d3c18217856ff710463c0048a299704ca739bc423832ae078f1f8e59a0bcef0d

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 2.0MB
Sample260723-mx84caca45
SHA256 d3c18217856ff710463c0048a299704ca739bc423832ae078f1f8e59a0bcef0d
MD5 af3f90737b9581a7d5aef274d0707c32
SHA1 6f69a226fc984ac59a34d59c8c578a2b7027a3dd
SHA512 cfdc5f9e24eedfc006f0de0024355b86ea208bc890572f89243fb34d0c31d401e5b9e6ca477617cfebf7d26eb7c1ec505cea9c89f5a6343329bdbd5cf9791d6b
SSDEEP 24576:8Kp9e/tJB0XR4x4xCeTWViMPsHAnrsRwYIQk3mhUVi:8Kp9eF30XRA4xmX/YIQkJV
TLSH
T1D8A5F4237156D8E5C65D9070CF168AF053607CBCC7F697AB31C9BEE4BB325803AA6609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2692	elevation_service.exe
5720	elevation_service.exe
5020	maintenanceservice.exe
1576	OSE.EXE
624	PerceptionSimulationService.exe
1356	perfhost.exe
2776	ReFsDedupSvc.exe
4620	SensorDataService.exe
6116	ssh-agent.exe
4972	AgentService.exe
4612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\47e61757763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9a85b92911add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9307752911add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b49a5551911add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9163892911add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
2692	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe
5720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1988	2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2692	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4972	AgentService.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: 33	4612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4612	SearchIndexer.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2776	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2692	elevation_service.exe
Token: SeDebugPrivilege	5720	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5060	4612	SearchIndexer.exe	103
PID 4612 wrote to memory of 6076	4612	SearchIndexer.exe	104
PID 4612 wrote to memory of 5516	4612	SearchIndexer.exe	105
PID 4612 wrote to memory of 1880	4612	SearchIndexer.exe	106
PID 4612 wrote to memory of 5816	4612	SearchIndexer.exe	108
PID 4612 wrote to memory of 472	4612	SearchIndexer.exe	109
PID 4612 wrote to memory of 1332	4612	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_af3f90737b9581a7d5aef274d0707c32_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5020

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 89adf0519ac3c4df6b692f43d87ef7e9f23b81e8bacb427839442cda7330e25c
MD5 1fc5349ba43b39db50b2c6670f65ab10
SHA1 0f31091469d8e71adf06c71472f6de163a66aceb
SHA512 e5da9faba5630405cc693c164d7423483fd940c697442aeed5102a61cc1183a202a7a31b21ca110915e2b8edae400c56cdca1f758570b058215cac4b0f394600
SSDEEP 49152:5b+632BuPkFKRrdE6ohQstBhuXjfS4LWxnl/YIQkJV:P3q6tjBKDJ
TLSH
T180D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 605fca984d0a79076d21d504cd9ebadb4436a77bc95ff8519493fa0b4c739f3c
MD5 8d6401b57d4b2a67a595ebfec38cb813
SHA1 e8a5775ed0b80a262a94fb6aafbb0cb0ecb1e8c3
SHA512 a887f659d3e0f24e705804d27adadf135d47458009c75a278f3cbf13f4ed32a1d0afb88a45eabe394e023d848124d9b08d78c99f12f572d7c8b02ad35300237e
SSDEEP 12288:w1XLsswWkxy2lRq2czAOPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:mXYfDtczAOPsHAnrsRwYIQk3mhUVi
TLSH
T15A65F12963E509F9ED67823CCCA18515E6337C9187A0E39B03E495261F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 10df2a7e20f23a7af72533320b76578eb50c5fbcdae8a39095e76d7ddc6799e4
MD5 aea6aaef8885bd9deec4db85dd0fd645
SHA1 906617733fbd4acfde0f3948026cd12959d02576
SHA512 909e436a3a8c157692ffe95e2411a8ae71c146f74c2a7882ee92831340f73fad17aba7dd566b9e4ad0245e354295a86fdadc14b123cd24a5b28a738dacc49ca7
SSDEEP 24576:h0Le5ji0hmxnrMrPsHAnrsRwYIQk3mhUVi:hPji0AxG/YIQkJV
TLSH
T1D4859E16F6788331D073C0B9C5D2A69EE97230815B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 08832dd60d6daca27306477a77c82992aeb8d456c705ddeb188c1ed9a0922e36
MD5 03738ca9c0996b5d385535547c289074
SHA1 d44fe2d678ca8bb6747291d7389b8da72e960de5
SHA512 36930e28375ed0de59ac45dbae629811b119e32c5a6050b483e37e83c082f61c6abf28c4229b5dff3e08351275a630fb23c36912c62d3376ae601c4fe579a903
SSDEEP 24576:qa7/ezSC6vUyDZaqgrvWx6q8wyuVPsHAnrsRwYIQk3mhUVi:d/ezSC6vURPvMHjyC/YIQkJV
TLSH
T1A4755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8c76cb1f2e09142cdc354b8dc51b2491a438897c039587faad9f39bbaabe2c22
MD5 3d2331ff7ad3f01e81ca89aaf4c552b2
SHA1 9364777f5875004ceb6359be88d0bc5b6ba05d1e
SHA512 e1bfa7948dd9c6289a916c07a9a87d9450b3e709a9991ea5d89641b38f10554e000f691366dd40fb7018c826f61cd1bd959fb44e36a45484fe33214a0efa2ec8
SSDEEP 24576:wVbqPb88hv/lV7UPsHAnrsRwYIQk3mhUVi:wVO88hXlVk/YIQkJV
TLSH
T1DA559F66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4d284002bab3911964cad9d95006bf45ef0431f229815d7009cb7a5001eb4e65
MD5 b3c0301c15e27c24b7ca4ccce3b91897
SHA1 e7761a2a0c5a47d4acfb25ad14177987332664b6
SHA512 3779153a64cbbe7fa41cd4ecec434270de542fc39e0bcda9770e916b718591820d9bb114684bc797469ec1b0a7ebdb519dfa45aa10edd9644a256967ed39ef48
SSDEEP 12288:rGPPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:rGPPsHAnrsRwYIQk3mhUVi
TLSH
T1464523A6C3AD89B0E3BB06343CA1E929C5377EE0FCD1133581F0761F6C35E01A566A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5ba3fecaaae6982721715728027394efb81cb00f266866d15ad4ac45e414b16f
MD5 78a15ee26923a90fbcae3d1c2bc214a8
SHA1 bfdd41904eb45556a71293d4d5b015cd8d13e609
SHA512 d0777d299d1a2b39d6491e81cfce7dabe856ed97e1ce359b8956725fc841b7c3fdfc1db179f6fb779279d29c1d6da9f96b3b14306eb0f59e8cbaf1e3f060b29c
SSDEEP 12288:meBNUbTVO86U8PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:mJIU8PsHAnrsRwYIQk3mhUVi
TLSH
T19565BF7BEE28ECE2C27A4D785A91C600D77278708F6293CBD174820EDE239D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a8f61d7c2a255ce660e9e343158d5010b650746338f3ec307870e78e4b0351a9
MD5 d5b4d9e02f19a289adda7f7168f7dfb8
SHA1 730a1ee05c63cbc10ec8e0cb8d8518729bdfda66
SHA512 5fe27954fe328fd5b2edd337bf06d5ba87eeb67cfdc455979a9556db036b5374484b2937923f3eefc8b80ac59f96c08177a1b95af1d5f073a6d92cf53643d1ac
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THw:TQvGAdlCEL8c/pRNw5CNDJ
TLSH
T151266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f5b66d3e924e96005c59b754b4e42f7f4b949ece78cec10d135729dd5925de09
MD5 aac34dc1673d7bf62e6fe77364f9fa56
SHA1 51efaaa3b33627dfe5ddc50a40fe66de3b86b1c5
SHA512 5556508bce212720796cac16d39ec71af2c9dfd5e288f2490e3e74751a30f9d668ad9fa8ac86cf7b24a85e038b1423add3628b74d4dc03c4623dbcee3d165d51
SSDEEP 12288:oAwSfxL/2Dc3xDLLmt0LDQewsAjmPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:NwewsAjmPsHAnrsRwYIQk3mhUVi
TLSH
T1F475E031FA78D432C3BB0DB62B31D716543D79604FA11AC3E3E89A9E59306D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 29fde00265b4d06ec108b1fb454ef3b3fe3a2fce7dc278d199bcd90d9765ba8c
MD5 fb8d6c34e8bc14b6ef70defa3cf06eaf
SHA1 37645e870d4eae4acd5d36ca9fd9fcfe7d8a42c5
SHA512 19d9afd418d44d3122c680f65b67c29b7fbb71defbc694419a66ce2dea7f0d8e7d42f29cb83f491f82dc8dcb4bc28c42ad8fa24d55865b9e18e8d367b0327885
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHU:5UEtQevvqc2W1cpV29I32
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ab1d1fa697d5597da6d79aefc46fee0686f67ac5ec16dac494eb27f8200e0244
MD5 b8a1f11d285bdec15dc5ecbe0c360fb9
SHA1 54143ee949be604ccacafaa761139d985cee4d1f
SHA512 68693a9ae3f6e7ebaaaf841e967b7c28014e705e69c452dd4f6b8063afbacd8e2cea522b32161fc6ee3d263c5b9f6fbeb7802f56ff2e8d7b0e6c3f91ed4d0eb9
SSDEEP 49152:9CbRquA/m2yL5zLfFiV+XenmE3/zW/YIQkJV:6oq2VjnmZDJ
TLSH
T169D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5d74bb258e0087230c3c3d033ec23582295f41ecd7346fe5f00cacdcd6ff485d
MD5 15bdd3c29b16c01cff143d53ff50312c
SHA1 196302d17a62e9762e84d798520f64fd9e29f825
SHA512 3b46c52d5c0f34c209ff9657b3eed51939f040b3fbe2063f924663f198ee03549232ffdb886e30c523adcd607fe00ac147d73cbd4bf31147706a5f220cda02ab
SSDEEP 24576:FAhGLmIFoiwtA5l7S53xPsHAnrsRwYIQk3mhUVi:FAM1Foiq5J/YIQkJV
TLSH
T1F435AD81E7F945D4F5B3AA78A9B69171EA76BCA65E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 53a25d6f42b157acdaa06d88a58a7391e616cd4c3f33e70c3b113c7aef721ac5
MD5 b2257dba939bf536e129b5ff170a8940
SHA1 5d23e83316a6ba02e87f7b0ad29bb66167a8b99b
SHA512 0ec9f5944fbedff6a4001f37637e70acb9c387b3f7a234feb733e857620290a7d85ffae5b5823f6d52419c405752dd01d7e5614525bbe21b9f14895e60a6e164
SSDEEP 12288:umw5HEjsChNOBFgl0WDm+C1PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:nwuXOWSPsHAnrsRwYIQk3mhUVi
TLSH
T11165F14A73E80CF9E5A782388953C536E7B2BC512A61D71F03A0C65B6F37711AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1d35acaec0d13785ef89cbbbe022cfc604e804cfd4734e3c9d728c4b7c2dddad
MD5 eeaafc5652ca4c0d92a4953002022254
SHA1 8641eae94725f5cc8c87bfe5ed1295f6d0452afb
SHA512 dca78d3361bd660c23c039fa2fc79eafaafe19c644bfe31c5f08710caee237b029d686ac639d4934b6ac6917a932eb58c11a1a3a2321d556b74cbda549db5ddc
SSDEEP 12288:0bZ1IyWPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:cZuzPsHAnrsRwYIQk3mhUVi
TLSH
T16455129A23EC61F5D2B7423C9CE19609D7327CA1A7B203DF51A0526A2F33EC15D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fa85064d6e19e95315e82277cc6d67a228617cfb7ed7a47c2e8e421cddbd8ec3
MD5 da146c7f8517b27aeeacab1ef72f5a5e
SHA1 20bdb37fddca2ab9113aa3746575820a1e00346f
SHA512 1e8e4d9d292203f42ff85ca141e2c083b5d4abc833ed2f49bf8d507bbc73cbcf7bbef3b235e33221a44dd271efa13c3da6af2da6cc37d82c1967c1f2c6b9c81d
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uk:3QRQyi36YOcPuLvw2gAf+PN30DJ
TLSH
T18C666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bdae99df6e9912db76b3cd127737a839e85e8bbb4c01493d2d9e6f5474758ef2
MD5 63ba0409708b45ee9b954108caca00a3
SHA1 f12c8ef96397f8f13cd94dc5d94e3f104a87f9cf
SHA512 54040ce523f21950eb9ef382cf4d980f4475548cd49064bf99cbc53cb77fb352817deac6fb841d1bf91aff5c5bbdb43a978e2a85f09eff3873fb9e94e6929949
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uk:+QRQyi36YOcPuLvw2gAf+PN30DJ
TLSH
T10C666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 439a9b0d291e3ce0e93228be40e99a1bd7e192d9a2cdb044840092c6cce3701d
MD5 2602c26f3214e47496e729a78794bda3
SHA1 5eff9544eafe9c5a4456518bdc0c69e88b46fcff
SHA512 4a28f092a7d1113d7e9712f6a6099fbea8635652db6d6a9cdb00a997a4a46792e8ab7c573639cf1f2313ec5c915589fb94b3197d4aedb0c2188766b2b269077f
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0DPsHAnrsRwYIQky:368Qg55nhxeWu7PNU3/G/YIQkJV
TLSH
T110B54933B2F600A9C44DE1769F46873196D27C718FE1E3DB8151721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 296e623cbe169ace2c85664378b551fe2623bf58d3ec13c4fcdea951de37b58c
MD5 85a1b482b7a847a88f7e5db3b112813c
SHA1 4ecd1f0f0540f439386a2b631c7e6ef0bd4cfd57
SHA512 3e578b78666f8acfc7607dcdfb8659ed7ea68f9a5cac92218ff58f624ce5bdec31140cd3f02512b6588c8b908797c0b52e6cf24fdbce76506b11b42db3d7afe1
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:Ny5112gYy5azzVvD69nLKnhZLDJ
TLSH
T1A5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f6c31ac576d8c035788a73e96a1d0d3bda8abc0da85660610b20afd1fe1d8cad
MD5 82b2e44465c06c55ea32b82d5a12da4c
SHA1 2e71823537394cb545234ac3ed23c8907ff77d63
SHA512 e15e61aba73cccea1f0dd2cd12baa3ad573ff7735d127da56832f341c9671e8f9c9a346c1ef14d23b66416799941ede2297955bdbd3e2d1520187b050f9ece4f
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glu/YIQkJV:mu6JmQxd2duDJ
TLSH
T1D4D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 97caa570f1e5f18338f09e1cc4ec661c503f777acbdc11174d83d9ac8da07e3f
MD5 155522eba8d2d5ebd7855623a74bd4e9
SHA1 2efe3432c4b3275e8e414dc30e64879fedf24240
SHA512 27903a09cf603a2fd5b896d9821a1e42fac97343dc2b20421a8e6a67dfe2d54efb5170311363794b57db82656f7a6df824f743a97b3e9888dc68016640e7e569
SSDEEP 49152:f1hpsNoJpF1A6yU44CwH7R4xo/YIQkJV:fmifPVRZDJ
TLSH
T1A4B5AE13F2D901E8D06ED17887569232EA62BC460B31B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 507a9f4f3418174eefc5ce4f0ed19c99276bec2dcf3e04288d4c08cba6f86307
MD5 baefc1dcd95a200b1a33bbb8f0740eed
SHA1 235870e1687204fd9e90c54feb229a3cb8f6740a
SHA512 b40bfe51628165ae8f3eb84fb48a4e61245a824b1f7069191f96b37169d03c7a3b876087e820ebe9e936525979879f9a25e560afd12bb906ec87a510bb4f45ba
SSDEEP 49152:aSuZQIY0Be2KIRVtOnks6NMHqv/YIQkJV:E5dKOi61vDJ
TLSH
T10CC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 14687fb2fb8484b5a1a99d3b1c28cfbbd2afe83a182396a3086b37956b1a1c69
MD5 1d4327d239983d412b7a9148ac2b6817
SHA1 0e2e662c0ff2467a4162e7d06585a1411293fabc
SHA512 f40c2ee95298f371a562e719599dfaa3e235452e839f93483803acbe7e99ef2b8e29c59e3b067c739ec1e5870e4ee6fdd2285103a35c31e44408dae8d7161eac
SSDEEP 49152:ahtSn8EApI0figGgiDn0AP5wM/YIQkJV:bX2i/phlDJ
TLSH
T1DA95BE13F2D900E8D06ED178C7468632EA62BC150B35A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6ca54123085962617eebb978cf7b8269272506bcd4d7db88087b8ef6103142ba
MD5 e89bd51c1082123e41065d1a5d2cd411
SHA1 18c617d7bd0ef26a4c5c0debe1927e72a0fe2aab
SHA512 95ea32b810bd527b10b55c7ebb0ee6c1ed46504507a1e83b0bc68ca2ade2656d4f289d76ff85ff38efcfef028c82b1035f05c2b7b0c8dd02b837c69aac3abe83
SSDEEP 12288:QXPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:QXPsHAnrsRwYIQk3mhUVi
TLSH
T13A4523AAD3FE8AB0D27B47347C60E629C43A3EE1FDD2037592E0721B6C35E012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cd7531a49f9fd16cf6796723ada47eaa2a160335f97f918a132b9313192c7023
MD5 746d3284f48c8d09c9fed6cddd75f745
SHA1 39e47afc750b562243064bb2228b37914dea7d7c
SHA512 ac9f09f6d25347c0add276106118504cc45927c6aa95b547276d65d74c7d929c447fe2f64fbdcf46b5b3addaa3e2bc736a06ce34ec79e2be4eac79e4211ec5ff
SSDEEP 12288:6KPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:6KPsHAnrsRwYIQk3mhUVi
TLSH
T14C4523AAD3BE8AB0D27B46347C60E62DC43A7EE1FDD2037592F0A11B6C31F012455AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d1ac34000809ffb67ad6fee9bf1664243599b89ad9c039cd8479b25f4e8ef143
MD5 11160d2ac5c829c5b51f9b3552ced088
SHA1 46a8ddd658044f210ac3731cc84df7cbc5c5edae
SHA512 d1c01a29f401ceb44225abf959a2db57247129156694e3369e9e762c6364b173ffd9f6b665b139d1dbd7d06d06f2c4465fbc6057f896d65d3ae617dfa210ff2b
SSDEEP 12288:pkPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:pkPsHAnrsRwYIQk3mhUVi
TLSH
T17F4523AAD3BE8AB0D27B47347C60E629C43A7EE1FDD20375D2E0711B6C31E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a6fa1e506168ff57bc64482c19f1ca75f2a315796bf8551d5d7b8c8d90492fad
MD5 2f62e73e1d669fabfcdc11a97fc0bacc
SHA1 fe203ddfb92ae93045a523314c159c675df4029d
SHA512 9b2b4a05b71d8df9f3584ba2717ce01386cc49ab9cbcb894348499998d12531a68855aa4433788f87d92f8dce99e73a409e08a96848625fb44286550a78126c4
SSDEEP 12288:HVRPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:HPsHAnrsRwYIQk3mhUVi
TLSH
T1104522A693BE45F0D5B78238AC61D229D2367DE0FAF213BF92A0161B1D31F406834F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 66c0f3050cf70df9b3f2d5af9bfd4834989b904ea960ff5b0ac1d10d851b639e
MD5 570c1808c74c627ae9c99af3ed78d472
SHA1 a790d7cd02d0596235e24094bd8ce5a9334d0f5a
SHA512 1792cd7568373c75264662a562075d44512f30b4a05e7b16e7781fb43aaf05f6774c3a3d1b62c4560c81ba0b01bd975f9403aac7a838f7b6b554972c14041687
SSDEEP 12288:BJPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:BJPsHAnrsRwYIQk3mhUVi
TLSH
T10A4523AAD3BE86B0D27B46347C60E66DC43A3EE1FDD2037591E0721B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0661361767129ecce571f51c94c78523d7f5301f873540a5ee27692df4b670f9
MD5 e3b814ec58c61b39a9639220b11b9a8b
SHA1 f9d28fca0707aca9301838f22d91261f52ee8af0
SHA512 aa0a40d51b0206137d272f25e9f1c41b5c994b5d7b3a59cbed8aaa2c126e6c12760d2c7a2f76f2c4682e9fa5e0df9ead867dc14e08ec15e86013d207aa32b42b
SSDEEP 12288:pOPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:pOPsHAnrsRwYIQk3mhUVi
TLSH
T1144523AAD3BE8AB0D27B46347C60E62DC43A7EF1FDD2037591E0A11B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1c092c58838111a6974c015e3454fe4ba8827d51fb4d05a08fd4d488f6e67f60
MD5 955ce95d0cb410acb2a2c14438052757
SHA1 987ac22c50297a70cfca35d38905de7bb51244c6
SHA512 5daf7bffc16208612fc0c1265e82d82321519bdc4e3b728b6cea7cad8b914bb7d1924ee55a2f98e21cb20b3b723e52b335cd114b6daacf5ed509f3fefb614ebd
SSDEEP 12288:niPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:niPsHAnrsRwYIQk3mhUVi
TLSH
T1404523AAD3BE4AB0D27B46347C60E62DC43A3EF1FDE20375D2F0A11B6935E112415AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1305847ab1afab35983daf20cf0c55aacf729c0484172df61cd366e2432463b4
MD5 917e770516e2873a3e94e21b37bc511a
SHA1 f349f9d45e4fb1cdcd6f9b751a68952d171ccd62
SHA512 6fcc3e326ade9a9aaa86d501973d42c9e345d9488a5f3633132426f32e78163fb82d36d506a94bd0c3d20a4e0821e5781dae3bbe17df2cc8c96e8fbf3e2e3b78
SSDEEP 12288:WiZwbNzzFEoS2cPvyqPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:ZZMJzFVSOqPsHAnrsRwYIQk3mhUVi
TLSH
T18E65F1A5B3A408F4EC67823ECD618916D6727C655BA0C31F03E4362B5F337A11C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a817e3a219c313f2e88a1b389ea1fd1a7be7a4dbcdce15933a5a148e4e3c656e
MD5 48fa2c85864673515e992ab29fc5f638
SHA1 f259f35a5f8453e110de5e7e811819ae0148b663
SHA512 c07c4aff45ffac9bd23e7f92b2d8a89e04a439b9f3ddf194c2accc7938034d86cf9e020f15fffb52b5ac80d0ba1955b8b32a0a8a789b0f966e3607a7bad3ef9f
SSDEEP 12288:wjPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:wjPsHAnrsRwYIQk3mhUVi
TLSH
T1C74523AAD3BE8AB0D27B06347C60E62DC43A7EF1FDD20375D1E0621B6C35E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 eb565c656a4da15b5fd8bbf5bc29d20da04dcad2080462bd1c1fe7934e975e8e
MD5 22bf071f319f07ed2638443e7b2f14dd
SHA1 bf98bd7e8e89d16c4fe4a6ff300100f89dac37f4
SHA512 f626c4da863b65e78c5441f1961d2e84629ff01eb0e14548d739717d97071696d313f45ba1f3716749819f47b8a8ce6b6a7959b3b674032207c759b7b9b2ee84
SSDEEP 12288:K/PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:K/PsHAnrsRwYIQk3mhUVi
TLSH
T1FD4523AAD3BE8AB0D27B46347C60E62DC43A7EF1FDD20375D1E0621B6C35E012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e8e62c14f470971d2ddf558dff781702a710397659a712c54e46332163f55f87
MD5 ebf6b7e8b573e96b2b99d19aa453a5cb
SHA1 70a127b01aad5b8a9e995ad33c71105dc6652471
SHA512 8749cce9bc5f7fcbea8664d75dec957990791febd31674d13e66a3b2c57f889076e137ded417159bfe045d95be4557e6d75ed1579dd4e67404a2800168468099
SSDEEP 12288:hyPz5L8WPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:wzyWPsHAnrsRwYIQk3mhUVi
TLSH
T13155025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3c77f8eee5ddab6953b7ab60160c45c80abb6ad594fdea369800d60e1e6eaff6
MD5 91a089e287671950a86c118061a1ad03
SHA1 9aac183e593edbbb9bc7a84c20639c212c2ec521
SHA512 e4dc7c4195fe4a251c06b19cc8ca00e5314176a5ce0df3a2edf1ec9a1412fe5c7e3eecc6c5dbf82e305cfea1c78ee006d28f044d36c79ab3ce845e0d8914b61d
SSDEEP 12288:OjPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:OjPsHAnrsRwYIQk3mhUVi
TLSH
T1F84523AAD3BE8AB0D27B06347C60E66DC43A7EF1FDD20375D1E0621B6C35E012419AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0e5b8ea361c3034f63b2e4b2d055ec8dd3765b6b5e865cf638714706a131cc12
MD5 94b921576729dfa6bea9ba71122f8ccb
SHA1 dbcf446e6e4256b79eb971851c227d71cfd986a8
SHA512 79cf0282b1f5b280dac7dd16b68fbb94835835c58eb5299e7148b5e9eb4b5670896e7e42e5a444158d062db6d8494d8ed6aeb87f4c965fe8f568201fc869678e
SSDEEP 12288:NjPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:NjPsHAnrsRwYIQk3mhUVi
TLSH
T1DE4523AAD3BE8AB0D27B06347C60E62DC43A7EF1FDD20375D1E0621B6C35E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 db088c6f7ef4548c4986655d99569ebdaa6d1ace72dc62d0a39ad90706163346
MD5 b1b4e765ae7c2bd8deee65a467562fcf
SHA1 df20820a0ac83ed047ac880761e317009464a2f6
SHA512 cecc17e7edf86d10ecf814bef0d1828ff416740199eaafc0b72d05b496b0deb212f9d8b454c86fa427c397ed0324f76e41100b03f69e6e47f0677dbee72dab00
SSDEEP 12288:EyPz5L8WPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:dzyWPsHAnrsRwYIQk3mhUVi
TLSH
T1D655025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e26ec1af9e789b07a523c2e47e4e7c2b53ff5ad3e3af8e07f18f0ff53a7a1229
MD5 7c36865a0ef6e02aafde8a76f5d72cf7
SHA1 c31606f8945344ec47ef6b892f7d4e708b5a0374
SHA512 050d846bbc464a6873d7868a1cafabeb42de8373f56567c9d895b9b6a4692cf7bd12aeee3cc4579e52d665fc20bd36370368d7ba1955e4f9f239250976c0e2f6
SSDEEP 12288:QCd9XWYoaLHF3z0z04PDvh0PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:JTuaLl3z0zD0PsHAnrsRwYIQk3mhUVi
TLSH
T15665F1A5B3A418F8EC67823ECC618916D6727C665BA0C71F03E4362B5F337511C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e18586b5b586f908a721b6f7bf45fc04e957c37a715c717225c9283224d2bada
MD5 46924f2b8072679dbd1b19ee085a4d1a
SHA1 be645f36190a51ba7fefff3b36c2b223d8e7f137
SHA512 945949ab15968edd92d59deadd7b0a49e7b0496c5642973f3fa5f3040b98026552824ccb983819cafb5a883d081e3f8409919fb7f322db54a5f2249e4eeb564e
SSDEEP 24576:z3xd9CHKy7GZ4PsHAnrsRwYIQk3mhUVi:Txd9CHKyau/YIQkJV
TLSH
T1B575CF90F3E814E4F1B78A358D729511DA767C9A5B71CA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4d33dffb0175d3efed20a4477be4c0a6e45fb829a4fd347fd6d5344398f8e2f7
MD5 9ea1a6cbf9761ecbf556cf22017e6cd9
SHA1 e240940d3b45ebf9aea46a137eea35c88a9bbf0c
SHA512 797d0ce3a0a62d70b8488c5e798bd2981f7c58f2a71e5fc5123df66cd65129de939516b14787e8fef02d743532a23615a71beb610cb403568660e7a146da9832
SSDEEP 12288:kEPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:kEPsHAnrsRwYIQk3mhUVi
TLSH
T18D4523AAD3BE8AB0D27B46347C60E629C43A3EF1FDD20375D2E0611B6C31E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c15d3f9b0af596bec3e1c93ad22d5383ca05f948ab2c3303e95e8ad838a27ffc
MD5 b7676486903aa2fa6505af23b984a81f
SHA1 2a48d0ad69dc6836f4b2913d9930a51c5953aec8
SHA512 c7b5fb7909bd847796b1f2623d0dbc66de7f3c682bc8bf9804f1757ee995eb9dadd3da0e0db298f6f9e6fee3abcb9eb080108bafd0ac913f5a6f81e2f07fe8aa
SSDEEP 12288:H2PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:H2PsHAnrsRwYIQk3mhUVi
TLSH
T1A84523AAD3BE8AB0D27B47343CA1D629C53A3EF1FDE2037592F0611B6C35E012415AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a11c88bf4f2d93ad0aa9059cabcfab6c8f38de98abff5e189791bea3892d4c76
MD5 1e30abd797612e2dda7266e3b303230d
SHA1 e9b6eae6874e14f244c7e492ff79659c96ab0261
SHA512 50db12dac3b34addcf2a594d53038a0c7a4bcd7fbefb0cc14883a5a56abe4d2350dc8d776883af0053f95a0d90949450971d6e017a06092e7ca14729a1372210
SSDEEP 12288:iNPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:iNPsHAnrsRwYIQk3mhUVi
TLSH
T1C94523EAD3BE8AB0D27B46347C60E62DC43A7EE1FDD20375D1E0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 08c109e73d21165c7b4ce613c9659ac936022c92948fb1ea77fda79908217862
MD5 0ea77ad2fdff51caa9de41f007a60914
SHA1 4a8fac1652c68bca8e879759ac456b6bd089554c
SHA512 86987c70b50702070214a5d6bb5dca1ea367518860267f223069cb02c4ba47a6dd7409186ca368882588ed44d53a1e541379284016c816fa5f3296c1638508c5
SSDEEP 12288:TjPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:TjPsHAnrsRwYIQk3mhUVi
TLSH
T1E14523AAD3BE8AB0D27B06347C60E66DC43A7EF1FDD20375D1E0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 26842ccf9d4dbfd57562dd823c9f91bd4f4b067377dfd42c9689bf55e88c0429
MD5 f20e5531cca8ad247ae1a5f61f0fbdb8
SHA1 3e00c85b72d713610d7138275ee3f53b26510703
SHA512 d19b0bdfab1e53b014aa5400858728e09e1ce8a4b6dee60bfa9496528f9ae87bd6e08cb9561a5c59ca963b7c151d6318511855310cf082e26f77cc4b8d386cfb
SSDEEP 12288:XEPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:XEPsHAnrsRwYIQk3mhUVi
TLSH
T1254523AAD3BE8AB0D27B46347C60E669C43A3EF1FDE20375D1E0611B6C31E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2c92b46575a1dcbecead3bfb64f29e401c6fbdf7091066afda73789529e2c01b
MD5 28d931f4744a2216808a31d54bba1110
SHA1 1bcf032e76fa2731b462a322015213d9a518429a
SHA512 12b0ae6ce4abdb9f0917407228cb9dc7f6ebd936b3d4e5f098fcf27fef3d9c41b040075cc1b3e945cc1b4bbd875e835fce2090de3bf97b9ca3b425e389427c20
SSDEEP 12288:l7PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:l7PsHAnrsRwYIQk3mhUVi
TLSH
T14A4523AAD3BE4AB0D27B46347CA0E629C43A7EF1FDD20375D2F0621B6D35E012055AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1ac448807ba1fa5fe8aa1268ca69e0b21ceb8db75d1ff67e275c90f70a5a3028
MD5 700c7513f4e877eacdc9c17d530934bb
SHA1 0eae88520db213c0865ea98d595df8c1a5caae34
SHA512 1586c1dcbb5c53b1e8bef7b1532ff0c12e48f2dfea508f197e457011b12371d55d5f5aaffa9455259c3f69a412b5162d4f0b49af671d0d7192d73c0e1635b6a7
SSDEEP 12288:qJPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:qJPsHAnrsRwYIQk3mhUVi
TLSH
T1644523AAD3BE8AB0D27B46347C60E66DC43A3EF1FDD20375D2E0611B6C31E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8528a98b75ec3bd2cb5816a8c87982563760c7c2ce22b545b0837ac569eb884e
MD5 bee21e0d9ea73b63a1ba9293d680f574
SHA1 14f6f23de1e89d6472837a3af399cf2d239e05db
SHA512 e4183bf6d1b25e8dfacb72e2b3ec2b5dfbb31c82bf556f692f442178d42e23c7242655bc73c19cd323f099971fa70e6d42917518c0e1ba086ed3c19d73bd9077
SSDEEP 24576:kfwvOk9RX6wkyAIvPsHAnrsRwYIQk3mhUVi:KMnYIr/YIQkJV
TLSH
T10F85DF29EBDC44E5E1B7923C99B3460AF6B178691B71C2CF0299536E0E33ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 efd1a2b489c5194b7928063383cf00181e6a24181052bebb36343cbb8c335249
MD5 8ea79181ed87e20f7c8d83681ef85b34
SHA1 34da2b5354af99dafd39939aaa052b0668300818
SHA512 b035fabb61cd6bd28cca9ca34716e4598ed28ebe4bd47ef0084aec1c7d1c9621413825ef212f283768c49a5e91c6f4fdf2ce87a37c615897de24f91a5a72e9cc
SSDEEP 49152:RYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0s/YIQkJV:/ySzPUDJ
TLSH
T1F0067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7356fb7c6fbf54b8e753052692166a26f733e9048606001dd46b72cb08548cba
MD5 ce1867062c3c7ab8143b441797489209
SHA1 f93078eab1ab1293d7dabb51e8492d500dbd5010
SHA512 243ce042cc2b07533c6a891c381ef9613f927a285ac0a2981be7e7b0f828970b76225a78a1394fb2d13e6551a200097aa7ba866bfca532c748d2dda7cedb0d71
SSDEEP 24576:u47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYaPsHAnrsRwYIQk3mhUVi:u47JUQjairIhCnDHUPfF/c/YIQkJV
TLSH
T14265AE1EA3EC01E5E1BA827885158A5AEA71782D5F31C6CF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 782bdef772fc06507eb9bce61493def5afcd17998a3fc93b74b52b3ad51bf7f3
MD5 c61c3102b45821b9d60ca2c3b80d78ce
SHA1 6ddb65d48c51211a8c49ce5f19ec054f2d047469
SHA512 1475e087592d786dc380a0916dda6310dda7a9156b1e4a81e7aa69b76d3256cf715139fcf72684c5d16de3760e4bdb1253145b4a5c0b7d2ab40cda31699bb864
SSDEEP 12288:ZksfzPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:pzPsHAnrsRwYIQk3mhUVi
TLSH
T1DA55F15AD2A802E8C06F5239CB519A45F3337CA197E193CB52D0F53E1F36A905DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a1ae0cabfaff3487e05b2bd2dbec1afa45397101233b3598ce07efb1d7e0d931
MD5 4efbe70c3cc1b6fac5a16839a085baa5
SHA1 c8c3d0c6cf67ad8a4e5049f708075eef5a77c31e
SHA512 e4935ee94aade06952fb1053f4791f88ade1da342403b53008e07885752078671015d2de63fe560b301227775b00250130fa654d8a557c408d7f96f784cb68fb
SSDEEP 12288:kXRgU3fhE/qCjjHUM2gPTj97KBcXze744fLRpcW50zjtS:kXCUPhEikUMjbRKGXK744fLLV50zjs
TLSH
T15B351850762AC75FC6A940325E32D1CCA7B07D05FE44AF0773C8873F8576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c8e15d65cb25132d8f94417757355104b214d45ace31a1490359e52abe15d825
MD5 b06c5682889aa17993c82f2b4ce0a3de
SHA1 a0e27793ac949e1027b0f1e429c1d29d6fc3b080
SHA512 2fda0e6ffbf8cd3434a1947cc5a48f8e77143c8057dfeefd2d2953267681266837abd3ed88d22d498cf5377cce2547c807248d3fae79a3961ee656c99b9757c1
SSDEEP 6144:y9ys/mwdnPn3CWoQHQCQ6mOoXMytMxXhlOkMytMxQVq0POy4xCibZL1yJmHLHg+c:GPn3ZVwXbkAlbyJmHzg+
TLSH
T105750C815137E28FD1FA6072032A5B4CB7B4AC06B7056F26B3D84539D82BA25B4F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 50e6f32a5c90aa889b3892136c7d8f71afca07419f398ccf278ec9e5c70d2db9
MD5 62b55b501664e1babad35a225c3421aa
SHA1 c512ba51688b0060d5d183af4aa1e0679b340e90
SHA512 695325264d2234eb904f8a4f6d2600a8e888b8116b330a8a850c296e67f7cac35d0d2fb965ced5341d4880ffa5fbebb95491db607dbcbf69ce7735d4037d61ac
SSDEEP 12288:WF7LPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:iLPsHAnrsRwYIQk3mhUVi
TLSH
T1E54523A6C3AD8970E17B47342861D538952B7EF0FFD103F7E1A0621B6831E816D75B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b78d89aa1b0297ed54a2403b6bbe375ce807a14a276c56f12b34469387447b1a
MD5 12146814fe012907e81c6cf859ea4d8d
SHA1 ea87e7ceef4f64719e8ff720cb0c4e0924d6b973
SHA512 3f94434daead9983794a05df60947bd8e68c17813c2066b937711df54013ee1e943895b9f18ef23c497ddb83fa23f46ae8255e3834b0a1f52ecebac71a4907fe
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYVPsHAnrsRwYIQk3mhUVi:Bgb4mBIBhGFq/YIQkJV
TLSH
T1D465AE1E22EC02F5E0FAD2B89DA64417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ce149627e1e405e05ee234f49a145dff83e16cc26d56e37411e60cf754ded690
MD5 b5c5a038f3f1875094747ea6a4897eba
SHA1 f2028f197675af851621a9f8afd0687eb50eee4e
SHA512 28167572b8e7348a13bd9dc23cf93bd8c19767e3dedd3f3a730a742dbac8d3fb0e29b01d9eaaabc1f8eb423ff9b4f20990a6d88c4f93e9626cce3882d4bb1682
SSDEEP 24576:PG88u8FpJqH1nzria7/mqPsHAnrsRwYIQk3mhUVi:+7ZFPqV6a7/1/YIQkJV
TLSH
T17585F165A3E501F0D47BD13889824667F672B8211360EBEF07A88B561F33AD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 11e8d2e80be473dc56dad7b5cdb6591c80f706049f66f20030666cc6ecb9ae76
MD5 976e350456a8742db1461bbad83ae155
SHA1 138b8eb86ad4d3a81dfb845f9722d5b4b4c18ac4
SHA512 491c78bc1fec4b4b8bc8416f45e8e547334012a6ac66a5b739727267f7ef32611636486819331c9460d3436d295fb9a5d37932fd8f620dc84dcb91f1bbea7def
SSDEEP 12288:DHvUrBFrEjwaQ+PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:DPUr+NQ+PsHAnrsRwYIQk3mhUVi
TLSH
T18765E12F62ED18E5E677A17C89828719E7327862575292DF02E0817E5E33ED87C3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7f134084fd7c5dd38ebd32609dd2dfd4d5b676a772c0e8649e15ca9ee990c809
MD5 848f18b5cbea08b9fb1c69e1435bedc1
SHA1 2e6b655b5c5120a013011c6d0345fef5e66da284
SHA512 8e93dad1f4ccd20e4c15ab5ae790ccb106b10ca719ef653803e0448d00f9cce92ff09de2b29d5341ef7d33723a1a602c9a6798e043ed64edc1a4cd7e7ab6595e
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+/YIQkJV:sG05lO43bjDJ
TLSH
T158D5CF6E62EC11F9D1BBC17CD9C6860BEBB23825033556CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d0ac76726a45d9dea260b3933ad1db4df5b90a9b8e7d098fed626b6138d2704
MD5 2ed4d2905d5cd77f28265660afbe1328
SHA1 d022c30b102baea9669417d9292155fc1705dd41
SHA512 7fbc0e499ba02e9c3ee9d3e910f9d42395a7a7eb3e17adc4dc3399bfa830eae50edc870e11dc3c6dfa814f276f78d66ae4a30ebafb70640406fc54001166c9b9
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnwPsHAnrsRwYIQk3mhUVi:xa5POZ3hJt2pasx2+mG/YIQkJV
TLSH
T14765BF5EA7FC01D5D1B9D17DC583861AE5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 13e3bf80eb9a22caa04fdef479b69065d0cd7f045181b1efe42a664c244cc166
MD5 8f062435bc222d57b2544327f2abb56b
SHA1 0f5e38c5f24b5e4b478d3494cb79aedb1cd3ef72
SHA512 627de8dc1f243fe13c7a1cbf7d11e7e52372ef7734f7291be41a8f7a7d0c8a6f520aa296d306b77dc608949fbc81c27740ddd798bcac0702f05a0e426eb323b6
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkyPsHAnrsRwYIQk3mhUVi:UNc/zEOVHFV/YIQkJV
TLSH
T1A6857B2623E901E4E1BBE1BE89779546FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb306368ed3d9e09f115bd618a3b0a1fda6c222b72e318a595f33cd7737db87a
MD5 0b1028039528cd0fe212cf9e5fc24c63
SHA1 f09d7843f786348172b8af07485a8553d09e7e4a
SHA512 6c1ece9ae693da6250d63ed5d74bca0b54ed72238a8c00bcee08fa130d79163b2b3e91a9037ef2b95130d79a29d5edac2251930b20ca58e38e4bc139ae9b57a4
SSDEEP 24576:73kNvNnaFeYhJNtmZBmSPsHAnrsRwYIQk3mhUVi:73MwBtOmi/YIQkJV
TLSH
T1B055AF6EB6F846E4D1FEC6B48D238512E6727861173253CB9290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 70b100350577c84578dba347bd69ea39b28ee5b23c7fce650a66d2303d49a4d6
MD5 ca8344d8bdd852b9c488801a04d80fb1
SHA1 51a9761302630f684cd875a72876dae4a3f692e6
SHA512 7511200e38cf1ce84bc0a0727b001dd453594bfd59df5ddb636b58bc4e398d9f40167f929d2a685a3f0565eb8a68fd324ee1d4cc88899fb31823ac9f13776b49
SSDEEP 24576:LD3FHshBIYQgA3PsHAnrsRwYIQk3mhUVi:LDVHeBIAAT/YIQkJV
TLSH
T14375E17EE79C04E4D57BC17C9A638A06E77138A9036256DB02D081BA1F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-282-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/624-78-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/624-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1356-84-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/1356-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1356-89-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/1356-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1576-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1576-205-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1576-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1880-331-0x0000026C13070000-0x0000026C1323A000-memory.dmp

Download

memory/1988-41-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/1988-8-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1988-7-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1988-2-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1988-0-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/2692-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2692-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2692-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2692-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2776-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2776-100-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2776-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2776-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2776-335-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2776-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4612-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4612-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4612-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4612-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4620-113-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4620-107-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4620-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4620-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4620-317-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4620-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4972-131-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4972-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4972-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4972-139-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4972-137-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5020-55-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5020-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5020-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5020-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5020-53-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5020-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5720-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5720-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5720-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5720-105-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6116-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6116-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6116-120-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/6116-126-0x00000000008D0000-0x0000000000930000-memory.dmp

Download