bfb3d6314b5f8d40688f45a82af6848279ae153f4fb67bd0d1e3b9ac1397df52

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.0MB
Sample260804-rr9vxay1et
SHA256 bfb3d6314b5f8d40688f45a82af6848279ae153f4fb67bd0d1e3b9ac1397df52
MD5 b9361a2b44a0abbc850a7344a97f92cc
SHA1 db409f720adf139d00f2a009e5f89e390b4974e9
SHA512 c9618d9ca34ca31ae2f6013e474a7d0aba3ec44df94364ea10f450c2779c494aafbcef520c60d49e11998f11601bc5a278797831c8b53a77c697b1ef56aa2d8d
SSDEEP 24576:nBYGb8a9t3A6nzSp3fJ4yL/tNCJPXUQrPP:eI8UA6OfJ4klKXnH
TLSH
T1C835E05663E400B8E1F7E678C9A65902E77B7C460271DB8F03E891772F772509E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3392	elevation_service.exe
4724	elevation_service.exe
2028	maintenanceservice.exe
2816	OSE.EXE
6080	PerceptionSimulationService.exe
5144	perfhost.exe
4208	ReFsDedupSvc.exe
2644	SensorDataService.exe
3924	ssh-agent.exe
1692	AgentService.exe
6124	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7c6f97e5209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d3db4561d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005df61d561d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf789f571d24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feaa0b971d24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa2d10971d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2984	2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3392	elevation_service.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1692	AgentService.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: 33	6124	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6124	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6124	SearchIndexer.exe
Token: SeDebugPrivilege	3392	elevation_service.exe
Token: SeDebugPrivilege	4724	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 1964	6124	SearchIndexer.exe	100
PID 6124 wrote to memory of 5356	6124	SearchIndexer.exe	101
PID 6124 wrote to memory of 5536	6124	SearchIndexer.exe	102
PID 6124 wrote to memory of 1200	6124	SearchIndexer.exe	103
PID 6124 wrote to memory of 1040	6124	SearchIndexer.exe	104
PID 6124 wrote to memory of 2932	6124	SearchIndexer.exe	106
PID 6124 wrote to memory of 5852	6124	SearchIndexer.exe	107
PID 6124 wrote to memory of 2772	6124	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b9361a2b44a0abbc850a7344a97f92cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2644

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cfe622673b3c9e761053399ce8c92f7130241828db32c23240398f4049a30ac2
MD5 6691aca9e095d268320821f1c9657e9e
SHA1 2532f8870b88c4031d208ede9d10b13738728b8e
SHA512 baeacf6ec49a67fabb0e023b50ab6be3154f51f2eaa463cfa760d95a04abf2b62178269b0ec390ccd7f091fb581e8aacedc69e60a49a1fdfd3676bbb891f987e
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEfJ4klKXno:i3q6HjBLfJ4k
TLSH
T121D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 83f61eeb40f1a3e75f7168b8c4781ea72afeca5ff225183d4fa51c9884bc1f7b
MD5 7cbf6393e9475ab4cfa818e51ae1bf47
SHA1 1eecdabbc73ee793a9bda069ae470f7164453a40
SHA512 240fb860b287004473bee13bda5473e26ceb117b953aadbedbfad4b16eb229acfd2f9801255969b1baa955eb1f67d16545e501e82105ae3d51e997a61d54b712
SSDEEP 12288:T1XLsswWkxy2lRq2czAPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:JXYfDtczAPfJ4yL/tNCJPXUQrPx
TLSH
T1E505F12973E008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 712f2989efc70144b0aa0cadc3aa3d042c233decf34baa5861a864cf67dc94e2
MD5 40d75b19c6fe2e71ec303cde07bfec14
SHA1 46a0b1430025eb2592f8213d5ced6d82e6810d51
SHA512 0ec07b349ae4c664f2b92c0db64dfc34b28c99243cfa0ecb01994e64279fc3135200fe33e6101df72f55e4247d48340e9e787444897182334d648917e15ae4d9
SSDEEP 24576:40Le5ji0hmxirMMfJ4yL/tNCJPXUQrPz:4Pji0Ac9fJ4klKXn7
TLSH
T19435AE56F6748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e1a71a2cd319775ea3af3ac164bbc583f95de0e7c2389478053d3e9e50db930c
MD5 41ca7024128c5e35429b546b3a3c3fd5
SHA1 a2ffbd2a13dd150bab7e9f0a81173eec26b88ec4
SHA512 e3b053b27eeae64726748aebfcf2900fa7877bb4b3b479326a55df04ed02279f7ddaa2494b21f3374cc843285d013ba701f90fffa3d226471e96282646fb3288
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWE6q8wyuWfJ4yL/tNCJPXUQrPa:X/ezSC6vUzPvxHjyRfJ4klKXnC
TLSH
T1D1756D15F5788323D0B2D0BAC5D6BA99FE3230865B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 16d24c306187f014141dcf0682f0a42425e62dc8ceb5f92001a984a39b373e6a
MD5 2171e9d2263b97c0740fbc568df3e187
SHA1 7e8156c9f83300d265d16f1ed40db776ed6b5054
SHA512 ad4d508e42bccebe9059e675e7cdf92486a24c903fe97f7878188b77721edda82fa3f31788a258581be94a4316b4b351b2bb138d20fad7b7e91bd67d7a7ba4df
SSDEEP 24576:VVbqPb88hv/l+6bfJ4yL/tNCJPXUQrPX:VVO88hXl+gfJ4klKXn/
TLSH
T19C559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 03e8883e702861ce15a41c1f019a3b6823c0ae22ec05bd89ce5ac35475a62879
MD5 48b63bcc7b98c9d2c7d05fccfdea7da2
SHA1 ecc61ddc95c0f7fdd0e452c12321bd8ac36e3741
SHA512 b2627dfad3215ca113eaaff27cf7099089036f5dbe4229c36abaed2245d1c69563587de81b4c911a8cd5fb0d3372e28e2807edc81c44a379b88f52ad31df64a1
SSDEEP 12288:qR4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:qR4fJ4yL/tNCJPXUQrPz
TLSH
T1FCC423E751C49485DF6A87F82A88F001C314BEC5562FA2E6CE43B8867FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 db89c233b9ecd537f976f8c51fff4ef23086f7dc05e5a452820bb575d118dc6d
MD5 8b5f36ba2d8f7cf5e5a9e3732a8501f6
SHA1 c27908597a548c8dcd2d2f8f5922ec8dcc58e7b1
SHA512 b5ff7480c75368144082e7d0ccb190effb8690bca23f04eb69df649d28decd2dea49a59018de3ad649e4905576b4f12c7e343d4f68ab1b8affe17a9272eb194f
SSDEEP 12288:KeBNUbTVO86UDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:KJIUDfJ4yL/tNCJPXUQrPT
TLSH
T13505CF7BAE28FCD2C67E8DB85B90C200D77278704B22A3CBD165820EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 38c9b5993c46022b697efa8dd738e6ad738cc0cf015f100a80ea27e63cf051c4
MD5 48cfb37238cc5bc8fea289d976f9d134
SHA1 11b0f1f165d3f6287b5f1c3107d44cf7d6c4072c
SHA512 b7cfe9997cdfe2281b161219a33b3c8927ab301d744f9e9a5446201dff2236360b889f386fd6b0352c9e5fea6d42fdc7277354a2dcbe365289ded7ba294e3093
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:vQvGAdlCEL8c/yRNw5CmfJ4k
TLSH
T191266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ef7bd412472f7a21870bb283cbb86a3e2f172da59e42b0a5f06b35488f35f897
MD5 55aed130405d297b3d90c0a2df66de9e
SHA1 8564ffcbcd792ae204ce636c879b2df5fa331b56
SHA512 d2e1d9baea9f6d206bde4b3a57096791f59a11337c8d8d40a3200a2510cab1e8aa2e3b67532a4ef7b25737bed6f12f4a2bea5439638b2d894e7c3f5ceb013ca8
SSDEEP 12288:nAwSfxL/2Dc34DLLmt0LDQewsAjNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWU:AdewsAjNfJ4yL/tNCJPXUQrP6
TLSH
T12715E031FA74E036C77F0DB51B25D306542CBA604B621AC3E3E89D9E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db2e0348a16b3b508dc66d6be68cfd5725ef38d9436ee3fe10faf0c0159b983f
MD5 f3b67945609b1eb857383230abea9756
SHA1 48d966db5b64ce8d34dda108bcc25b2937ee7e0d
SHA512 a8d387545f6fa1c6493d91ea6d35d1b4bec35e09879101b3810487e658f0d192629efddbb10628902c2444b617bd6b40700df0fe8649036a7ade7e992127c192
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFfJ4:HUEtQevvqc2W1cpV2EI32F
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f1eab71761f090cf50e84e5265ef42bc8230e9d1321b275a56dd97b67c46387e
MD5 e19998ec8d0677e9bd2e3d1405f4ef8b
SHA1 bf754531f1c399961b86c73cb6b6588e1017d5e2
SHA512 90fab6f68acb2fdc674eb40f8ee4f22dbf002bbf8c886d65f50e5896c7975651c93a884e365bc4d2e5c6011d458ac21e55f98ce0114f2c116d4ce300c8596147
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/ztfJ4klKXnx:+oqHVjnm6fJ4k
TLSH
T1A5D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a1a7593fbbcb99e27903f39a1d42fecb54705b0867e7ee9797a07c6a6bb41326
MD5 65b4cc707d68dcfd6cda9a9cd8afb975
SHA1 d082098d309e693ac0974000d4695b048a693031
SHA512 9cfbd90047482ab0d96ec6005d72f99349f7673368580e09d45fb356539122c95fb8e8ddaf8995cd3a48c4ac76af10129bcd966d632ce37d4fe93c72f68cd656
SSDEEP 24576:rAhGLJIFoiwtA5l7S53afJ4yL/tNCJPXUQrP0:rAMyFoiq5KfJ4klKXnc
TLSH
T106359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 464e1853ddd45c1b38aa0049e4022bc76283e151f9c8b3fbe24577895916900a
MD5 4297c6d63f9d48427d76f4bc52e07017
SHA1 13d1c0e3aa051f3f81d78e3b45683b635f1f0613
SHA512 d8140ca3c014af2d64106b5a3111daf0ae569cf615160953a8a21d77f14dd6d70f1ed52ac353a52a490cbb1300195b23dd31640c88be6317c095f704fc5b07f7
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+C2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7:jwuoOWxfJ4yL/tNCJPXUQrPH
TLSH
T18B05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 916fd7c81371c294d36860f45d2fe472930746245ba9b60ff9459a71f3a51de9
MD5 c43a9ddd5e3aa717b64933f53e892538
SHA1 6305e63a82872ffc4d70ddddd67380f4e73b4376
SHA512 c0d3679e125a39a8ead2a820b47ce100268d780dc3c42a56885b413753a6366bc6c7f4a7024fc6e7a3e7e61d4bd6393d9f390ea6dcd7fc3cdb63d2d183595b39
SSDEEP 12288:2BZ1IydfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:AZuUfJ4yL/tNCJPXUQrPs
TLSH
T1C2E4129A32D460F9DAA782BC89D4D101D3317CD2233A93CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 67626a644ed0ca4a546025da7caeac03bf9c57a8f40ba2d25bdba18234168893
MD5 401f3929d39dfb9a40e779c0e2ccdfb9
SHA1 49ef47c66cd59aa5580eb66d7f051de6f6fc4ef5
SHA512 91f55d8a44a863b3b79acf403d75391e22e98dfdd599744814c9bc1281d7c8834498ca6f2657af9de79b90a66d1b7f384c79ae0f213c5082ad50601e71ef199f
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:aQRQyi36YOcPQLvw2gAf+PN3XfJ4k
TLSH
T1B0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c9c2e48e361611a899b0836f51f10e4dd0f0d6c279b1a3426120bdb705700d8
MD5 11b9919fe09c15f87f1b91165b3e3d56
SHA1 43ace2032053406b9e80d8e58ae8b739a0397e6c
SHA512 e3f9e9caff94be34c9813b9277e6c9b4b51b1cf4557b7c03790352954c1d8bb66aec5f1272c18b65d8146a7025c397f4cd55a5142494f3eed818a15c5b8eaad5
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:oQRQyi36YOcPQLvw2gAf+PN3XfJ4k
TLSH
T1B2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bf22b9f7b42b581fad04a24a5333130005931910690755b582801b55f023f6d9
MD5 08d6904032ffa2ba3e302c2c4beeba93
SHA1 461b9ed844abc58f9cc801146415cf3d1f76e489
SHA512 fd8089e3536212a7f83c0ce94d487785da23c3da8d6fb0108ed5fc8f7167e9960bc22b4c20af1f2fd361332a0d3f6099b491a338a505d0fc8e22a05135e13b13
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0EfJ4yL/tNCJPXUE:W68Qg55nhheWu7PNU3/9fJ4klKXn9
TLSH
T1B9B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 120df7f8704c466af51f82ec71e10a752d7ede27fef446330e8f081f444f63c8
MD5 506bc2b0b0220428a9671ae8aea58182
SHA1 39f356586b00eed597b2c2cc08649ec1abe436cc
SHA512 ecb62785efdc560d5758a9f53871938006312375523500b87aa4d63480ff8a59893b9d2ee7914b2168d9254ac98e8c507cb16b49bfe297164cfaf48efe09835d
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:8y5112gYy5azzVvL69nLKnhZ4fJ4k
TLSH
T15E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f34f0c35adca1e96f8a449aa551f361959599d90bf7b4d763818b00ce7555bf
MD5 a7fe1c5efbe7ae20dabbf58065df620c
SHA1 b87adb5a2175ba5a94e20e67a309491c327c9b09
SHA512 01e5a48070bf1ef9e143f9bd6d0dcdd37579ab13f2e1dd9b240785662d9e2240410853b372aa5ad1cb7f150bc8a6a1e323938c96039ae57d8df9c55599b5a9a7
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkfJ4klKXn0:/u6JmVxd2dkfJ4k
TLSH
T148D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 80b8ff97ed558fc5adffddf121dd89fb5085848e2fbf494b3ef916f96d4a519a
MD5 dc60a01f54d1126fe9add070143faab7
SHA1 be45bd746f67cda188097b6a4644a145817f7003
SHA512 0167670f3d7fffe71ffbfb97a531ada8480d23bfc0d0c0df5c609a28e828dc8c17eaa86709bf2858548ea59a2654fa5c44bc99e448684d23797d5e3540c04f90
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xjfJ4klKXnI:fmifPbR6fJ4k
TLSH
T100B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3fce7bafc23cfc90f59ec943c8b96c3b8d334c9a8e6ed0f01aca909d165db944
MD5 293bcd0cf6f8e18a46da7bae47ecd355
SHA1 65d58c6e54e4d5fc6c138a47a1dd6556473f18bd
SHA512 c6d01db87a061c7dc6ce30fc4a1e6bb11306ec9444e4c6173d4b497921de3354ee0041d09d306b8f9c7b8d9854f0f7fe800868f4ed3c25c30da182c8e63ff28d
SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqUfJ4klKXnU:z5dKTi61UfJ4k
TLSH
T13CC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0e3475176c1ddc7763fe30752c28e557b53d743c5c140692bdf872011c40b613
MD5 8e428d9d26ee1ba72c6fb3ed5f0dffb0
SHA1 9c53f52b2d673f35ff3c433a0cabb22170da4e2b
SHA512 78d748e3fab2474f33ba0e569ee1d4215f39efb39c8f887b0963d236f4fc541f3611f87e160b2e6cf092420db0275e9d51b2d7c0efaf286efdb6130e89730a8d
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wPfJ4klKXni:YX2iyphefJ4k
TLSH
T11595BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d12875dc1b3710cea7f2bd5cb6dfd2b15118fd4b74ff024004af1ebb767a1748
MD5 c5d88f8d4b6b0f04d58ed5eaf83a6afc
SHA1 da25842f580a355d642bfbe3d5c0970d9f171d3f
SHA512 9be4469d638a88fccef4e37472ee4489e781030aad30dec53ee0d97307f6f9d2010f0d6d6053c3ceba25ae36559c7e1ba2951aef2ee550338950b2929cbdf8f0
SSDEEP 12288:fgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:fgfJ4yL/tNCJPXUQrP3
TLSH
T122C423EB60D5948ADE5587F81A88E001C3087EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9560cac2a44c0b4e982da85580147736b8768716a01f4bd0feae95e898d17fba
MD5 5c422e66157e04e4eef4b805666e0ef1
SHA1 dd66d68fd9e5a1ff2c63b9d985fed451e72436ae
SHA512 71510e1721fc001247c2e966013a0c0034bf6f0e5279bb1df7dafb899ba2275b80e6b76f5324370c0b3d5549ad18b2881df303757f7eb23f8e417d1ba2d75467
SSDEEP 12288:9JfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:9JfJ4yL/tNCJPXUQrP3
TLSH
T16FC423AB60D5948ADE1587F81B88E001C704BEC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 45ddb3bdcd38f6ca6096fdd680490a9520f59b6c89c9ae3ed11d6233cd341836
MD5 7341aaf76f9b46687cdbf071acf1f8c8
SHA1 9d684460aa565ced46284e5e2fc4b3b320caf11e
SHA512 5dc8929c23eb0a412c86270d25a73a4bad5985533cad6dcacb6012ed3f020004ec82a02938ca63326da191378c6cfb8a525a67274d4ce9534be037b80d944ac0
SSDEEP 12288:XLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:XLfJ4yL/tNCJPXUQrP3
TLSH
T19CC423AB60D5948ADE1587F81B48E001C704BEC6672F62F6EF83B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4a27f3865191fed0083b0b1c5dd4b4b1e4c61afe676eef3b53ec1a74a7df3e22
MD5 3d5a06a2ca6f666902f7ebf56d6863cb
SHA1 551ee81c264ad4c0fa906b7ae8db0338aa8b0bd8
SHA512 507961b719829d66b22a964c28b3ef60a8ab3b43b31a0ae9946d3bb15107e33014de9c13168b675906137eab983ee2e68329c5f9ace288e2909a21fc80a7b4d9
SSDEEP 12288:FV6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:6fJ4yL/tNCJPXUQrP6
TLSH
T164D4239722D540C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659296C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4a3de2296985589695aaedb7de5876dbcafc4e409133996477600b26acd2beb5
MD5 484d643980d9e74e2856c54011039cec
SHA1 0f4876bc6dedb26f83c7b0e87b9623e4f6f39b05
SHA512 782b02a3f63409193bbaaa4dc80912e7f401cc2fc1dd5ea89046554fd2eb1301775a8d66c62277cb814778dc16d29b15b5502e7e1267a9a48775b9f648915c0d
SSDEEP 12288:iSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:iSfJ4yL/tNCJPXUQrP7
TLSH
T11AC423AB60D5948ADE1587F81A48E001C7087EC6672F62F6EF83B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 71c18a37281b0f6d62590159417bc8112bcfe0c5eace79cc580d7e2db5ef7fdc
MD5 f8a48f35a48d3e35f7d12c4e0ef420a1
SHA1 e66a0c5be8e930089a0fe3cc550f1447736e8d76
SHA512 cb7a8adb1daebac28b1773af1067a5831e4f2022b3cac71df47bf3f72518ee6f7fcdba9cf4851dfdc1c3fd7840a157e6e202a329279dee84080893cc85738062
SSDEEP 12288:PVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:PVfJ4yL/tNCJPXUQrPl
TLSH
T1B8C423AB60D5948ADE1687F81B48E001C704BEC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1e736767f5cf67d284c2fdf86ce580bafc695c253c856547d9a96f3adc005e2d
MD5 6ee2999f7cb6797c14a6f9e3790b0c94
SHA1 372b54697c523b855c1784de2bcf66c79cab6f59
SHA512 dbcf6fddd98120ffa9b5eaf3bd71352f1f8755ee803a7d4fa51c9e9985f5482a42525073eca0ce1e718d8e3eb39cff2548238a69bd8b70c4ecb25d5c546c613e
SSDEEP 12288:VhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:VhfJ4yL/tNCJPXUQrPd
TLSH
T168C423AB60D5948ADE1587F81B48E001C7047EC6672FA2F6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 79d0bd91c2cb1a7d78d42a7eea862e7c623a317bb3f209153627743a917d4e2f
MD5 23cb88999a7d19d4b4ec3fbd99a2c6f1
SHA1 91c87ec7883b931ad217b55028f051ce09ad416a
SHA512 ac5cb73eb5fdc9499cc490a79e8cf46fac65514b5940a72c4ed867593cfdb4185babc8b5f1301a17f1561a683cbba018f187f51855d1cb7ba25a21d1516809d1
SSDEEP 12288:iiZwb6zzFEoS2cPvypfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:FZMSzFVSOpfJ4yL/tNCJPXUQrPf
TLSH
T1F30501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c5b54a39eb695388c0f06c4197ecaaf12701edede66565102eadf27cf2107de8
MD5 2614b40d778f1c6488332c0637105143
SHA1 d511d0a033cf7a2e59259523c234a3faf8720de1
SHA512 37c411d5867400d9d91c3e0c949ee57a3f881e393e5289211a4b54018bcea99dc7ce1b5743d993db2126587b4e71e3c4b7761f8d1bc4b6fa6f9bcf0d4b2bdf3f
SSDEEP 12288:NkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:NkfJ4yL/tNCJPXUQrPo
TLSH
T167C423EB60D5948ADE1587F81B48E001C708BEC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 814ba59fc612083442473ebe6d6869bfffb96e162396518dcfb7227fcaf5b24c
MD5 f8e9d9afae7dc3de4f166e7a91270196
SHA1 c9606bfdac46cd835f2ab13606cb7112a2e5c641
SHA512 8971bf21d12d174c7686aeb278400d261d48876aaaad4ad45b99d10c878a493f024dbf5df50c4047653f80a071de3f0f93cf6583a73010e9d428a28b4001439b
SSDEEP 12288:GIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:GIfJ4yL/tNCJPXUQrPo
TLSH
T1E4C423EB60D5948ADE1587F81B48E001C708BEC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1feacebd28c228c4c6d8557883e4c9e5ec4f3b993d41c91820b3579ffb3bf344
MD5 dd8a7e0cdf4d5e7a6a906423f111ba57
SHA1 cbf33daf005464d44a5242b04ab77c1390f2578f
SHA512 f5a70cb4f6c53239c5880936c83c5d86ddcc331d9020ab7bf8ee233245546b539129d9d09b7f5faefd4f8db6363d4fc26acc79d7be0e46e4071ca1ebe2412082
SSDEEP 12288:SyPz5L8dfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:PzydfJ4yL/tNCJPXUQrPj
TLSH
T16AF4125B32A130F9D536827889909502F331BCB2072597EF5BA046B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7ad21865c56f1dc5fce9a569ba734c4d70db3555d22c683edbf35fcd5f39fd6a
MD5 44779677e0b4262a1e104b1b143e230d
SHA1 289fc4389ee20afda171ca8c0b79b8023071561e
SHA512 788c1341043ee12bfed15daf4e928003c8302313def70221dbb8b67dd8ecd5425066e359bd35e46324186f9e94a276d8f21fa38febfaef7c268ea7ea0d2991b8
SSDEEP 12288:8kfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:8kfJ4yL/tNCJPXUQrPt
TLSH
T166C423EB60D5948ADE1587F81B48E001C708BEC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4aeeb414474232f0c5606d1d2ac0fadecbb6412344dc74b5da62430d7f4fce08
MD5 1aabf2d869027cd5ca1dad1636ed18bf
SHA1 58d78194a6191c9b29be84703a37f4a54181ba4b
SHA512 55f67b4163356b1b367e77ed94a3f14da201ba8c658df8cb5a35c02856c88666101b195d0b103ec467dff1cf399b5aa44a3da92654bc607456ac8eba01d985e1
SSDEEP 12288:gkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:gkfJ4yL/tNCJPXUQrPV
TLSH
T1B8C423EB60D5948ADE1587F81B48E001C708BEC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f1a9aabcfa26decee18e6a613e0c2a1e323614834e20b779fa92261545ca749a
MD5 c2ef70a9fea020103af76126bc537480
SHA1 fc3979325d3086664e513759c1f2cb5066040f90
SHA512 bddfb9854903d5d29f0aaa364b03dcf5c08cc37ffe2026902b6cd36d3a6f948f7511df89548b495b8c1315bc6acb6a7c586021e83fd58fd0d2d8d6bdaaa00d3a
SSDEEP 12288:myPz5L8dfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:bzydfJ4yL/tNCJPXUQrPH
TLSH
T102F4125732A130F9D53682788990A502F331BCB2072597EF5BA046B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 53524f51b75f27d9debe517b93fe375e6dd2944ff7afdceabb971b9b5020ea3b
MD5 339fab6c4f4ff04339ac2b3057fdf887
SHA1 71a86f7e34571b547ee00d10c899516f3ba57f0b
SHA512 585ac8cd9eeb282287857c1386dd54f6bc5fc3f825c803385cd382f039839002bdf3c3daa1d323803d04468cced50381f3de1cffa8159d443a33125dd02660ac
SSDEEP 12288:LCd9eWYoaLHF3z0z04PDvh7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTs:mTHaLl3z0zD7fJ4yL/tNCJPXUQrPg
TLSH
T1E40501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7cf8f9ddfc620494c2360980fc08c654c662ce55a90974a685f1a1c1cd54260a
MD5 32723a5bc0dbc21863d019117934eabd
SHA1 8913cdcdc4a8909c40d99b627f6b2dc53b894589
SHA512 c71ddb1cc886a207c199b5c307a8d2fb837955833768958cb7588856ca1c9ac17e50aecef675aff1070bc052b272859b3f0c0042b805ae64cf3ec594f7671029
SSDEEP 12288:3i4e7+RdTfgwCHKy7GLbbdIvufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGr:337d9CHKy7GZ3fJ4yL/tNCJPXUQrPa
TLSH
T14D25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a4ff438151a9fba507d67a64531ba7ec97fb956a068f8117889484cf89520ba9
MD5 6110a1bad036d16fe4e7a76142edec96
SHA1 d608bb9bb5243fffea3e9a72c3209cc04a249964
SHA512 76b32868563266ad221a3c60ed1f8f5d7b325c68c66a040c6dc361c9921d9940d7f91ad81bd10db48e22b1d09f81ac3f4cb6931b6b15c2fe57b19f665642df0a
SSDEEP 12288:rrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:rrfJ4yL/tNCJPXUQrPG
TLSH
T160C423EB60D5948ADE1587F81A48E001C7087EC6672F62F6EF83B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b18a460adcad24e165df89217661ba0a89e924f361f6e6f4d17e2e0bc0dbe769
MD5 9625a0dae9fdb0eb95d841f57dbd210f
SHA1 d028ab25712b225e34e7891f4e990132f0f0ae96
SHA512 1629956a4d0de6495206bd6a30c6ab9bf0f351252b521267fe202bb26f2f1f3689e40a065ea1ddb7e5d881230316ce9c12bee75d39eb946ee970b7e8526e987c
SSDEEP 12288:U9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:U9fJ4yL/tNCJPXUQrPe
TLSH
T19DC423EB60D5948ADE1987F81688E001C7047EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3d6921c20f00ff30d87e505674feb4e94e4d57e0ab06b1dfdc35eda0651b8ae6
MD5 e564470a3b0e512dd909e8cced85dbcc
SHA1 74e41b3624ce904c4aefd8fa25a7d12bfb7664ab
SHA512 28bf563b367cb5598138af5ebfa5a0b2f1298c73c042fb9cd7f40bb462f9e5b4b61f3a08ffc233b5c27f460d4c33eaefc42a7a99d381ea4c93f6d625d7302da9
SSDEEP 12288:+ufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:+ufJ4yL/tNCJPXUQrP0
TLSH
T1F0C423EB60D5948ADE1587F81748E001C708BEC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 2e9d5fec59641d5d4b6872d963c8426e2516f5b152f5d152a6c12c819af8d9ec
MD5 503bac2d2ccd43f88e8403b708178568
SHA1 3a5dfee6bbdf5ae21fed516336e86198fd5128e4
SHA512 f7acfb4868ef57aab909002d6d143e59cf756b7f724b684cd9c1d9291658647fe5e569dc8f8b53936e7fc05454cf871e2332d8f6ccdef490249b00c2a9e25f3a
SSDEEP 12288:fkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:fkfJ4yL/tNCJPXUQrP0
TLSH
T184C423EB60D5948ADE1587F81748E001C708BEC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 33a380b4eaedd6c3d8f9d071f3a155739cf4403fc4f93a862b15bb2bfe66f9bc
MD5 5ddc2bdbf7e5f3c17d3cc16675c3df35
SHA1 cea78284bfd7de5d91b15fef91a515d182801231
SHA512 f7e6236731ee68c261f6c9919b29ed3536b9540deba4197f4eb08db8a26135d69a807bd470f5087babdfdee4eb85650a0573f307054bbfd298a0052940bf9ccf
SSDEEP 12288:YrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:YrfJ4yL/tNCJPXUQrPe
TLSH
T121C423EB60D5948ADE1587F81A48E001C7087EC6672F62F6EF83B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f4bf934fae0b7f419d19cccd5a2f6263b8c6a5853e30e0cce1f731405b5ff244
MD5 2f5bc4f56c52d100551e780c63d3e6f4
SHA1 3d2f1bb878fdc7bc5786d45918dafa6b892582a8
SHA512 737a35139296c6b3033dbe1e1fa0853a714d13cbe8396f8b969a71fbc57cd9bda3a74a6fa9d4d83e07f8568c4011e0817b501ca2792f34e43ed0af9c6ccf9457
SSDEEP 12288:68fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:68fJ4yL/tNCJPXUQrPq
TLSH
T150C423EB60D5948ADE1587F81B88E001C708BEC6672F62E6EF43B4427FFD91A159C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e52761ecc35bb595c63dbc2e5ba17cb0ca432b130c42a23c2b3506ad40e9544c
MD5 36e7bb36dc080b2b6dfb4be589c9558d
SHA1 7c8aefc57d0a8a8cfedb013058156e3ffbcd8587
SHA512 9fbf5a7053aab0e96b844b5807ac364a7ceace24592e5966fd5c4e87d133549993c2a5660c991f215f5ba788cd976cad4628b97ff4130c46dae705af8496a4dc
SSDEEP 12288:NSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:NSfJ4yL/tNCJPXUQrP9
TLSH
T15CC423EB60D5948ADE1587F81A48E001C7087EC6672F62F6EF83B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 24613929f279c70a297a720743221e9672eed85d9fb8f1106f244a7f58b03cdd
MD5 d8f2f04b463e1c6b977f95c899fc84dd
SHA1 2bac871074b9a132e5a04c2396b2ed2e91a44933
SHA512 9f07a3862354648a9dfadce6ed1e680388f620f9d03ee9d5e5c7a678de88e339c9c72992a0d428876830fcd5d0b43af4a8e6637d3a29cf501d36a36205326406
SSDEEP 24576:sfwvok9RX6wkyAIYfJ4yL/tNCJPXUQrPs:MMnYIYfJ4klKXnE
TLSH
T1DD35D029EBDC44E5E1B7923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f58cdbb3266bf8b5193f15f8eb62dbbdaaac5a02b06a35dcce43db0e4e8e92b9
MD5 37c305916dd10b31556044c50df5474b
SHA1 08fbb6204a904ec567cd9874c2a2d233d90363fc
SHA512 c63658024e1c314ddb32c6f7e52491e2ce71620975af22dc7069c1d659f05fd88fd94f67c7acb87148f383b2fdef526a41aece7185e39b08365726e542a94875
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vfJ4klKXnF:7ySzP3fJ4k
TLSH
T195066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5b56382da46124eeedf13edee53f1cb0e1939c12eff227368a9608fba87d9642
MD5 108f35a37e27f6edcdfcd90c49063955
SHA1 fd029be7e289e2544f90235e5c2c14fc8299ad86
SHA512 22aec7c06d6e856749dc787ecd2610754fb6dda66093d74813274db72928d7e46747528027a3863740745de68da763598607965bc239a1ddd4410fb516ba0163
SSDEEP 24576:g47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5fJ4yL/tNCJPXUQrPY:g47JUQj1irIhCnDHUPfF//fJ4klKXnA
TLSH
T14765AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a531051809e3b15f5086e55d44947b2c564e585a3f17704100865f76c56675c4
MD5 e8cb755f4e050ada0e06f59ec3839ce9
SHA1 9af8c87228ceca5351a62ac99ee6a4e908d357be
SHA512 ef01e71e4d1025c35ca04016dbc78d1267446e528095c9ac57d5070e04e5b95c1be489efa680e026b29e1ee85359c376c60a2a7b68afcd1052ea4298e6222e18
SSDEEP 12288:5NsfUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:+UfJ4yL/tNCJPXUQrPk
TLSH
T1F8E4015AD29801D8C46E92B8CB449201F3237CA593E2D3CB97C1F47E2FBA6945DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6ea22c8fbd6cfd3f5b1582d8caa03250fb67439dc3591819a0caf3375f7611cf
MD5 13d20ba8e74f19b12830e20045d50d4b
SHA1 3fca9aff60e45d0ae44641f5236d11af9278347b
SHA512 4a4a3940557c3e5ebb6f7fbcdff81fbbdaab2c031330162bf3adcce12eb3f5d8a056f5ae4209c33583f781c6e8c379ab9ac8d93b1e44567380595501721fcbc0
SSDEEP 12288:nTk7U3f1NKown3CK6jRiAAWqjRN5QH1siRkURMjpM97ZRSL:nTqUPfwCKIAWSPyZRDqja9u
TLSH
T11C452840766BD75FC6A940325E72D2CCA7703D01EE056F0773C88B3F9576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 0909f726ed777e50f65869c12b31c52daa25ee0a813987525ef15ea9b69e361b
MD5 8b27b35153eee9916881d028d7acee6d
SHA1 3140575dd6d655598d6d7b1489d58fd694cba4ce
SHA512 ddb3180626ed141a307189d9df9ae3a5fda57fa960066fff2c13c4882c8067ac6e9837c2e988445201962482475a320017a16b87844be940fa4d6c6e721eeed9
SSDEEP 12288:gfQBwJqd9jSlyWEzdUCNFsB8cLbHB+uvYvPbLEDYTLe5:gfQBwJqRWF+P/6Yne5
TLSH
T155750BC16537A38FD0FB607207265B8DA768EC06B7496F2673C8053AD866725A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b65ae341e2ad9bbf11f07f454245026ccda846c2e0c11c36b44019199085a0ec
MD5 7dd0ebe7f768a8a32e4dfc5126bbcb9a
SHA1 d4e8f0f57f4853fbbb92347a3fc346133606d675
SHA512 a82589332f821b5770a4e77b41b242f21e723ca7191a464369e907e82e25d66ce8baec83f6f42c0d16da8331030aa58b8a6342aaf2716d7af392b51189fd0574
SSDEEP 12288:+z7sfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:ssfJ4yL/tNCJPXUQrPX
TLSH
T18ED423A751C89446ED7A87F8164CE000D308BED55B2BA1E7EE02B4867FFD9891DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 48613f24f99f28000f3642bbbd12478d217b0e40ddd3a7064a292742a548ddef
MD5 7eab61bff51fe945e1eb784e9ac815cb
SHA1 829809641bef20be43e7d6b4161abce8bbbc4c7c
SHA512 dbfd7dab99a56a2fcae9a187d118f1952f50e0072cbed7b74cbf537625e731ff94e20fe1a65b0455adbf7c519f4284b012924e80c530e8feae061622bcc032ca
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYWfJ4yL/tNCJPXUQrPc:pgb4mBIBhGF5fJ4klKXnU
TLSH
T13765AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 131477ee3c67787c0d1bfc705c4ee84254cf3b76d0b5ed8eaf9e0256ef62b764
MD5 44d4d0bb5401d45f4d5227e67e9b7d69
SHA1 4f95c4df5a445cd915b0379d32648f3c0a731688
SHA512 081a205c4cb68c1508083732391a2151e9f0bee4fa73b192a27075dd23e9e8ba2cf5fa36e438826eb411edd85d08a0dfaa1eb5af92ba51f5d41553a5cfdb4422
SSDEEP 24576:PG88u8FpJqH1bzria7/mpfJ4yL/tNCJPXUQrP3:+7ZFPqVea7/OfJ4klKXnv
TLSH
T17335026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 7960a4ae26f4e9864c23e38a13adca26c175ba4ed838ec3ede6383dfdc686321
MD5 c51795fcc8c5bf979d1df02d24ccdec0
SHA1 f0dcebc3e7f711675fc27d96de858a2bd93ada0a
SHA512 06acfb17c86e87e02ab7c7648b7b53fd8b52681d2083d5b3d80695673c65e6270efba83498d8196d9bea3e0baaa6e9989aa17c498558c1c3139b2ffe21f14264
SSDEEP 12288:RHvUrBFrEjwaQlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:RPUr+NQlfJ4yL/tNCJPXUQrP1
TLSH
T1BE05F16F22E818E5E676E17C89858209E771B8A21312E2DF02D1817E5F77ED87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fc1075ef43bf495fabcae965a7652663e85027b65604bd2c9eaa43479e041fa0
MD5 2a3c73f98cabbfb3afb6c00fcbad1ede
SHA1 05cd2c093b84d15e15774a4333859de534d49378
SHA512 1d70c268eff349ecb4737770a9c242586bb274b2b56d1408d9159da98daee84245fa043f70c4a244cfa43552caebbb8cba6ad54844ef7e9c4bf1589b77c43bcf
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVfJ4klKXnZ:MG05lO43bwfJ4k
TLSH
T1B3D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d5a2663590daee56ad8134a84e9c5345138b7fddc9c2f5b9c51fcd826f6bb93b
MD5 a1e152967669a7fb8931630bf81a35c8
SHA1 cdc8dfd665b86981883b767762ab95e6e73b2217
SHA512 4e2bd6d9861eddd6ffad240d44787355e5a21ef5f41b8465f3f8cdbe1951b5f41fc8650c53186057c7332464d1db79fbb4379eedebf5ccb3080436d7f58c4e0b
SSDEEP 24576:3fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnvfJ4yL/tNCJPXUQrPQ:Pa5POZ3+Jt2pasx2+m9fJ4klKXno
TLSH
T1CB65BF5EA2FC01D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 df092a586c8cba8dff90dee7b185f820c281c420c92e3ee58e071dfcb3edfdc9
MD5 6c34de58e2cb108d95eef3af87136b2e
SHA1 9d3cdd34a41bde089234165116a283f0af1258e3
SHA512 a2dce6c8c1d9931ae16fb70e1104a773b8fb509bfc8a5ef10af67507818bd8129fdc293a7e1ef8cba6fc4956f77b6cac62945bf24012bc257ba468ac6995d427
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkRfJ4yL/tNCJPXUQrPv:oNc/zEOVHFufJ4klKXnX
TLSH
T1C5858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 564906dcd8d793eb09adde3d95a6ffcd12fc9d8145d9cfc69e3210cc47d03a70
MD5 5c150c5a2f110f3315e6416d37fd88af
SHA1 433c9a07ecd3f3ba6e9759bed1ea522a82c67bed
SHA512 395379c14122faf00c818cf2a42b4183f401fd681fc71bdcae17140b1f6413c9d35d81aca48e4247e21dd5b079178885467393f285f0cbc4637feaaf8484910f
SSDEEP 24576:V8kNvNnaFeYhJNtmZBmIfJ4yL/tNCJPXUQrPr:V8MwBtOmIfJ4klKXnj
TLSH
T1DD55AF6EB6F845E4D1FEC6B48E238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a5cc466adc092497b17ce46c4ba4dde730be5f344045fe9158375ef043684908
MD5 0483cf1a6d1c0f54dea8bf30647a559f
SHA1 a72a0610d303bbec9b95a60a8e95c86d680752fa
SHA512 27805e688316c8022a37a2883ef6309a8344073e4ad260956035e12b2385888d8695845f1f855c151adb9accc035482b4e72ae4432747a92296e22a1ff563ee0
SSDEEP 12288:SQcMxWDXN1Dp/fshBItT1IQgAAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GC:wD3FHshBIYQgAAfJ4yL/tNCJPXUQrPK
TLSH
T14525E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D1C1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1692-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1692-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1692-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1692-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2028-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2028-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2028-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2028-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2028-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2644-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2644-315-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2644-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2644-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2644-111-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2816-280-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2816-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2816-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2816-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2984-15-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/2984-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2984-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2984-13-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2984-0-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/3392-24-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3392-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3392-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3392-18-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3392-25-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3924-127-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3924-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3924-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4208-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4208-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4208-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4208-330-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4208-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4208-92-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4724-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4724-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4724-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4724-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4724-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5144-87-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/5144-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5144-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5144-82-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/6080-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6080-77-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6080-297-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6080-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6124-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6124-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6124-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6124-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download