fe74ac425e13c246072dbb1a8105651816427c8659e3eb0cf7009b64b8f634bd

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
Size 1.9MB
Sample260807-nc4hsstekf
SHA256 fe74ac425e13c246072dbb1a8105651816427c8659e3eb0cf7009b64b8f634bd
MD5 b896bef8806779c65cef2eae187befcb
SHA1 42da32500bf5e8c8d6157177acf50b548641403f
SHA512 663443c5597fc653c503e1c0e995e103ab86f198dc6da10844ff6887a6bad97b8dd20933143d8a5b140f7dc60fabd6535aa4d368f95872ddd531696df3105a9c
SSDEEP 24576:TxDdwlOjwGbatr0zAiX90z/F0jsFB3SQk:txAOjdaB0zj0yjoB2
TLSH
T102958D7AE5B844D5E6B6B53882538459E222FC09435196CF7A687F063F37BD0FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2348	elevation_service.exe
3424	elevation_service.exe
4176	maintenanceservice.exe
4936	OSE.EXE
3808	PerceptionSimulationService.exe
3048	perfhost.exe
2716	ReFsDedupSvc.exe
1672	SensorDataService.exe
716	ssh-agent.exe
5904	AgentService.exe
2588	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5584e7ce238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001705962f5e26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058cc7a2d5e26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098bc582e5e26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ffb612f5e26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000923cb9705e26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4560	2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2348	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5904	AgentService.exe
Token: SeBackupPrivilege	2716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2716	ReFsDedupSvc.exe
Token: 33	2588	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeDebugPrivilege	2348	elevation_service.exe
Token: SeDebugPrivilege	3424	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4132	2588	SearchIndexer.exe	103
PID 2588 wrote to memory of 1640	2588	SearchIndexer.exe	104
PID 2588 wrote to memory of 5440	2588	SearchIndexer.exe	105
PID 2588 wrote to memory of 4976	2588	SearchIndexer.exe	106
PID 2588 wrote to memory of 3708	2588	SearchIndexer.exe	110
PID 2588 wrote to memory of 5140	2588	SearchIndexer.exe	111
PID 2588 wrote to memory of 3540	2588	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_b896bef8806779c65cef2eae187befcb_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4176

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 904 2840 2836 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 904 2892 2888 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 904 2840 2836 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 904 2892 2888 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 25852a70798b9fee3257f3569742b649b4b30d9646df06e71ae8584059c252c4
MD5 5ddcb193e989f98e6ee102308e3695c0
SHA1 df747f1dee71928178260dbda70e2e5d0a698f25
SHA512 5be9b85dc2d606674c44e0ad97353ce6a2f5d10ba16867edcce6eeb7e05e1bee7c5ab66805c5d067111809766a26e6c4422c1e3be6e78b6b44cb667822677dcf
SSDEEP 49152:Nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9aB0zj0yjoB2:T3q6sjBDB2Yyjl
TLSH
T12FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 7d4ce83e1285021fc159d54692aaf26f608c8d647f24898e57bf5cc3b20c95d1
MD5 ddbe2ad1287062e6dd44a349de440870
SHA1 831dfe40f453bb076d24a386a06cea34cbae48b4
SHA512 dd214b4d47ad1aecc7ad3224f75e9ab651b499e9b3ef2527472253afb2f4a696f8f5eb5f811817fe1b6f903d17aaa10725d776303b44f90fc02ffa50cbff6fee
SSDEEP 24576:1XYfDtczABatr0zAiX90z/F0jsFB3SQk:gtcKaB0zj0yjoB2
TLSH
T1CD850229779504F9DC67823DC9A1C502EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7b52bd472977c86a39e66e2704e758b731e6f0dda7c284d3455be3dc6d6188e5
MD5 797c2e347e429111ceef0ca3991ef0f7
SHA1 b7c23f09f3551bd5f21c0fb67eee4052dcbb6402
SHA512 c2bd3b30c26496b4851f3d3573873dc8347152aa95c402638bc8743c49c3557d1b179a404538e9e9bce64ccb9957adf56ec237d6c5949ede36b836e6040a18b2
SSDEEP 24576:N0Le5ji0hmxLrMwatr0zAiX90z/F0jsFB3SQk:NPji0AJ/aB0zj0yjoB2
TLSH
T18A959E16F6748371D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b03f383eb195cd15cb81b4b295d26b2ec1020ba03563346cce209176b177657a
MD5 056e789856a05e9010ac6dc3b26ec196
SHA1 2f73ebb4ba22c51b25a855c3a95a660cbe7e38ca
SHA512 4d3a2f5eb42c8227bdde8c41015a53f7e60dc9bf0de1e337142e39edfe9e8416b8f15746ee8ddf88828d350a4f613d438e5ae6ec50562bd5252b318f0f35fb2c
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyuaatr0zAiX90z/F0jsFB3SQk:h/ezSC6vUzPveHjybaB0zj0yjoB2
TLSH
T171755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0d6eca4dc9ded6353b7c7766ed8545588bd835bdc0ff22f8eb4562abd285bea2
MD5 e1c57f41aa49280649f719c2ede6ef16
SHA1 aa9b9e7f1aaed88fc0abda12cd8fc9934cb66a7f
SHA512 fe6720a9227fcbef01dcb601352b18502faed9bd3d62eccefc6525157ded076db27e39cfaea6a184be1903c5dbe16f80d456d60923c729276c3351e76d7d2cb4
SSDEEP 24576:BVbqPb88hv/l+Ylatr0zAiX90z/F0jsFB3SQk:BVO88hXl+SaB0zj0yjoB2
TLSH
T1CC55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d9477dc50e026a0a2a1b465485a69aa08076fef064170913f824fa1d1873e719
MD5 69fa282b78243bdbd7e58f7f027acf12
SHA1 10f804dec344684dcea1d563ee0684212168540f
SHA512 8fb68905cf38050d011c390c72f905e7e422eda80dc888c1326fd5926f88d3cf456eafa793900ff2a627939b5bcaf77e7859877143985fe45a535bb1d3aa827c
SSDEEP 12288:G9UUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:G9Uatr0zAiX90z/F0jsFB3SQk
TLSH
T1A265230B240E40F2CDC31B3566989C4B2AB96EB065D2AF84A1913F4FDD3C2C6D56A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 fc2d201775c0e112831224f4d663b7d86222f8996683c64567646790abc54c72
MD5 2103d2622703c076c59a8c57387d65cb
SHA1 b1b2c06a5dc28074506ee5159d4084ef5bf25f0b
SHA512 418b1c2cbdbb4e6f3a30b01ea25fd2bb3693a0d377a48777980959244f22a99a5a7cde02d65277435bf8c81b92f2a0dcf04433315abb913a9460e26019c58b22
SSDEEP 12288:FeBNUbTVO86UNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:FJIUNatr0zAiX90z/F0jsFB3SQk
TLSH
T15985CF3BAE28FCE2C27A4D785791C600E77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e558c08f2d1d0ca8b6f7d3e55c3261388cde8281d27880a123ff6ddedd8997d
MD5 d84eb7f16cab75e18dc0684991dc04f0
SHA1 43599cefdfd131eb4b11ee11d6d782190aeddef7
SHA512 5d09c3f9683b7bb5243e1ec9259deffbb1ddde45ab2b6bfceec6d1c0276a6287194c2361e4daac2fe42405ecb2de92ff45f45891b58abca41d08bbc6e1897b81
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THz:IQvGAdlCEL8c/DRNw5CtB2Yyjl
TLSH
T148267D656BF880F5E0A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8b74943b8dbe6588f76a1dafc62665f23ca949f4ceadaf708b7f120d4ad817d9
MD5 a0ab523d09ab85593d8cd21f392b05ee
SHA1 27186ad97b9f999e1c92a2ccab5f8765a60aaa89
SHA512 6ce2f0015a26d75f1e2c9cb6f0ee5446a234c4fae3a5bc4ad6a433c8fb2314005424d23d9de5d7fdb371a409f201417920c45103cef340f245da27a6b2000d82
SSDEEP 12288:LAwSfxL/2Dc3DDLLmt0LDQewsAjPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHU:0SewsAjPatr0zAiX90z/F0jsFB3SQk
TLSH
T19F85E031FE75D032C6BB0DB61B25C706147D79204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ee205440f410991b54af81cbbd33607630ab8d0995dac2211a9c9fb8fe0c60f
MD5 09d5487f58cb2f0f0ca15d34d199024b
SHA1 e5d8f0a9f716971ebc9a6180d962a7b1998ad3f6
SHA512 647ebbed54afce40f8f20c5139b2c758dedb31eb4abc292404bbaff9f7adf0c1f54bc9f65ef49df8ea8073523104a2e2e27a8a8344f3081ed820faf4d4c6796d
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHaZ:XUEtQevvqc2W1cpV2tI32c
TLSH
T19E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6311e12ed6fc16eed92de5fcdb37b6514350d74c30fc149f6a3149a0a0e0b430
MD5 6236f21432bc6bc86f8b50b06bbaf565
SHA1 3491936051f5488a9786c4744d5ee6c4ccdf402b
SHA512 e1bc7ff11f5b966f7066ebff4e7f6ab107c5259ab18a1de851d225e4cfd0b11489480c7a4fecc550084819208781a1c2298ff4af1a1f8771129294649bc7a455
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zvaB0zj0yjoB2:coquVjnmxB2Yyjl
TLSH
T1D4D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 39ecee0a9b02eec6ae34ae2dcc7ad8e5a8e65f65dd5bd25817642b4510fe23f3
MD5 a0c2b9192c3463b5819cb5246bf7dcbd
SHA1 a919dc8035fc997a2c9aac5467d688a438b41bf8
SHA512 d8c195b89776478e126a3f7cd3e995bb7a13ac6e3594defcd689f7f8fa00a3d25fa106884b21e11d409ed9effc1e40dc38337ba46a3feefdce98209b269a4113
SSDEEP 24576:QAhGL3IFoiwtA5l7S53Gatr0zAiX90z/F0jsFB3SQk:QAMUFoiq52aB0zj0yjoB2
TLSH
T197359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d202dbf6a069523c96110eb8b321d692ae88699dce2a3b2d829fe050319359c8
MD5 70ee163dd4090ce45c0a196e3298ab46
SHA1 4e3f390a1266573ee3d40909fa1c2facc1df177b
SHA512 e8ddd5102dbbe957c60301832305a3e8ffa06da62dd72ed231ca880754b5c3ac7b499d60ff797af3b32f70a424cb0463c2fe9f07906a32fa245ef04604079f56
SSDEEP 12288:Amw5HEjsChNfBFgl0WDm+C6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:dwumOW7atr0zAiX90z/F0jsFB3SQk
TLSH
T18185F14A32A90CF9E9A342388697C536F7F2B8112A61DB1F1360C75B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 328e910240a28f00760e6cbfc98da9473afd9af8aca5a253d04fe6dab6fb19ed
MD5 a098c374013436d1fef54a7b9de04968
SHA1 26ce3c77479209c127db225289d923d384b21b1a
SHA512 1bb740f9706ec9149839c29643a7e0e63caa33c1a0b5281cc2ae95f50e97d297075cf733b4f0383a15da00f0174b0324e6eff8da1b036e4ee9ac45bd476bb99e
SSDEEP 12288:OEZ1IyfUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:JZuYatr0zAiX90z/F0jsFB3SQk
TLSH
T17F75124B329920F6D5D3523CC9E48906E7B2786123B283CF12617B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a77dd31d18d7d09c5572f8b7e12e7f9b78be736d5cd020896bd6ec4d803c7cfd
MD5 db3a501e3b041b3db8ee573adf9c762a
SHA1 de5a0b8ed960a935246b7b314eac3d6d3210aa91
SHA512 ccfabda21567459062ba4d608c3e14296eb209e373f1d93f5b36a77c1baafc2a5a314a1fa19a1f67bc37ddd7745022d28c7956e31e8a0ff922ec693bca2d345b
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:8QRQyi36YOcPbLvw2gAf+PN3wB2Yyjl
TLSH
T188667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8235cd831463670b92c99e19fe9c554e2c8165e808cd3ed195af5c758ea58385
MD5 04dba39a57d27d8f5b32b80368464e14
SHA1 c0db0363bf7e982fd592d15a7228151a4e5044c0
SHA512 4b4df2fa84d8f4a70fd7d7dfca5f0b8234dae244525a5bb50ec068fcdeaf78f14d9dcad3ae71ccd8c27d2a356af675391b557178504559f3caa29bbe71a6732d
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:hQRQyi36YOcPbLvw2gAf+PN3wB2Yyjl
TLSH
T113667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ec4ec6f2f595fe7aaa3d1fd27645c245790bce1d1251c3a5675577ef3c9367ce
MD5 e9b916ea0ac645ad19d2fd2953fb546f
SHA1 272db6e6fff1df14fc94d1cf121b47ca9e300dae
SHA512 25a448ee8e928b154ff273733385ee8f851ffbe43afb972f8e71321120ba74dd5c65421cb11331841cf0a71a29124e5b94faa9b9abc6eba520101bda806917fe
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Iatr0zAiX90z/Fm:w68Qg55nhceWu7PNU3//aB0zj0yjoB2
TLSH
T1A7B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 953d67ec860b16c5e2ae7d4feec43fbfa837d286bfeb491944a7876a43bcf992
MD5 6a51e0e0541e8ecd87e5e6f5bf51fd6c
SHA1 82f910cc9d2342560da795b137cb4d0eb0be10fc
SHA512 c3cc6719d5174aed5f3b0157fb1a05f980b13fe2ffcdba88370d416e062c8b118b3c8ef15e468898dfabe4a973608b9d3f7ce018c05f9ef980fed5e341795784
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99h:ry5112gYy5azzVvt69nLKnhZLB2Yyjl
TLSH
T17E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 408ef535ef99009885063082fa0afec56fd33c8d0b9aa5329e918836cae01bb2
MD5 eb09e999ce5d25c441e3b5c07d67fb36
SHA1 4d4e8784d84a17be0f3600332e41b25476598eb3
SHA512 69721f025181e21d209750530fecbe2f2361bfc4235b447b9d533acf3cea44879ce8f7e7b140ca1ea76fe84c3a5cad16589dc2e2ebd93851add76276f5361779
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glwaB0zj0yjoB2:fu6Jmdxd2dPB2Yyjl
TLSH
T1EFD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 24011004c41aec8e4cf43c9a51f507e3ae8e24ddb7c4cee44ba9f89c778c0a78
MD5 0a5d6484144583b00faf210e236e2389
SHA1 0920a9b375baa8fb47a6736f231c1d165638452c
SHA512 35318f3c35f8ac5e449a1b612555ae3c0d5d1305d645ae9907da028eadd6f61d88105ad136c1155dbdad3fedbe2ed3a4015d1699e1241922252c97c2b8649895
SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xtaB0zj0yjoB2:kmifPWRxB2Yyjl
TLSH
T1BDB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 806955b13f134a04020cdf73adb7c8148bfd4babbbef1de43961d113ab5843de
MD5 5d61b6cd5073f19af2303f58c8ca2399
SHA1 5e7892cc8aa229ab3a7e07033a0cc8cc78e15d3e
SHA512 b030c9ff51833114dd5f77fd22d2f59510d398e099686f4289244f56951e794277eff9d3f930533ab0983a584416c5d1769e3bf05605b189026b69c421f714e2
SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHqYaB0zj0yjoB2:g5dKii61XB2Yyjl
TLSH
T126C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 66d01bab88355abb9ab17765916dfe5d9ebb22d056e5c50447650b7e2c8ca732
MD5 e2789dc9e60711c329e4da1773f85688
SHA1 13b7b100f273a4965171a7f1e86cc6518e6e01ce
SHA512 aeac56c982feb39b1180c61c881f705e043bd340081c469a26abda32cd0d2afc263bf0c66cac5842ac24b56f03025feda875464df7d038f89f77ce38a4f0b005
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5wBaB0zj0yjoB2:9X2imphlB2Yyjl
TLSH
T18995BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 73de4066a7c169ee6d2a6d4470ddb59b8dfffd3f513d586a9ea883216d0e0279
MD5 8310ac207ff9eebcb41f589ce3a34136
SHA1 93846f0f8c30985676c2b0196645d93daeaedd62
SHA512 b9a77e87ee3ef41686793369c598c2180dd9a91b5ef5b19e6406602a4df18456ffa70f25d77ccf7db66eef1554ee56ee5e3e56ad5a3028fb55e092ff60789188
SSDEEP 12288:GcUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Gcatr0zAiX90z/F0jsFB3SQk
TLSH
T1E965230B341F40F3C8C31B755284984B29B96EB476D36B85B2D63F0FDE382C625699D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4893ec71c85726b93872092fa4e145d2bbcce4b43bfb6cc9a45f4269682fb838
MD5 d8be6880e0394ade7def119fead3589f
SHA1 4907e54f3e92b542f6ac5468869aed8fb29d92c6
SHA512 6c71d11b44ca901a0d2c8425801e55e8c6f2d6b0b297b7c436e3161a46a2f8d7f64146790031e318c1e8d98cf282982784ba857b2f80f4c19dadd6ba37632d31
SSDEEP 12288:9zUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:9zatr0zAiX90z/F0jsFB3SQk
TLSH
T13165230B341F40F3C8831B355388884B59786E7476D3AB85B2D67F0FDE386C6256A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 342430aff8ae31db0c9143d98834204ff05787ed921d510640833675b47af4df
MD5 deafc8d36b7790358a166e86ab305ce9
SHA1 7c2a14b90784bdaccabd5eaad4a4d3ed788499d7
SHA512 9b7bf8c0b4038c662bbeb35d81dc8276de41fe6f5232b031ae38add051dbca44f9b93deb351dcb1c5d82608e058f7326b6d27c27b5b0161313cbef9fa51f21c3
SSDEEP 12288:UVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:UVatr0zAiX90z/F0jsFB3SQk
TLSH
T16A65230B341F40F3C8C31B355284884B59B96EB476D3AB85F2D63E0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f4d0a1d59dfdb1d849f4418f56b90da011211369ca1672c6bdcc1658aa56cd14
MD5 d021c513d331445673f81d20e5a0effc
SHA1 ac1ac1096c2f69e0de66f9130e5e1b9f27237cb8
SHA512 adae76e1cdc09c8404804b696013718fe5bb04b837d13d9f5e3dd1e1fd6f76efc2e018749b2cb06883977bda43a47126c10376af0220978661482f981b6d83ff
SSDEEP 12288:nVmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Matr0zAiX90z/F0jsFB3SQk
TLSH
T18B65230B351F00E2C893973586948846A6B57DB4A7F3ABDFA2413E0F4E343C56939BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9d8e9a27183db16e7b51e706e4303793a31b35a6af4ca5bd87bf5b97c1661479
MD5 2f64063b76e80525aac5ea22a91c6580
SHA1 63d65f04dc9dad18584d6374bd65314d9fbd6044
SHA512 a6ecbcb02b80f5f67b0392a88fcbcf54558a3bf1f70958437aa488d6da0499fd44ccd22e139e209ff2a9e522b51729e140389068a0fe1b14403857e1da4f8483
SSDEEP 12288:e+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:e+atr0zAiX90z/F0jsFB3SQk
TLSH
T1EA65230B341F40F3C8831B355284888B59B96EB476D36B85F2D63F0FDE386C625699D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1bf1644d7a8a36a9842687b6689fd03b390d3104f924d67ef8a099cd07ac21c7
MD5 a10d458c221b6043398e23370d851568
SHA1 9fdf4b52056a1978bfefc2966cd92600e1259db4
SHA512 bfe5b9793d67ad7a6aa3cbdcfab96b689e098a5875ae7cf0010f8baba09047c2755bc1c85bd1b79300190645645023b609971ede895a113c05224705b93efe92
SSDEEP 12288:s3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:s3atr0zAiX90z/F0jsFB3SQk
TLSH
T15165230B341F40F3C8831B355784884B59786EB476D3AB85B2D67F0FDE382C625699DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fc973cbbf851fa768216a0dd3c8dd3322cfd71d550900730cd8c089835048ba4
MD5 7acbf4eb13e1a212855ce7d892685ca2
SHA1 c8f618153a767e4142da936d667941c206b8fdbb
SHA512 85ace0499aed6dcb486576e47164e6e42ad560cc8b9b45fec0a21f361fe9ef96d1c9603542f16eafecef94e0295e251fea64b60ed9c73b9cd5e501907518ed8b
SSDEEP 12288:5rUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:5ratr0zAiX90z/F0jsFB3SQk
TLSH
T1FB65230B341F40F3C8831B355384984B19786EB4B6E3AB85F2967F0FDE382C625699D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 26749a7710aa32cfaca6785d6528b91fd0771654c906625299782256d5481991
MD5 ba4aaaf08ef52988b907fc95ecc59c54
SHA1 d5104ff05a0ca380ba7550f4aad7575650047504
SHA512 37ff4e30fe6d772fbf1216f723e811cf3d4e367628132e27b50a13ad21a5ad7df08595a38bd2fab05f6809f0ae938ce486be8286909aa697f5b81becb4506ce7
SSDEEP 24576:tZMbzFVSOTatr0zAiX90z/F0jsFB3SQk:tZMbzfHaB0zj0yjoB2
TLSH
T183850199735108F5DCA3823EC9548906D6B27C691BB0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6fbc0cd876c2acadd9bc076db16be3b5705a8eccc19ba0b3fad3e07dacb9a71e
MD5 6eb09ce7d43670d41b7c563bbb51b9bf
SHA1 461872f8a203e2b3b2982c9c60f142b1c1f62cb7
SHA512 1d9dd661f1ef48c9fe5ff05a8629107fd3df28b90acbde8680e25cf7a2f502137e187e80207160d6a9f1463821ff127eb88869353e23ba050c3062204c3d88df
SSDEEP 12288:toUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:toatr0zAiX90z/F0jsFB3SQk
TLSH
T1CE65230B341F40F3C8831B355384884B59B96EB476D3AB85F2963F0FDE386C6156A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6f871d0581ab593ffd0541bf0bce554ff92d0564b8b2cf0b81ca73e95580790f
MD5 f07ac5faea1544dcc12e503bee6e2e1d
SHA1 584bdfcbd8af8cacbd94c2bb8cb92ee2bac15cef
SHA512 41aa8b73edb3a4a7df61f25ad6b80349f8da0dd4e8e23f3d8ecbfe41db1e1d100a8741c95c6265b0fd761b20f27c8450334afc854881be9da2b6c3e1ff28956b
SSDEEP 12288:BkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Bkatr0zAiX90z/F0jsFB3SQk
TLSH
T13665230B341F40F3C8831B355384884B59786EB4B6D3AB85F2967F0FDE386C625699DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 bed12cfdec0d0cd47bd08b6cf313c6b5557c827c804cba202e4dae00af369ed6
MD5 b924204051e2460525ace85f30bbd383
SHA1 cce33aec6017bb88e2019c714567ad0c318a2272
SHA512 a117f6fded2b5eaefdb6cfab9fd86b83fa35923d61c282342475a988bbaa9ed85eb5708a557651edf787ae088e7cd7fec59b911ad184c995cf0efefaad3d1d5e
SSDEEP 12288:qyPz5L8fUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:3zyfatr0zAiX90z/F0jsFB3SQk
TLSH
T13375120B326620F9C4639238C9911906F775783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b438540b476a03abe53dfa56415bb10081eed6c61627291ba78c17aea2845517
MD5 6ce81c4d67560faa8d3d6dd1150d1065
SHA1 0cc9fbfd259a974be8f66766db885f4f84a52db9
SHA512 091cd4deca8e0a6fb31332545b022935add5cb75e072bfd82162cc8a46a7966c736a08d83c30931cfb7b4bed714ed49bbb2287d176a4e07d9a73af65aca64203
SSDEEP 12288:qoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:qoatr0zAiX90z/F0jsFB3SQk
TLSH
T16465230F341F40F3C8831B355284888B59B86EB476D3AB85F2963F0FDE386C6156A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ea69a3cc26f720db94fa70bdb9b9df8a0218889b370159163743acca95d7fcf7
MD5 44331991c037a40f2a9e10aeb284adbf
SHA1 a05733ae695bc58ec586661b8bae3d94f464ea50
SHA512 a39d05e087328ea6626ef4b82e8c3816e9a5b2d5a94462603344d978d8edbffec9c382d5e782b32ddd116ba1ea1cb3049f9bdc11848a2141f8bd4c9be4979b6a
SSDEEP 12288:MoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Moatr0zAiX90z/F0jsFB3SQk
TLSH
T19265230B341F40F3C8831B355684884B59B86EB476D3AB85F2963F0FDE386C6156A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d9487ef7ca81369a1408b02845489b218b46f7d25a40a73e61d8d6ea521963d7
MD5 532dcdd7f126d7279422a9d7134769db
SHA1 4a3d117b0438c4a8957c0dd46583c4574a51ebfd
SHA512 cbefe1361d1463deadad788b469c3a13193bf99ff07eb93baef6caf325bd9f6c96bc02e3bc44520c7310d08a471930dfcfb11574269628e69c9c61b5e3764d8c
SSDEEP 12288:AyPz5L8fUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:xzyfatr0zAiX90z/F0jsFB3SQk
TLSH
T1C575120B326620F9C4639238C9911906F775783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9a344636a604a9afe895e37ab3db4def2a2136af2088fcc8ada6285c9e380f04
MD5 47bea14953597b53072dbc0eab8ae95d
SHA1 6d1e73f42587f6171d204b2a732536f0ce7f6a68
SHA512 9d579d3beecaf8eb26d4aca3fd9ff091262c1846cb0aafa636794f02beeaae0c46eec36a33af95c9eadd80b31190df225e6cd6ec9175b37dd61a6ca8f669a3c6
SSDEEP 24576:KTBaLl3z0zDFatr0zAiX90z/F0jsFB3SQk:KTcLljaaB0zj0yjoB2
TLSH
T159850199735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 b3f3f24a978236c66099816b51555375e50871a009711016161777404fc10fff
MD5 348b19dc5e4cb427c6312b597710c83b
SHA1 ed09dcebdeaddff1592591cbb6252ddf6e7d9b30
SHA512 50d3f1744ceb8c0a64595496d9cf04c214a8277660e24a32d5b8e9ad2a5a12e96047e2c99cc3495fc1d574cc3660ec1a7d92cc62c4675b3aafbac1a790675bb3
SSDEEP 24576:D3pd9CHKy7GZJatr0zAiX90z/F0jsFB3SQk:jpd9CHKyaHaB0zj0yjoB2
TLSH
T1EC95CF91B3E810E5F0B39A35C9754512DAB67CA91B71DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 253e40af4754731a7afd4eb7b39766a1ac227bf0542d02352f526d78928ab25e
MD5 adaf657189ae391299d0f4dc2883379d
SHA1 81fceb707adb6d8662934d8b450ea858b8a6aee8
SHA512 05ed2b066fb2fa10aa397411dcb526ee8354128d561c8654e3b2a9edce4ced31e2e880bde379bddcb4a8c9d626c2bce4f0667aa59c9dc996980aa4a2e3b872c5
SSDEEP 12288:g1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:g1atr0zAiX90z/F0jsFB3SQk
TLSH
T13765230B341F40F3C8831B355244888B59B96EB476D3AB85F2D63F0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 a9f32cec934427cacddb032af341630027f92a1c4b02514fbbb159162f203e2b
MD5 059a966dd094525529c4a8e6339558a0
SHA1 5624279028c295a12f4db6ad40399be71755d9fd
SHA512 906bebad3b3bc62899183a2c076a4cfe317946958e4a8efcd2d701338c38591fb310b4cd7b38ba105e2560bd7cef116d187d412484b821ee78dcb7f2336a32ec
SSDEEP 12288:U/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:U/atr0zAiX90z/F0jsFB3SQk
TLSH
T12C65230B341F40F3C8831B75528888476AB86E74B5E3AB85F2D63E0FDE386C615699D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4fe433defa11d8e30a03ad177fbe259ced95d4b5b871756f264c4761eaeddf59
MD5 b85971a2111e2dbd775b7e27cc4f9548
SHA1 3a57ef74bf98abdd983b824bb68a26cd97f19571
SHA512 2323f935cf4dab56ee9acbaca0b903b2ac662e96d60300f5dfbe59dabb8316c8ac773b1960260154725b696a2ebecc7b03d44e407bbf58124236b784084ea67e
SSDEEP 12288:QyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Qyatr0zAiX90z/F0jsFB3SQk
TLSH
T1D365230B341F40F3C8831B355748884B59B86EB476D3AB85F2963F0FDE386C625699DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0b18f5410829ec42c505e81187ac2c3b166e2498cd9b33b2a92934570b26af56
MD5 6d4b3524a6e4ebd5f2f61dea963fc341
SHA1 c8b3998f285ef7775eadd9c03e0270ed6d1b6239
SHA512 7418ccd748cb4f973b11e7df8102201aa6310a236a40a853c726181a07d8175434a9213a13f2999d0790dd5664209bf8713113922b7bcfd55a2e197509ed2789
SSDEEP 12288:AoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Aoatr0zAiX90z/F0jsFB3SQk
TLSH
T1C965230B341F40F3C8831B355684884B59B86EB476D3AB85F2D63F0FDE386C6156A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 33dfc5cb0c199617702931227eb8381904d6c97ca92ee6e6bcc3741bb4ad9f9d
MD5 6b288d5a61d97ede114d9049737198ad
SHA1 32f57563ba292adc56198a3dfd9b1ba4d72282cc
SHA512 c1e40eabb84cb97240af5dd2ea764e6607eff8c0dae80748169872228343911c7b459788ef9e1360b63d2727a56a3bb632b0a03b8cd5d7baa37114b17e3bdee7
SSDEEP 12288:o1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:o1atr0zAiX90z/F0jsFB3SQk
TLSH
T19365230B341F40F3C8831B355244884B59B96EB476D3AB85F2D63F0FDE386C6256A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 29edec2bffced03be3ce11cba19733e2a59dd38f7c360b506f4152576b0ec4bc
MD5 daa02cb8d81cb1eafddaef4317ccc3fc
SHA1 b76da1257c6fe9578278272afc4fe030b6f3febd
SHA512 8ba0e7dccf3303e4fdd7df6b723f492fdb5f56bb6ddbb937e71f95bf96fb858af6de48d5cf91b9f8e8d6007f3274596dc2ab9158b36cd6aa975083aab3722c62
SSDEEP 12288:fgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:fgatr0zAiX90z/F0jsFB3SQk
TLSH
T10D65230B341F40F3C8831B755784884759B86EB476D3AB85F2923F0FDE382C6155A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 edbb64ccc8092b6e9caf9ed722136a224a773b3015fd9072d08e8751f625a257
MD5 5e21c23d20249947892de2a1fe100392
SHA1 06c79f6e756309c126e352f7c9356e09304a758c
SHA512 e131ed51e929ab639e1bcf69e975d9560b913bc1c1c250f3b8048c0ba0666294ba0b1bd8a2bb6486f913e76f806712465e6cd870318cab33166ec703d6e7ceb0
SSDEEP 12288:e+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:e+atr0zAiX90z/F0jsFB3SQk
TLSH
T1D765230B341F40F3C8831B355284884B59B96EB476D36B85F2D63F0FDE386C625699DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 81f03aa5222d5ffb650e20ba7e4f8c847c6129a86b34a37458054401080293a2
MD5 6a1f97774004146808392633b5c30fb8
SHA1 ef21ccb8b397ac3f7a5b8ded0d999857de8bcbe6
SHA512 cb9d6813be27025f5906430d687409c5161d76b03cef7f14d2bc0f00af5ed87f706b2552275bbb0b06cea83226072c656c192b37945f8f47ca1b44c88032bd58
SSDEEP 24576:ofwv2k9RX6wkyAI0atr0zAiX90z/F0jsFB3SQk:eMnYI0aB0zj0yjoB2
TLSH
T1A395D029EBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cad3ecf4475a6d50cd2b1774e21e9f74bd695ec509e2c976185581454500341f
MD5 e9198c412a1a63449964d048dec5608d
SHA1 d93b12bf5e5f65de655c7a32873b087521101c17
SHA512 b6138564098afe2298f56b83d393dbbc2f9fe0bd18d313acce80f160fa48ff1020993ec15e57f83a083b53ff8e8ab5c402b5a07233f41ef29f1df2fc47934cd9
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0haB0zj0yjoB2:UySzPQB2Yyjl
TLSH
T118066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ad875474dfde5dd3a77c509c0c0305e4135d82643b6cd13afceaa02fb97a180f
MD5 b9048f3b3ef081c98c439e3fa15af886
SHA1 79fff2c5eafbc8b59a4bcf2a697dc450f3258c45
SHA512 654c0af0d11a6ea508560fb1f54ee8be58a39aee582a7da7a4a7172aacee872cdeb39c7ff5d07b635fc74fc193e6316ef068f6f9fbd68477ff643caeb9645b98
SSDEEP 24576:j47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYjatr0zAiX90z/F0jsFB3SQk:j47JUQjTirIhCnDHUPfF/xaB0zj0yjos
TLSH
T1A565AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF22B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 dcc648b9c4304094b250c98b214ec48ba8d9d80fb3e0fb2463de407ff1ceb360
MD5 55715a241f1056975ffa076073557fd3
SHA1 9d2d1e9c913b4e38af30df062826f2a0ad36e2eb
SHA512 92c7afaab10c4912c9cac1a58eb3dadfa8c19a9966973e41f2364d9e1dd5026754810c9275e4e4f21ce03f6559b6d57d9c32992152448928d3dad93f6e9f7eb0
SSDEEP 12288:kVsfYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:NYatr0zAiX90z/F0jsFB3SQk
TLSH
T10275F00AE25801E5C0AE6235C7544A42B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d674b5c2324192925ce204e1c1830865b9b34b23f6e1e8f4ef41fba62b3e9428
MD5 b7599f15d839cafb6055f5509d6bd169
SHA1 46384fbe9a4341076596e6afd330524931e57763
SHA512 4a5dee27aa87e042077a8f5aa7744139427480624ea041c0da137f0f9042a094f95240488507db8c2830fc31f24aabee92e34572eab1a2b241fc5a25c018037c
SSDEEP 12288:JjeSWy5cKkIgN6srsPdozIFCgDlrQw7cDTvs:JxWXZIgg+ExDlrzcDTv
TLSH
T1AC450750766AC75FC6A940326E32D1CCA7707D01EE456F0773C88B3FC576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 973b8125b5021809bf780df1008fcbe34f3fae570cf85ca64a26b895377351b6
MD5 68db64992993829b448d106e509abc44
SHA1 9be2c30b7e28afdf85fb2383ef32348dc16bc58b
SHA512 4f8ca539b8c214bc92f6016ee9d27d087ae85d301ac732869e45244a69ea1fdf2e240de588b39f1b22c0df5a48ffe7ee7d41c5a3a81e2fd773f6032156fc5176
SSDEEP 6144:Jb77+2IM2IK2I0Ttl/FkBfBKDexHIEfks5smVhwNATXp8BKDexHGDnYFnVg7E3Ky:J7xktRi+DXpfU
TLSH
T11865E881A137A38FD1FB5032132A6B8DA774EC06B7055F26B388047AD82A755B4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 decbf11e4d17377b7007f0b8f9d78d62852040fe45077ad9098f437956686aee
MD5 9cf3d228da2c1be7e2e8bdc0f77f7bd1
SHA1 4ed6af7c3509d42e73b0fb33c24e4af2e5c71c69
SHA512 13d2e7ece022f547bd3b1e4995569df1cbdd72711d1214a753304c806ddaef10b6dcfc7afd8feeffae40ce73bf903b1b2a665affdf21218002b8fbe771f55c65
SSDEEP 12288:MO7QUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:nQatr0zAiX90z/F0jsFB3SQk
TLSH
T12665230B251E40F2D8E31B3452988806267D7A746BD29AC7F1813F4FED386C65D79ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0368e572f4b00af6352a9dcf8df7a0c266bfdbc95c735e50ada7966c68f97a4f
MD5 68fe4d81dfe93dff0b9848feefbc840b
SHA1 413b86af997eff2e0546f247327f75a243291e70
SHA512 6b68d486b6fc9811675023e62f61fbf171714dd1eaf3d2c11c7b59809f8071028b21cf153225d29bf5989cefd24b98b183633feecbff608e3d024f6c9b0b5780
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYaatr0zAiX90z/F0jsFB3SQk:xgb4mBIBhGFjaB0zj0yjoB2
TLSH
T1CF65AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b334a682c53a0c5135ed7ae45750c5c709a005c8941fd0584c52b402c5c207fe
MD5 f8268de4a955f837ef063a8b20d92d35
SHA1 0e2c9091ec6f63fd31425e107f2bea4ae0a0d908
SHA512 081c1e223105678642c699e512b783cf0b617ab49626bc869cca39947d9e22edea502960de689ab7f8a6184cd7936a5b61bec3c837b7ba32607b2702d9d4cb71
SSDEEP 24576:XG88u8FpJqH1Nzria7/mTatr0zAiX90z/F0jsFB3SQk:W7ZFPqV0a7/SaB0zj0yjoB2
TLSH
T10995016676E101F1D477D1388A864663F6B2B8211360EFDF07A89B561F23AD50B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c2f4a4571a2dfc682ecbfcbd7d1ca3a338fd919a231272454bd1909df1db8580
MD5 a186a8c4cd853de9a4cbf764c3c5b008
SHA1 5d1f6188c7dd85122a9005dfa9fc9c3f72cfd3f1
SHA512 58663e57913ebafa33d5bb6792730049ef5e96fb05fd847f5d33d03656f2c883eac719053d26c0e41c8d1ea6b62c6b274c36861895e1bae2bb39013c2e3e8e9a
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3aB0zj0yjoB2:XG05lO43bjB2Yyjl
TLSH
T17FD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a97ca266e27bcbd4691318a6645d087497f9b0763193240ced3781eeac066dea
MD5 3582a0116243dd5d68c45f8c6d486355
SHA1 b9a5ce20b1ce2df946f53fb06c22d8cd96b3f918
SHA512 1cf5048788a674ee70e2276e8b64f152ea76c4478925a750ad9aa2adf4ab81d74778411e199988f322561726437869f30ffb10fad455da082206255f57becef9
SSDEEP 24576:Lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhatr0zAiX90z/F0jsFB3SQk:Ta5POZ3BJt2pasx2+m/aB0zj0yjoB2
TLSH
T1F065BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a11f624741e73bce982ad33ddb68ca13deb97a8595656916269df233e0b61f30
MD5 8b584f23ff518b994eb0db4c32ab4916
SHA1 78cab0106afb759f1cc1135c878f0b73bffbb838
SHA512 2d4f18083ecae8a29c63cc4df7d799d51321d4c6f833b094314f5c673c66ea83feb6b94eeda5e0fee55789b09f161c8454077363b9fd3a4567f064552aa785bb
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fkbatr0zAiX90z/F0jsFB3SQk:rNc/zEOVHFyaB0zj0yjoB2
TLSH
T168858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b4f5984780db3a43cc5ffd8f1fb26733b0404afccd0322805b447dabd80cd37a
MD5 5afa1199d6e34c91e92d42a006826768
SHA1 4b835d0109fffa67a3e87af579b2220c50a0a793
SHA512 7dac94489b27bc3ed7d82bb3cbff2d59d109f1e4ef2c0db1b25a952bd1151df9a102e60e6aa1d78aacccc2fc6cd6106675a09a16895b4ebf22379a2af56c75c0
SSDEEP 24576:uTkNvNnaFeYhJNtmZBmkatr0zAiX90z/F0jsFB3SQk:uTMwBtOmkaB0zj0yjoB2
TLSH
T16C55AF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 8c8a36c49e77361b3124bbd3f73bbd467da721c720ce718835ee2f676109b63a
MD5 72b5be54cb867e5685ecf83530e4e284
SHA1 0591f3ca027b55ef0f944cd19ae6112faa5fd849
SHA512 ccba38ce14903856588c841978f1e4bfff227442e66bdb0d446fc673789c1da1060e165f6c12f2ed8b2840508f6e47941076a5b98fc8bc62d9ba8bd3dfc2f77b
SSDEEP 12288:0HvUrBFrEjwaQHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:0PUr+NQHatr0zAiX90z/F0jsFB3SQk
TLSH
T13785E11F22AD18E5E677A17D86818609F771B8621352E2CF02E0917F4F27AD8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 68ed1e2c2409644f083b706d7836767a5ec73c51cf64c8f15f53808d4c3b4951
MD5 93286d9a412c8fcea5b8bfe6dffb96af
SHA1 75898bdd64b22b3550a12bacd6a78bd767806b1d
SHA512 700b7617eec3fac6fa0ee53cf6ad5c013a0cf5223714844ab7f9b1e5e6b24a192a286fe7adb678e6163faa7770eff1db7b855cb022a63b45e6c93db54b244832
SSDEEP 24576:jD3FHshBIYQgA8atr0zAiX90z/F0jsFB3SQk:jDVHeBIAA8aB0zj0yjoB2
TLSH
T14295E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/716-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/716-112-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/716-310-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1672-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1672-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1672-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1672-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1672-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2348-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2348-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2348-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2348-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2348-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2588-314-0x0000000002F80000-0x000000000321E000-memory.dmp

Download

memory/2588-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2588-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2588-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2588-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2716-294-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2716-85-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2716-91-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2716-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2716-328-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2716-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3048-281-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3048-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3424-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3424-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3808-275-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3808-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3808-78-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3808-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4176-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4176-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4176-42-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4176-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4176-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4176-57-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4560-8-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/4560-7-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/4560-1-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/4560-29-0x0000000140000000-0x00000001401E6000-memory.dmp

Download

memory/4560-0-0x0000000140000000-0x00000001401E6000-memory.dmp

Download

memory/4936-59-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4936-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4936-223-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5904-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5904-125-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5904-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5904-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5904-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download