Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 11:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 4.0MB
- Sample260720-nxsl2abs5s
- SHA256 4ea0b12899dc49ce1ddea55310b94de5abda6502672936af6aa22748e46f78c5
- MD5 5aadfd17ac16bb920e8dd8e71d5cf70d
- SHA1 cc17c84b797c88af5752c5b9fe646d7025420f8f
- SHA512 f9d1f5b68d083f5c0e138b6fe128a94c2bb4b0f887716d28ca038b5f3fedc9bedb0c3381714522c4cce779c8739f6b0e90520117801ef16cb7bd4ff2ea5b6a72
- SSDEEP 49152:8vew15R0+l5xDxl/8blvq+MAep53lUm1t1bAotc4Wu3rPOhQT0RcRjoxnMkgYh6:k/rbASfoxnMkgYo
- TLSH T1C1167C07E7B901E9C4BBD13D8A569657FAB27849877197CB07A0835A4F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4736 elevation_service.exe 3904 elevation_service.exe 5948 maintenanceservice.exe 4480 OSE.EXE 3972 PerceptionSimulationService.exe 3768 perfhost.exe 716 ReFsDedupSvc.exe 5148 SensorDataService.exe 1320 ssh-agent.exe 4488 AgentService.exe 4628 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ace5dc2f209659e8.bin elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005416c9863d18dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000211b1e863d18dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ca3c5863d18dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b54bfac53d18dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009d6e9c53d18dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e5398c53d18dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4736 elevation_service.exe 4736 elevation_service.exe 4736 elevation_service.exe 4736 elevation_service.exe 4736 elevation_service.exe 4736 elevation_service.exe 4736 elevation_service.exe 3904 elevation_service.exe 3904 elevation_service.exe 3904 elevation_service.exe 3904 elevation_service.exe 3904 elevation_service.exe 3904 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1276 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeTakeOwnershipPrivilege 4736 elevation_service.exe Token: SeBackupPrivilege 716 ReFsDedupSvc.exe Token: SeRestorePrivilege 716 ReFsDedupSvc.exe Token: SeBackupPrivilege 716 ReFsDedupSvc.exe Token: SeRestorePrivilege 716 ReFsDedupSvc.exe Token: SeBackupPrivilege 716 ReFsDedupSvc.exe Token: SeRestorePrivilege 716 ReFsDedupSvc.exe Token: SeBackupPrivilege 716 ReFsDedupSvc.exe Token: SeRestorePrivilege 716 ReFsDedupSvc.exe Token: SeBackupPrivilege 716 ReFsDedupSvc.exe Token: SeRestorePrivilege 716 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4488 AgentService.exe Token: 33 4628 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4628 SearchIndexer.exe Token: SeDebugPrivilege 4736 elevation_service.exe Token: SeDebugPrivilege 3904 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4628 wrote to memory of 996 4628 SearchIndexer.exe 100 PID 4628 wrote to memory of 1012 4628 SearchIndexer.exe 101 PID 4628 wrote to memory of 3468 4628 SearchIndexer.exe 102 PID 4628 wrote to memory of 4804 4628 SearchIndexer.exe 103 PID 4628 wrote to memory of 4500 4628 SearchIndexer.exe 105 PID 4628 wrote to memory of 3788 4628 SearchIndexer.exe 106 PID 4628 wrote to memory of 4132 4628 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5948
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4480
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3972
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:716
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5148
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1320
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:996
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1012
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3020 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3468
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4804
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4500
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3788
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3020 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4132
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 a971b429b12519c98b2d75a867ab445c5a1552ca59fa21ada42b89c974921f3d
- MD5 df6b5b0dbe5838826ba1ee377fc08918
- SHA1 95c04d3dfc62af80362c652ab6b874e44155ba3f
- SHA512 52a72946e2dca6c7fcda2162e38034cc9d775489f8816e6b576afa8231e78db39bed1a808270893d864bf503853695be7509849751f2a511830b7626a3df9d6b
- SSDEEP 49152:Pb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn6joxnMkgYh6:N3q60jB9oxnMkgYo
- TLSH T1A5D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 15d5365c0c0b0fa39b778b363b160c592723c420414d970a73d165d080d9a466
- MD5 8cec4ff2afa33b3f8c06ced8b2742feb
- SHA1 2a49805fa17ce64d34c250877c410e1723db0af6
- SHA512 96999fcd353b0fa42f37498bfeca4481d983f222f9f64f43f4180584e7022f8b58d0ac21fe8b094e4aec2664ed2c7642035683df610d214f3b3e59349a849515
- SSDEEP 24576:IXYfDtczAOHjoxdRdGKdalyvYYSibdgptf:ftc1joxnMkgYh6
- TLSH T13A05F11873A508F9ED67827DC8A28511E6727C8547A0EBDB03E4AA751F333C85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 7c10e9d8c76daefe9ac73dacc0d640c863fdfcb2a0564dc99b1495d6fb8497a3
- MD5 001352c3c0995f53202a5fa5bcd279ee
- SHA1 12d0db538f4d561a3302daee663a9b491eca5be4
- SHA512 f1e2649fd1dfe1b7094e86bbd611dcf7b5ee722c2391e5ebf928c18d408461382bc6be08508f3d6203022730cf405d3296579780ef3b2c3d65fe8bf9a4687107
- SSDEEP 24576:U0Le5ji0hmxNrMvHjoxdRdGKdalyvYYSibdgptf:UPji0A7ijoxnMkgYh6
- TLSH T1A5359E16F6748731D073C0B9C5D2A69AE97130865B308ACB4286D77C7F27BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 acf42a8aab011c0abee5131e56c12dc99167adfa1711b7a5476541b95bc404d0
- MD5 17deb8bda50341382020205a8a55b746
- SHA1 9d14d4d8b8836619032dbb8294ce8167238327cf
- SHA512 0bc93d03e01f597cc8a1bfa6fe5abe636d29803a3182d088799e0cd5acf3db7a1b17b94067a5b0d53f9141883252e625892f53bb5b00ad4457d37598dba25a10
- SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWr6q8wyuVHjoxdRdGKdalyvYYSibdgptf:X/ezSC6vUzPviHjyWjoxnMkgYh6
- TLSH T135755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 7cec4035fd7814c7b9e6cf635de305296d71bbfedc88613a93b957d829888a40
- MD5 7479024d15d9b8a5f1b7fb61899c0c8d
- SHA1 30ef3c2ce33918bdac7b7ebd6d0c15eec429acbb
- SHA512 c60987310b630c99f15c647a83eaa0adf3521f932f7dca8abd2a1b968ff9d49e41461b2dd09ed4576df5df9aa69971b5a201dd46e9b11e24c1295a4b57ebbc9d
- SSDEEP 24576:WVbqPb88hv/l+byHjoxdRdGKdalyvYYSibdgptf:WVO88hXl+IjoxnMkgYh6
- TLSH T12E559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 4cdaf22ab8f10dab8a86c2cba3a03d0071f34dbecbfc9df3ba2a7382463539b1
- MD5 34d81dbd98227ab6ec6808b93115382b
- SHA1 f0efdb49e5a7dea90019af61fe1e58d1cd56f8d5
- SHA512 83f61023af0463b0eab59b7e75f78661176671e375cd6a045d5257c6ce35e997a0d9f859f78cc87da8e2ef4f950928da87db38b30e1a6803a8a31b273c56131e
- SSDEEP 12288:OjEGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:OjTHjoxdRdGKdalyvYYSibdgptf
- TLSH T19CC42386632D28D1F69BC6B294E1A37293707CC458B8CE9E83547BF9AE3C1C6DD17502
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 fb22310a4241e2bb6a641811e655d1857ef5dd29b1bf40ba15d90493b279864c
- MD5 cd5f5caab06d941e2b6aafd6746e9315
- SHA1 8723d1d95d6cc4fdce003a01c0016922ce210337
- SHA512 4e527f95b9aef30e1bea41690132ff91d8a93e4d42086e5811291ca87fc4e1ef12f4015213b72c1d246370d117f83dac18ec2e613bb506ec617d8849ccb70afa
- SSDEEP 12288:EeBNUbTVO86UzGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:EJIU6HjoxdRdGKdalyvYYSibdgptf
- TLSH T14B05CF2BAE28FCD2C27E8DB95A918300D77278704F6293CBD165834EDE235D15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 29cb199f0ff667fbf6b99a2a642659dcb4d5b1cf2120615f7564cfd135699281
- MD5 6229b663fc6f73612bafdc16a329af8a
- SHA1 a5779b284154f420cd164ec497a3570bfca0746d
- SHA512 d3d6d6209668a548d69703313998643ece350612922d94b27a6a7b4c8a0d3b5056c0d7a0234cb1a7fb4193859a3fe7709304ce140fe438dde806d933813f25f4
- SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THO:QQvGAdlCEL8c/RRNw5C1oxnMkgYo
- TLSH T179267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 9b146ad07e0b612b43725e24ea7bee6ee7b471845e6f90118ef5b6d899a57975
- MD5 458b335f83db0c0b7ae2e4e90bd25b8e
- SHA1 0075279612d4196a2a400afdcdf525d7fccc37f7
- SHA512 74da786ad9176886bf4e101826e600cea02077c93af0794910d3c8fbe376e1ac1fe5220ce73e5e31b9a095b0f9130bea3ffce5d208c6c516108ee42ae18b5046
- SSDEEP 24576:xSewsAjoHjoxdRdGKdalyvYYSibdgptf:cljSjoxnMkgYh6
- TLSH T14F15E031FA74E432C2BF0DB21B36D716543CB9604BA11AC3E3E89E9D59342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f6f043e071572257d4f725a0ad357570df939f10f8dfe98ab7440c2f7ff7f398
- MD5 0cca78df58b304ef550aaad05d3f0133
- SHA1 6bf152b3128370ad0438861255e44838ddd829b6
- SHA512 2620ec651a4dd9118adf62f57579047696ffb830ae2c4985acd7960581f35f56540bee3ee7f9d98d77de92e26da902aeae5b35292475f2ebf5ae0520595a2823
- SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHFxs:eUEtQevvqc2W1cpV2RI32o
- TLSH T196474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 bd87e52a8b6436e53adc13ca44973b4e4623d34fd57c9f246c236cf5049fbc27
- MD5 dc1397fd6e0ef81fa47078234a04005a
- SHA1 0d1f51aa9d59f126c30c99b16609acd597d6a9fb
- SHA512 e8a55e2b7fdf07ac2f7980d13dbee96dcfb306a45df31cf03d8e8e7b21b4a4a737ce2703c85a769c68dfbb04c50c3e5fd35f33aa2a321138173d5a5700b5524e
- SSDEEP 49152:gCbRquA/m2yL5zifFiV+XenmE3/zyjoxnMkgYh6:poqHVjnmxoxnMkgYo
- TLSH T1F5D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 6b46ff297ea99cf786294b5bbf7d1b14cbd3bb4f942b40ed33511d0832e43ea3
- MD5 c7a5d34b62fac23e61c83512d3994d05
- SHA1 916be67fd7266b9b9d4bf4bf33c0f8998b069520
- SHA512 f4cf813a67077a0bab471792fa1c89a44177708fa488ac828032066c4cc9a89b181452ef95d5cbfb97278ae8c022ed4b8d6cc9ad6c5afcf67d6df7288f3d6b36
- SSDEEP 24576:4AhGL2IFoiwtA5l7S53RHjoxdRdGKdalyvYYSibdgptf:4AM1Foiq5pjoxnMkgYh6
- TLSH T1E935AD81E7F955D4F5B3AAB899B69170EA76BCA65E31C20F2150D21F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 96a7faa2885e81ed2ac3345bc6a92dac8f77bd412622ff9d1a7e1de827ae7c00
- MD5 ca8af3ba5d37d820aef48d8fd67c6e75
- SHA1 4d64fd02c1bdaff527aa690ae83bcbdcca36c347
- SHA512 4940d0e49cc2202b51b75b2b95b6ead0da1258957c42468a121415d42e62850d64b1c00df18186cd6a9caa36ae3112c39a3f64aaa67d2518398bcac245074f2d
- SSDEEP 12288:1mw5HEjsChNSBFgl0WDm+CyGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdG:wwuXOWUHjoxdRdGKdalyvYYSibdgptf
- TLSH T17C05F14673A91CF9E9678239C597C136E7B2BC412A25CB1F0360C75B6F37251AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 7f1913241539f6c24b2100c45269b8cb95dad85a2a0c309d0264ef1b22efc137
- MD5 7edaf948261c0fdd118827bc33fd76fd
- SHA1 69d807f0c71d1aa280aadc389023026685eab47f
- SHA512 51bb32713c741fd00fb003b3e690f01d757fd8bbcf6bdc87323543f5470c3df3b6410552ef66bd68f3fee4996e5bedc56639605e6563ecc72891f9ae7cbd3298
- SSDEEP 12288:Q/Z1IyNGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:UZu3HjoxdRdGKdalyvYYSibdgptf
- TLSH T1F6E4128A33A830F5E1A7827DC8E19715D3717882277583CF126467F96F36AC25D3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b2255812d2e7154f62e9329a2b47e92d770e05d9029cee01910b3175820d734d
- MD5 4f71a0c9b4c20deecfdb0cd0abb62409
- SHA1 9aa8c446a96e58c9feb39afcef9ea828ef300f9a
- SHA512 2de048840ed13b15c13a606c58bc3df2e5fa1923800b90407668cdeceb1733d4cb19234486f6373debcb39b62a35aef291ea8ef2ffca2586398d51f045e7fe42
- SSDEEP 98304:IQRQyi36YOcPhLvw2gAf+PN3CoxnMkgYo:fQyiKahX+PN7xs
- TLSH T112667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 1d7962a94e6b25df6939be8e809ca1df78ba6cb741458088f7ca366128c4f544
- MD5 84868ad7df96fe8005c2fc98377eef46
- SHA1 d7e344373215f4d8598cade7427b95ee4c2b8a11
- SHA512 863127426284e9f1fbcbc3738fd42bb51282bd97e08011d11931647e86beb041a1df5040fa0f5b1efd0cb4b5475368410d6a5cad680be34915990c54d9ca7616
- SSDEEP 98304:+QRQyi36YOcPhLvw2gAf+PN3CoxnMkgYo:lQyiKahX+PN7xs
- TLSH T15B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b04945b5eb56740240c0fc8010db7c9c1315cf4be86661c31d9a2498f08b516b
- MD5 d2c83aba8db172eb4c42350191bab951
- SHA1 002992345e020dc94c8eca64943bea3d4f8d04b8
- SHA512 303613ecae78e5ad585f0a8a004ec48c6a25c621ae11da8f7af1c8ce43bd2a9c7730e6b5ec2b081dbc309ed70954b644a2bd9c93cbbef3681562265d3a2b5491
- SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0HHjoxdRdGKdalyk:t68Qg55nhceWu7PNU3/ijoxnMkgYh6
- TLSH T128B54933B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 1f787ae09a55a8d615645a0e0e2b7528d0db32b92c10828f3f1abe7bdf9c89ad
- MD5 364458b4a3bd2eb79eb2c579b09792c8
- SHA1 1f3f26362419a88f582ee25fa274cf4196e31234
- SHA512 41e1537bdcc683a31027dd8e3b83d1c2bd2818926e1196152326e919c00c0d185e6d4e0865f78dabf49b045fb0fae763ba16cff5d09de09e8aa181c6d60474a6
- SSDEEP 98304:Oy5112gYy5azzVva69nLKnhZvoxnMkgYo:/LIHjWh+xs
- TLSH T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a9662fd9f17ebfc69ab0233217d9c48903c2acc4a1ae43721720a8e0185d0940
- MD5 dccebd58b9b19767c72f282346076aa4
- SHA1 5b440576cb76983f34da683a065143eb69026e11
- SHA512 a4b904ffcc2c6890f2f622ac0220457b202443b7ebd9a8b7d9c2a6c69b67a470a0aa4dbbc562dce76518b286155da0ec97f7fe3a0c7abd674464ee4d02adda16
- SSDEEP 49152:1B+taZ3usBWOBr4tEG20bqx0z+n217aau1glZjoxnMkgYh6:7u6JmUxd2dRoxnMkgYo
- TLSH T183D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 9ad39a0c17063f6d668bf684b0dbee208dbf0296a21b99907c5adcd52abcce92
- MD5 44ac38dfcae806662b72efdc7ea8b0a3
- SHA1 505e57b36796a3605f8b70dcba1ce25cf6d57231
- SHA512 23f525ed6329c0c29fd7d8935db1a390bdf252e99aebe8fd607203f68be6d18a9a653c77302488d70115523611ecab9d485ce392d1751c326a006b8d43790fb2
- SSDEEP 49152:N1hpsNoJpF1A6BU44CwH7R4xkjoxnMkgYh6:NmifPkRxoxnMkgYo
- TLSH T1D0B5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 16fe2729011d9cf95d81f9e8c9bf1f4d8d6877a617f5431d20eb431e5169e8cb
- MD5 a47eb8006162a9523e254896f96cafc2
- SHA1 d284ba03ac32ce7c214e65147bd1613ccfb29ea1
- SHA512 980738da43c07b91ce9d75cfb1de29e6d2390584316d3a1195114ae03a5be48353ba8e0a195e55ba53388c6eba732853a3040c01646280f03eb8dee7e298c244
- SSDEEP 49152:TSuZQIY0Be2KNRVtOnks6NMHqXjoxnMkgYh6:R5dKvi61ToxnMkgYo
- TLSH T1A8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 f1c3c341b4cf5270b63304940bbcc40498d57b057fc3120e0d23aa2a51920958
- MD5 79dd2e3fa7cbd22f747a5c6a306cc354
- SHA1 f64228b6023ed3ceb47ed2fc93324fb7ae8ff060
- SHA512 415e0bd7383c963692c628840fc0e66ea7c382c7b7f1acd3ac89d282bc0e0fff556dfa493231221632886eddc2e04cf92b856e3ab96deb3243be25ae52521dcb
- SSDEEP 49152:ehtSn8EApI0figXgiDn0AP5wgjoxnMkgYh6:/X2iyphdoxnMkgYo
- TLSH T1A995BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 3be5dbfdbaea00b04bc34b78808e3f506466e0be39047e47cb73b533b6563ac9
- MD5 8ae7f153b85cea80ad1b9b8f5ca73082
- SHA1 edb5fbeb2a8f9258766bcb02f0221b349ab5fafd
- SHA512 e41e0190a838744d91f30868404dbbd2fb4e7628283cac1826fe4b7d524451b472597840e5ed735569efb04bc9c31c32470a81d7796921bcded3636d037d4376
- SSDEEP 12288:csGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:cbHjoxdRdGKdalyvYYSibdgptf
- TLSH T174C42385722E1CC2E14BC7B2C4E0A365D2707CCA78B98A9FA35937F5AF386C65D0B501
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 531ea42df380ff23631343b983a97ef7b3684c805590fbe08eeee0fe0ab1eaeb
- MD5 bc5cd4b56463ec0a74cf0493c21d8f9a
- SHA1 032f4e831172843cd6649197865ac0dfe02ff7da
- SHA512 c7661d5dde6f5c969c8d24920d3063847880ed5ecf1e2f7b557ca12b3983d9e72b9e1a999d5966a2a41a202cccd9ca8c797c169e41d653827f6329147402de47
- SSDEEP 12288:M5GHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:MsHjoxdRdGKdalyvYYSibdgptf
- TLSH T11CC42385722E1CC2E14BC6B2C4D1A365C2707CCA78B58A9FA3593BF5BF386C65D0B911
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 2faf2f76f7eee71cbf60b7157d7b6c96854b97d1ffac610eda65b837154e6b50
- MD5 376647daa0648e8d88911017177be1e3
- SHA1 5e8c8f68363b499613ea13e8d1a90ae191aa4ddb
- SHA512 0822539e0c7d7f82051bb671c4740098f746afbb765d6f1fa1ca28511e5d9feac277e096052441fc0d3cfcf85bb11fc52e5f2a1640d98614ea535d9560c48c79
- SSDEEP 12288:EbGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:ECHjoxdRdGKdalyvYYSibdgptf
- TLSH T16CC42385722E1CC2E14BC6B2C4D1A365C2707CCA78B98A9FA3593BF5BF386C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 b24cd78f369237539f120c4ea4cf8951673d69fd4064423a8dd07397e39c8286
- MD5 232d9616c6ae09f5c239699cc1a65c1f
- SHA1 d4efe7d8382ec496ce60224f164033bd2b92a581
- SHA512 4167d96b4d09efff6d111d80bc0892013ceefcf8faddc32bd17fc4229632414b0fdb9f58e4b509de2abb97bf768f5be4890839f4aa94963272d25658abbc369c
- SSDEEP 12288:jVmGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:vHjoxdRdGKdalyvYYSibdgptf
- TLSH T1ADD42386372E18C1E467C2B5C4E1A261D3B0BCC5AA75CBDF97403BE96F343C5AD26A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 3bf4cc861691c23304943e5b01d1ad4db01dafba7dac615cbf200f758f776517
- MD5 49eee3467d34758858ae6b09ab75ac13
- SHA1 f5b6b2820fe3e57438e723c9ca89ef5b62c9e70d
- SHA512 bce133713d58442116348a69a7c3bf48b8993f7f1ba056a0b33bb57aedf26ee5265020faa17166dc623f0015e0f98e65df155f0c1492aabedb6c2277b7102cd7
- SSDEEP 12288:ceGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:cJHjoxdRdGKdalyvYYSibdgptf
- TLSH T1D5C42385722E1CC2E14BC6B2C4D1A3B5D2707CCA78B98A9FA35937F4AF386C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 a03fa1efa9e32466dbb855faec21e32690d46df9af0818ea919fd611a0c7c6be
- MD5 f873f8eb2a47a9791047a1694f260bb6
- SHA1 ace32d4e972aee6d86fae544744416ac7d91f762
- SHA512 5b175e02cca8650459e135e49721fc646f1844d6a80305d1def3193bb0783d1cee712a359bef157554a88f5a0db131621ab0ea14a3c07439c9698ff531d6b934
- SSDEEP 12288:XFGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:XQHjoxdRdGKdalyvYYSibdgptf
- TLSH T10DC42385722E1CC2E14BC6B2C4E1A365C2707CCA68B5CA9F63593BF5BF386C65D0B911
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 ce53c954657fcaf879486ccb2a1d4feb4aabc13a1cb489fb2bb61d81ee71feaf
- MD5 c6bbe7eaf018dd973a21ea2d410d2456
- SHA1 7d5cef36ea89a13a7bc13ecdc63511a439a033ad
- SHA512 284d40a3dc156ab8577ad49708ca8288978ac70fb845861c0721ac62269d5f2f9088abc34f81cc92c6dd04bb657d12b34e2c60b5f806e72dc33b953aa95b03f9
- SSDEEP 12288:wRGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:wkHjoxdRdGKdalyvYYSibdgptf
- TLSH T1ACC42385762A1CC2E14BC2B1C4D0A375C2707CCAA8B9CB9FA3597BF5BF385865D0B911
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 1d1bcff24c1765affb97005852ec54151a5dc503e50c3adcd4e46aff6a7b75a1
- MD5 15b55b90a13606dedb29346076c8fb32
- SHA1 26b5a117f4c885ec1eff736db175026bd9013137
- SHA512 d5405bc3e27e31e8ad46c198403ab38394495a72f83695d20982d3a1f03302458feefbe428fa1f27e1db2ff24d0534586551c0ae9de0aa83777f79626bf2a0ca
- SSDEEP 24576:8ZMMzFVSOMHjoxdRdGKdalyvYYSibdgptf:8ZMMzf6joxnMkgYh6
- TLSH T175050195B3601CF4EC67823EC8619916D2B27C5A0BB0CA5F13A4376A5F333911D3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 d03172e866a12d42fa83c4bd67ce4b78a1c82737b7394fc76d4ea6e3117f0f47
- MD5 8a38df60a4fdf89d1c7ffaab871862b2
- SHA1 5ef7eb6414171b21fcb92db5c79f825052b667e3
- SHA512 bab0b076a724bbb805de966d17d935f2c187e59cc88f330b4ef7e1db46f76b8bc0fc9ee323cd7ee9823edc09e186b5334b19daaa2becddb3c1277564b26b3344
- SSDEEP 12288:7AGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:7nHjoxdRdGKdalyvYYSibdgptf
- TLSH T13BC42386722E1CC2E14BC6B2C4D1A365C2607CCA78B58A9FA3593BF4BF385C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 1e25225c225f647e0b4624bd116fadba1526e6b31e49bcd496353533353a16ac
- MD5 1540b408bce24455950692c2e7243fa0
- SHA1 2c9a116fa5ed7fa9739be931aa7eb22ab1834f26
- SHA512 8765b9a2c2b6aa15b6abcd02ee887df15d0971abd6c720f565c3baef0a6d48147bc20e9fd726b9fff35f86a2c51f938deddf85795c383878d8be32194b2e80c7
- SSDEEP 12288:lUGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:lDHjoxdRdGKdalyvYYSibdgptf
- TLSH T108C42386722A1CC1E14BC2B1C4D0A365C2607CCA78B5CB9FA3597BF5BF386C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 10c96a0b1d6ade72dd561b4ffd7a42d8b3508e0755abf6bfb69b33dd989c6fee
- MD5 e99952768bbb8bcd22e4035c463176a7
- SHA1 e18d6037d732492a9e4f13e868e3fe66083cfe39
- SHA512 f81d420dc204b87defc8e9c3e7538a01f6ef08dd328b54eb3925a29484850eb4b63c6a75e08bb84b3f86dee97218028aee0db05b462a9d4adc1adfec42329d7f
- SSDEEP 12288:6yPz5L8NGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:nzyYHjoxdRdGKdalyvYYSibdgptf
- TLSH T1D5F40247736530F9D1678239C8A21A12F371787617748AAF13A427B62F376D19E3BB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 947fdaf4abe45bfdadbb2d9cd36e6682655a5d0669a8e61a8973def26aab0b91
- MD5 938c21b9e74b72259d42cbc50b19eabd
- SHA1 66019f2a739bc074f8c4f244e842e21ad20f3e96
- SHA512 4c3c21764b8d646650bef643846ad7676381a4b84a98c4e8a567d1503a09018e9e41ac64487993908e53e296410183f664ec72fd9e7ee419b3f194aa2426ab00
- SSDEEP 12288:gAGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:gnHjoxdRdGKdalyvYYSibdgptf
- TLSH T147C42386722A1CC1E14BC6B6C4D1A3A5C2607CCA68B5CA9FA3593BF4AF386C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 fc80b41098bf3ec4f7da9af3a613f16596406237aec2f2832f5ea5c23986b848
- MD5 7d0f451aefbfe1d1172f2ce3716fcaa8
- SHA1 2abe3623b28ab8c68c6d37c2f7bd0c4134ad4063
- SHA512 6d7f415e14d56bdffd7096d11ed69565ce0d789397b293422977f494f6025c85416e5de4fdf87faa4ea6c99cb1ae871c6168db0dbf0d6873ac19321557a2c446
- SSDEEP 12288:HAGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:HnHjoxdRdGKdalyvYYSibdgptf
- TLSH T1ACC42386722A1CC1E14BC6B6C4D1A3A5C2607CCA68B5CA9FA3593BF4BF385C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 62d8c3d427ad8748b8d42a9bd68106604827b06ff13c2c649a963432bac109e5
- MD5 f37260f4871a93456ab549af990b32c5
- SHA1 b8f57ff9d9d6ebe3a624045c18e9e6605656ef91
- SHA512 56f8c6a31a07bf2e6a4c506127aff48b2e8ae453d2edf16d2642f9a8bd0334ea983fa0b016bc0476f18615ee598801d77c74b69142702824a807d51001eef206
- SSDEEP 12288:NyPz5L8NGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:kzyYHjoxdRdGKdalyvYYSibdgptf
- TLSH T1EFF40247736530F9D1678239C8A21A12F371787617748AAF13A427B62F376D19E3BB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 d39c68a77f5b98628109a8c0aa21b65145b7d9788220431d0036ee271d90d891
- MD5 37088ec66b40548bab4c7c2817bb3504
- SHA1 bc06b38da414f1ca44fc7e65ab7402144b5ea070
- SHA512 3565aafa49e565553b13aa8453b828966e2fbde9a465b429006ac8793c28bffcccfb1a65c4e3f4612518c1b82b4796fea1d54df3203e7e02252c39cee58bbbb4
- SSDEEP 24576:eT9aLl3z0zDSHjoxdRdGKdalyvYYSibdgptf:eTQLljljoxnMkgYh6
- TLSH T183050195B3601CF8EC67823EC8619916D2B27C5A0B70CA5F03A8376B5F333915D2EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 7270791ccdc5b52aad45efbb8805ee23c29a104a915f9e0dda8d1e036de1f367
- MD5 1fcf4aa827308c17494d1f96101f4cdf
- SHA1 8ea7d771eee24ab3518fd164e53f931f2488c5b6
- SHA512 957491d0b76921e33790dfa0a4dab47697f8535d22d0c840b0a7f9d4ab222a32784835dfffabaeb8fd37508df3fae88170fd2ebaa323808749ae7f1a1a4cff11
- SSDEEP 24576:n3td9CHKy7GZ2HjoxdRdGKdalyvYYSibdgptf:3td9CHKya6joxnMkgYh6
- TLSH T1AF25CF90F3E814E8F0B7DA3589725511DAB67C9A1B71CE8F03A4265A1F336D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 dd0bcbeaee2993cf855def45f7dedba22832ebe493e20963b523284816029c4e
- MD5 d0f0a359288fdcad165a890250b5a813
- SHA1 8570ab346c55ac995e33f9b282f77a3612440fd0
- SHA512 6a285c2a4e87f06888c9344d3d2a40e6ed30b5cfafbd93ea005ae8bba916fbadf0df36a0ae058f96b3e4587192e5e0436cb68c45540d5142644612479304ef03
- SSDEEP 12288:07GHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:0iHjoxdRdGKdalyvYYSibdgptf
- TLSH T1B8C42385722E1CC2E14BC6B2C4D1A375C2707CCA68B9CA9FA3593BF5AF385C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 ac4dbe6cb61a18106c82d4726fa2414380362180f432ce1ab08bd0fcf02d63b3
- MD5 7707ed1c0399f70c6b3dc94c5b1d6c67
- SHA1 46f06ca39e6a7a7515b67941780aeaa797b48180
- SHA512 8f38e398a9e0ae5c1a9f6fb64d370784e8cf5aa46a72bd7d39b800aaa609cbda7a5b8471c8eea3ea6e4b6b9dbc6f29f4e53addc87e63ac85b50b2491733f950f
- SSDEEP 12288:QtGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:Q4HjoxdRdGKdalyvYYSibdgptf
- TLSH T1E2C42385732A1CD2E14BC2B2C4E1A361D2607CCA68B5CB9FA3593BF5AF3C5C69D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 daaf1cb0adc3840413940b12aa5f3bd414828aa1bcddc81392c76d7b0bf57186
- MD5 ecb0cd468296260e14cea5ecb2352429
- SHA1 17d2b70d424cd512f4df2ada323cd2eb66e75bd9
- SHA512 15d15eceb730568583e4594a5c6d07eed1c67ede512b275b92910215eff5eeaae6362b755acd799b96f23202740e3c54a030fd9226b432d36142f896043dbad9
- SSDEEP 12288:7qGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:7NHjoxdRdGKdalyvYYSibdgptf
- TLSH T173C42386722E1CC1E14BC6B6C4D1A3A5C2707CCA68B5CA9FA3593BF5BF385C69D0B411
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 90b82e923fef922ce6a1e475b565ae7cf581cdcace77fb1546cae0a8c90d0811
- MD5 8e2a8fb43fec502284608034e564da3b
- SHA1 2ed9414e1eae69a554cb5c864b05b39411b2d1c6
- SHA512 408e67c078ead7775f7c16149251721af3c7a760e049312c25fe12a0f4e9aeff461747ec8fe7383c47bd9e260422c51ba5ae053c3714c6e8cb3c2ade6401315c
- SSDEEP 12288:yAGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:ynHjoxdRdGKdalyvYYSibdgptf
- TLSH T1E4C42386722E1CC1E14BC6B6C4D1A3A5C2607CCA78B58A9FA3593BF4BF385C69D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 b6f0584ef69c0720f5f934e01dac5f3409408411b922f2a27b868444225c731a
- MD5 bbee8c905d94074d03af0314196a1e70
- SHA1 356bf1da846079ce593def99eee18c4dcc931887
- SHA512 7e447b2c9d5899526ef915da236e2a3d2057fdbfecdd1934a9c24b1e2d7dfde0c8fe91eab27d1886aca69c5496d2fc163fa2f3daf73e33a77bb2fa8f0f50c9e8
- SSDEEP 12288:I7GHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:IiHjoxdRdGKdalyvYYSibdgptf
- TLSH T1F7C42385722E1CC2E14BC6B2C4D1A3B5C2707CCA78B98A9FA35937F5AF385C69D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 08e5dcbd1b3fba4381bd4cc1a0b4cee669f126bfd549bca8c91884e5dc6c7b3f
- MD5 6a692e445c4d5497928b9a59088b268e
- SHA1 27ff3cdaa26791b064939983fe3049590deecf65
- SHA512 f8b5e47bc389133b367fb6c38814886e0072690e269f299f868169d45bbf43c198a972e926f894907f6f17ab62557dc3f34fc28b4fc53750b00abfaf2ded3c5b
- SSDEEP 12288:QYGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:Q/HjoxdRdGKdalyvYYSibdgptf
- TLSH T142C42385762A1CC5E14BC6B2C4D1A371C2607CCA78BACB9FA3593BF5AF385C6990B411
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 d6e398478e514e25d785d1ce2f25b263fedc6226c2256682c3b14c290af04b08
- MD5 fea0c01cfcc762bb83278b36e186bb08
- SHA1 eb06b38128f0a22781f97049c8184428c4e7d958
- SHA512 ad4cf0e7623936bd1fdd967265091dea767b310d7d8b386db8128056c37bad01b450b4ef9e3e3627cbcbca8f24153f2e1366ce631692c2377f929115d4176ded
- SSDEEP 12288:ieGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:iJHjoxdRdGKdalyvYYSibdgptf
- TLSH T10EC42385722E1CC2E14BC6B2C4D1A3B5D2707CCA78B58A9FA3593BF4AF385C65D0B511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 bde5391290223c384a8c64bf16d7cd7346bfbe1119974d5347fc642c0026c989
- MD5 d12a06afc0f6c31eb891a5ab0a7b23d2
- SHA1 b26da087335d157831927fbab1a4a377adb6ddaf
- SHA512 3f6b4e0a1ccf6ebf8223e6d85bce5f37033e1a27489006cf584f573f1a7daae6777dc286f3bb4b731475ff293c9dd0001eb2c44d2d34599caa4164a380c2b96e
- SSDEEP 24576:ifwvok9RX6wkyAIzHjoxdRdGKdalyvYYSibdgptf:WMnYILjoxnMkgYh6
- TLSH T17835CF29EBDC04E5E1B7923C99B3460AF2B178591B31C6CF129A53AD0E37ED45D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 37e2e45f76e6f49e98bcbed6fe1a72945f9c0f43c89c92e221e273d020cb77b2
- MD5 6f7589ae1333d37ff5ea40c832268d59
- SHA1 d02ee6fdfa623f53bc4e56b3f81e3c9de93288ce
- SHA512 30d1e6c3521a11ac6ca2f12e99af2db93172a0c5cbe8189e79c12cbb48be519e905c5892a8c24673d7fb4c3ec7b108d3f865ce4427e17b9241c6682bfd6c104b
- SSDEEP 49152:5YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AjoxnMkgYh6:HySzPioxnMkgYo
- TLSH T16A066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 874cb32f6db643d63b385c34f01359c9c2c6e400e21d426dbf776fb4ba265b7e
- MD5 0f016500fbae55475036bd1f60b26a10
- SHA1 a40f70975461705754b949f6e6d101767c66db77
- SHA512 95008e9315b14226f22c583b20b1d77a8ccdf0071d2d7db1df4eb0cecdc3565084fb0820fbaf58d2f90441b51675336259260a699168ed8949c770d02ece7670
- SSDEEP 24576:947Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY8HjoxdRdGKdalyvYYSibdgptf:947JUQj4irIhCnDHUPfF/wjoxnMkgYh6
- TLSH T1A265AD1EA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 c437b314aeca69bdb15ade0f1f90b6d41af6a014aca7cd76d216a0dcfec687c5
- MD5 43a67f1887da5360d87190ee0d193c12
- SHA1 d8cdffc2fb3ac32d80837ffcd873ddb10202710a
- SHA512 da060ea0e9929b5c895e71bf72eb84039d41871c128ea439d04f5ef6bcbdca6d829c64ab5a111e93c6bf691fd36c41d05780dd78ecab9d9c4e8e4b7c248c33f2
- SSDEEP 12288:2GsfwGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:a3HjoxdRdGKdalyvYYSibdgptf
- TLSH T123E4F04AE25801E8D06EA279C7929641F3337C5597E1D3CB53D0FA7E1F396809DEAA03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 a5dd0cad99010a5fbe2f0f9d017d7853b03e0aae2d1347299e4744e9f2508166
- MD5 966de5f2d4c1c9c5daaa4cbc41969ab1
- SHA1 c2164274d18659efa5d374ce8fa34260f638428a
- SHA512 944c66922ddae726fe67a1fee504b545e2bbf6e5917f1f4fb764ae9e7749be2bc691a9fffa7eefe8e7c9a43bbb6af1f34504c2c4644ea00020d2b6c79277783d
- SSDEEP 12288:aXkUU3fSWuE3SNTm/mopM902ARMDexZooJWe:aX1UPLA6ee2ARMDQZ2
- TLSH T1DF352840766AC75FC6A980325E32D5CCAB707D01EE056F0773C9873FD576668BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 79ef0771a76f7e5e7cf9e655ca96e725563782fea4d3c98453f681ca50510a42
- MD5 dc41445a916d2ad68d3c550ebc012226
- SHA1 4fe02d464c121db89a962146061747a101c9ef7d
- SHA512 fe92b8867325156d3dda2ff7b8a7289ba9699f936447c91a55a691ef4f2950181003fc60abc0f4219bfe871d64b363e426445e57ecb92d18478e1f72dc14e56f
- SSDEEP 12288:V9Dt3scLHpsUGXnoRbF2oBkme35hn0p2UVicmM4UbSBrlWKhgyJco20KELW:x3ELW
- TLSH T16255D8815137E38FD1F76032072A5B4CBBA4EC06B7496F2673C8053ADC6A725A1B93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 79ac116ecef241fb4647a7ae58c795f1495d21d38f2ce5c7ca466f4c7eae0026
- MD5 4e6ea871e963e1fd1918b5a058f610bf
- SHA1 49690c98ab2558a1552a98cf896839237bbd2030
- SHA512 cc8bb85e0a03dca2ba95ea344100fd46926955618d2c9595e97e7ab07d4caafa8d79013c0e25d49c887f5ccc8f1a21545e6d995933e1d81a49f5cd5b943b6a56
- SSDEEP 12288:Rz7IGHjoxdRdcHKflVYsXqju5LvGFMKea9qTP2vKf8EdgptfP:JPHjoxdRdGKdalyvYYSibdgptf
- TLSH T121D42382632D1C81F47BD6B184E5A3319224BCC95F74CADFA24437F9AE386C69D37606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 6654c5c692f0b00828f4ffdfa98552c2073831f36c1818946b2a926e3d31ba3f
- MD5 5d1c84402ca3810f49b82e3e16ec9cf8
- SHA1 4f95707539a6d12a6493e1c08c7347e5c1157dce
- SHA512 3ff5ca2ff95097429cc47dad754dd26e533b53961fb15cc7eea2c65d6112a2f722d090dc151d0a6970b2fa7966f872c73b3f9d717c62f76a07fe7d041c4a3b0e
- SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYVHjoxdRdGKdalyvYYSibdgptf:Kgb4mBIBhGFOjoxnMkgYh6
- TLSH T110659E1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 9ef7e144a8b7a6c95acf826be270158c5fbc37d4d184374ae94eeca75804075a
- MD5 cf9dee8d82e383a32f27576a74f4fb1c
- SHA1 ea0ffab17776bfe5c8f8b22d02b32384c060bbb4
- SHA512 fffeb462af0f4c64515c00b20cad8c0d2da6f0fdea834350fec42ae38d182ed38ea3ea34b906c215f4b075b92a95a964c3f98d68a4bfe4acdf34294c62778952
- SSDEEP 24576:VG88u8FpJqH1Wzria7/mMHjoxdRdGKdalyvYYSibdgptf:Y7ZFPqVha7/NjoxnMkgYh6
- TLSH T18735F06577E501F0D47BD13889824663F6B2B8250364EFDF07A88BA51F23AD54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 70892bbba722e4527a09f5065cd6a9c20059521d510b86c7ec93c742a3308ea8
- MD5 518d30a7056d4d9778406532aeee6565
- SHA1 738f538e9c83f4ff62585139fa939898580a6c73
- SHA512 49ff7b6df43e2ba3893eca0b320a949c4bf0823142b30fe8487d9caa224e9f85cb95f4eb2e9d5a7938844a51b8aeb3c958511ae22fa435fe7342cc56255d8eb1
- SSDEEP 24576:MPUr+NQAHjoxdRdGKdalyvYYSibdgptf:MJQ6joxnMkgYh6
- TLSH T1D205E11F22AD18E5E67AE17D85828719E371B8521712D2CF02E0917E5F37AD8BD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 9421b8e93852291416166700404020097dfefe8f597fba426296c6214cdf5cc5
- MD5 978621d89fd779a47b34d33d19a63ea8
- SHA1 d821d4b3bd69c759085db52bb56bc908555bfa01
- SHA512 01d73f1202f41cc15a3ecbdc62ab096e94b3390fcf97abeccc39510c5f569a88368e544ce2ec1315946b0cea1fa81992d3c15ba48a5bbae98430e4917368d211
- SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKjoxnMkgYh6:AG05lO43b3oxnMkgYo
- TLSH T1F4D5CF6A62EC11F9D1BBC17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 b5a34bff1f4a52a6c932a4da9a380726e7808bb9c1a82566c7c23393bc8dda63
- MD5 5233b828873991097c509ad8315d25cc
- SHA1 8552d524f9aa79dcc0b743f8ac6732bc1a5e98e5
- SHA512 e6316fd5667f1d6465a86ddba0bc4efe52bb265f6cb812e3e592ded3409f092eaa4e0facfd634ed4695c31264be011d702c8c18ec1a65a3c071869a840f88f0c
- SSDEEP 24576:Mfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnuHjoxdRdGKdalyvYYSibdgptf:Ua5POZ39Jt2pasx2+mijoxnMkgYh6
- TLSH T1ED65AF5EA6FC00D5D5B9D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 fc166b66efa60c4daa58c0c45e336e988c22aed77b1ca9372c5620095dcd51ef
- MD5 14480621158608a1af78af75d2a02108
- SHA1 39d0b56b52b78704123a8eb8cb2a7ad2bb74cf15
- SHA512 c3ffdc994354715ef3ee4f2bde3cd390f912b084e1eb1c3f022eb762d21a92458c4eb0328f51dabc15e4a4883453e0059cd1a2519c2d7026620692f163a193c0
- SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7Fk0HjoxdRdGKdalyvYYSibdgptf:NNc/zEOVHFtjoxnMkgYh6
- TLSH T1B5857B1623E901E4F5BBE1BE89779646FA71786513308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 cd2cfb79e290ff01af68636c7a6059be458ef079aade7d886c3b60d159394d5a
- MD5 6953f6d79b83ecba33ec0bbb137b4085
- SHA1 0ed07baaf8437def040781fe2c83d119a9134d82
- SHA512 6e73b3bd4a65ab6bf0f3cd18bd2bc11c589c608cc4473d3940da02cb91981f66140571a7bc28634f0bc1aef83223fea3d90dc6d7dab02a6906014ed3e9e9e6df
- SSDEEP 24576:8tkNvNnaFeYhJNtmZBmlHjoxdRdGKdalyvYYSibdgptf:8tMwBtOm1joxnMkgYh6
- TLSH T14955AF6EB6B806E4D1FEC6B5CD238512E6727861173293CB5390C13E1E279D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 311febe2bb1cf12371e2bd272363d984e4644366977015cb9e336bbe5a31c8e2
- MD5 809db5fe276467d7c89a81ad460133f6
- SHA1 6c148b72c613b2f3ef3c060fb117a70483609d78
- SHA512 b7bebc16d3f2698768b147072fe13d8d4ae75785ad4e894234f78e5d82ba401647aebf82a10f8037a4e36474d41d8cde8536dff94d2e2756c14e229d99e66781
- SSDEEP 24576:iD3FHshBIYQgA7HjoxdRdGKdalyvYYSibdgptf:iDVHeBIAAjjoxnMkgYh6
- TLSH T19525E16EE75C04E4E57BC1BCD6638606E37138A9033256DB02D491BA5F2BEE46D3AF10
- MD5 SHA1 SHA512 SSDEEP TLSH