bf9419593762f6c0a09cc74cf941b40f5ead159cb00fef131077a1e05f67fc68

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260809-lrq5xavepc
SHA256 bf9419593762f6c0a09cc74cf941b40f5ead159cb00fef131077a1e05f67fc68
MD5 dd066a523a8b57719b23b2b6e9422bea
SHA1 254851c882969d9d81a1e7cb732a5be1edeb350d
SHA512 92d6890e3cfec2e61034c25a8f7dde2d509e94005cbdb8a1e411c873c643e0aff0c09b1f2c42e750f0dd492e53b0eb7c0ffbc588876e25357ac618078bdb9db6
SSDEEP 24576:3BYGb8azt3A6nzSpFyvOcXW/jEEL9HmNuQJDzkY:OI8WA6IyfYEEpGnJv
TLSH
T13B85E04963E900B8E1B7E678C9A74902E77B7C460670DB4F03E885672F77660DE39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2316	elevation_service.exe
5616	elevation_service.exe
3680	maintenanceservice.exe
572	PerceptionSimulationService.exe
1612	perfhost.exe
3440	ReFsDedupSvc.exe
2032	SensorDataService.exe
5228	ssh-agent.exe
3076	AgentService.exe
4704	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2472f5a1e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000480f4ffbe327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f28457fce327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdaf48fbe327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
5616	elevation_service.exe
5616	elevation_service.exe
5616	elevation_service.exe
5616	elevation_service.exe
5616	elevation_service.exe
5616	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3556	2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2316	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3076	AgentService.exe
Token: 33	4704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeBackupPrivilege	3440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3440	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2316	elevation_service.exe
Token: SeDebugPrivilege	5616	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1392	4704	SearchIndexer.exe	100
PID 4704 wrote to memory of 1096	4704	SearchIndexer.exe	101
PID 4704 wrote to memory of 1136	4704	SearchIndexer.exe	102
PID 4704 wrote to memory of 2408	4704	SearchIndexer.exe	103
PID 4704 wrote to memory of 4568	4704	SearchIndexer.exe	105
PID 4704 wrote to memory of 5144	4704	SearchIndexer.exe	106
PID 4704 wrote to memory of 5580	4704	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_dd066a523a8b57719b23b2b6e9422bea_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2b222e73017ad3a12ffca52f44cda216c2fd6ac000e0987bac60a5c0c45d4218
MD5 149789c5e1e4f7cfa48ea15890d84451
SHA1 bf9b1b320678c0815f5008c625a365662cbf73b5
SHA512 16b3d8c5c3574cba960b5421490d91f60ce09d2a51f5756a19edcbae60e724297cc6367c3ab1a8ebc7df0a086563cb066ac88d90e0d9b7f9f6e83a3a92a9ef60
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5yfYEEpGnJv:o3q6HjBuyfzKQ
TLSH
T172D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2702c37e1209e033f96e79e0c41b9b013292b3b3249e0e91cf1888cc72e23426
MD5 b6d85bc0686d98226b0edc7ee6b5d04a
SHA1 63dbc901f2d7f8bf0d63c0680cc6b21cc04052de
SHA512 cc6110a7fca82ebc8f9f23425a7efee910c4b1149f49ca622515facbe8aa9563ccff865987df4353decfe9d80a9e6febebca2c5fe25956a4753dfb1380ae3e6f
SSDEEP 24576:1XYfDtczAayvOcXW/jEEL9HmNuQJDzkY:gtcTyfYEEpGnJv
TLSH
T1DA65012C73E809F9EC67427DC9B68411EA7378950760E79B03E49A251F332D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2b47450f68139dbd17dbc0d3cf188ec848d0227659dec7b5620cd26808b9a0da
MD5 2f6107377deef6a6a929152b8d59ce58
SHA1 9bbd05d2b1109fe62c35b8d8894c8dacbf933638
SHA512 5ee2158acbb7f929c89e5ea9e86fe0bb1de4255c27a1dbf7c3425b718bafab6fe747ced6d8ab5642044e81aba632e3741e5949cbfd40b5e7ea246b7c75b23a5a
SSDEEP 24576:X0Le5ji0hmxMrM2yvOcXW/jEEL9HmNuQJDzkY:XPji0AyLyfYEEpGnJv
TLSH
T160859E16F6788335D073C0B9C5D2A69EE97130861B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7099c9d887e3e5931655a23d41504e97cfdde914224a39a9050ed37072924e6e
MD5 f4589d92536f01ef44f82d200eaf7b2d
SHA1 ab7331f7f31dac3f86f2b9a6b5968eeaf215d4f0
SHA512 7c3f453b67725693cbbef5a69b586a0c1a743402649feb5ae5ef131d450ab5993205dc6838007ecf8957379c729112d12192600e12d22a6019c8128b4bbf81fe
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuIyvOcXW/jEEL9HmNuQJDzkY:+/ezSC6vUzPvxHjyvyfYEEpGnJv
TLSH
T117756C15F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 692bad7ea6864f3d16c3aacdf0c78557932656a27d98835426ab8f6f74f9bb50
MD5 59bc3b21d9323e0233bb37170e398478
SHA1 9b11dc77dae5e0fb2717688e83763b43d4f7a6e8
SHA512 78a26e1abe266ebc05433053213cc5174e603b171a77e1c0de97fa6a7d13d18e4a6866c9de8180a6633a826dd441bcee9f1faffec554b0e55aab095b1011a17d
SSDEEP 24576:jVbqPb88hv/l+6JyvOcXW/jEEL9HmNuQJDzkY:jVO88hXl+6yfYEEpGnJv
TLSH
T1DD559E66F5B48331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E677E6C736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7579d98df8191aa6dde91cf884c1997a81bcac4026ea429b5fadd946fde4873c
MD5 00a4cabaf2a9c1abef40311545f28dba
SHA1 04d5347ea4e3d437489ce1087c302d0eb49b2780
SHA512 0c18426b2d68cea01d06dfc4031f9c3bd43085cced13362f77174489ce8459254c1412aa2248647d40bd42efbaab098cb19f952f4da5f27ba419e80db5eec84f
SSDEEP 12288:TDGAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYI:TDCyvOcXW/jEEL9HmNuQJDzkY
TLSH
T12045239E21EC424AF6660F7632FF44D5A89D1CD92C39067376E2FF029AF9870C312995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0c4ba0d685f2ced38e1195cc2721287b190d0c23978636596e6558d86c9fbaaf
MD5 b06c1f405b34c2d5448a6ba9d65032e3
SHA1 e90717e6d53a1773c16d87858a7e126ed92abc25
SHA512 21f7ea1a20e3256d24e849893162c9ad273ea4c325a2a0bb99d56be204ed0444eeaf0b85e47cc01d3a8458b909b4e0e28699373a0eee349ece7ea4e474655201
SSDEEP 12288:AeBNUbTVO86UpAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYQ:AJIUhyvOcXW/jEEL9HmNuQJDzkY
TLSH
T13C65CF3BAE28FCD2C27A4DB957918640D77678704F2293CBE165830EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 848bdd0809c3b414fbac1c04e08bb9b66f970058a5ef08f32bf984c930fc3af4
MD5 e943d45c4c9840aca58e7e87980197c1
SHA1 24b2f687b9867e976544d2a66b510d5fe0c9cf0f
SHA512 1835d0184456d381331a077dd0773c3f744da90a233f7d0d82d5c92745902cc055aa072f14737eec5ad45b6972dd034114c6876eca2be02871128909bf051116
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:oQvGAdlCEL8c/yRNw5C4yfzKQ
TLSH
T17B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 cc23cdad2849858e363f11b9dc0acdd5994390df427995f7f954e65cff953841
MD5 202367195ff6bede9fb864c38b06bbb8
SHA1 4095e7c01b24f7f84cfe49ef09db5f7326a11a3d
SHA512 44c0e9eb8d608802280cae42f57477336912b05003d86c400e9575f6812201e98321a10d9f3a14f77ac3c3702293900416881fe904baf831154838bd64c23559
SSDEEP 12288:YAwSfxL/2Dc3uDLLmt0LDQewsAjzAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJC:9newsAj7yvOcXW/jEEL9HmNuQJDzkY
TLSH
T19575E031FA78E036C27B0DB61B7AC716546D79600F611AC3E3E89E8E59702D26336E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed99cbe91490ff60bb30dd6bff2c42548ce431b91d249688fc9d28021267831c
MD5 c3d77ea04017af0b7de4bd00bc66a138
SHA1 195775d10bbc10403509ea73c299d0ee50284b05
SHA512 e5904243521878122872653e9ad604e8460f101e18f8f9cbaa74d60cda71b7c5b36cfc46fbe24d9d7b74b065fca8e214a66e0d43de93431a794136d9d31f5ad6
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHWbd:SUEtQevvqc2W1cpV2EI32Wb
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 45acead34de1247904cccd1b3f10cfc563d397e2a15168318583e84ea69e5643
MD5 964d806f669779d67b7a8293ecfb656c
SHA1 9c12550316756e6ec69c35fed64dc6c1bd021495
SHA512 06a2a5d9e44f944a1664a599cdd9333fa61500d575e54d00d47f1547468dbde654ca93c84a95f7c3b2931bdf327dcc2755cb09a6dd79d88c0bc59ab27329bc1f
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/zbyfYEEpGnJv:Noq2Vjnm8yfzKQ
TLSH
T134D58D0976B8C2E4D1F6C77886A2C647F37178154B3597EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 278864be6e26d8110a3a84021e764ae09be4b20f5818efadf9829dbfe588b9ea
MD5 1ab9fc7bc2819ca54b6c33c85cbcdab1
SHA1 2288c2eb34a7bcbe0ca63232c898e52d892cfea3
SHA512 1864946a10ce6e41f54f3852171fe3ca91cd80622c572f9cf9737cce8f20d643c09bf0395092e8e681f4bbde9c60be7f939ff26f90572e4923cc1718ef61ca88
SSDEEP 24576:1AhGLJIFoiwtA5l7S53cyvOcXW/jEEL9HmNuQJDzkY:1AMyFoiq5syfYEEpGnJv
TLSH
T165359E81E7F955D4F5B3AA7899BA8171EA76BCA61E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e6e1041998504f68a2acbe64de2eb970b6253089d231c6366e34f282c9646ed1
MD5 44affd4623ca3ad40d03fb02cde51737
SHA1 2de57820d59c4e6667f003cf258c1b2a034976f7
SHA512 347c09c0a79a678bb816f648a668472c7bbb37c73cbb61024bc6edc79a73fada55fb94e50ae8bd124f25986671d7921ce57ed7d0976eb3a880fdb0492ecc7aad
SSDEEP 12288:inZ1IyDAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYZ:KZuuyvOcXW/jEEL9HmNuQJDzkY
TLSH
T13855129E32EC21F9E1A3063C99F94445D7B538962B3503CF22A187461F73AE19F35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3a80a9a8b04f489bc56087c53eafc8162de6dadbd86513cb9d9cfae35780ba62
MD5 4b2a2d2be592f8fca895bfb30517ec52
SHA1 da92774e3c5ca58a79d8ccc31fd608ce81f7b7ea
SHA512 7bed82bbd5dacf9039d7a23bfdac792fcc3eb06e308638614a1000299c88600c976deb588a64ea311c28d5cacdf61954973ffdec4ebcee3096d813951198753d
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:xQRQyi36YOcPQLvw2gAf+PN3lyfzKQ
TLSH
T162667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 382e81df40db933c171f83994b7a4f9ca5b9c57ed025f042006522ab9328689f
MD5 3451f6e6cbc820eff46e20facf2bb30a
SHA1 6f8f6579a2d34738ac9cffbb8d1f40c6402a104c
SHA512 70a80827102f79d21f654e441009fd1af21c4a2a2b53a529af5650a11abce2bc64247854750e4320177ad8a056e8ad77c7a669e7b5a23d9f65643fe2a422fd31
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:5QRQyi36YOcPQLvw2gAf+PN3lyfzKQ
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 74c92084515801125da960b4bf739c0735823819a946a6e15f1b37c57ab25c8e
MD5 96b75e3a1e1a8a206e60aecac38d76ed
SHA1 c49e7b80fb2a503a6483152fc423c501166a0dd1
SHA512 6f58d990b0711f990a618867c3bdb20ad717742015c5e0d1c740029fcc38662a75ccc4cb3a64e418d7746700ae01edc637c45e3ce231848e108a54192e76ae01
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+yvOcXW/jEEL9HS:n68Qg55nhheWu7PNU3/LyfYEEpGnJv
TLSH
T143B55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4ea0f8c4678bd50b80e38f7a9ba5b972d0969aa223ef4e2479f97164c5325f86
MD5 b0e39d85bcad37124f5faa4e45e98216
SHA1 5807d3a5e5b78179a2bc8097a79a6a68fc52bb15
SHA512 74388e3e3fccc297ebe6a99c5276d2dcf63bbf819649464ed9d6dd6763741f34cd420e428741c0d42379a34e6f01c34012038f199f15c5675202e99e7afe8a8b
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:Yy5112gYy5azzVvL69nLKnhZCyfzKQ
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 deb87482fddbe2b6f8ac9ad9cebfca161b78f85c2d175cf872a700085e8d6540
MD5 f36498e6e023403fe82a5d31788f5341
SHA1 d46f3c3a8e465ca4fedede5ba5922f72252b007a
SHA512 4b3a6737ffdeea7cbf9b9251bd632c949a58e41f906262bf1d8d54393223fb21daf19f12165cbd117d43d63c0e5ff989b423ca5fe0a4a8c0b9a866eb629c7d09
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKyfYEEpGnJv:wu6JmVxd2dKyfzKQ
TLSH
T1A0D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9fa65ec02563946a1cadd7d13af47c70c435a5052d5db6786ccafc2a7015640a
MD5 d60467dff971aaadee18af28141fa411
SHA1 f17d336c76ccf8ceeb932fcaa223b5092158780f
SHA512 5befd241ef17d461ab756ee6fc42cde193cdc74d50e24b891ec0c7ca1da2df548e9c767acd722d2a6a4dee63979f7c8ddbcf559964ffb56140b9747e7cdcadce
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xByfYEEpGnJv:SmifPbR8yfzKQ
TLSH
T118B5BE13F2D901E8D06DD178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 de889dae383ac8800875723245ea54e265f5eb032ed5633c4385bd807d36f44a
MD5 04f320953af74f611fa95c192515ce35
SHA1 2e92033ecc036004a37c053b811c5efd6de95e73
SHA512 c1ef024a8bd1f3a29f59b96a158338a8f4ccad103899ac1bafb25a8d142be9ff36639e565b45a670f21dc11eac6f03f026b9020a0a3ba65da1806689c42997db
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHquyfYEEpGnJv:L5dKTi61uyfzKQ
TLSH
T1CFC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3c4d188db019740d5e1eb4b160508935a0c49ee46527e7c75e36903b638fd26
MD5 6d04708ad4c21809284770a4c95b4399
SHA1 69c000e513d7d94357f10ff0e0c7cec475471b11
SHA512 744e91cf9f49c6abb05d14b822dde03d190acd007bdf217b66e5c4979691b9e55aaf9c82bbc9fb1df6f6618fbfe73f162d144edcf839011c641d05894ec568d2
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wNyfYEEpGnJv:nX2iyphAyfzKQ
TLSH
T13895BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 02da540d70a38bc1b4a9bff5ddd5d8ff354a51e39440e93c14c6b1a72222e3c0
MD5 db3f036759ac2d948d7c9c29311edcf7
SHA1 f914efd6d74aba6ce5be45f1bdde99e94b168418
SHA512 82517574b06681a3db61423b9ba8ee83d68f37ae4758d1a336ed908254079bb17e198ccb8f34b6d683192a0b1655033dfccb20b68885dd04900d43a177005184
SSDEEP 12288:L+AIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYP:L6yvOcXW/jEEL9HmNuQJDzkY
TLSH
T1EE45235E20EE474EF4110EB662FE40D5A49C1DDF3D3A017376E6AA02ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3fd2dd82f63b03029b9b38b391f81f2205bb4e7a03fd579ac0a98ba0d3a1b2ba
MD5 7e7bf4f166f513a61817c2f6a24f766b
SHA1 5b71493289801a70d3942aa253e6d72199852bd8
SHA512 9bf294fafd900ae99cad3487d42170f3ae7887b9546861cc9a51ecef1f85dbb63afaad64161e49b9cd00e3402b6fe910c49034e74a5d10bf82d3c481d02c8e1d
SSDEEP 12288:DnAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkY6:DXyvOcXW/jEEL9HmNuQJDzkY
TLSH
T12E45235E30ED464EF0110EB662FE40D5E49C1DDB3D3A027376EAAA02ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6e5028af2671c7c273cafaeba5a43934286db352f305fe225bfcfa5c2c2579d4
MD5 41cf82e6d96edd609a8a61062f0c0e16
SHA1 097386169fd01b363168b520e542b61319375fe1
SHA512 96da6f7e29fe2da707295254b37a1e5bd571d62754e86dccff3e24be236f6d8d29e04b29fa4de7478af65895dfb6243aa9c35b8d5f53f4f382c86adcd0f8948d
SSDEEP 12288:nBAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkY8:nZyvOcXW/jEEL9HmNuQJDzkY
TLSH
T18A45235E30EE464EF0510EB662FE40D5E49C1DDB3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 731a3e283fd9b8cd28187f977310dcc334592897f770a8dbc4874cb6d36bd582
MD5 79e38d20194efbb452dd6174874765c3
SHA1 f18a696030d24ab599eb50ea59f7b585dc25e84a
SHA512 3484b74633d52162bfd0f4445478d350dbb43d0b912be91dc69553dc585c16c9e2825132a800cfcd24bed7e9ea59ac145ee5d0d1441cb4a91339876068349802
SSDEEP 12288:xVQAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYx:IyvOcXW/jEEL9HmNuQJDzkY
TLSH
T1BB45235E32ED02CAE4610B7996FE4095E5AC3CDA3E3603AB77915E021FB16B09731E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1ad613fde9161307470560e77e50281ff72201cb44ff3bb3d6240da99d0bebbc
MD5 22ae94407b133e85e74180b21949a23f
SHA1 cbca85ec4220596d39be1490a7eddd78957b8848
SHA512 9582b7a573715bbf607840b993011f9fca9655ce866ceec640d6b4eaa737e921bbba947463f2d96582d7f4313cb4d6486101a0609a5a1528efc8b57614159b9d
SSDEEP 12288:TYAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYL:TEyvOcXW/jEEL9HmNuQJDzkY
TLSH
T19C45235E30EE424EF0150EB662FE40D5A89C1DDB3D3A027376EAAA01ABF59709316DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f578c13afb2aa9d330c6f8c47c42fefb39225361a42a05e3b136b63e899297b0
MD5 2fb69c9c20413dc227f976ab182f6deb
SHA1 25d0b099d4e6ec704a796a034b1844d5d0c4540b
SHA512 30ab186420457bfd0d73e73f238d5f71c87522b3481a92a7b80e452a4f90e0f6df63a090b3188f2c590494b567820998eec46e20dff3d814ff1266a0c9f42926
SSDEEP 12288:LLAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYL:LzyvOcXW/jEEL9HmNuQJDzkY
TLSH
T13445235E30ED464EF0250EB662FE40D5E49C1DDB3D3A027376E6AA02ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ff45ecbf591ba42c609754dd73aebd2b57f0c57c33dbeb3d9fc0a5e5e7fb614d
MD5 5df7e5ed971e8a7d7ef88acc745bb8e0
SHA1 319cce7bacc9c0d413211a5132a06ecb330f8708
SHA512 38a0a35af00ba945c6d7c4263923b69fd53d7943e3e57e0e67288090ad8cd401069890be90cdf43a9b5cf68ae348e084f475699f5e966156c0b714f336739174
SSDEEP 12288:XPAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYR:XfyvOcXW/jEEL9HmNuQJDzkY
TLSH
T13345235E20EE474EF0250EB662FE40D5949C1DDF3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a055b4b247d2db6429aa81b89bfd0a51fbee2d63d7bfe786e8ab3ff6adc28f19
MD5 493270a5f5117fc0f1c9882e9e7682d8
SHA1 9d924a118045449655e36e7bd2d2de6598a97b2e
SHA512 c06ce0b60ae2431482e2c22a10f9fe9013fee2c089d3c40cb8ac2db182f8344bdd804b0da817a251a0e680712c7b44097f6d4551f106448d6e66125f3cecc46e
SSDEEP 24576:2ZMIzFVSO3yvOcXW/jEEL9HmNuQJDzkY:2ZMIzfjyfYEEpGnJv
TLSH
T1DF65019973A408F8EC63463EC9698806D6B27C5A0B70C61F13E436165F733A15D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 af5a902571b9297a542e6aa7515b657259daa624674cca4ec6652c46a07b7ac1
MD5 d4d699e1201a9db39d74cd030dfa5dfd
SHA1 248e6a954c0166108ee9c07d20cdefb4ad8ec298
SHA512 cfedc849fee4280746f1caafe932d142fc5248862fd0c998ec2b9c049a9a77d3613198b2da3a979dcc8de560dcfe9d6168089a3314fa8d4788e9aa0c9719680c
SSDEEP 12288:EaAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkY1:EeyvOcXW/jEEL9HmNuQJDzkY
TLSH
T13B45235E30EE464EF4210EB662FE40D5989C1DDF3D3A027376EAAA01ABF58709316DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8c6efc4c62f4bd0ae3dad3dcbb4923124c0a0f6b44ce089fddef936e4a1dca23
MD5 d3210cc6e61ed7cb14834b01e8e7fa63
SHA1 54e38eb92658a87c17d4020f082fa45cee6b91c2
SHA512 1189011df35d2856f40b457979b99ee2ba864e232680bdfac907208d908d9a9274b0bc9805af91e7271dfbadaa7d4ceaa89a6af54ebe14e20a8de19e1adbc376
SSDEEP 12288:AWAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkY/:AyyvOcXW/jEEL9HmNuQJDzkY
TLSH
T14545235E30ED464EF4210EB662FE40D5989C1DDF3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0629cd8067ae0bc2901ff71ac94407de35d07fa1ae9c08e0884c0074399d21a9
MD5 356100ff3889a5cafdc1697e8134cf6b
SHA1 ab55a59605d2463c146e64913a9f655caabd5cd3
SHA512 0b43ecf760889896e7d4fee87b1fb80542868022baacf72c61576a1f891b6332440b98420290d923881d9f52879e9044dcc81b62f61bf1172e317e32459594dd
SSDEEP 12288:NyPz5L8DAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYa:kzyryvOcXW/jEEL9HmNuQJDzkY
TLSH
T13955124B33E931FDD036023989A60941F77578761B344AAF23A447762F776A09F3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c95bd5099e33843a796a76ec9a1859d276a7ae073b86616c944175ade0b18f20
MD5 0596228030f9be7712955b41d5ef56a5
SHA1 8a0c02454520d1eed99dbfa0352dc973a3974687
SHA512 2e3c825d29e2664b90e89eef60f63a71e50763f258b8b68cbc233e68fc20ff5ca573cdcb58aedf185bd3e09835a8a71cb83b22c4637e80f5e90306478da8c099
SSDEEP 12288:raAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYK:reyvOcXW/jEEL9HmNuQJDzkY
TLSH
T19D45239E30ED464EF4110EB662FE40D5D89C1DDF3D3A027376EAAA01ABB58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1069a7d495bdf996484e54c3951ea3e94bfa8159fd1fc55892055798ce61439b
MD5 5ff6dc8f681247bc2976bd20a20c2c38
SHA1 2d70d60d837f63e3d10e758d1a01c2c34b7f32c2
SHA512 8553b91c3a25940c30fce7e86094112bb809de6a5b0643d4f3355e79d7f19e269cd6dd1470a0e61a63c6e7176e0cdb57247e64affd9ff61e304d28add6222bd9
SSDEEP 12288:SaAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYS:SeyvOcXW/jEEL9HmNuQJDzkY
TLSH
T10445235E30ED424EF4210EB662FE40D5989C1DDF3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 24b4d70ebac65a42af5d528663df17d4c7a14a4c9b19eb3327c575028f393f91
MD5 dd3909b3504f112f44c643f149c0984f
SHA1 a69f18237bfcbd253791166aabe0598be85a2e18
SHA512 99fc6de3d6c54338ba84c957b88d9538c19f0edec0d7f0bf321ee2916614e85d0970b0b37a31ec948e6133b5b73b8d4045c13de61e4323044da1cef7d93b8aa5
SSDEEP 12288:2yPz5L8DAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYm:LzyryvOcXW/jEEL9HmNuQJDzkY
TLSH
T19F55124B33E931FDD036023989A60941F77578761B344AAF23A447762F776A09F3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 121ee19391450b26d7c62af6f104c6c8c170849f69cc37b419c5e779ce71ba4a
MD5 a0ffae466c51f3a8c1af253c89d46ebc
SHA1 23410aed95e3b1660936a2c8e296e32f5097e0e5
SHA512 692e1688db386e2b413bfc59261fde94759c872bc26a4442d99cc44242ac1ecad54fd27120d0684fa6f7a57e0f176b5dfc1adc7faeef76960995dd90c746c576
SSDEEP 24576:iT5aLl3z0zDpyvOcXW/jEEL9HmNuQJDzkY:iTkLljIyfYEEpGnJv
TLSH
T1D56501A9739418F8EC67463EC96A8846D2B27C5A0B30C61F13E436175F733A05D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 047f94a8ff16392b20ae702807cd05a12f16fe4ddec668070b9b65d1d9edea41
MD5 3cf3fe1dfbd8e5e64c1230236ca8a309
SHA1 0057542e3d83dcdcf4bd4d0dc0809f4b09c97507
SHA512 5b5a6ca2320bf3da56a07825f424ba2716a5b8f6a193957f2090c51dd393ebf90aef27538af54eec861931cc02f18c15edb2ab608435e2a69e48cf64db6a9c33
SSDEEP 24576:531d9CHKy7GZFyvOcXW/jEEL9HmNuQJDzkY:J1d9CHKyajyfYEEpGnJv
TLSH
T19085C094F3E810E8F0B78A3589764511DA767C9A1B31DE8F13A4661A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7bb2bc51fc71a260f32c2f3a45001ff1beb104e49e6566d160b811c93fe5b7ef
MD5 d72dfb8e4edbd9ec64bce8d8f1714600
SHA1 b4c9f2ce62daa85a5cf27087f5b77576ee1383d6
SHA512 758196efc1869c6741a3d37abcdb85776d5f50b3d83fad7079d885e599440521c27f921fa38f91777492e2c1717caf3a01ead5bc668b2dcc5172f530d0593443
SSDEEP 12288:hhAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYL:h5yvOcXW/jEEL9HmNuQJDzkY
TLSH
T13F45235E30EE424EF4150EB662FE40D5E49C1DDB3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8d20ebb63f844b0d284aec079de306deaf8c5802d8345ff9f191095e44d7d770
MD5 5fa75eea88899f384facc1dc4df25c0a
SHA1 0f01bea5d4529bcd4cca80cc5705ae3159d6a694
SHA512 b85dbbd542c79f3672621630aad337d595c67ea4016560b6a9078a62faceb0ff9543fe96f281d5dbd78d909763c661caf133aa4c0e8adcee99bcea423497265e
SSDEEP 12288:HjAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYq:HLyvOcXW/jEEL9HmNuQJDzkY
TLSH
T1F945235D30ED468EF4250EB662FE40D5A89C1DDB3D3A027376E6AE026BF5870D312D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e0718c7aced7d13de77fca95e083399c95471eb68e95a72835a7e6456c848125
MD5 17d0ffb83eefc39da950ea0a18dca986
SHA1 9d280acfc4a0cb40bd7ade715302e03717fbe468
SHA512 a28f3c370a025b111ba754de6eb6057b7c9550a737bf776268ff9b32c817faa0e9161b5cf1d6189ef455876c9e7a0374929cf8b030f6af54124dc8fff9db1458
SSDEEP 12288:KsAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYn:KwyvOcXW/jEEL9HmNuQJDzkY
TLSH
T10845239E30ED464EF4110EB662FE40D5989C1DDF3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ccae98843ff50761c34e51e4fc210059d1da688a5aeb893061468a193fb00a03
MD5 b8ab7b131cb9ceae32d627e74e2f518f
SHA1 17fa2a3d386ed299053d35df918ae9a9e2dc93e1
SHA512 1af4add7d57e489988702725c5955e80c0d0383124581508a6708abff64d9438461e9078ccf4c827ad355793b1f353b2612a254f48f79640268c2a001f583594
SSDEEP 12288:waAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYn:weyvOcXW/jEEL9HmNuQJDzkY
TLSH
T11545239E30ED464EF4110EB662FE40D5989C1DDF3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3b44a9c27e046ab1d3e69caf8425bef70aac906ae26e40944bad9b5fdddd7664
MD5 c271fa2141d6743000ec31b23d428ee4
SHA1 d04ed32e64b36b894df68c46823d0b10ef722f94
SHA512 61923c0c481c4ae9c5dde698ebd12d13d411295e9f12c594208183627c86b295cb5683633f4e2066e0d274c3298e42534e24ab6c82b85a51ccd1de9b00c674cc
SSDEEP 12288:dhAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYl:d5yvOcXW/jEEL9HmNuQJDzkY
TLSH
T14845235E30EE424EF4150EB662FE40D5E49C1DDB3D3A027376EAAA01ABB58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3685f35f5f9a2441ea9375a1f4a67749bbb071ea5fea4c084a1f52e8e3b3de6a
MD5 49f96e72fd16aff1da5adce4f9dde6d3
SHA1 6efe8a067772779086582d4c5279386aab40db33
SHA512 9cbaee4667112519735bb18df4d89d722c7917b9e6eee533021e79c1c9716ae47ddd07a9f18c600bebffc00b640bf90f729dfebcf88aade93ed0e297d59235fb
SSDEEP 12288:6iAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYZ:6GyvOcXW/jEEL9HmNuQJDzkY
TLSH
T10645235E30ED464EF4110EB662FE40D5D89C1DDF3D3A027376E6AA02ABF58709316D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8fa6b4e0d66e510745c23e71714745bcba3ab5b450cf94d25b76b99e456c6a0d
MD5 a2e9aa1ad79a6c8b22be4fdb3d0d1a25
SHA1 1d007e6a96f9b996193436db0f3842e3c287e4ad
SHA512 2e84ea4f07b9b92fdbab05cf1a23fe257728254a9844278a9ae30767eeeac7b617fdc9cc566f4bfda05805e5f164f04407fa01c089203366ce062c9b1e58069a
SSDEEP 12288:nYAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYF:nEyvOcXW/jEEL9HmNuQJDzkY
TLSH
T1D945235E30ED424EF4150EB662FE40D5A89C1DDF3D3A027376EAAA01ABF58709316DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c313ad31ee1586e3bd91b690db8ca933def6123baff023450ff6c70b927b66b1
MD5 393000d2e8ca4a1c5a1c1d824ec7fe14
SHA1 fad8f86955dcb7cf41e903f8eba00c97be418761
SHA512 9b73cbdfb068ef1257730d2f4100915422a33b7b582017d967ed6c55c51d2ff304679f5cd1d62b48cff46beaab10e5b632cc0f7b91a7782ebd9b165073d86093
SSDEEP 24576:pfwvvk9RX6wkyAIiyvOcXW/jEEL9HmNuQJDzkY:IMnYIiyfYEEpGnJv
TLSH
T12985CF29EBDC44E5E077923C99B7460AF6B178591B31C2CF129A536D0E33ED49E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a315886ad6aee4af5290dcad0bcd6d74fb425938d02950a88d78fc0ddef32eb4
MD5 c98b8cf95d1675ec7fe8c9edecd328bc
SHA1 5571f1afe5852dc0b3063931521a137c28886934
SHA512 a48c449ce9a69dcf795d9c1de6327302b0145fdd7950df4873b175e0c6b4b32856a1f93c83606d9a6368c8bc65bab06a4d38da6f20fafcb485479a1d254da37b
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tyfYEEpGnJv:NySzPFyfzKQ
TLSH
T17B066C56A1AC01D5C1B9C1B98B1BCC1BFAB134490335ABEB03E556835F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 374aa447f41dc324c6309ee893772e81f3a7d0ad8ab7e9230262d876b16d781b
MD5 31d05c4d68c177736aac6c3e6d23b658
SHA1 ed4b06cd12217bf9d641e8d5bfd1f8e0c7d50e93
SHA512 df831bbac0f34f4995bf2bce3586990bb3bf56ee5faababe26de7916c8045cb0428bd7abebbac9e9d1b6148d21b4ec81f21ffb87017cdf736752ba1e7c4c9af2
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYnyvOcXW/jEEL9HmNuQJDzkY:k47JUQj1irIhCnDHUPfF/dyfYEEpGnJv
TLSH
T1AF65AE1DA3EC01D5E1BA827885154A5AEA71742E1F31CACF2270837D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6a328a2aab2a2357724b09f3d59f1edcdd7d5ad43558c8fd51c1eff49adbf73c
MD5 a0501798fdc46550f138bb1a12bf30b1
SHA1 1fec91c6a35ef0ae85a71d0ceac307b0abab9b35
SHA512 9536469256d0985a6b552592a2d09eab1e792d08dee984e002ca5458716b6dfd9fe8637a611556274f245a92a914428205cbaa736b440a85b88266deac99f11b
SSDEEP 12288:HnsfKAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYY:euyvOcXW/jEEL9HmNuQJDzkY
TLSH
T18255F10ED29802D8D06E1279C7AA4541F3273C6557F193CB62D0F93E1F766A09EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2edfc2cd2ca366be25fc9a33da2299d53bb9a8e2b99a13aac28a89b23057e710
MD5 41676267bc493e663aa6d44e79474f78
SHA1 8533ffbadb1c3adddb6fa33c4bb1b079f9417614
SHA512 69cf1fd14b8b720fa437cd00457cfe108e5ba3547e8f45f10a992414652d8003691d4fe72452f47a2a298dac7611c60089547753cff990eda7dc72228ddfad31
SSDEEP 12288:6MJd2U3fo3SLtT+k1y8wTYCNeOoNtyBkGnR1/K1:6MJMUPNLgTeZNt4xnR1A
TLSH
T197450641762BC69FC6A950321E37D6CCAB707D01EE05AF1773C8473F8476668BAB5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 6c32e9105755da11d69e945e3e93f8590f3fdc17b488baa5268fa8dcb2e448ec
MD5 5ceb21c434c700b7c1dc241c6955525b
SHA1 0d0c8e33606bd753d1e00d18c732359db77e5a50
SHA512 ddbff0df70a99f3eea9a3ac605e22b25417fd286c6518644404fd41debb0a9a848e2f55c7424f239f283af3a631bd271fa13d43528077c27ed5f9b5363617347
SSDEEP 12288:722xatC2OrbERZKsoGN/pXTsUvnydOCkx:73UMn3CEMxvydnkx
TLSH
T167451A01A5A7E35FC9FA50370732C68DAB749C07BB462B0573448A3C986767EF5F2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 143a4df0991dc041ab6744aee4e00b9d09d83ac106ebd8c89e533b6e41b8f898
MD5 2853f2e0e97be366c33e9efe1baf8417
SHA1 775811fedf591d47f94e78e389206a1dacf1c474
SHA512 43fe9baf2ced297ccef2677a7029498d5ea81f432085c7bf7cf7623e4841ffab5781579a339dc7b7f2160d0b0c5be8d5059d6a20532a29a5c975172880c28856
SSDEEP 12288:yH7SAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYD:8WyvOcXW/jEEL9HmNuQJDzkY
TLSH
T12345235E22ED464AF4750FB522FF4060A45D3DE92F3441F3B696AB016AB58E0CF31E89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 509ea256233640fc9ee651c5372cc0f4f274c8f51422f8dc71ebe6cb9b6d909c
MD5 0799a293ba81dd5f87a08361c592e009
SHA1 8da2b67b6c7d7cfca88bcdc215e24edf67d04870
SHA512 54995a125f7d6a1cd498b14605ccc44f206755e71de19a0e44998ea36cb4432c8e854decbfde088c7438a90f59213b657811ca26f2b2d869a5b513eee46bbd41
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYIyvOcXW/jEEL9HmNuQJDzkY:ugb4mBIBhGFnyfYEEpGnJv
TLSH
T17B65AF1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9dc18f6a3f436805e2559c2d336025a5fad109054616e315ff53795ee3e588bf
MD5 c7bc3b3b821a508bb54d1b249468bfde
SHA1 4263cbdfe274dda3ef64652cdf047dfd9c09f914
SHA512 6ae0808b1a93c3af949ee73f09175bad0dda29d1baccd942a0b54408cbc6fe5db7d7efd43dbbae53ea5ef054b30dd2fecbec68e0f91d0d5a5ce37168e8a7cd78
SSDEEP 24576:qG88u8FpJqH1Nzria7/m3yvOcXW/jEEL9HmNuQJDzkY:R7ZFPqV0a7/QyfYEEpGnJv
TLSH
T14C85F16572E502F1D47791388A964663F6B2B8251334EBDF07A88B411F33AE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8341c1d0187bbaf176e31afdcbeed951d6f875a4a3c89d36fc694b7ccea718f2
MD5 47900bf993a7de4a7ee2d5c991d4735a
SHA1 b99e45e23c20a76b7b4cae4c471966d238a820ab
SHA512 18430cd9df72d2604bd570f93be641c96d58f4118bd7b2ad32b64a83a84c51f4239c8833581a40dcf06043951ae959a17b726c07fe45825e5eed25b7ab4ae599
SSDEEP 12288:rHvUrBFrEjwaQbAIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8zkYt:rPUr+NQjyvOcXW/jEEL9HmNuQJDzkY
TLSH
T11965F12F22EC18E5E676A17D85868609F7717862171292DF02E1813E4F77EE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 022f9302c9103550d55faea8fc1323b8d697b14e27e553c3c7f5381b04f98eb0
MD5 0a54b39680fa3b795db7091d3c07db99
SHA1 8f1d81abf8c1ff4ef88e7d32645c6099bf861443
SHA512 9730c89c21bf283547d95f8c0c06d27c21b8fbd911383196775bd4ffc2df9b0250d0efd6378b68f3f32c26af0953a0548ac77c7b02ffefa17eeba40312ea3781
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzyfYEEpGnJv:vG05lO43bqyfzKQ
TLSH
T106D5CF6E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 526361530258dcdf49d71f2cbc20e41d3fcf64e3c610cb65463fabb8855969ef
MD5 c2ced6f12120328df3859682f1a1c2a9
SHA1 815d1d0aa495b24d19675f252e884029677a3d3c
SHA512 6e806121ce0afdfa64dd91b5ef66810592df04a9bb8fc2426baecca419902fa4d3d0ad5ac3ce6383b2e555d37b585f49b8c6a719323b8bb2b9ead26035ef6880
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidntyvOcXW/jEEL9HmNuQJDzkY:Va5POZ3+Jt2pasx2+mLyfYEEpGnJv
TLSH
T11065AF5EA2FC01D5E579D17DC583461AF5B1342613329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ce85d67f8a4676da18ced10ab66e66e66c23ef908299482c39c89a9fda5eccd4
MD5 c0c2e627ac6a48aa1b95600004580428
SHA1 2dd6f59736e532a081088eab13629e7fb5d49af4
SHA512 cd6a07a8ca1594c6d9b6b0cccd81a74133fa456608ea3e8c6622ae4861d7db681a2bff2869b453e5212fc65594683f18a7bcdfd39024c478f72ae14eb68c4162
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkvyvOcXW/jEEL9HmNuQJDzkY:JNc/zEOVHFwyfYEEpGnJv
TLSH
T1DD858C1A23E901E4F1BBE1BE897B9546FAB17865173086CF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 535905d6540c0c04cc554994f06495ad5f948ce1a07f7fb51fbaf93e23306ca9
MD5 5fb1a1f4f251c1bf701c285ecb126d54
SHA1 76d1616f2d7656ecb600bdd624e3d1f573550e2c
SHA512 8ec9bd77a081451a92b214b8be6e356c69c2b5e94f067fc348087dfd6811ebb820334f094035cf2c4d0d37e50984f0d69588b00ad1352f85f9d293a08ccb808e
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBm2yvOcXW/jEEL9HmNuQJDzkY:Y8MwBtOm2yfYEEpGnJv
TLSH
T1A755AF6EB6F806E4D1FAC6B58D238512E6727461173293CB5390C13F0E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1b625409503783244752a89e2441bf61dddc57ad691687ea5db277f6ce29cb38
MD5 0834d03df9b34b0462ed79cb940c133b
SHA1 7bc2091de0260297725d46c45e125bf05504a14d
SHA512 66396c0b0ab9a02532fc6813a926088244872486567e483bc619b35571d8ba07ef370a9c854700b3f59d596dbe000ce272e4febc2b6e07293c36e0507c1119bc
SSDEEP 24576:cD3FHshBIYQgAayvOcXW/jEEL9HmNuQJDzkY:cDVHeBIAAayfYEEpGnJv
TLSH
T1DA75E17EE69C04E4E47AC2BCD6A38506E67138AD033256DB12D4C1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a8eeba7bb30f546e1ea14659111584cfe9a5080971a447b97de8ff9e9fd75ff4
MD5 d091f158f72436b724e5912d71a60abe
SHA1 ae6275aabd7e922c3aabba632cdf35e7b63d6f5e
SHA512 75468fc05f419611bc5a46c53645a5648a3ef844e9e6f88b88c57b800ca7cfdc9ff62f4e54d2a07f922968273a8e23d81621dd0088c63506ac7f09ac77923c63
SSDEEP 12288:vmw5HEjsChNHBFgl0WDm+C7AIWXvWBmCq1dJNVM/wnu/sETHqiHRq1NuQJi+sh8j:OwueOWcyvOcXW/jEEL9HmNuQJDzkY
TLSH
T17965F14A32E80CF9E9674639859BC036F7F27C452A35D71F17A0C64B5F37261AE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-286-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/572-60-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/572-66-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/572-58-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/1136-311-0x000001E7E7600000-0x000001E7E788B000-memory.dmp

Download

memory/1612-298-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/1612-76-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/1612-70-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/1612-71-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/2032-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-93-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2032-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-304-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2032-99-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2316-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2316-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2316-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2316-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2316-21-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3076-119-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3076-128-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3076-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3076-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3076-125-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3440-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3440-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3440-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3440-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3440-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3440-321-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3556-52-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3556-47-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3556-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3556-9-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3556-0-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3680-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3680-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3680-56-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3680-38-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3680-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4704-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4704-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4704-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4704-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5228-307-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/5228-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5228-107-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5228-105-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/5616-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5616-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5616-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5616-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download