45d54721a5b0a2d988adf6afc7474d25707c17be2687aafbed3cfa9fdb04fa9c

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
Size 1.9MB
Sample260807-tp87ps11fw
SHA256 45d54721a5b0a2d988adf6afc7474d25707c17be2687aafbed3cfa9fdb04fa9c
MD5 4212f8a554bc5ab163ed4dcba00e87d4
SHA1 3282754a46a3b94a53baca8eca6a07f53ce20271
SHA512 3446b0464c68ba91012831b10131e8dcea191659b78dcb03b35f5608b064a62193a9df3d103a220dcfeb0a92961dbaa9455c75b4cdd029100093db0aa3cbe34f
SSDEEP 24576:QxDdwlOjwGOatr0zAiX90z/F0jsFB3SQk:YxAOjMaB0zj0yjoB2
TLSH
T15A958C7AE5B844D5E6BAB53882538459E222FC09435196CF7A687F063F377D0FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5320	elevation_service.exe
3148	elevation_service.exe
4332	maintenanceservice.exe
4748	OSE.EXE
5160	PerceptionSimulationService.exe
2304	perfhost.exe
992	ReFsDedupSvc.exe
5340	SensorDataService.exe
6132	ssh-agent.exe
2052	AgentService.exe
1456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\812a418824febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f4b93398826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8c563398826dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000240cd7f48726dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005341ef58726dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d5a17f48726dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
3148	elevation_service.exe
3148	elevation_service.exe
3148	elevation_service.exe
3148	elevation_service.exe
3148	elevation_service.exe
3148	elevation_service.exe
3148	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	592	2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5320	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2052	AgentService.exe
Token: SeBackupPrivilege	992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	992	ReFsDedupSvc.exe
Token: 33	1456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1456	SearchIndexer.exe
Token: SeDebugPrivilege	5320	elevation_service.exe
Token: SeDebugPrivilege	3148	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 3864	1456	SearchIndexer.exe	102
PID 1456 wrote to memory of 544	1456	SearchIndexer.exe	103
PID 1456 wrote to memory of 4252	1456	SearchIndexer.exe	104
PID 1456 wrote to memory of 4528	1456	SearchIndexer.exe	105
PID 1456 wrote to memory of 5876	1456	SearchIndexer.exe	107
PID 1456 wrote to memory of 1732	1456	SearchIndexer.exe	108
PID 1456 wrote to memory of 2988	1456	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4212f8a554bc5ab163ed4dcba00e87d4_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5160

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2304

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1624 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1624 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5f5e5eb63958356af057db08f8b0df6cfbf7378fe0f76613ea9845a808242175
MD5 f625d0568c89038b1f6bd00310f22ed9
SHA1 17537588a310318cc4f969782aea72b76ec9d161
SHA512 86bbec11bbd67db437bcb1d57f966ee590011914ba5062882b0a669f199596d35adcc1cdd2cf2170f661e89243719b1e662e1afb5b90cdfabba895fcfcfa746f
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2aB0zj0yjoB2:S3q6sjBCB2Yyjl
TLSH
T1D2D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b83833952e1921909be1f34436c9fc3421d89bac83d0e2ab3dcaedb9a00e4963
MD5 905c8a2a6f2f7ba6b25bc2937bbe447c
SHA1 3ca5dd2a1f8c8e6f895b4d06dc13a9313d1c5b17
SHA512 9393984424aedd3032f5b920d3fe2eb3a650105a99d43d3f5cbdb200cad49999097408579327ee8d33173e1dbc8598b9227dfd49e5b38db3b557527269b935fb
SSDEEP 24576:VXYfDtczADatr0zAiX90z/F0jsFB3SQk:AtcsaB0zj0yjoB2
TLSH
T132850229779504F9DC67823DC9A1C502EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 712903fa68d571ade266fb0291ba561185191df1b647be02e595357d107568d7
MD5 c72faee01bd7f6094458133eff506565
SHA1 852caec37e0da3eadd17c154abd12a2ba5fb27be
SHA512 d3d41b4448ba6c11c2fa1bae912e705f3b8fcbe058c5aaff254eba6ebd88315d2c9d9a39e8b697ea73840c636c03cb43abcba257f43fd6cbf6a4f8bbf7230a6c
SSDEEP 24576:B0Le5ji0hmxLrMnatr0zAiX90z/F0jsFB3SQk:BPji0AJYaB0zj0yjoB2
TLSH
T11D959E16F6748371D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cb781ae34efc3aa9ea966f287c922c29b23b98956c93f4d438862d3389df5d1
MD5 9ac7de357eb2909dfc66e7d87b5359e9
SHA1 9451f19356da0e9948a35b77c78bb30f9f1106bb
SHA512 5b01221f09468605a6f0927d68dfea2a1f283a8e4b279c91b93e114c7c17d27390ac61a783f2889b6d0a37341ed5ba3e6b00bad5a0aed383db1815a009514e5d
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuJatr0zAiX90z/F0jsFB3SQk:M/ezSC6vUzPveHjyUaB0zj0yjoB2
TLSH
T16A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 df0aa5a5fd57c9b788e276c643f737a9f020855ae589bc50ebbbfe10c4cb55fc
MD5 74e41fd5147d1546d5485dff82d69c36
SHA1 069637c828535290c25e68e9e0f10e5b84302484
SHA512 802491ada24f07190ab38a6acf23771ac827eee7ad4570554aa4ea54e010c27d6e4949bfa112fe307ad9d7976ba44d46cd009ce82db98e22d413e132e9d6f32c
SSDEEP 24576:CVbqPb88hv/l+Y2atr0zAiX90z/F0jsFB3SQkJ:CVO88hXl+haB0zj0yjoB2
TLSH
T10355AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 93ac839758a5a7d9dad9ff3575e462a14cdcbd57b51d51d5808a0de185961a1a
MD5 f149842025faa156905f66a7ab7d505d
SHA1 271138aa94c48a98a7d23c279ce9d4400486e55f
SHA512 47b3e53327959e3f8a1005f52173f8a6acd22f87cd34b4ea1e2f6d9f7113a8bc2bc5d6c9d19b8d4f3038af4b8e5c4fa10675e4c18619b08f671ffe678c496b5e
SSDEEP 12288:S9LUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:S9Latr0zAiX90z/F0jsFB3SQk
TLSH
T17B65230B240E40F2CDC31B3566989C4B2AB96E7065E2AF84E1917F4FDD3C2C6D56A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 dcfdb5a4c90a7d6b4df03966a33a1bfef7d8702688bddb199ef3906888714675
MD5 30a3c25209784c372f069c20299d55e6
SHA1 af3122721748144bc9ea114b39a9737d42d45c9e
SHA512 cbe63eaa84d131373c14b098192b63acbe52e982e214c08d2ef2e18e8405ae028d50f092f90a1ddb65f62cdd1462def94de2ba02dd69eff62b7028f4a90f51a7
SSDEEP 12288:ceBNUbTVO86UeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:cJIUeatr0zAiX90z/F0jsFB3SQk
TLSH
T19285CF3BAE28FCE2C27A4D795791C600E77278304B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 121d08500d3ce324d9c1553dd207fa107040b8100984e60025196234fb77a3b7
MD5 cb1e29fe0768dbd15d9f21806dcf1833
SHA1 a270dc82264c94a92895db429a10489090511125
SHA512 0494289705cdd74c865b6e7c28f1cbce64794ee94042e421ccb73e469654b0a25f63c51fafb661c9444e5d0a364308db20b8c6fcb5115100fd559e55c2f29925
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:uQvGAdlCEL8c/DRNw5CgB2Yyjl
TLSH
T148267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5de4f0f84f89e2da48efaaad3984a9957e81e0540b3051054c8e619ae714f3d4
MD5 919eb4ac03e825090bd70624b131f612
SHA1 499a92039174c159b9ff97c54ac8b330c9a0172d
SHA512 19880c7a00e4232dd52bfdd765b7e1223222b0156e61e1ab33164295e6a16e2b928d60bf46c56894bc96f46308d52e79ccaf2122b1ff79b4a58c8bb6a404eaf8
SSDEEP 12288:rAwSfxL/2Dc3DDLLmt0LDQewsAjoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHU:USewsAjoatr0zAiX90z/F0jsFB3SQk
TLSH
T17485E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 78d9414418866164dd7603bbdcc3b8b2311bf081591c5177fb9accdb43778ba6
MD5 117ba0fee19e0a4fea4dd768cf6cd8c5
SHA1 5ac1a94efe7c14034331e3b18deeea6f9c9c7644
SHA512 ee1cf78389e3496bb5525769728722b989282fd0aacf17a1b39441ce45421d3a035745565d56a2ac7edafcd1d26b7ce32b56c8e1bd6e7c6dec3c3a02f1fc05ee
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/Z:LUEtQevvqc2W1cpV2tI32R
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 98d67b96131916487086afa9dd37603193282b08871922c31a6e37511c5d6bbd
MD5 15e01af1a918c20bb546690e0713e1ae
SHA1 d665f59b160673251fa8420f3827d583b522e3aa
SHA512 c5b0583f0c2e9cfadc93f3b3b0adab0a5381d1f1fcd75f8b96d39cba12f81d11333ac7f6bd657484e53b172e46066ff1a108b44f02b32e87ea51be5b0bb95a40
SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/zIaB0zj0yjoB2:uoquVjnmEB2Yyjl
TLSH
T13FD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f82803e29b82f7f0e5cb54a40d5e7af6db7f4d0534e0e0a205ca5853ad7638d3
MD5 78c8da52efa9c94000def5bc3e728865
SHA1 a0734c7628cd943537291480f18874bebfbbc331
SHA512 27e41d02a9c5fc2d5ebed57eb823abe17c67358d1f1672b0638f7e40ae6766010afcd3f37a8e492e8270f2e9cf53e6c7440f796587b83316ab819de89cb60e88
SSDEEP 24576:2AhGL3IFoiwtA5l7S531atr0zAiX90z/F0jsFB3SQk:2AMUFoiq5laB0zj0yjoB2
TLSH
T17A359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 93c0a3ece221ce61afdbdcb7e13a08947147cb3789625f3635d6c1c7c90ceaf8
MD5 07c0e811c368e80b74c1b608702882e9
SHA1 0ac11023b80c4c0835c19dacd718c1cd281dc80e
SHA512 0f33a54126a9453a20b5a70b4c3044bcfd545bab35d1d77e2b64a7257078c0587a146dc099e812b706c94ed1d80e79012316c9176fb47d700e7bd83bc938c4ec
SSDEEP 12288:Dmw5HEjsChNfBFgl0WDm+CpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:CwumOW0atr0zAiX90z/F0jsFB3SQk
TLSH
T14E85F14A36A90CF9E9A342388687C536F7F2B8112A61DB1F1360C75B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 afa9ed0f8b66d536ae746796dc0037f4eb32ffbb4707f980e80338b52e9a6e83
MD5 3b46f6539625b0debaef1f1d39e62541
SHA1 a7fcf65f9f696d8fe80effdb73ed3d217990fa05
SHA512 413c124c9d2c59342039b568eb7aa5a2033eb49bdf930e6787418ecd50133e31d6de2d4afc51d8ac069fbf3c4dc8169bdd2fdfd5078f2049b8812067e0167948
SSDEEP 12288:1EZ1Iy4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:qZuvatr0zAiX90z/F0jsFB3SQk
TLSH
T1D875124B329920F6D5D3523CC9E48906E7B2786123B283CF12617B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 981cfc9e27c897f6412a08f7348496ca5ef365fa4cd66fe1c84173f22f36eebf
MD5 d62e4c92713b6621c17249a8c9007f07
SHA1 e96dddd45d7c6c412153cb6dcebbce7ddafe984c
SHA512 58a91bb77d2c890801e5605cc7ab1d44273b7ec2b3c2aa5de1f51525a26119ff5ba23095d1e2c23d80b5aa3fd0676031912e6b6aa1bd9b0a5a7db916b4bfc065
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:TQRQyi36YOcPbLvw2gAf+PN3tB2Yyjl
TLSH
T110667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ff9ffdb119879f7a4e0a495d8c5cae2cbff9cc2c22e6e3897220b91d5a3d520
MD5 3d8f4e2f9fa192a1e93faaf420cdd513
SHA1 32dd36359fff5bce1ce39ac4e3671387247b28c5
SHA512 4ed0b17701839fc6edc236fb05f7aed26e4e8387f1973f729e42cd20cbd008593c38e9fcbf99033874e7f2e49f19dab22ae576f298f66d2ececca2ec07a37b91
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:tQRQyi36YOcPbLvw2gAf+PN3tB2Yyjl
TLSH
T1FF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dcf20248433b1c714f145b7447e8e2bedb192c13a3d1d548d34cf878778a4da0
MD5 8da77a8aa310a9bcdca02967a35ace14
SHA1 eb4eebf88437b40f6ddb7efefe99c71c6ffb865b
SHA512 9d2e761e29a10fbceef90a22acf4d925a1482468f2bc1a1bd33c8b188cd991db19a561ba9092998de427984fa40ba6491d5493c4755b6ab5c3e131a8ed1418e3
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0fatr0zAiX90z/Fm:568Qg55nhceWu7PNU3/YaB0zj0yjoB2
TLSH
T124B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3304412b4796eaa347e0ef0b54ea7176f3d86fcee852e931bf486ab2335c129f
MD5 d28a3a1dff7f93cfe85a5b1d1923c389
SHA1 6962e928f748f56b641777c29ff8c4d47e5ab9cc
SHA512 0cc86615c77ecdc0ae0ec842720b917eaca1146cbc67468553d18776992c9584c728b0a374effc9e42606d8ab7293bf01906e8fe0617c4856b31e80a33aa5066
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99u:iy5112gYy5azzVvt69nLKnhZ2B2Yyjl
TLSH
T1DC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 374b632d6438bb153b3eac1a5e647f9d8cf57efe5c847af3e01cc1737b7d4e47
MD5 ddb689c69df2edf09ebc112e17a70d69
SHA1 f1c25399883010e5a249c58d42ca5ea1853d1a31
SHA512 6b66436611543866a944d49f1b232342ec43955b0bc5fcfc7e386b915e12225549cfae01e7d01509a400bb8fd14a23314e664180417f97475f1b2820a7a048b0
SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glzaB0zj0yjoB2:Pu6Jmdxd2d+B2Yyjl
TLSH
T150D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7f7d6a296037426d0886bf41339779805e6488d369faf9c33a45bcda8efcf131
MD5 f8f7c5579fb87990172840e2464e1ffa
SHA1 7d847253419e5b7c4b11cb088b957d09f1756f60
SHA512 97bdb7a7261c8f1c960f4e48608e1e214cd9e000745e098836959c39b68345e26ae7ac91d617f8d46e8ad974e297adecf22c6cedb0ac1f00331c68f37a5a49c7
SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4x+aB0zj0yjoB2:1mifPWREB2Yyjl
TLSH
T1FDB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b05464eeb40ebcc339e2377f901f064f8194624e2005576d3676908d001874c6
MD5 4c1df4b5447005d48d15fa1a6ae06f02
SHA1 ee6a4eeb3654d305cba4d5f93069794c797df9db
SHA512 e08a6b97223920e0d6f7f1faf9454cd762cec1e4ad840adb657442907843a7d56c430339303482bd5141f1073d15c1f9f33c80ec34cfe699ccd26e5ce48b25da
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqvaB0zj0yjoB2:95dKii61iB2Yyjl
TLSH
T106C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e33f4f056aca1a0c26232baac0b425cc0f05d911a4c89d09d50280f65972eab0
MD5 ac43bb28d5a413b192dd456f083ad719
SHA1 c44031e8c79c4be4a828b8e94bd804e877cd99a6
SHA512 94b68a6b941561de68bd099d3660cc2f6618cd0237a6958d7f3db0633746da810a5e98744c9c13b49e1bc3c78cbeab3fe65bb571179b7622d578cddca4dcbe11
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5wiaB0zj0yjoB2:tX2imphYB2Yyjl
TLSH
T13595BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 85f40fb2fff1cb805040a226a4278e19ff7166cde87a8d9de0f1c6a3a005fd49
MD5 03bb589df4aa67f4db86e6f7b4679d19
SHA1 c44827ce0601f17d4f755c883ce5f0eb30b543fe
SHA512 9f6ede12293e5c8b7bca974212f4967d9b1e1d71fdc13a1dc7ee49b08b11bca49ae5bbc54293f20271b1375f6c92194df2ee7025b12cd499881b3f2ff8c71146
SSDEEP 12288:nTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:nTatr0zAiX90z/F0jsFB3SQk
TLSH
T18C65230B341F40F3C8C31B355684984B19B96E7476D36B85F2923F0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5315f047f1eb2a15c51670d5a848b8ebfa099852694e24e45115753888d93b09
MD5 de536c5af80c6d54f09a2b4f768c6a96
SHA1 947db0458b0b78331aeabff45ab9b248f3ce13ce
SHA512 bea31568514cdb8115ab3030e739ada267dccd3536bfa9648ffdb4ca145bb434d8b110ac37b092d28ad8197aa9110e71040fe9e377938c032ebb931f177b03f0
SSDEEP 12288:IsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Isatr0zAiX90z/F0jsFB3SQk
TLSH
T12665230B341F40F3C8831B355788984B19786E7476E3AB95F2923F0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 81826c57e08c9190e8e7541b786ac08f8d905ea8b7486d0377b38cd9d9650ebe
MD5 ffeefa346c7a824e77bbfff3f2e7be82
SHA1 26cf0826cc2356bf38553c16d5839124e51c00ec
SHA512 6ad94ea1e170f0f775856e2965ba79f1a795ddc71869a60a4579a1bc04cf50eee5e2c510c420637cc35f850b97cbb904b7945da0a697043770896f41ae18070a
SSDEEP 12288:lmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:lmatr0zAiX90z/F0jsFB3SQk
TLSH
T1F565230B341F40F3C8C31B355388884B19B96EB476D36B85F2923E0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3408d1a052add8826734b14aef42987c5dd49501cf593be62f4a48c72570dfda
MD5 834b1dbbbf48dd3048cf8bf61bbd4eb4
SHA1 21ec19a550c796ae0b0d87a0cd1b18f13c5acfc2
SHA512 54c04ac0b317341c894e781cfe626695b10720df8c49cb8473542a430489647ef96dcc297da44254673ba5a4cc58c784309112523395f9ff731d2fe0e1182cff
SSDEEP 12288:jVVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:natr0zAiX90z/F0jsFB3SQk
TLSH
T12565230B351F00E2C893973586948846A6B57DB4A7F3ABDFA2413E0F4E343C56939BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 84f4d498f6044c5cfcaa529bdec2f34277171f93108f0e2d623981b5d4bb1ee4
MD5 ed53e38cffb6c7825327eac1eabe5a70
SHA1 e85c3fded397c4e2f6e68788471db6cbebd21abf
SHA512 f672ee37f52666e4ee852aec2669932a74a7acab7d9b3c4b35e8954e529128891f25fc62b7fc88968b86dbcdc99b0d897961f0c9b0859bd1b7debea898a055b1
SSDEEP 12288:utUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:utatr0zAiX90z/F0jsFB3SQk
TLSH
T19865230B341F40F3C8831B355644884B19796EB476E36B95F2963F0FDE382C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1e6cbb1b2017c27d93f23c570ab2f53a612bd927a47337ac4a0eb1fbb72059ab
MD5 8049119705eadbe3fbacf31d243812bc
SHA1 202b38ba265380b349d53953cc48d21ae75f6df5
SHA512 a4fbb9d98e984a9fae3adc28cd6c13f17c6de29e1f404fd7511b67a6d1f04a6feca50447e06313566e28c18e04656daac8fa0e417e34c91c338783001acab91f
SSDEEP 12288:rwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:rwatr0zAiX90z/F0jsFB3SQk
TLSH
T1D965230B341F40F3C8831B355788884B19786E7476E3AB85B2927F0FDE386C625699DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ce92d905281bea4b710774ade82862295bf39abd0d4f92742942821bf441ce25
MD5 37f385e29f10c96a20aa9ad726401d54
SHA1 1cf53bf31f370f15a819033b0f8dbdb46aed9947
SHA512 27ed705f20b60a0529cc16e8fee1f321fa3d02d58ef206617196c003724a73ea6621c8627e6a33e1f2311c71348e146478e2003d305b2b2aa47942fe6d8f35b0
SSDEEP 12288:4kUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:4katr0zAiX90z/F0jsFB3SQk
TLSH
T1FC65230B341F40F3C8831B355748984B19B96EB476E3AB85F2927F0FDE382C625699D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ab65dcbf375a767b9674d1b6096666a4512fa1e97167896ec6ef53e1d1e549e7
MD5 f96d450ae13de7fbfb0b6aa52a24f08a
SHA1 ca636b18a106439bb98a76684de48e7f818959a3
SHA512 2df3c1fd9fcdd17723d6b6bdf8d497722bc5dd2acd7a596c55b096db72ebad7db4fbeefe4a139f34f6ba96d44975f298418a135fb0bc33dca83d468f980521d5
SSDEEP 24576:pZMbzFVSOMatr0zAiX90z/F0jsFB3SQk:pZMbzfAaB0zj0yjoB2
TLSH
T12085019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 21733c773daeeb4e6a378f6ccf8944007c47fb289473c8fa885f6224edcf186c
MD5 2379216d6fc62f8280943945a360a347
SHA1 7c7448f7ebf2e9ccd630cbedbc3e4eeb600cdaba
SHA512 fcf5ac0530c510f3dc1b013620a78445c48ea18722dbf5524ef0a83c5bc9a25ac721f0806254ea1f048fb3435dc115993cd0e96acc4f88b838cf06c4594922f6
SSDEEP 12288:j/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:j/atr0zAiX90z/F0jsFB3SQk
TLSH
T1AC65230F341F40F3C8831B355648884B59786EB476D3AB85F2963F0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 4d42f2583196fc428abee052ccf3aff369dc3563f95c40278a7048b5e938a5a3
MD5 bf38e71fef5422a5b65692860708d75e
SHA1 fbb93b22dba29311e589d0b6972ee5c840ec5cef
SHA512 28efb4e5d6c6f29d349270d28d83c6c93e134bb673107df22ab1ffc56d484feaf03ec78aef8825c0b68871955a294d9f7fb890f3ccf4e1328c632992bbcf0e2a
SSDEEP 12288:NbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Nbatr0zAiX90z/F0jsFB3SQk
TLSH
T10765230B341F40F3C8831B355784884B19786E7476E3AB85F2967F0FDE386C62569AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 245e4135054a0e1cdbec573070a27c9ce35f0833d8913d1f38eb2a92cbccb0de
MD5 90f85ba0ea061d2683d4825382975d93
SHA1 5151c4c5f04bd8ba28a1a9ea23410075646afe49
SHA512 6643f9a6564dbe171f7e4cb3493ff5e9f1c90baaf9e0abbd31ef3f5ab6f4414f1a596a5956360464a6de4e0c729a4864c6f1bb446a153a1e21130864ccbe3696
SSDEEP 12288:nyPz5L84UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Kzy4atr0zAiX90z/F0jsFB3SQk
TLSH
T14675120B326620F9C4639238C9911906F775783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 789e314eaac0015a98a1deb64b6d31081c0ba0675243ff0f0220f5a5e22d0963
MD5 d4a7336a42aafcb5dcaa3d22806ac8e4
SHA1 157b2f709980a67fe68a5a5ec0f0bfdd688f5ce0
SHA512 d672c62ce4d132a6d9074400bd0325c7feed52baacaf17d1e04818181a9c6aa3e4fa00f597e5e71b6b32708432e421714465c52996021f0713b9c552901ae3d5
SSDEEP 12288:7/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:7/atr0zAiX90z/F0jsFB3SQk
TLSH
T1E465230F341F40F3C8831B355648884B59786EB476D3AB85F2963F0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 beca1b553cedf1f7331b5b5ba88ebe2b7a0c992b894fd4e5dbd3b2df7a8c8b62
MD5 ee015a076f6ac032d982ead2155d0d54
SHA1 a9fd78db9f61fc0e590b03dab669735775ea7ede
SHA512 91ed61b9705916e19b1d968208282abb6184f7405ef9fc7a0a726257202299b5eeb7c3dc0a943d75f3f726b47bdb80fc81b68ed63364d66583931740de103ce0
SSDEEP 12288:P/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:P/atr0zAiX90z/F0jsFB3SQk
TLSH
T10E65230F341F40F3C8831B355648884B59786EB476D3AB85F2963F0FDE386C6256A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 8baa26cc4b8c23e28b41cd229ef7c552ce51a93d95e8fb7b3f9a4e04ac8f69ed
MD5 62b5d2efcdda9201ae38acb090b006ff
SHA1 a274e4c9781638a6c0e89add8dfdb88c47c80c8f
SHA512 b411f0c3ff57e7073440da7b30e16f84b892efda4f5943755c7c42a16c77d3dc499b26abc73ffc438f22969b1b1efb1794501aacd24e3fe20cde48af05be8519
SSDEEP 12288:DyPz5L84UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:uzy4atr0zAiX90z/F0jsFB3SQk
TLSH
T19B75120B326620F9C4639238C9911906F775783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 1aae5e1a9c31b6b83ba02367bec7d3c8c43e8740fafaeed957f983e1ee25ceca
MD5 f0bc3b596870e1874748348c8c8e46f8
SHA1 cfd20da221e4c727e8438a695663d761a31d5c9b
SHA512 e90d39d9af7ef539613334ec24f2c8b4f747484a0c109fb246cc2bf5b32d60671b2fdf8fc1c4cdfed83aa973a46d719a843c7ae34f4f0bfc04a6d26bbab3b7bd
SSDEEP 24576:RTBaLl3z0zDWatr0zAiX90z/F0jsFB3SQk:RTcLljJaB0zj0yjoB2
TLSH
T181850199735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f64f25cb1d7506dc8a47a99813b60387d290afba2e4cc9ab4ada3a837c3df77c
MD5 0a896fd7666e06b8ea1938e780dddd5e
SHA1 ca1d74f7f1c4ccc60b0e60a9672228f08506e4bf
SHA512 3331c4bc0c6346b1911875d04952dbf75e5c395a27bbffd196163109f41e3d5791c91f0b0cbbd896f1352e0cbaa5670533435bbaedf69a98fc5e8bca7378c08c
SSDEEP 24576:k3pd9CHKy7GZKatr0zAiX90z/F0jsFB3SQk:upd9CHKyaAaB0zj0yjoB2
TLSH
T1CC95CF91B3E810E5F0B39A35C9758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7c55117807e665f58befd152b6c11e297ff4e3b3dfc8f6a62431d842ed9b9df6
MD5 c8bd2515a2b4535ddd55a33c388e657e
SHA1 ab0179890a7365d945f9fb35dd57c89254075334
SHA512 f84246dc0377b360af8b470072cdb5c9b2e1ccda08bc295c6ec49410a532a328e3d07b23a8c708bde552ec9162030975037ac31b80f536618d12b3c130b9e197
SSDEEP 12288:KGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:KGatr0zAiX90z/F0jsFB3SQk
TLSH
T10B65230B341F40F3C8831B355648884B19B96EB476D3AB85F2D63E0FDE386C6256A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 7494598914b92a191d59e70b3daeeb28cac557b17b97d45ddf304cf16bd267f3
MD5 a9babae0f6292f3bfb4c2cd5927c9937
SHA1 b7a0d9ce329a30500e7d4f8044b7642fb45c4122
SHA512 dd3746017617cbf2337e9f13b3fb2cae892eb2b6f4b6a1c15d064aa657ae78f204d2ef2e1d6f126892fbe187794e064bd89d92116b934d2ee7fb0ea28b8958c6
SSDEEP 12288:GYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:GYatr0zAiX90z/F0jsFB3SQk
TLSH
T12565230B341F40F3C8831B755688884729B86E7475E3AB95F2D23E0FDE3C6C625699D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8d03c78d8e1c8f0a16a9209ede5aedf2096d0765f40797b82995360067305c1d
MD5 fa0ba521b21242b54f6b46822b35fd8c
SHA1 e209991cd8e4e9176a65eee0b85947043204fff1
SHA512 310d6df2ba10da9c082f5d1827f28af0d360467e55bc6388300406402a53ad99702bd8f2e09e196ff49e74f1a5cf0433181c4b0cc2684f3d6d4c5555e0db916a
SSDEEP 12288:EBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:EBatr0zAiX90z/F0jsFB3SQk
TLSH
T10765230B341F40F3C8831B355748884B59B86EB476D3AB85F2963F0FDE386C625699DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 77d5def948fd4d4b51a5020919e5f66a1b4746a3ad0076bd67d4f48100bc2720
MD5 f21ec16486feb01ea9bf7166392a75b3
SHA1 ddeda5cc760778ba5b91f02161b94acc0eb84adc
SHA512 0193ba354f32de9748175ad74627b5d61840ad5c80e838b8df1066fab4bf8095471b74e821e2c2fb328504be6abaa794ea83410b4f6e3be6ea9276ad97d4d69a
SSDEEP 12288:j/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:j/atr0zAiX90z/F0jsFB3SQk
TLSH
T12F65230B341F40F3C8831B355748884B19B96EB476E3AB85F2963F0FDE386C6156A9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 16d56e4e09e0425fd9c54bea044cdba441940091575e83fd9c7b3f8e486a0d03
MD5 f5b9834ac2eab10b3472e2f7e62ca786
SHA1 7711b93a356402f858af42676d153ecd67f4a268
SHA512 c4824cdb3ed5d79c0f73b63aedc99f870aec4a5ec8a6e9da58f17103e8b5ffe3b90545c9a63d380910fafded02fc6d8cceb0898ee4419afff04d038e788d643e
SSDEEP 12288:hGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:hGatr0zAiX90z/F0jsFB3SQk
TLSH
T17765230B341F40F3C8C31B355644884B59B96EB476D3AB85F2D63E0FDE382C6256A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 acf866dbbe362a046a4f4b43f23b1cb6135c3b694b44dc1086e512de337069fd
MD5 daf653eef115bf6b62f9bc2a60ffac26
SHA1 bb3222a12ec0deba27b29ea77368445434e54f68
SHA512 92937248b463fa18b72b9b4db6e47f0320c2bd2f77ab78dff2370538d3bc6aac11d09ea51249b711db1a1038eb602a0e61255784f1013057d41a4540e78baaf3
SSDEEP 12288:sXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:sXatr0zAiX90z/F0jsFB3SQk
TLSH
T1B165230B381F40F3C8835B755788884759B86EB475D3AB85F2923F0FDE382C6156A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 a5e53ec37a275d98a5aaccbd28e115d14878f13ac713531dddc7c409487ded4b
MD5 adfc270a381f78ebb54754fe20846d63
SHA1 3e428966570ed09bfbf4d08d1475c301395222f6
SHA512 3dbb665e1a47850bb441564c0926dbd5c61d3cc2b0f1f1451887fc9e3b6f86425d4e61ec2c51f339e707f4129f17cc8de2688d949e37080680779f00ff68b679
SSDEEP 12288:KtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Ktatr0zAiX90z/F0jsFB3SQk
TLSH
T16065230B341F40F3C8831B355644884B69B96EB476D36B85F2D63F0FDE382C6256A9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 42c346d453bdb88b8c725e05b2a5b4c4624875f126c79adf9f0bd1dad22c5d7d
MD5 b8886e9c138b4822ed5733a265c9cc73
SHA1 c3458cbc4a238f40e6cb20b5f70fcbe0966940c4
SHA512 4a2b09e2cc16b601917eef0337a652351ad40028c66f3c66c26b3f1541f35cac4028cd8730dd2f6359aeeafc8c5467a8bb880f8d1e596c75888e42bf8a092016
SSDEEP 24576:Hfwv2k9RX6wkyAIratr0zAiX90z/F0jsFB3SQk:XMnYIraB0zj0yjoB2
TLSH
T13495D029EBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 73010e4bddba72b1242073f1124c4551693347b3bddeb134a54fdf7b376319d4
MD5 d85e7f3e7c6f1d6d4ac843771187fe9f
SHA1 f5826b4d5b21511ce70f038669b7fdf790d63e83
SHA512 03ae2a332a100c5378fadfc938b459d52d9e839517c5115781a6ebc50b60f97f7871a4693f2d145a9b512ca49e3482d2ed94fad4f012d6f4bdb7cbf447f75959
SSDEEP 49152:GYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CaB0zj0yjoB2:FySzPNB2Yyjl
TLSH
T119066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e00e70fd881fdcee9082345d769204235ede357215e35615cc0fce2307870275
MD5 445a7b4bd3ef044ecbaf2aa0b65750fb
SHA1 88100d8b1e8ae611b50c0ab8e80a7348de409ded
SHA512 19695144e570594a948199f418a86eb7a8858b5772627f5bd6d2f5c3966dd585b03c1efd105d408ad272d5f60647412c489815139f8c059c2d00726aef1b158e
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYcatr0zAiX90z/F0jsFB3SQk:a47JUQjTirIhCnDHUPfF/SaB0zj0yjos
TLSH
T11B65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e3635bda082012c762ca721220c244bd8be6b308ed97d03fc9bc0d74b068ae97
MD5 0e26ca27b6be49ea27954dada48e2a98
SHA1 93eacf73d9b27f76476265407b9221296faafcb7
SHA512 90fc36e7e5bf11e5caf3a9ad6318833512dd65727812c947388ce9dfe29265745b1b8acab4ece8a911c68d412e399e4bb8f85d6233fdc35a331f8b37c5bf46b2
SSDEEP 12288:KVsfvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:vvatr0zAiX90z/F0jsFB3SQk
TLSH
T10C75F00AE25802E5C0AE6235C7544A41B7777C6493E2D7CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 bfc54e39c3f821dacdc0193e123edafa89d85ee51399d8c36eb04aa44b8f914a
MD5 07c61357dc9da189173fb25557262ede
SHA1 fce273c277d712a7c2718970b1b985dc5f9ca5b0
SHA512 184fc069208276a9a730492283368a7c44555fbf09d49da59e9abc38f6119c3bbf2cf1a2c85e71f55e6c327bdcd0151cd7bb59329c6138fb2b9a545397df1925
SSDEEP 24576:cZWQtUPkUyiPDpnpzgvD2hLwWX0Bj47hx:UtUFPdnVqDoLwWEBj47z
TLSH
T159552741762AC75FC6A950325E36D6CCAB707C51FE046F0373C8873E9576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 453abfd9c0d29088176f3c2e65c54078538d49ab7f8ef87163a6c9beff2aa380
MD5 d3c6ecbf8b22c376aa38b4c1d781a9ba
SHA1 61997d1c437e61db54836f265f24e899399befe6
SHA512 ce6a040654a2003f22276f6bee90e3fff54b69e587730f4ddb2fb27715dbbbfe69974fc3145b752d2ac17111af46e012db7183ab3ecb5645da2d0bb76467ab78
SSDEEP 12288:TQJQ7t6WnuN3h95gbaAKlvWrN/0IygebXVVeONqaAp7rMT5wJc5S+cwjOArVrQ:TQkO3h95gZQexsngUlU6tGX85PXKwVrQ
TLSH
T103653A40A5B7E31FC9BA90374631868DBB746C56BB452F007384CD38986697EB6E33D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 591813c77d4d759349a54245f44c16e83e6d4b4177f4bb4b037469f567048848
MD5 88255e720f8676fa5af4d6e772eb0d68
SHA1 7518d35f3ed5e516488af47a066e6c62af37b93b
SHA512 a778fc1e77ccc2ec557c45720c972aea1d2767604d710cdd24b48b16f35bdaaf8096adc8cdbeda3a517e3c2939da56f6c03769c68147e6eb6146e8f7efc2f50d
SSDEEP 12288:oO7HUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:THatr0zAiX90z/F0jsFB3SQk
TLSH
T18B65230B251E40F2D8E31B3056988806267D7A746BD2EAC7F1813F4F9D386C65D79ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8e6741fadc8ef6cfd952d845080c7601116580b5b650ffdac05dfec038c4c2a9
MD5 38b7c1f935f1fd70e2d2d2de45cd4275
SHA1 7d15c386ff16265c14137ebd1f5205ba5cf6b9a0
SHA512 4b7d9528296d2da8419c3aa1c97390303d31e3b0e94ab4e1401245b2d97af378bba4799093e46493a3e28fbd786fd59860810719c1fd8c2c3f463fc468ba1d1f
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYJatr0zAiX90z/F0jsFB3SQk:Ngb4mBIBhGFcaB0zj0yjoB2
TLSH
T1CB65AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 f2fa5e2a38972fde8f04a190fd0e969d0589a508147e4bf32fa18b8ff6bbb36e
MD5 d6d061bbbe3a6cca19934a25aa53d552
SHA1 0dc4fdacef08f6b17dd0b7a6cc4dd72f4ae6ee2a
SHA512 299c8ffee706a2a198f27fcb77c4f0288f46f07a1e3813549493e9d6aa407ac47d82d343f18ceeecbfbf88dcd94fcdd0b04b6f97507156b366144b86f168edb2
SSDEEP 24576:2G88u8FpJqH1Nzria7/mMatr0zAiX90z/F0jsFB3SQk:d7ZFPqV0a7/haB0zj0yjoB2
TLSH
T12495016676E101F1D477D1388A864663F6B2B8211360EFDF07A89B561F23AD50B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 1a9762ee4961b09b138447bfe1020389b7a7ead10a57ed10caaf623bc4e6ea3d
MD5 31682f26ba15db3fd2bc9e39a2a95e1f
SHA1 6b12742110082fb15a2e148398fca1c66bb28a2a
SHA512 47f37072b9f8d94f6cfe5fb482172c99d437604b27dc96d95588146f049741af1e0f0c23d327c0e78309847997c34c1926591d5f296d25af08cb4d110ddf24a2
SSDEEP 12288:hHvUrBFrEjwaQAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:hPUr+NQAatr0zAiX90z/F0jsFB3SQk
TLSH
T17085E11F22AD18E5E677A13D86818609F771B8621352E2CF02E0917F4F27AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a0b6a3e6d30a10d3ee420da1698955bf44ab209e6b31576fae8dc210d9ce1482
MD5 6809fbcac74b3bddad1517cb0281d357
SHA1 21a53fada848147b7b404e77f08e31d88913b83c
SHA512 ddfbb47bec340292a7652cbc852d4ce2deaae9e3e3eef77e65d73d2f4be3dc1906c05116c6d17424b59c63c00e5525ec77358c89fd5b3345f16eb031e31fa55b
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwaB0zj0yjoB2:KG05lO43buB2Yyjl
TLSH
T106D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b035a84a0cb0077a8d5d499c6b8cff5b5c31303f750de341ab49d17c5f62878e
MD5 89a6c1e103a460069718159fb2930c9f
SHA1 b7266b7282548500211b72896582a8dce6a70c9e
SHA512 05d6c48d1da85440ae8918afcd74ff93f000936c9a2ee41a6bf636eb0934641394d7ecf72be0d2881843de1b6d072c14cef6471e3ee5c6e6ed383b7ae422a66a
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnCatr0zAiX90z/F0jsFB3SQk:8a5POZ3BJt2pasx2+mYaB0zj0yjoB2
TLSH
T15A65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5af31b2c63ef37f2313dde47aa2b10deeda23319f84fbd8d7c2dfc95f13b1cef
MD5 b57e71ffa7a533321c097918a864a2eb
SHA1 e2b61257bf736b13fb1a5c4f3ca4779ba137fe18
SHA512 a932a5101a20ff48b94e693346e8a56fa00f9ab3305657a9a2562d556b86a35387cf1bb6bfd0c86dcdfe3cb57d30adb699169de5d55afdaed86bafae915cb55b
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkUatr0zAiX90z/F0jsFB3SQk:FNc/zEOVHFBaB0zj0yjoB2
TLSH
T142858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3be56c04d9d3a904880a9cddbcbe0cbf41df2cb0461d45ce8713277844bb3cac
MD5 6e37395d96c2f803466f9f89c36a09f9
SHA1 9a61de0288eaed61b1343e7877f4bb451b7f1d92
SHA512 f2de15ee31a212592dca3e21c51f9c21e845f607cbd28dc55cd3dce4b1eb5f2f264d9553267bdeea860593d7f7d384a0b63041039e4e0844c93a6d07e94462b4
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmXatr0zAiX90z/F0jsFB3SQk:RTMwBtOmXaB0zj0yjoB2
TLSH
T12A55AF2E76B846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 45e4617d9fb9c4e1eaff9188b81be3a47f5ca9b9897b318c2f94dd030c6d0c33
MD5 950a60cd346e0c000f35050f9d4522a3
SHA1 0098cdf09117e614b7190209a7cde7d51246f44b
SHA512 3685894c9ef0e6b22fcff08aba495c8fa63ba358267b2bcfd9819b6f9b6672f6ba53655a042a1b04ed730afc60068317dc4306a4eb9c772cee77aed23ad1ca7c
SSDEEP 24576:jD3FHshBIYQgAzatr0zAiX90z/F0jsFB3SQk:jDVHeBIAAzaB0zj0yjoB2
TLSH
T12995E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-8-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/592-41-0x0000000140000000-0x00000001401E6000-memory.dmp

Download

memory/592-0-0x0000000140000000-0x00000001401E6000-memory.dmp

Download

memory/592-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/592-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/992-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/992-324-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/992-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/992-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/992-86-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/992-92-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1456-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1456-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2052-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2052-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2052-123-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2052-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2052-129-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2304-305-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2304-81-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3148-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3148-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3148-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3148-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3148-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4332-43-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4332-44-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4332-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4332-64-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4332-62-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4748-251-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4748-65-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4748-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4748-54-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5160-77-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5160-71-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5160-291-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5160-69-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5320-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5320-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5320-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5320-23-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5340-98-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5340-310-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5340-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5340-104-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5340-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5340-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6132-118-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6132-309-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/6132-112-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6132-111-0x0000000140000000-0x000000014021F000-memory.dmp

Download