28449ee01ebb9b65cca73609c42c036d748db3d868926005a17375dd88272d41

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.4MB
Sample260729-azfhladm21
SHA256 28449ee01ebb9b65cca73609c42c036d748db3d868926005a17375dd88272d41
MD5 a2924ee822f737b15d472b2b5af4f533
SHA1 00366c1397e149c880d9d366ff677f75e5bcd31d
SHA512 4d626c32c4ccd81a1970e77d2c802195f9771139931a36dfb9d3c4d4d573a419d3a7dfce40b45b3fd8ae2356a859721e2979fb733cd32e2e2d9c6e7c066b24b7
SSDEEP 12288:Nn8Tc2SjAqlWyA1XPeQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:rjPy+YgV0lde1tl31OBDTwlYnTekwp
TLSH
T140651266336514F8E1A2423985669122F771B8250774ABAF03A41377EF337E19E7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4888	elevation_service.exe
4960	elevation_service.exe
1432	maintenanceservice.exe
6068	OSE.EXE
2052	PerceptionSimulationService.exe
4728	perfhost.exe
4992	ReFsDedupSvc.exe
5828	SensorDataService.exe
1020	ssh-agent.exe
3200	AgentService.exe
4340	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3cc8dc40238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\SearchCompress.exe	elevation_service.exe
File opened for modification	C:\Program Files\UnblockRedo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\RestartGet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f1995eaf21edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005af6b7a8f21edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6eacfa7f21edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000baa594a8f21edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3332	2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4888	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3200	AgentService.exe
Token: SeBackupPrivilege	4992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4992	ReFsDedupSvc.exe
Token: 33	4340	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4340	SearchIndexer.exe
Token: SeDebugPrivilege	4888	elevation_service.exe
Token: SeDebugPrivilege	4960	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5324	4340	SearchIndexer.exe	101
PID 4340 wrote to memory of 5768	4340	SearchIndexer.exe	102
PID 4340 wrote to memory of 1468	4340	SearchIndexer.exe	103
PID 4340 wrote to memory of 5724	4340	SearchIndexer.exe	104
PID 4340 wrote to memory of 1244	4340	SearchIndexer.exe	106
PID 4340 wrote to memory of 5644	4340	SearchIndexer.exe	107
PID 4340 wrote to memory of 616	4340	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_a2924ee822f737b15d472b2b5af4f533_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b1e54ee373c09cc5c9b3634ff3b83af6c13e418cda874075ef13d7d9e4457afa
MD5 b25e3ed39f8f8e7408bcbff6cd02159f
SHA1 1def6b635c7d4ddb044dd2f12c8dd26dd44b9ce0
SHA512 419a7d9fc3f8f7f39376e88eaea80bbe85ed624771833dbebb8833bf7dab519db0f53fbb4b725b8de90e3ccedbf77cd2c0ad0c462ed48f5bfc99d35fbefa06ca
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnttV0lM391OBAOn6kO:C3q6sjBW0lO180kO
TLSH
T1FAD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 66a80ce06188f27dbc29f66e76af500e8539dfd1077b9de8476f6fc72e3ea123
MD5 9337b15673caf23456b5fc25059f15dc
SHA1 3974593913eb37a37005ac23016e0d679fa362c4
SHA512 45de805b81667b02ba9b3785afea4c44414495af3427537f9c0e4b7460f17e6951fd8c51faaf9c7be28bf22569e8f65b56c1c99d9558d5b5d9c4ef8656091c44
SSDEEP 24576:VXYfDtczA4YgV0lde1tl31OBDTwlYnTekwp:AtcbtV0lM391OBAOn6kO
TLSH
T10775F12973D408F9EC67923DC8A2C111EA33BC5447A0E79B03A49A665F337D85D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3fc967086557618a56dec04571672f6ffe9657c78bca9102ed3af8174e2af6b6
MD5 36f8c851a9547c477203e84ff3295fb8
SHA1 ceb56d072a56a2beea7fc0347ab62dc9224ded9d
SHA512 ccecf3d915d1633e65cb82105540c655828da28ae0d6e1f3df411d2c710ab7a891c869eb31741bc70238ba5d62659d8ae1143ccf139aa856d323febdd7995efc
SSDEEP 24576:H0Le5ji0hmxlrMlYgV0lde1tl31OBDTwlYnTekwp:HPji0A3StV0lM391OBAOn6kO
TLSH
T18D959E16F6748371D073C0B9C5D2A69AE97230851B308ACB4286D77C7F67BE6893A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fb1c294c82f24b262e982653ce5c823097a81dffecce76d9fe3368bfa5d4ebe5
MD5 01e7bd8bccdec699beea3f3413be8428
SHA1 657b24ccdfd2968c481ccee4721aea567f09c6cb
SHA512 92ee946f06a0d4d0cbbeb75edb28aa82d24be2b5f35c12bfd21f00a287012fb5e8804ef2819e6123462b1146c40a4781732f27eb1952a43b3d613d8bf512241c
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyurYgV0lde1tl31OBDTwlYnTekwp:U/ezSC6vUzPveHjyGtV0lM391OBAOn6V
TLSH
T1EC755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ed9b05fc09dea3f138ea9d87814235ac9478cee00dc584bdd8794867f051146a
MD5 bb6454305c2e1093b3408e969e8b9214
SHA1 ea53e5f122d85209ebca347d712e74838d43b8f5
SHA512 a83f8f9efa5b2cebbabf8908e9544d68d399b6657e0da1019f777c8f69042140587fbc12c3b4f7a5f738ffcb00e5a08e484d02802f70315c6efafb10f4ff1254
SSDEEP 24576:GVbqPb88hv/l+YEYgV0lde1tl31OBDTwlYnTekwp:GVO88hXl+TtV0lM391OBAOn6kO
TLSH
T1B0559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3579285b2e41404dedc51d07b9fa014a388aeac622e425bccf324c36aa681f5b
MD5 0e6c3a327f15bce3032be0e95946f95b
SHA1 62c3501871bd1e277f7b6da42b0704caceaa731f
SHA512 e146716f34da8bf659677f58e222d1ef1ba753442da929d99bf4db0894b6b0c1ec984cc03e41fb55d93604bbcc9cd0509fff174e584ad19ff0e7a3cedbe95b56
SSDEEP 12288:50PQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:50hYgV0lde1tl31OBDTwlYnTekwp
TLSH
T1EC55236F520D04E0E291353661BAB0217622FE580ED49B63B24B77A7ED35F64DCEB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9471d39df4c776875cd61d3cf435f349c3c74cedb3b9e702087cbaf7fd5af597
MD5 d7fae9e11375406c2f5ec0a77b387d35
SHA1 915591ec36b495a7178ec0b44bf6660d22424f72
SHA512 bebba1a5d02970587ce959cd9e745f4a8e4e5a97edbd3f3f6f037b07334ba1618c0afd557b5efb79b73fdf4a3051f1081167140e8b7bf9053c374f94963bd2b3
SSDEEP 12288:YeBNUbTVO86U8QQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:YJIUcYgV0lde1tl31OBDTwlYnTekwp
TLSH
T1F075CF3BAE28FCE2C27A5D795691C200E77278704F61A3CBE165830EDE235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bfebe18c13b3bcd75d16311ee66ea1d301506e8f4b5be27287de9b4c93018ec3
MD5 a972694be7d684d3d7f646fb10970ebb
SHA1 2df9989b9e50886b4c106a796f5a9fe738c2cdc2
SHA512 5a1a0022aad89c4acfc68433d22863a781d7b5b6f4875b5da1e87718711b160355b4db24f9ac04bc5e99dcf7234504fea078864c95a5f9f0146b255c1922ffd7
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH0:6QvGAdlCEL8c/DRNw5Cf0lO180kO
TLSH
T109266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fd9e13496279d6d1376a4d17999f631a84853cff47555fe3e625be58ef120582
MD5 1ab7a6874ab80b7eac140b92c0831b35
SHA1 f9897e24ebbb287b7a84ece24bbe3f7945ebe8a4
SHA512 92270af3fd34b0ec7635d7634f78446d65ac4942a3acbefe5bbe2254f4c9499f6fd644f69181974a180d311c200cee9c2858d96442ebf8915f50f1e7a0b6d79a
SSDEEP 24576:SQewsAjiYgV0lde1tl31OBDTwlYnTekwp:3ljitV0lM391OBAOn6kO
TLSH
T12975E031FA74D432C27B0DB61B36D716143DBA200F911AC3F3A89E9E99306D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f80e6016d2940a93fcc578a9d0e5700954d2e1c684a7aaa46a65039537b3f43d
MD5 10cc8bb2d1aa04d4f1a8c7bfc9ad6ada
SHA1 edb7895d85c14e3c9a066c907f2e98fa32ab49e8
SHA512 3089aa9a6f620cc94fccc5253d836d95ed8e0bafa82db2f0c4a8d00c1f0030223522027432632b484988dd722ce2cdb0972636cff22dc40939ae72c230272281
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpC8:JUEtQevvqc2W1cpV2tI324
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ce1819d27e03517ec95f2f2a3cf0547ccafbafba38e72c1a160ebaab21eb3858
MD5 6d35c6ec7c757f5222b230219901d141
SHA1 aa714ca17377b36a824f3a4c3fa4602ffd0d6c4c
SHA512 01aec8d5fca86d65b0498aefee94c92896fe3e16ffb4940febfe6b75cd89075a46ee5b775c224ac66de4bd777a03fab9673cde23bf762a64049701a26b6be708
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zCtV0lM391OBAOn6kO:woqtVjnmz0lO180kO
TLSH
T158D58D1976B881E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ff93e38b960d33f3cfefcb0350c2e140b527c51d160a534ce9665b80463db9c
MD5 6e80f7b7c07d621d8b4e5adecc575704
SHA1 94d0146abcd9b42017fc37c1d1d16184e083ea59
SHA512 056e7e91b8d57ae7663c7764615b37a090f8c185f361e43ea428dbe8ded9d40de455cb4c5bdf10d472b4b229f6a5e7f88b96efc2e9010260390ffb1a33518a0b
SSDEEP 24576:4AhGL3IFoiwtA5l7S53PYgV0lde1tl31OBDTwlYnTekwp:4AMUFoiq5/tV0lM391OBAOn6kO
TLSH
T18435AD81E7F945D4F5B3AA7899B69170EA76BCA95E30C20F2160D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 809516e0e932f4c0a016518c87f1d00a76833e6c1721cc547ed8bf7722944e99
MD5 03c0e2a22cf682599ea6168695543fe6
SHA1 9aaf16db27149f03f47b6ea8c227c4073ecfe1f2
SHA512 03c90357a8211c9b35ebad2492fb4a5176389aef07e8bfb6be3c25123c5d59b12c532d8fca6b4cfe8301a66805769f792f765375656a4ba4a3399e4745098c46
SSDEEP 24576:awu8OWmYgV0lde1tl31OBDTwlYnTekwp:awjODtV0lM391OBAOn6kO
TLSH
T1F675F14A32A80CF9E96751398597D136F7B2BC052A65DB1F1360C75BAF33321AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 43c8ae37826f716bd41bdae33d03efb35a974ce2f635317b32be3db4cbdd5454
MD5 b13f473befa4ac86882dc575b3aaf8f1
SHA1 343838151e63f3884429e4b6be15c26581cb4824
SHA512 8ecdfeed32b46b54b0da5bff556f99cb6e7fc628af027e714e5c06a34da28fdebfe6c442e3e33868a643c78980fba91967cd748fa428ed9bb37356a4f02bf813
SSDEEP 12288:ytZ1IyKQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:8Zu9YgV0lde1tl31OBDTwlYnTekwp
TLSH
T15465125E33A820F5E1A2223D98F59205E772BC5517B583CF221553A6AF33FD59C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0674728563a27569030a0aafd716af73f2526cf9fededebd8c24e5128cb99bd
MD5 8d0e0d31b28b0d4d202c619cf1ca7c00
SHA1 b5634cf8ff1f86752eada4efe1e782782336f85f
SHA512 73f58a3b0f0411cf3f86e50387e28237ccb0549da2ea3763a68e0cf646aa6bf25f12ff68dbfc99655a293002c55aec5ed45f6d73fbc6de78183e6d9563089e91
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3S0lO180kO:pQyiKa/X+PNXC8
TLSH
T1D2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ea61f1075db81b5b8c80ab2aa8ee2725e231e5e830128b5272cbbd7b2b7007d1
MD5 f2795230a56ce0503f89df1a2518d976
SHA1 4d2c24a26a1033d4cc19739c42a449386197f04d
SHA512 3bccf4236e33edc118c856ebd8404c46ee8dcf4c4f46018087ea46ac8311320f1c85641555f349299d9b72b62d7ca86af1a11168cf322949cdb99ee00f493f2d
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3S0lO180kO:MQyiKa/X+PNXC8
TLSH
T1C7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fd13753467e25ce0935166cbed666030d8a2b11392cd4d5dc04e02ef70849cc2
MD5 93ce9341d96a9e1800f22c6662d0bad6
SHA1 12040f085c16e6fefba1ef31c5bcd2da4efe29f4
SHA512 1a43b8dc18e85ac97a0b06f39f2bdfb78296a7d96fe1b9a5b0ac6b933ef90097f2a79a903850a5ec96e538c00a5c4d8d314e8733ce9afb6098278070895986d7
SSDEEP 49152:J68Qg55nhceWu7PNU3/StV0lM391OBAOn6kO:XthLRc/40lO180kO
TLSH
T14DB54933B2F600A9C44DE1769F4A973196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2a7d3d34aea95cb42b0c7fe3c67a079a3ea5d6da8b569d77f05c26438ade49d4
MD5 ca4afa797cf2c1355eee5057b89cd1af
SHA1 1e9c2b319547c485f0c4f8c707b0b9bfdb670514
SHA512 cf2b05bf4dd4123dd189526c5213f0b07edb70bfad3dca31c7bd7da70bc2c50d28666ead699d970c5d5dc5393f29428cab5009ba464ab037ca3712cbc56dabe9
SSDEEP 98304:vy5112gYy5azzVvt69nLKnhZZ0lO180kO:iLIHEWhYC8
TLSH
T1C6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 610509962fb7f6347111f838fcb46cbc6e60e7e4457c5d5b6e457df2880ffdfa
MD5 6ba502f1c3c896ee7cfa44e5ea52b2dc
SHA1 c92bea3f160093a3a59104c822d83dbf2470aed6
SHA512 eee79e99d137957d523b37eb9b840d4319aa99ba95cc86313ab6367b9ae1f5983b3304bb6666d273578117a17de0fd482b8e76145d36c442d8f0e09bd272d047
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3tV0lM391OBAOn6kO:Tu6Jmdxd2db0lO180kO
TLSH
T150D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 49a5cfae653d8fd14ce73601fac77052d72bb9534ee06e188ad0db030c98728e
MD5 9147748e1016cad20f9f3f131b0bfb05
SHA1 a71a283f92eb5e708ebc4c565b558c90d5795dbd
SHA512 cfee80732499182c2f4c482f9d4b12eccf25df49adaa511d0ef409618ffefefc8d2f2185a5a325bd352985538a2e2328ffcc43a131f175e4b4358af02559d1fb
SSDEEP 49152:i1hpsNoJpF1A63U44CwH7R4x8tV0lM391OBAOn6kO:imifPWRz0lO180kO
TLSH
T1DDB5AD13F29901E8D06DD17887569232EA62BC450B34B6DF0A90B7961F7BFE46B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6f616df0e1f7de5218ab0c6cf565f295e0efc963e0c92ff21256855e2e120af6
MD5 b02f5fdb03eeeda9df3c52bd0ab5ef48
SHA1 15342c3ea725d86b49d74d9d353c6f36e29f0167
SHA512 b0c4a4e68d9ecd6352f63f465c6e67fbbf4e7ea9af017e5dccc5f9c03ee37504193bc552ce34adbda8de46c96b08221466bc6f629f7ca7d2cffc689e93a349e8
SSDEEP 49152:ISuZQIY0Be2KcRVtOnks6NMHq9tV0lM391OBAOn6kO:S5dKii6110lO180kO
TLSH
T106C5BE13F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 27190846b470d586f7fc3e0f3d15c277d572138cf829093dc8c6b94797a1cd35
MD5 a6e66c2febfbc837b3e9a45a3ff8eb2d
SHA1 401df8e8d841f389d52f6b47a77276d365bab69d
SHA512 3635c704abd522581b2e70000c67b4af3de6df33ceea44e16b5a2cfef6870d0a1a241686095890fddc00831b673858514412a8994d967059d3b9b7b5b03e1e0d
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5w4tV0lM391OBAOn6kO:aX2imphn0lO180kO
TLSH
T1D795BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 a9be595d11277551217b7a98113f9cae0d344cb3f4e06ac6609d745ab5eb8023
MD5 dbdbd289ba83060e6574cf9d6c4deab7
SHA1 227c793545f8443ffeca36bfc7d691616c59a21c
SHA512 1c0c3432d8752a5bb3f45ad9ad38811ec0c7a28d68e3ede2483c962b602c6452699cb87e27d8bf39599a112716bcd16c5de96cb3427c0874e896d5ffa744adb4
SSDEEP 12288:LHQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:LZYgV0lde1tl31OBDTwlYnTekwp
TLSH
T17755236F211E05E5D1503136A1BAA1217615BE9C0ED49767B24F7263EE32F68ACEF3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 c84d3575fa7be00e628719cf9f9791d7242ac0b825f841431ab5ca1adb568d9d
MD5 4bf76bfd58f8343b42d38723b7b27bad
SHA1 6aa5e1d8e53358fa511899112ee8bb8569dce786
SHA512 29f88d574f50e27c4224795686caa67b1dca4f4ba2fa9af0cf672b5d955c3d2d85b23a3f4585ff35f8ab24f813c8d66ea8c7e1fc020bf69b19e0f6ee575ccc4c
SSDEEP 12288:PuQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:POYgV0lde1tl31OBDTwlYnTekwp
TLSH
T17955236F611E05E1D1503136A1AAA120B625FE5C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 a702670d488c062a8ecc9fc4b2dfae1dcba80ae8c245a9e6a44baf12c0bc50e4
MD5 0da00b8d0f93213978f356e57e3a6ccd
SHA1 6f30632a0206c62ca9680183050275e826a8b628
SHA512 1c5c995e38b5346f8ca729db3bb8ea072fe7cc230cc85ab67c48651c77c231619d70df6c420ad1b4c668a549bd1b81f6e491d1d6eece14a757e25c5a5f06746a
SSDEEP 12288:o0QQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:o0YgV0lde1tl31OBDTwlYnTekwp
TLSH
T11A55236F611E05E5D150313661BAA1207625BE9C0ED49767B24F7263EE32F68ACEF3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 155ce0560a32a51b29e928fc88a6f44a29a00112f67796769e38b063722e8142
MD5 c6aede9c6522755458881692281a0e5e
SHA1 ca81e679bc9817143fef7dda0db5e866364d6ef4
SHA512 f0c6eece00c51fd85283673f61a037f8f4a2783dd9c72202a4bda6c8db6c7cd33c5aeee81d82596b39cc4e7ee18182d879a320c04f230a5c0600f43919820efa
SSDEEP 12288:5VVQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:zYgV0lde1tl31OBDTwlYnTekwp
TLSH
T10055236F225D00D0D4617239D5B6A121F372FD980BA197AFB7063257DE31FA4ACBA390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 766fc8a9a2fb898221c96014732455e36eb60efb280c5bb98b968612129e7b92
MD5 727094e017606999f768cae0fda3da68
SHA1 db2ce33b42a901fa0474ce1073de3f311c381982
SHA512 17dfa889cbf0b13b603f80bfb3c8358ebf009f50fcc32e4e35466ed1443f3062614f4bc3882edf3732d48d732cc24b19c7f9bf178811a738bbd2561890e0d564
SSDEEP 12288:TdQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:T3YgV0lde1tl31OBDTwlYnTekwp
TLSH
T17055236F611E05E1D150313661BAA1207625BE9C0ED49767B24F7263EE32F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a621ec80e977bebc450b6f774547d4907822aeaeec9cdc0f762765c300e1a936
MD5 68d50fcb3dcb81be357f0d353aa535f0
SHA1 be3ceb3a49317ab6759d10916c035ccb0ff73ce5
SHA512 b48f3dbc5dc75ca72115016d2523773b198d87ee8b71fb66177ab4a1297ed483fda88622adc4c5cfc335b05c090fa7bb38ee7bad91d2f734eaa1bab335b79992
SSDEEP 12288:9SQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:9aYgV0lde1tl31OBDTwlYnTekwp
TLSH
T12D55236F211E05E5D1503136A1BAA1207625BE5C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 1394eb5ac728d8092cac275bf98345a62e1bc770035c46b616a2a8099c450d99
MD5 513bfb4513c4fc5333a12fe83119a92f
SHA1 12b56658d1f1ddd48dce6ae5716a9836d8ce3711
SHA512 565b8d85f65ffac15c92db74ca13d0d58b2f77272d84c5dec18950a3a11942028644e2fc55cce712bb5d94f5e7e03a0f2382280f806ebd9702b2654e9c04c8b5
SSDEEP 12288:bWQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:bWYgV0lde1tl31OBDTwlYnTekwp
TLSH
T1D155236F611E09E1D150313661AAA1207625BE9C0ED49767B24F7263FE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c4681dd37c581fdca645cafada67e4b7157e13ee4320746bccaec0c2ef2f26c7
MD5 90a41f48cece5170ab99c4f8ac5d5b60
SHA1 504d4829d960b066ca87de28fd347f85105bd494
SHA512 9e943ce22304b976811e45f23e1168a66d5a8066c09e87bd18cda990fd98b77cfa19284451b0f244abf2dda5b134115ac2221bb2a29ccaff56446c12d6e402af
SSDEEP 24576:eZM9zFVSOuYgV0lde1tl31OBDTwlYnTekwp:eZM9zfqtV0lM391OBAOn6kO
TLSH
T1C57502A9B35008F4EC63413EC9659916E6B2BC590BB0C71F13A836679F337A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 8e0a07f4fbdcfefca833ff8c428916a9f12d67acb4b0e1938eeb3887f8a905f5
MD5 0d464ef19fc02e076f41205655988c4c
SHA1 e622afb627985ab7e67b85764978d88aa0c88d08
SHA512 f458b9a97ffac9960d78628aae13ddbd8d2add5f4c62c82c6235498e845a8e563ce98c3df1fbdc5d9a0b8e3f4bbf1f77b3ef04747570fa999ff8e39b94f24c4e
SSDEEP 12288:8jQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:8NYgV0lde1tl31OBDTwlYnTekwp
TLSH
T14755236F611E05E4D1503136A1AAA1207625FE9C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 883e6c02306bd5a8a69a17ccd3b114c5e2c4df895ab0b18e0eb008c9c54c1caf
MD5 50113e267509cfc8393d5e7050dc0ec9
SHA1 17b3e21aae778a28839a2831102ea570b9478c8b
SHA512 6eea0af84189186966025bbe958387fdab264a9e8a5757953552ac1d4cd7e68e76a11eb6190d6b748b7ee81a78e114f5403b54f7103affb8898bbdc97c11681c
SSDEEP 12288:NfQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:NxYgV0lde1tl31OBDTwlYnTekwp
TLSH
T16E55236F211E09E5D150313661AAA1206625FF9C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d508b26b9fb085b9e20dfb34e0edb2ba741af965e266f69170774c19f4d5e064
MD5 f9585f31d640873803f4b07e45414388
SHA1 8840c4c3f2396f262f4e1e304573682310756b48
SHA512 86c05c295ec7ce9e6e7eaef4720269d310470e33d53a3c87db835c5c213bffcceef9d3e2d4bd3b354c7a652075e1005f72da48dbc94d8f7c6b5e75081a38b49c
SSDEEP 12288:TyPz5L8KQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:ezyyYgV0lde1tl31OBDTwlYnTekwp
TLSH
T17665021B73A520F8D166523988A25611F772BC350B608BAF63A413776F33BA09D7F760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 4a332455ec3aade73241d9b6ad63c533df1f4460dcc4fb20aa040c46374ef43d
MD5 12bb38c814e763c077764738814fb65a
SHA1 5bdb6db172d2dd15d6caf19bd7a40a307add381e
SHA512 4410b0617128511e381cedef5b0fafde991a8167cdbb2aa8dff7d49733448c70452969e9268fdb3a69e2670449608f3b7f3e21c6fb9113d9e6e3a9b0cfec754f
SSDEEP 12288:8jQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:8NYgV0lde1tl31OBDTwlYnTekwp
TLSH
T11E55236F611E05E4D1503136A1AAA1207625FE9C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 d4263e937f383df05453589243688de1055bffdd3e4c42a96e93f8fbf5910b1e
MD5 45350ba6d1b6c42133e5f4905514a5d5
SHA1 ec087de3c694ccbe8610303094c897fb75221a7e
SHA512 0e618815ebe6cdda07734c3ae8a09b9f1ae2343474bbebc4a337780ca2d4944d89b7b4f3b4289a47abaeab9854aadddae7e7da5c14cf3b8877cba2baeadf8f9f
SSDEEP 12288:BjQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:BNYgV0lde1tl31OBDTwlYnTekwp
TLSH
T13655236F611E05E4D150313661AAA1207625FE9C0ED49767B24F7263EE32F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2af000a278e86b4ba310721f187d4a37833cb51e5152407b2bf4c0b104d3b369
MD5 e7db811185c76f82b407bc126fb26368
SHA1 1f30329100161d1f656e9baa7fa75f426e9409fc
SHA512 5bc237a155e4c3f79bdc5a11e632d3b712cf1ff36be19465426f55994b038884e387f896ff709146624bb3ff22931ad9205958e697e174d1ffb3644ee4ea2db2
SSDEEP 12288:ZyPz5L8KQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:YzyyYgV0lde1tl31OBDTwlYnTekwp
TLSH
T16265021B73A520F8D166523988A25611F772BC350B608BAF63A413776F33BA09D7F760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 26a34448a3f2727b17350e75990d8770a602d71f0773254209cd1571bcad1ebc
MD5 dbe595233cb2a390ea17b7be7f2ffd87
SHA1 f09653b02a7cefa2cfedff78a30c27a7423c034f
SHA512 40baf2a83d7e693ed2ac37b904dfdd2af1a53e7ab6a9afaaa7e9b1d7ec31f31a457c253b1cdbcadb7da06d02a8a59c1eeddf7b8d50413a4887b4907c0de637b7
SSDEEP 24576:vT/aLl3z0zDkYgV0lde1tl31OBDTwlYnTekwp:vTiLljrtV0lM391OBAOn6kO
TLSH
T1187502A9B35008F8EC67413EC9669516D2B2BC590BB0C71F13A836679F337A05C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 7dcd56c86354df67716cb5353971fe4800100aef517edb75331b520c136e2c37
MD5 28b581a3c36c170246bd01a1089961d9
SHA1 72bec526f2716d167ba74d0af773f04d6a680a00
SHA512 f96bf1ea18b452949bcf57b744eb0489cd01c83440ff75991e46499779e04bfd67ce993ea7e9c7b5e38c943fad353b5321b61d034625c3203aff25c6d54e9705
SSDEEP 24576:O3ad9CHKy7GZwYgV0lde1tl31OBDTwlYnTekwp:Qad9CHKyaqtV0lM391OBAOn6kO
TLSH
T1AF85CF90F3E814E8F0B39A3589769511DA767C591B71DE8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 054668ed22c28169428e0b1d6814809b396fa620a4c96fc9229aaf159682f132
MD5 9dbd3745c985ed18a3d99c4711ac2d4a
SHA1 c3cd6ffa2d7440161a3e0b6d9285b181ad09213e
SHA512 986f4aca71878ff101acb466f8456ae6e3ea78130afe580482e50276a3e35fc676bd850dad73b2fa55fd05fcfa63b87d0e6aa0012ea89f6f7a9fc1997819ed4d
SSDEEP 12288:2UQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:2UYgV0lde1tl31OBDTwlYnTekwp
TLSH
T17855236F611E05E5D1403136A1AAB1207625BE9C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 485116eb852212d470758427d5a84df3880708fd77331dcd21fc1259cbecda54
MD5 e8f3c3a990a758d03d771919426b8668
SHA1 f2efc32a3d77d2de925c9676d283f6ba2646c9c6
SHA512 94d8b0a4f488ccf57d1e636ebd6e27872bf3ce408962e6adf8562a4bae3b4a85a592f72876c62103d826cc310eb2d6ab9060c1059deda66bc1e42514b01ce6d3
SSDEEP 12288:OqQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:OSYgV0lde1tl31OBDTwlYnTekwp
TLSH
T1ED55236F211E09E5E050313661BAA1207615BE5C0ED49767B24F7263EE36F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 2722be02bebd1daa87a266aaa8c2df26ec9afede61f9a8529c7588d57f42f7d8
MD5 e87063a9398f8e806ce0b97af4d604e8
SHA1 431ef5259f323677fa2a9ddea3fa120b29b1669b
SHA512 444e572359d3190c671141336baff7f0a797b8898a0cd0de90ea655d640ae5edc6885c1ab81a4708fc17591423bb38eb9ab194e733931e9ce063b40f81bf8ad8
SSDEEP 12288:aRQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:azYgV0lde1tl31OBDTwlYnTekwp
TLSH
T10E55236F611E05E4D150313661AAA1207625BE9C0ED49767B24F7363EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 51fa36133895e6829ad16be158c56abd56005a004110f1f2e9b695223034880e
MD5 3e99b990f41c9f62625722fac03df3f4
SHA1 5d56aa1a8cdca7a3c7bef690d21b1a77974f55d2
SHA512 d19c9bccf653def2d66fd0be693c8f52be96ec9475594965076d123e479014a8a3cfe4efd802ba9212c6944d4f7d3fa04dd5016ef79122b7eef625d4c58a2ae4
SSDEEP 12288:IjQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:INYgV0lde1tl31OBDTwlYnTekwp
TLSH
T17D55236F611E05E4D150313661AAA1207625FE9C0ED49767B24F7263EE32F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 d11bcd51f2efcc978bf1a9522a99882aa6a2d44c088cbd4b96a60fbd70389fd9
MD5 5ebc08f41c915a7c748eb955a3dab538
SHA1 2a518b251eb207b868e7ba9a1521bbd95cf81268
SHA512 de9b9b8106fe63c8e42f9d561f4fe0d92baa123603bb79ece14e41a40b80f02023c9b05b9668c58c60976970fff5ce5a8d346cd54d497cd7fd342a5b0e438029
SSDEEP 12288:dUQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:dUYgV0lde1tl31OBDTwlYnTekwp
TLSH
T1BD55236F611E05E5D1503136A1BAA1207625BE9C0ED49767B24F7263EE31F68ACEF3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 0c3ceafe652673a4fe7d97d6a43c1ead2c8b0c0740342aa6ff07b20f4fea544f
MD5 ca5f1779d7bf445637e6ae0cecc67941
SHA1 0b639a6722c5a5917311c18425d2e9d0b77cce8e
SHA512 dce2cfbe465875413b3b0adc9944176c543327d2da6b174942c0b63b36db1245d7f69547f7d6c4bfe1f117add22397e408af35420b6aeb8241d1bc7ea37412ff
SSDEEP 12288:OrQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:OVYgV0lde1tl31OBDTwlYnTekwp
TLSH
T11655236F211E09E4D1503136A1EAA1206615BF9C0AD59767B24F7363EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 25a80698511b41586a69be94e13338024ad1c8fd4ed265e0028141573bca5f04
MD5 ab725e3808929ecfaf26d45cbd4ab12c
SHA1 356a9040c4201961c37f94c9822200ce729ed363
SHA512 32ed0f119eeb3c372dc58c0b80921348a2005be58172b3e64a464d4b0c2c1254973ff5842da9e346614a33a6a0ad2519cfb6145befd82b4b1f45c1a072d4ea2e
SSDEEP 12288:7dQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:73YgV0lde1tl31OBDTwlYnTekwp
TLSH
T11C55236F611E05E1D1503136A1BAA1207625BE9C0ED49767B24F7263EE31F68ACEF3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9f6e2f478ca5c2a8233435bad7f78fe46c4629f6e52891b29e5c44ca61a1d4cf
MD5 5ecde71fb94e3adf650856cdd0f8f775
SHA1 e75fbc4a85de27fa9a8f30e6ab2e38a4e1d3d788
SHA512 b38d28457d04bdcd2bcb5070374c85e816315e117787d5a180e6ad8be5292e5d84669267cf48ee05e7c6b600fb24e9b3a088093b4ea38728f16b4f30d931b24a
SSDEEP 24576:bfwv4k9RX6wkyAIBYgV0lde1tl31OBDTwlYnTekwp:9MnYIBtV0lM391OBAOn6kO
TLSH
T16C85D029EBDC44E5E1B7923C99B7460AF6B178580B31C6CF125A53AE0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 deaf2667dd1cf6766252084e2d6921a4320b70a2155ef99d1149f95cd2e35aee
MD5 42c58f41f57fd13dd9f6a262e955fa37
SHA1 b4524e2f3833e94d7c21aaa5a4ca76574dc914bd
SHA512 5e728d68afbfdcf5b90d43ef244827a39943cac887c6235cbef03b06339e503d8f5521dcaf30d4ea1edb9e7fc7a723151590f828045ae5986ecbc4ac6ac229ff
SSDEEP 49152:0YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YtV0lM391OBAh:DySzPy0lO180kO
TLSH
T10B066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ea0fa64c09dc9271cb5a32ee6c78f9edf9a783be5baf86c8d3876b6f14c3af54
MD5 cae611bea4713a3709575458767a6531
SHA1 7035ae60dbeb3846d62ba152370d700d9329e723
SHA512 e0164871d0ed60166648bf3cc2e22a36710ed7b86ff1422202e113b45989cccf25fdcef8cdb353876cdd822c491f928a1a33ee63e81c335bd08bf3e9efc3d06b
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY+YgV0lde1tl31OBDTwlYnTekwp:n47JUQjTirIhCnDHUPfF/otV0lM391O
TLSH
T17965AF1EA3EC01E5E1BA927885554A1AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0799a0ec79c41588bb790f5d6ce88338de670238615d67f54340e5537a9848d4
MD5 13a7d2609369acf93bdf8988f0934b2a
SHA1 d1e1df687860bd2a74a3fe44e98cca279d767e63
SHA512 0ec0ae13e1ec45f98aca553e056f3609298ae4ba7db056ce981e012523ccb5ac965e0c062d622bfce8947b0eebc7047c89a4d959b71ba979452fb35a75e95d0d
SSDEEP 12288:lvsfTQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:E9YgV0lde1tl31OBDTwlYnTekwp
TLSH
T16965F11AD25802E8C06E6279C7969601B3337C6847E1D3CB63C1F67E1F36A949DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7ed9ba2a66dcbf68cd59e4ff47827fa4120f9c50e0924df5e62947588f22d5bf
MD5 33bdb603329406fce7bc8dab5ea7b6fe
SHA1 bd2a110ec0ce3e360545124d2093fe369faea05c
SHA512 289e241ce21ae76b3cae0cc0839969b5c7a322ebdc975f018a2776dd79b1adf58e5402b26053b749765fc847ce929d0ccbadbd91e765dce0bc9d4cd3cc13470e
SSDEEP 12288:ujx9Wy5I91VwXZIt+yJBlFfrt5wXHU5qKWabgkLWsUXGu:uHWN9NI3IT5b8sUXV
TLSH
T144352811762AD75FC6A940325E37D1CCAB707D01EE456B0372C88B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 61d95476e6cab068701df95e1f7996dd52a635dea4f2c5ba11d4a25e12c92beb
MD5 6210d0ae52272827c79f1702a04d023c
SHA1 a68bb69de64c05cb5df46b312a6aea220021e2ff
SHA512 fe2332effe58efbff50b26f7b52a57e174752d330b3aaa52c816278e8bf692f4413ee08c5e9be5703a327abf9000e2d4b3ef1ff9d8a639d886a3685c2f87ed99
SSDEEP 12288:z3Yt+yJBlFMt+yJBlF3t+yJBlEnsIjcRBsIWcRPcRCfRcRjb6/vz3nTzsmoO:LakVzsvO
TLSH
T17A65E881A137A38FD0F76032472A9B4DA774EC06B7096F2673C8453AD86A755B4F83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 7b8557e3ebc03e92112d67489b768a3da42bbc2802ec7acc160ab990e9c03116
MD5 f35645e813f76d467e639e2a00d4bab7
SHA1 cd4414c320fce51dcbd2e7699935e21a5c07ca9a
SHA512 bc489fac68aee6e9cf65f86c8410062a1cfd0f8b814329b684a4f95aae3e34853892137d0959e24a18085b441bd22cc563bf068aeaeb01a7588602d9c2c25410
SSDEEP 12288:OZ7bQQfYgoBYGW+Bld1HIt1Jf6mWM1OBDTAbZ46YaqnTWZkwp2:+FYgV0lde1tl31OBDTwlYnTekwp
TLSH
T12755232B621D49D1E470363561AAE130761AFE680F84D6E7B10A7396E931FE4DCFB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6ec89ce0004310e78cf0e846539e2fee1d043e049d000cc9c65774654821434e
MD5 51905dbf3298c1e1979172d023111ae0
SHA1 80f40486faa0108f5024ae6bfc7c3cc7983caabc
SHA512 3c54c18b7c114dfd7f9e7438cb61cc2993ee8593eb9f93b3a77633e4c166d8156d1c33ca2932a84cd717a4346b31408f2922e71fe87925d14e94d4a826de3ce4
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYrYgV0lde1tl31OBDTwlYnTekwp:4gb4mBIBhGF+tV0lM391OBAOn6kO
TLSH
T193659E1E22EC02F5E0F5E2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c912e08ecdbe699efef8657c2e1343d43ab32fd7e1b6819d9115f34be0ada22c
MD5 644ed818452e96f801811403e79f12a0
SHA1 87dd0aca552aa3a535bd12aad45019977efdfb0c
SHA512 5d15252c9cd8858a0e43c07cd3d301ce3ea54f2e67be984d71d28ae7278dd158be002dc541bcea14140ad2e88276f0983062290f2679a06f7b7574fab53f4eb9
SSDEEP 24576:SG88u8FpJqH1nzria7/muYgV0lde1tl31OBDTwlYnTekwp:J7ZFPqV6a7/TtV0lM391OBAOn6kO
TLSH
T1E295F16572E501F0D477E13889864663F6B2B8250364EBDF06A88B521F33BE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 359829231d1c3a3cbcd282627248c131ddbf7033ee7ff7420324868035e2fc14
MD5 d7e7f00226806a16dcbfc9fec7c890a1
SHA1 71509a43f91296fb2d1fd4c7faeee4eaedeb8028
SHA512 0617a8e46f2c1c8381c08ce5e3ac5a5cd52ed39cdf7294cb2e9df1089bfb1508cf1a2d55297fb959911f035815cc9673704ac29c0350ef87f4a42363ca579b09
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjatV0lM391OBAOn6kO:7G05lO43bh0lO180kO
TLSH
T11BD5CF6E62EC11F9D0BBD17CDAC6460BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 380ba2c2a4380870d24049da163f8df147cbeb1caf81870ade462abeb582e24f
MD5 5a7ff5f698da820172f9aa3c459bd27a
SHA1 1cc32492015e5499a1f3b3708181ab6284cccecd
SHA512 db11800fb240089fa8a1558c4d7028c725722cb3cac220535287e98f7ee08eb1bded3d0256489b69373fed4d4369f811c23d9a237c18a62c434fe7c383ed31c8
SSDEEP 24576:Bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnYYgV0lde1tl31OBDTwlYnTekwp:Ba5POZ3BJt2pasx2+mStV0lM391OBAO8
TLSH
T17D65BF5EA2FC01D5D1B9D17DC583861AF5B1342553329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9cfe3a94c196d893e773c5d3033cad870c712a99775b9924f64fc32679905b8a
MD5 3cbd92e061c17736baeb8423d694bd2c
SHA1 0b004df88c8f0b309853f0acbd658c31439a5b3b
SHA512 fcc34da4a91b244f0a550582fe37d11159ae2e73880fa4955f492088d180ff185cdb95c26d13f56e69c06f6b0dbf94613c7c168135b2d494e9bbbbd909577fe8
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkGYgV0lde1tl31OBDTwlYnTekwp:tNc/zEOVHFztV0lM391OBAOn6kO
TLSH
T1A9857C2623E901E4F1BBE1BE89779546FA71786517348ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 37c08b10a6ae97f3237176bf84226435378d5af439dbda0f97a2086c2f689308
MD5 ff5e48c28ffb5b15dbdfc7d60dc0ea8a
SHA1 896f0defe9dd548030e7e51e75aa1b25e83f87fa
SHA512 e20206a981b6cc818cb242d7fafe6ca50747b759e6121d1722c73765f546afa02994d882be9860f7fd8fff15e553b27836c582d2e9d0c25077488dbaa2720286
SSDEEP 24576:7TkNvNnaFeYhJNtmZBmzYgV0lde1tl31OBDTwlYnTekwp:7TMwBtOmztV0lM391OBAOn6kO
TLSH
T15155AF6EB6B806E4D1FAC6B5CD238512F6727861073293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e45f9f4e8caee55eb2fa2d3bf854277e90aa2e49176f7a411f905d62045704ce
MD5 1b8dbbaef17f2862140c3e1859bbd880
SHA1 800d9426f3123cb12a24ceb8b5c739a1c75b6a37
SHA512 8787d216a56f0f8b7b7b6c85f3e002730b331251007b9d0578fd6f19a2619230738872c1f755b729968ae94e8a80cce93cf8e6a7174c7f77915be5bd5a02af43
SSDEEP 24576:IPUr+NQqYgV0lde1tl31OBDTwlYnTekwp:IJQqtV0lM391OBAOn6kO
TLSH
T11A75E12F22AD18E5E676A17D85868219F772B8650751D2CF02D1817E5F33EE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 f1c602e39d19f310869c7f2e771afdad4aaf371d019a882cb70f418e1771bfdd
MD5 3af7362a3993d167168fa4f066862a6d
SHA1 f00a62c958b701430fe259b5ff0c8b1482bab600
SHA512 ef728aea29c647cae8401e06c07808b0eae3e6f2e1a84d30d4dcd94537161092e3958cab3a679a73ffccca9b470ffc7df0b569b2e1065b0f1a40dcd149dcea61
SSDEEP 24576:HD3FHshBIYQgA5YgV0lde1tl31OBDTwlYnTekwp:HDVHeBIAA5tV0lM391OBAOn6kO
TLSH
T1C285E13EE65C04E4E47AD1BCD6638606E77138AC032266DB129491B65F2BFE47D3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-118-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1020-316-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1020-124-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1020-117-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1432-51-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/1432-56-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1432-54-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/1432-49-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/1432-43-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/1432-42-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2052-298-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/2052-77-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2052-69-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/3200-139-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3200-131-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3200-137-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3200-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3200-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3332-0-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/3332-15-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/3332-13-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3332-9-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3332-7-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3332-1-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4340-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4340-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4340-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4340-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4728-82-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4728-312-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/4728-87-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4728-81-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/4888-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4888-24-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4960-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4960-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4992-332-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4992-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4992-99-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4992-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4992-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4992-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5828-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5828-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-317-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5828-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6068-58-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/6068-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6068-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6068-281-0x0000000140000000-0x0000000140189000-memory.dmp

Download