SSDEEP 12288:D6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BF965C41CAE52608B5C3E5F15DAC073E5BA9200483BA977CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7c25070092c8979dc59f9a32059004f149b7b232f73ef303fecb592c8c37355d
MD5 808b1c5bbaeeddb6acbb11bc359da2e1
SHA1 712c00da775706f43665eec8663056d4e43c0672
SHA512 b83258641350297d9d121f3728567f443b239ee97f2e1c8b02b62982f16e96426f35a23b6b3953f0f8b4a7971dbb25e57d5fa1d4efffa6bf9603477bb9b63452
SSDEEP 12288:2EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2EsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3088759040707cd1e6196b051dd8b3b6cd2783facf20e364ec73ed3e9c159bb6
MD5 6eb1d3cc613230ad9239bd1eea35ba42
SHA1 539debafbe56e3b8a5874e4132c19919736b8433
SHA512 00c86e4c17e2b0bb518318095c19a7116bff0499094bf4d1229c323b4cf974d82598d4486941257946ca9b5240ae823f2024a29699f012f885952e9d144bb8df
SSDEEP 12288:DzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 acc192f980cf526fa1b073e8874e7c9fae59042db19648360225821974b3959f
MD5 60b22eea98d77de1275fc75c4c1a680c
SHA1 0087de4192f7e663dfb3a1228031004c7d9c7f2a
SHA512 48a631f45eaef2838d284316a729d9b10979b4bebce83de012f2694986867547e99fd95f8434a936b2a7586378254804a40862478e7f728b38dff825052f1716
SSDEEP 12288:icXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:icsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BE965C41CAE52648F5C3E5E11DAC073E6BE9200483BA677CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 69b75f48478b7f6c2eb16b59cc071cbe0f63985765f332c7ca8ccacf37b6bc54
MD5 a200f78d7bd08a9717f58e5fdfa096f4
SHA1 cb6a30aed4155296442818ae9bdf2faf8af542f5
SHA512 84e4c103f8795684a5b4f34162add27c9df8aa9877bf4a267307f3c5422877844145c33ef05c6a7b1c692336d42eb4fdeb65f697472e8bab558a67a5947fad6c
SSDEEP 12288:amXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:amsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 53b680843d4999e51098313b1fbc5a2f13ea2721a8a842041c88d2a7f150e7c9
MD5 9b1888636452f1ba36ed5243d62efdd7
SHA1 689991cb704262f919be59fdb20ccabe7e9c78d4
SHA512 8d351ba252fff77f587161b92f6dda71d5e99460252ae43d731042bdb594c6df842bcebf52d14ef6405bc4d0dad41af45d1fdfa215311c00f511823f1041f8c0
SSDEEP 24576:4fwvUk9RX6wkyAIAsqjnhMgeiCl7G0nehbGZpbD:sMnYI8Dmg27RnWGj
TLSH
T17185D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c361d40799bd1c13b6da57a0cf26071c3fa4ceb5276b9f3848e13592657b94d0
MD5 4b1c7869bbff5981dccc494011e8dc72
SHA1 afa980ece91eb181b9a75e4af3625f1485390643
SHA512 ab5f78c53589cd829a35e87647e8cec1e7c666cd1ecf838dc246b4ae4c3d5e69853a96f15b6978d4c588d2d098c744911ae7a2b7755c7fff196efa3669fad880
SSDEEP 49152:YYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jDmg27RnWGj:PySzP7D527BWG
TLSH
T1ED066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 41f7ba372401d73dfab95bed192d45d7c370850e92aedd31346f26dac4404a74
MD5 67fa634ffd36292cf222db9c0fca2ee1
SHA1 84cf8945f6a56f2151370237a25c52a76752437c
SHA512 62288a9dad7fc01ca2b5e9151280ffc2849cd30062b3acb6cad08a30044adec9c6e12c1f0484505af9736c49fa7e6ea14961ed5c609eca02d8888e6d38b6a58d
SSDEEP 24576:C47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYVsqjnhMgeiCl7G0nehbGZpbD:C47JUQjTirIhCnDHUPfF/zDmg27RnWGj
TLSH
T12665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ce8be12c7f641d2622ba90f7be1aeabbd8fba3790248d1d4d0b1cefa77881979
MD5 f2b62789103ae91cc412dc27ebc6e015
SHA1 63334722f1f0a3c59afc2d60992a2d0580eb24dd
SHA512 2878d5ac849a8b9f54b2e5d527d33bd65d33d78ffd89a4ac376a3b211a14dbd5a3542c2de8b41ef74a6828451fa708aae40ff8a91e26dffb91fb9eb754a123f6
SSDEEP 12288:vbsf0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c933eee92fd68a7be782335794fad48100411ff23a80f3851113f2804336dce0
MD5 925bfcbba88adcb9b0da9a5daa59542e
SHA1 1ce6dee2c76e3b1f81fb5e5ad7ea06007344f87b
SHA512 a96d594c0be9aeeb23e7fd48c52389f424ea759d3ba7a04c4f7786a32c2d669180fb2feee8d703d812cb52398fadf9d095ac78fb1955372eac110c9af160c235
SSDEEP 24576:DF770UPTysJNMn8g/cx6cwOUKvPS1HL6Eq:R30U7p28g/cx1wOU+PsHW7
TLSH
T1A05538417626D78BC6A940321E36D6CCAB707D01FE446F0773C9873F9476668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 f4a3e968f4e0707021461b4992ffb9eda1cab6e610d5cc4e289e57178e02fdb8
MD5 0220fd4ce099b7d9b87a7c3824e3d82d
SHA1 c77be2b8799b9b73b366820b8f4106c85d43e09a
SHA512 5f1f108d9040b7bd438077094ba8fc5394d93dbf24e5c6cce90b9be8f2fd813c9e83131bb527d245cc2ea45615caf52ad2f3112a5bddffcab3f05a321af74f15
SSDEEP 12288:Zf8DgrIKIsbdGvX6YMu58RozuAIsa8o6MP3OXf:Zf8DgKJF66yAbaT6geXf
TLSH
T12C452A41A5A7E75FC9FE50370332C6CDAB749C03BB85270573448A2C9877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3280454418c9f3a44d761adea1331ddb47cf5f3f0b3bd2e76d2f9f9d4828bdfa
MD5 f26273ed6e7a3b573bb9ae02bc347af8
SHA1 0eb75c06381c051e0a04f0de78d6e95b01108fbd
SHA512 23f3371ee0afdda119a0fb06e8cc9fc53b02068c0307164ce29512f30a65d60af9b6268cf2553d2017573bd659978f40de54583b69c9784059f71419bca3e82d
SSDEEP 12288:o07MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D45237B934C518AF93609B482EAE12D681B7E669F1044C3B91378FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 54b2c64e8535149698843aa292ba15ae43a81fc874b90a09c2f4eec32a03908b
MD5 ddb07f52b31cf4233e50df408de66744
SHA1 7e96cc469a410de990f0bd3f1ed592e4e6c2e894
SHA512 e886bf1e148bdd5df25d433479707f64884d0bfc7c8070aa324b71b5d56ec70e06c46ad9fcf96b5d1ca6f9763d601195f8c22ca91c3867b2b5d6b0710eb0cdc6
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYCsqjnhMgeiCl7G0nehbGZpbD:jgb4mBIBhGFJDmg27RnWGj
TLSH
T188659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c1bc1cee647adbaf74d93e4e69bdae140b0f0d3c885597a4ad3a3cd4def04edc
MD5 24b7b960f190940feb843d74574b3f52
SHA1 bc5c173137c2a2b2fce7f4c2c56baf8007f2b625
SHA512 61991d6a970b0541c14241d47077b976004cd7169fb7d1b07a133c94c89dc3307f7bdbca642ad5766a22dda64e1253d1557eec4919032a230feec582c9809038
SSDEEP 24576:RG88u8FpJqH1bzria7/mFsqjnhMgeiCl7G0nehbGZpbD:07ZFPqVea7/uDmg27RnWGj
TLSH
T1B185016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fd1cd1b288300e4310eb77faa088aa0a37b3d7b75fd79949cc9ff60634f05e89
MD5 82f273882dcc939e7f5dda728bb23142
SHA1 0964a771a2ca742ffc62562e5fbd91a268649bb2
SHA512 1116a19c3d5a55c8b73352c6881560c5962b6f11fbc048f998b97471eb0948de5013fb539aa2e6f29022c0114400fe217570b9011e8e4b022272d9f70333ceb8
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Dmg27RnWGj:fG05lO43bkD527BWG
TLSH
T1ADD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3d6975ff3839ad49123db25f86db2511c03a14c278cc40bfcbfea114e6dbeaa
MD5 007d0fffee283f287fabc05fff1f721a
SHA1 9a64617b0d5d5d4a7f8a096288c7e2f121cae735
SHA512 4ad4cf09894581ebb9e6b672037ca4377512b660f4c2ced014e471fb3fb481f231f2cf07ebee578ebab08c06796714238c12a2cbbd9bbc8aeb12248aab538b6f
SSDEEP 24576:2fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/sqjnhMgeiCl7G0nehbGZpbD:ua5POZ3BJt2pasx2+m1Dmg27RnWGj
TLSH
T1A865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2b45bea1a739ce5a336d312ff3223538c8ac0a928bcff07218ca6df5274a2ccf
MD5 d4a442b3943c8c53d63249e12e1a2f49
SHA1 eb3b33d1fb2e3c6bf9a31cb9b312fc4108a065d4
SHA512 ffba478cfc90131fa434893d95a607f5c29affd6607de25766bf4437f92007e62a92c35ffb9f4328e408c7e4f29f734e5af717f4b2571d4515171dc2c0496a0f
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkNsqjnhMgeiCl7G0nehbGZpbD:RNc/zEOVHFODmg27RnWGj
TLSH
T12D857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1aa2c2ddd22f215981b00d26ab581dc872feb25b1a0745e6084a4c668b5fb6b9
MD5 46cd028c590a2184087a782a5eb5869d
SHA1 5ffe896b9c879944a869040bd57dd989809a7f19
SHA512 6307f9c1048a19296d054aad92f43d6c11eef71868206f0d349c2cecb8867641bbc465ce47a436935585ba6429591df2a07d88ecd70f09a026f6a3737e0ceb9f
SSDEEP 24576:eTkNvNnaFeYhJNtmZBmrsqjnhMgeiCl7G0nehbGZpbD:eTMwBtOmfDmg27RnWGj
TLSH
T15355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 64f8c878cbdf22e6998b77618e3dfd8767199a1aa82746d441061cc2bd09166f
MD5 26b802e8de457fa8fb8dd68417fc7cc6
SHA1 912da955318662e21d6941f344a9724583592031
SHA512 0d0b70b30dd29a8b920900a7d5d4dcd68e9576a03a343db638b51146143e3e931aff76325ce44898470180842984ce8493521412a8600165cd4af82171f0e1f1
SSDEEP 12288:GHvUrBFrEjwaQJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:GPUr+NQJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 79bf7db533417c3c8a637321216cee6d976b7ae4b9f292fcadbc50ec032c2478
MD5 ee56e2e6a0e544480e00e9a107e284f2
SHA1 5553f81130aa0f6c38e08e825a0462571e771bef
SHA512 5f5bb929aacaf18ad2cd30950c04b6cd26659a709d4bed170a076cd5fa4e49114484262e87276bfbd5115c39a797e6309ca5254a2ceeef15455ab74e009b1069
SSDEEP 24576:5D3FHshBIYQgAIsqjnhMgeiCl7G0nehbGZpbD:5DVHeBIAA0Dmg27RnWGj
TLSH
T1C575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1068-92-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1068-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1068-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1068-86-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1068-325-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1712-119-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1712-113-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1712-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1712-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2688-310-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2688-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2688-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2688-99-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2688-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2688-105-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2804-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2804-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2804-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2804-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3168-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3168-40-0x0000000140000000-0x0000000140244000-memory.dmp

Download

memory/3168-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3168-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3168-0-0x0000000140000000-0x0000000140244000-memory.dmp

Download

memory/4252-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4252-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4260-44-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4260-51-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4260-50-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4260-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4260-55-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4260-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4264-72-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4264-78-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4264-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4264-305-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4512-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4512-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4512-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4512-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4512-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4552-124-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4552-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4552-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4552-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4552-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4960-23-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4960-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-15-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4960-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5580-66-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5580-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5580-290-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5580-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download