a5e750886ae45f2a2bf0debc3b286715d89b6ba4a31949b783b46539b32d2e0a

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
Size 1.6MB
Sample260809-txvz2saj2v
SHA256 a5e750886ae45f2a2bf0debc3b286715d89b6ba4a31949b783b46539b32d2e0a
MD5 861e4f5c69cf53bddfebfcc119b8ed48
SHA1 928186eb70f7781324f2f14ec70e4e84ff684af5
SHA512 70523d437b66e157ae2fd22aeccd9a833d94bb6fd220c113e49ea508737a1e4e4e75dd014e292c1e24774300f7d9c5cbdbc3284462b934d1d7e68dc87522bed9
SSDEEP 24576:CxDnwlOjwGXWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:2TAOjAxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T186759DB9E5B844C5E2BAB53885638559D222FC09475196CF3A687F063F37BD0FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6264	elevation_service.exe
3572	elevation_service.exe
4940	maintenanceservice.exe
6316	OSE.EXE
6812	PerceptionSimulationService.exe
2160	perfhost.exe
6724	ReFsDedupSvc.exe
4620	SensorDataService.exe
5468	ssh-agent.exe
6344	AgentService.exe
6908	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\625ab959957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc8e63e91b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000063125cea1b28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0da6dea1b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b883e3291c28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074f5222a1c28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017e5ade91b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001de5142a1c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000daa2eea1b28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad7d56ea1b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6264	elevation_service.exe
6264	elevation_service.exe
6264	elevation_service.exe
6264	elevation_service.exe
6264	elevation_service.exe
6264	elevation_service.exe
6264	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5636	2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	6264	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6344	AgentService.exe
Token: SeBackupPrivilege	6724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6724	ReFsDedupSvc.exe
Token: 33	6908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6908	SearchIndexer.exe
Token: SeDebugPrivilege	6264	elevation_service.exe
Token: SeDebugPrivilege	3572	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6908 wrote to memory of 6684	6908	SearchIndexer.exe	104
PID 6908 wrote to memory of 6924	6908	SearchIndexer.exe	105
PID 6908 wrote to memory of 1980	6908	SearchIndexer.exe	106
PID 6908 wrote to memory of 3420	6908	SearchIndexer.exe	107
PID 6908 wrote to memory of 4516	6908	SearchIndexer.exe	109
PID 6908 wrote to memory of 1000	6908	SearchIndexer.exe	110
PID 6908 wrote to memory of 3936	6908	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_861e4f5c69cf53bddfebfcc119b8ed48_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bd1976192c94d2a23dbf25040caaaa623b290d84420190bb41bce657f5a15fc6
MD5 c4fda308a31a80936517a3d43429e425
SHA1 f0352c2b30f672874db927bbaabf64d3294afc2c
SHA512 bd643312293c5b9f8802619065a99015f033280a481ad922ff473c52e998d619d393d2f53fdcaaa617cbc7006f746c0cd3eee10c52f947d9293aec9b1122d331
SSDEEP 49152:Kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnixlMPdlR8v4UC0Eg6ET7M/I:83q6sjBbl2/V0cETQ/I
TLSH
T102D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dec70731a123fec61101328509ca86905dbadb3be618c3894d8c06756902fbcf
MD5 499e553673d9e7f249cb49c42c80de39
SHA1 5e282c2a946aae237db04647127591a86971b666
SHA512 7c348000af54652df578d876529b57824687db7fb5fd537a8db54b8c2c0ba01fd92f951a661ca2d39e0eed0c5be800ed830696bb0fb69965b00c3060d9f0dd12
SSDEEP 24576:/XYfDtczAoWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:KtcwxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1D065F16877E048F9EC278278CCA2C116D7737C5247A0E38B03A49A665F277D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1e2e3b9e96577766eb1441f4ffa108e89efd9709dc736d65ef9aeb9b82ae7076
MD5 f51c5a56c94a487824accc0ef1867ce8
SHA1 a39f4db99ebc1358fdcb44e3c10a405cb5b6581a
SHA512 1ed2546f5721759a99c33fe9a061c003c7f08104394ac2000a91d23b318f0e9df5fb379f18d842b1fba5495aaab3fd3826542866a490dff36e572eff12eb5fed
SSDEEP 24576:h0Le5ji0hmxxrMbWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:hPji0AjLxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T14E85AE55F5B48335D073C0B9C5D2A69EEA7230821B308AC74286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc297fae572faad30885e08ec371efc9809d3d74cca2539314220c4a5a7c5620
MD5 17fc1d931e1b0d610ad80d4e1808faff
SHA1 1cc39d3c4f5192c2c170a51de495704fd0a4857c
SHA512 41c3dc3aadb17350c38922ed5c02473ba16bacddb0c42c50b9eee6472c0dfdb738674e9421fdae1780e67f8e438a6a638668686e27fa5ca9dbebfbc0e2653bb6
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyudWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:N/ezSC6vUzPveHjyPxlMPdlR8v4UC0EU
TLSH
T104756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3cedc1d3c62ff785d67bf5f8acf3a3a0f4b2abfec94fcbc78b32ade376f791ee
MD5 3669c62f8d628da02c266cc657463889
SHA1 0ad0ee19763fa87be005d12c3d2b1ecd8dd1f6e4
SHA512 e23017b8c0f60e500fa60af4b29c0afc147cfa3aa24aa00f09912dbd6f3723636fa32b416de0b35efa5da38c2e8b140750110eccbec8ecb5bb6aef3ca018722d
SSDEEP 24576:PVbqPb88hv/l+YkWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:PVO88hXl+oxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T15E559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6985fb0e682cf8a6d2d7494b296fa963a6b67de80c4c73cc922737226a183f2c
MD5 4e936750971f58aa1ee7f874c50c2495
SHA1 666a9c508713ae47ac95a20bf48a7f5684461c02
SHA512 221c3d718a025fac31b03c5fd300b41363dd0c790e88e369f84904746066e203b3a31f75e56c857cca4578b9b577d4e7484625d9c0ab988c6dc03e5a9b1f3a9a
SSDEEP 24576:SL3WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:pxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1FD4523C069D4E05BF2260E718CAEF02FC3770F9259A121534B423F96FE3C9D2D68A616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8733a4798af064159b9c696610277722a47b564c73a95f6ae979858efe94807a
MD5 76da3f32fe6d073be94858384aea5fd7
SHA1 80892b9988dfad82e23903ba6d62297b24255b25
SHA512 8406e2d00fe9cd6bc618cfda6eca9df7fa061c24688cb5114deffc591a0d9cd746a501a82256ba704b17fab19264e4dca04338d78b87b4ddde96e5c7ac875a28
SSDEEP 24576:mJIUcWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:mJIUVxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1DF65CF6BEE68FCD2C27A4DB84A91C200D77278314F62A3CBD165830EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 95d42e7eea55c94b9eb57cb71d5d55a801aa3bb9b46961793b8c3998a37042a9
MD5 29a914bb85c2ff3f18a049049052d515
SHA1 6fe73faa7a2e6c9327218594d6af47bcfac3b656
SHA512 5967a75c5262082c9116117f5e91920c6a61c042f5706b6ce11662407137f6240b96839aaaf396af8fc936d8812ae51ebbccd1d8b89e313bf0c04bcdea5b2064
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:KQvGAdlCEL8c/DRNw5CEl2/V0cETQ/I
TLSH
T152266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2f9334f6d7632ed5a67b728c4e7b28964ace851d1f3fdb18f4d303cba1022801
MD5 c5f68ef739e3fca5d65b1ff7443b045b
SHA1 2c4d47c1134f16cef13a6ed62772a4129929edac
SHA512 c4a36c17f0708db1861a6ad15c191de19fda39a9e6938c1373123d72091815dcf7bdb9263322df68404a17e3533aac8c530fc5667059c8cec452337252c8c9ac
SSDEEP 24576:Z0ewsAjOWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:CljbxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T17375E071FEB4E036C27B0DB20B36D316547D7E204BA119C3E3A85E9E99342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d1529b9b908188727e258e29e6a30c2a93a46da2b2e6d95254c805dbe38c48eb
MD5 109b77a9751a925577cee5d3010af0d4
SHA1 7e22bae6ed50b123fac144c337bca564ecec56ba
SHA512 55d4a43bab4489cbb27a908809808ca9c1f66370ccd53503d5d8fee9971383e5b23c6a87886dcc2b3da9587313cb86f2f59e54509458559741cba91e837089a3
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHF+Z:MUEtQevvqc2W1cpV2tI32F+Z
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 32c4e4005b61275fd7d2259e90ae6a8bcd96a277640f13af3d12df75628826cd
MD5 faf69313a61afc16343d0c5e4e1ba29c
SHA1 19e97abb961ad0fd881b3cdf07050c454c70a888
SHA512 d8fce3f76359b68d37837b43af3171ebcfe0b0e2509d4626b334e41a2553f37dcd82e9a2ceae0baecc4cb849951316d23e50c428e15f836ffaeff2729f51579e
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/z7xlMPdlR8v4UC0Eg6ET7M/I:poquVjnmgl2/V0cETQ/I
TLSH
T1CBD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 834a504b898da78c4baaf00d265c7e7624c07e3618ee97ef27e11059871e0807
MD5 50e3349f4f0998dde749cd4a71ee5c04
SHA1 23a3da275d2e853f8d1507e808e145b6142e3ca7
SHA512 a746c09b44e5534d2afcca79d02c24a2cf785afa4ee14d37808cee1f929f416baa274e62ae0c3c97e97265b4d018f7e6ef23467b9ed1f34b8d1181ac70a6f27d
SSDEEP 24576:fAhGL3IFoiwtA5l7S53xWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:fAMUFoiq50xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T19A35AE80E7F951D4F5B3AA7899B69171EA76BCA65E31C20F2150D20F1E37E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 09f9bc3ad62cd541a6d261a1131febb37148bd7360123888dc1d652b6d5364c4
MD5 93055c735b0eaf2a69af8b9cb1eaf78e
SHA1 7a0c481e0a5b9039966be12a936e9fcab9ae6336
SHA512 e03959d1a65d5066b4f532748e20303fef4988b94a793bce422f72da58c2327f2916ffe1da3899f2f3c5c65bc3a84c800d860829a7a8b1dc4a55f8e8bd25fa6e
SSDEEP 24576:6wu4OWSWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:6wvOYxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1EF65F18536E41CF9E56746388957D136E7F3BC022A21D71B0760C75BAF3B261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ebdeaae8266c1c95706a887d78b3a05e84e810c5f8cb32fa37574688ea3ec1d9
MD5 a1985114d90592a6231b4942af73a30f
SHA1 2548cb7a165f43cb585ecaf40fccce170b8d67c1
SHA512 5f1dd9d066a5d55fdf507c5da5473fc5974a2b833a81c0f609271a04030a036157f24100c2bedff89b3d4027c75d52b3654dca21278a9d85812ac6c6b3a079db
SSDEEP 24576:pZuTWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:9xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1E25512C936D4B0FAE1630678CCEAA11AC3737C53277253CF1651175A6F2AAC25E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 731e2186f8b8b33dfa058ad8a476bd394a0f1b64165ae778c0b06840ee55eb5d
MD5 487d744959f3605b7389fbf942a42202
SHA1 74276ea58a2b671ee4d4fda7ec5153b0892262f7
SHA512 db66ef4656c053b49109c3e5a3e0b82ed3a5ceaec9788e71f47c2ae9ce5e8065cbebde59465cc775e0a66ca49afc1ab170ea3a9d7d4e967e92e963cf27d8d8e8
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3rl2/V0cETQ/I:uQyiKa/X+PN7+Z
TLSH
T1BF667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9b080a33abe6f244c3c5965188105b218513a7cb1fe33268be061179d02df56
MD5 2294d35c501f9d03ac0609522a985345
SHA1 67096acf32eda954fc7235d47a68f65e79f6f9a2
SHA512 7502fb0cf895539d7ceb376a8a5fad036de79362e43f084a50a6022628c8ee3c3f054713f3cb8def729ec301591e3bafc71a4e45954bf9fd0a9bc8ed75f7bceb
SSDEEP 98304:/QRQyi36YOcPbLvw2gAf+PN3rl2/V0cETQ/I:OQyiKa/X+PN7+Z
TLSH
T1D6667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 40b68d8590dbbd62f2f6a57aafe9aef83cfd55bfb9bcee57d8ffd0992c7820f4
MD5 7bb75e9270e49980f77b36f05c26ff73
SHA1 f94172a23b16482849ec9837730595418576e8ff
SHA512 326d24a3163fba03e3d8538e8a3c99a67eb87422fdde02c3f34c1b31d04a7bf3be568d777bcc0272f402230169db14ba8537b5364ae32efea6cfacf18081a278
SSDEEP 49152:w68Qg55nhceWu7PNU3/LxlMPdlR8v4UC0Eg6ET7M/I:qthLRc/9l2/V0cETQ/I
TLSH
T1F9B54933B2F600A9D04DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b10ba57aa7c38c095f237d0ae7a1a568144099aae136f1415c95144b4f6a034a
MD5 5df965e838ef7ad653105e2543c75a1a
SHA1 56a598ac8f4209c0090fdabaefb1835ca9596c47
SHA512 76fe063dea9bd7441c8918ac6ed0aa65bd6ebd83bac3fd216693a767851f0709ca4c45fbe3deaa5b2deb8198d55ab3b7bba117904f20ca874d1c9cf196818653
SSDEEP 98304:+y5112gYy5azzVvt69nLKnhZSl2/V0cETQ/I:vLIHEWh4+Z
TLSH
T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cec4e1a099c1818d9861079df90333c3e401ec143303a63d4bed848455cf4246
MD5 c6f7084be47c07166e49e7e5f431aa81
SHA1 1c8c628d533e2fc035ba75bc5a399649da4247ae
SHA512 3d24b164a0b79c3aa28b2963445be83975b63252e200c2a09bbe87a15af1dfdd5b585b452ad0b7b59873d6a6413f7266d3b310f64356b7668cfb68c369adac71
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glFxlMPdlR8v4UC0Eg6ET7M/I:qu6Jmdxd2d/l2/V0cETQ/I
TLSH
T17AD59D13F1D901E8D06ED578874A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54d6abbc590746f68b2520ff9c30027aad05215dc29b81ea16cba048ead7586d
MD5 9c0ab7a10221339aab96cd964cbc1f42
SHA1 7d531faa16bc3510686c70b472acd00dbb046896
SHA512 3a69081550bcdc9dc3a8dad13b7fbdea952c920186933c13015820e9b5b71732122ddb6ad2c94d2a9560d484b819305349137d4bc95feb5e45fa53bc6fb67e7a
SSDEEP 49152:V1hpsNoJpF1A63U44CwH7R4x1xlMPdlR8v4UC0Eg6ET7M/I:VmifPWRgl2/V0cETQ/I
TLSH
T1F9B5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 51cdae9e1401827f26f0c0957ffd562da01c597f4a35d8525e710de4e0e1152d
MD5 6a40f9e9ef8898e93e452678b87e5c0d
SHA1 41f6dd9cbb92818e35c65e5897d81c4a78a9f718
SHA512 095fad96bd8f6b1d01eab722efe5a2aff2a935786c7c0b3c34be19cd87471c7998faa4655ce2f47fed201ed16418c59b151af48fa33a078751ada6ea0f2a8b5d
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqSxlMPdlR8v4UC0Eg6ET7M/I:G5dKii612l2/V0cETQ/I
TLSH
T19FC5BF03F2E940E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 129a694cafe4ccd31b06cda02a8b346ea942a4aa9291a76cd07570938eef8151
MD5 0f663099e7be3117a24076beaa4b9664
SHA1 0845f205d7e6df7b65c9e2ffef452bff4444feac
SHA512 a5824729448ed885b73c6b7fd69135f2febc5701710efc54dba5c508cfbcd028e4d8468d6e69f6e867e6383b10cac8ec10fbd5d72a452c1de23fe66fe0c452a4
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wRxlMPdlR8v4UC0Eg6ET7M/I:XX2imph8l2/V0cETQ/I
TLSH
T16F95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 478b1438c521b4e838dfcfec096e830324741127f7c814b2c746b3bc46dbe8f5
MD5 7de2ed4cb0949c66188acf31a1c9b099
SHA1 cbe55bd215080da264dbafa9f3abf9f0e09a9aca
SHA512 0dec0c66f97778b1cd6daf7674d2bd481cf3831d459799dbf0c69a090d14a0c27c482161cd225c11a1eac785ef30a059310a07476fc4609f6e120cd50345c247
SSDEEP 24576:gPWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:DxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1004523C468D4D15BF1120EB18C6FF02FC37B1F876A9220936F462B12FF5DAD2568A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 48be67f28c0313bc46bc2c6d33beafead3e25eb6b7689b352a5fd6cb99748f93
MD5 c44a50bfd055a5b1b3666de2901d25b1
SHA1 7d427dd395ba9abf90594c2c0cac5ec934008a2c
SHA512 bc07dee7d862e8c1d4de1d33ab8c72e0360adfd6a28cc8b0815b8d43498e6b9f2eb37875056a4d126c8e136e2876925938a90f190e30b667033389803d3783af
SSDEEP 24576:baWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:7xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1F14523C468D4D15BF1120EB18C5FF02FC3771F476AA220936F462B42FF5CAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3c7d3d11e6067f610ae46ead8d44d85d40e12483922936bc34b8a4b8c85ed977
MD5 3e598f1caf1be06d371604e4cc279d97
SHA1 d425bbd5fb30aa8f5b749803894814e21f09f1c6
SHA512 cb5d45f1b4f3121b8554f7f1c0d17176e6dd5d4267a18b91352cb37c64282ee5bd36dc68f1736919b15cdbe05a7d61b7ae4e29f08ee0a650b5994ed876dd6e48
SSDEEP 24576:u0WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:uxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1554523C468D4D15BF1120EB18C6FF12FC3771F876A9220936F462A02FF5DAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9176d489ccfb5ad4b352a9e47cc4c73694f615793ea47a007c98d1fde8d64e09
MD5 fd7f23feca2a37ef122931823eaf45e9
SHA1 9900045af81c353e5e93dd75f28f31f745684b8c
SHA512 102361c482a33cc63f9eea58c4544b6a824b27efb04dd2f56da7463e0f4bca43c7527dc517e84f1dcc030116366a777c421c2fb47314643819c17a606ab3d7af
SSDEEP 24576:7WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:6xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T15E4523C02AD4D0D7F0224A70CC6BF02EC3B77E93A77222D75B011A46AF6D7D16A65B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 09b4312e20e8493185225c40cd32f4dae68ccd5600bcde272734d4d37cb632b9
MD5 f9c261c4b9611eabbe824cacdbcbe1a7
SHA1 d7fa945ec034625394f1e559b5ee814fb2d101cd
SHA512 de223deccf6f8ee8a2b620311e32ffe39194af241a4b6439847dced039b6193e0df7b6d41e91b5d6652732b08419ec9395d7facd1ff51910e4c4c4ef9b1f7854
SSDEEP 24576:u5WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:BxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1804523C468D4D15BF1120EB18C5FF12FC37B1F876A9220936F462B02FF5DAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 47fbd32c737bfb6559703ceb899aeffb029b8e4a845bab4de9c7a2285fac29aa
MD5 801ae4c3beebdb5331b448fde667508a
SHA1 939e6f45159c7974878bb2f36c0992679e0cd468
SHA512 c21f2dd8f31c4f1561c4ed20104d10da4578484275351357dc0d583e37c70080a5a1befdfb16442d51e93ca9c2a5b1f7c002783170ea13033803e7416380d8d0
SSDEEP 24576:rGWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:vxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1FB4523C468D4D15BF1120EB18C6FF02FC3771F876A9221936F462B42FF5CAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ed7432bde0b3ed774be780171d1c736ab00c9b2eb53527ffb3e90d1c209cf31c
MD5 8a2cec8223f8a770162eb7e9e07d72e4
SHA1 51c752b5ce1f0a63641d164740407d8016ca842d
SHA512 ec02741ad134670eeb19fa7a3a302bc6d8e716fb3b010a990dbd59386f47f555123b1ff1b69f2b3a5e82a330aab305a2a386e7a1e88d73786ed53b15d2fe8d4f
SSDEEP 24576:wiWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:KxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T12C4523C468D4D15BF1120EB18C5EF02FC37B1F876AA221936F472B42FF5CAD2568AA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 09c98599ab28e4efe6a695564817eed6659b2e79d6d8c2a889cae41efe14ef14
MD5 4d928765116dad8d4d438f2d7a21058e
SHA1 7e747d11fc4e2e431d6ebe5208a37e0c0612b622
SHA512 ac1ed14688b899d3bc75b4f28ef09f80d039c63b6b7ef05f46b9d6195a8dcd565157489266b2f67d1c3caa32d843e845826483bb7bb8d4462329f02af7bfe95a
SSDEEP 24576:ZZMRzFVSO6WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:ZZMRzfjxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1456501D4B39058F9EC63423ECC669916C2B27C5A0B70C25F07A436676F373A11D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7aac367b46e30a07a0f9ae6335ebd7b3c690b22fd02e16ec2d219c4feb9300bd
MD5 d950105a5bd2d7a6ae578d5d9eeeb13e
SHA1 da8617208e89b8b8221917f6b697e16036a43421
SHA512 e95acecf824ffda2b6d384646e694a3afd232d0212e7f67705ff65489bef659a96323ca7779b54b24d405ddd11a4c8f0a3c87a13b977d2a2ecbd3e82ea56e139
SSDEEP 24576:SDWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:fxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T13B4523C468D4E15BF1120EB18C5FF12FC37B1F876A9220936F462B06FF5CAD2568A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4ab882ee82ecaacbbbba4e09b8c5b7f7de5b513253bac5101d60608efe1b21e7
MD5 8933a667fe2240c62bbe839e57bc0b88
SHA1 2e62c8ee5970c9c2f8c07212a42c21da76f95cc9
SHA512 eb9a2c9e4876852834d3cb663244aaef3c69e2f93f4baa7762c3b83631227c01dd3c674efa43f021677a21345c5e913a99e452904db91cf05019867a8fd531f5
SSDEEP 24576:HnWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:2xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1864523C468D4D15BF1120EB18C5EF02FC37B1F876A9221936F472B42FF6CAD2568A615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a49cf7070df4bd58b4adbf555468b2d3629338bacae13742143f721cf9d75cbb
MD5 0018797e1f0469f54a7d5e7a56d43461
SHA1 0157496200e160694bfdda364f715ed1f4ed8c8e
SHA512 70f2f1badd2f26a5ab921e3e865cf32a4b57b6b6b1a736f3c8cc0cb0cae4687d94cf431d4189a32c2d53ab5ea31fd4d379fc4270e9129f15943f5941af8eafdb
SSDEEP 24576:Szy+WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:S4xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T11755028776E070FAE1374234CC666616E3727C320B6096AF179407766F2B6D19E7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 03ce38106add46a2428a288dd5ad74a6b5fc2f08c1f8a719afddbca276308d9e
MD5 15f42d64ea0cd70ae9706d01d953f1bb
SHA1 8d832dc74a0156a230d62d037957c2b98d3f7fea
SHA512 9a24918d5006eb0eb6f4ddb1b70da933763c2fa0a6d3d9922e75e8ab6aadfb215c5380f63ee076a0f9f0e5a8083938bd66ab52b0b75f071381721161c5b3d895
SSDEEP 24576:FDWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:UxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1F54523C468D4D15BF1120EB18C5FF12FC37B1F876A9220936F462B06FF5CAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 59d9a89453bd1f388d2e44b430814a35db5b0e3b56f4479bf2a114b4d3083d7b
MD5 d0dd3396b48ddd037ecf4680f4c53aea
SHA1 5060aa13d3fa0af24d4c3809357bf7ecc024bd6b
SHA512 a4bdc37e0ffc9082e3403dfa02609ca23a8bd1ab3354d1670317cf01c27cb7b60e24424bf8125e44455d61f4e3fa591d0a06ac2e4db7eb07365648d2f05c12b1
SSDEEP 24576:VDWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:kxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1944523C468D4E15BF1120EB18C5EF02FC37B1F876A9220936F472B06FF5DAD2568A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 36bbc340e2882314758db6840f8f7400716ba1f613fefcfbb8f1e5f500942408
MD5 81eaa6256afe68a8353cb222265318ea
SHA1 4d04a364e028bf619e276fa5fafedce0ad09b527
SHA512 a6d364bf92f5adc717b212964169f3f16e41d05b562a24643e7fe65830e08744707ed2ad11b8008fe64c66a1c3f83cd3f711954e8f782116b670d262cb7a2737
SSDEEP 24576:Ezy+WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:E4xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T11455028776E070FAE1374234CC666616E3727C320B6096AF179407766F2B6D19E7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7e2b747e0de6f4fa98f192c0c670fde2319b88ebd25e3c21d770b5246561be70
MD5 6a04954c7638f9411a59d4ae8756a8fe
SHA1 4e9de7b8652886c5c405c0841147e2218ae6615c
SHA512 04fc9a4d2f02acc7375fa22d4f3418e1427dde561134219ed9cf96f513dd9a8862dfd6f440efbf162285e7f530d5d490797f716e4262e2c23855c9f38b95c355
SSDEEP 24576:uTDaLl3z0zDEWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:uTuLljAxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1C86501D4B39058F9EC67863ECC26951AC2B27C5A0B70C21F07A436675F373A11D2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 fab80a3b7fcd01fdd4369e194644f2eff6a1a8711edd7cc35af2a9555f6923ae
MD5 7ecddf0e10f918f9b1e681d53c5b4d73
SHA1 7adea6d08e22c6d8f6d150cf0cc474fa3ca1ae4c
SHA512 693cdbdfbcc2f87ab5d4f82a4fdab15d0d864ea101e1ef64b9874889ab1f87e67b03907aad9b711835e4c94333d8b39adcf718002cfa8e888e507cc1c524a041
SSDEEP 49152:9vd9CHKyajxlMPdlR8v4UC0Eg6ET7M/I:VCqll2/V0cETQ/I
TLSH
T1A475CF90F3E410E9F0778A358D769512CAB67C5A1B71DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 79146db2399dd121d2767c697f725612de51d19c31b6730519f24b34b6d94185
MD5 a6eeea2c188fadc5a4237e125cff3dc6
SHA1 0f8a236258641ec4cb9802f941fb9aa11ca27a6f
SHA512 ce4c3939acf7d04020cb8d697f444264c94d28ced62b03787a036c5839b4cd17e17872c81995791b5508694c7d32099e35c56781893342b1e55c9d47aa22ce7f
SSDEEP 24576:1UWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:LxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T13D4523C468D4D15BF1120EB18C5FF12FC37B1F876A9220936F462B02FF5DAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 32cef6ce0bf87db3e2189f02b4073f5999fa30a450d1d37f38f4e4cba360c43b
MD5 3d94de224a2242f37792d0fa03d7208e
SHA1 f6304c35653009993cbfbf0e50ae296e3604664b
SHA512 3924ec125eb2d5311d169e2819b8727d58e34ea7b4e25988fa0f34ed0d2166fb1c210b067663b3ecb371580c1110be83d520ce19ab3d94aca07e461056954918
SSDEEP 24576:geWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:OxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1184523C468D4D15BF0160EB18C6FF12FC37B1F476AA221936F472A02FF5CAD2568A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9b20666d5b2a87265d4cbbb0cd316b4fe1081a6435884398d16e1672a172e2be
MD5 d938d44557385cfb2846e36a9b513d99
SHA1 b674573ffbcc85e919abe0da3de4e04feaa399e4
SHA512 942eafe8410edd26a4fa7d5031e6f85f510c85c79d45f57e8b5e3634d8f1f07216c126e17491e63243fedc643dc032e5c52ffc59cee8bee10f902ae17c4cc1e8
SSDEEP 24576:LlWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:UxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T17A4523C468D4D15BF1120EB18C6EF12FC37B1F876A9220936F472B02FF5DAD2568A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9b88035b96411eb2080db96ba590de8ffbd2a401905f9658f3d9f21832f79282
MD5 c1619584a51ea379c0f0bd688de2666a
SHA1 76ae87dfbd56bbf7c6ede397e094c84495158e7c
SHA512 74432f5f8e0b306b05e8b9fde2597018aef1decdf19b44cf8cf718f5bf70ece75e438db0ee943cfae7322246307a0fe21835dd065d79d3ba0f0bc7fb4a7f2273
SSDEEP 24576:EDWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:FxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1C24523C468D4D15BF1120EB18C6FF12FC37B1F876A9220936F462B02FF5CAD2568A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e88bed7d4d06fcdd74b48704ac1bfae76c1ec9265775b96d79cbf0638de80b6e
MD5 40b98eea97c71963de5f29d6d4e36852
SHA1 81fd1174d6174d5ae7f7d52e3efe33593f341255
SHA512 a01bd504cd62d80b8d7b8d29bc411aa94eae81142f86d1a4e7ec83abceb193180ff43520cbf137ec160ee8748811774f7e676a48d6990af36d43c9ebd61f68f1
SSDEEP 24576:BUWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:fxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T11F4523C468D4D15BF1120EB18C5FF12FC37B1F876A9220936F462B02FF5DAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ba652e9951a8573a6e66f61313f9c3d871cbdcd0b79beda8d68499bb92b86dc7
MD5 e544db7fe979c6a0bf9897771a57a61f
SHA1 ecc85f05f117f40911ee596855d44f38a4551c78
SHA512 938e6446f09118d04a72313b2091d6183ed27b0454a0ee7244b1720d49be8371f86307c11c274b01d183adb3a6e6fcb884d012ee68077b7e353810c0f72b73ff
SSDEEP 24576:DrWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:WxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1DF4523C468D4D15BF1120EB18C5EF12FC37B1F876A9221936F472B02FF5CAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ba6d67fb9b1ea1c542bfd90609cfbb0f034765c7d8edf8b1a0ae3decfb78d477
MD5 cc489cb103d7e48b94b2e9fdb5a790a6
SHA1 8092108df4ff16aafedc18616d11405f1bc572ec
SHA512 0335cf7d13cddfaf9fb5e9f1a5feb8089755bb40f5fd71acd5985ff096054f9cb16d4719eb9fbc0d30a31403a854ce6e42806855865c9362e8a13c40c71835d9
SSDEEP 24576:I5WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:HxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1C14523C468D4D15BF1120EB18C5FF12FC37B1F876A9220936F462B02FF5DAD2568AA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6519520b90a64cbcfa3ed1b0a2b4ee5301d29055743d2cd6d0c53cc18869ba1b
MD5 a7d10db70a47b361ba5e4cee8e1a0e04
SHA1 f108dd82da80e96213d62221592d58babc8d29e2
SHA512 9f752264d864ed13e7cff239bc4ac7e5d97d2d272d98deabfa0e67d049a40c86b49f257bd9d4bef4a1deaa96a2f570b03a4adc661932ff10687054cd13fbf23e
SSDEEP 24576:yfwvUk9RX6wkyAIXWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:iMnYImxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1C685CF29EBD844E5E177923C8DB7460AF2B178591B31C2CF029A536E1E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 023d73b548b276401c794e116e283de52474cdfec910fb87a8ff23db366085c5
MD5 ef2c87e33b03632b415ca4d8669144d2
SHA1 06e3cafdb6d3b576dee556395ee28885fac7aced
SHA512 505888704de2c2f14ecc466261d18177ac45f5c9a003533547831b54d2f8c209b94cfba25c46725731aee8a755cea3d25a6dfb835eb9ab109744ef522091cc07
SSDEEP 49152:yYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xxlMPdlR8v4Uf:pySzPLl2/V0cETQ/I
TLSH
T133066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0068893fcaa0743e4ffe5a213b2ac37a0d03ab9e7e1f7021c677beb1df0f0d6f
MD5 85e1ed33c701aaf31a7954be2a43327a
SHA1 585dbb256340a73e2db866b7d4729974294c5aea
SHA512 b5e3e59394d5db981f5b7a7cd5b673fc332634df8dd7fdcd3581195b09001ab2e9c460e8fa828a6081a0b19e3a4c143d5c99ee97d66fbbd9fcc9ab2657efbf27
SSDEEP 24576:I47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYqWHRlMugdD+JsRgZRJ4fM430Eg6nE2:I47JUQjTirIhCnDHUPfF/BxlMPdlR8vp
TLSH
T1BB65AE1DA3EC01E5E1BA827885159A1AEA71782E1F31C6CF1270837D6F27ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 74d650a905138eebaa1e106f4e45c54f9749b5ee0a54f15fb6f6a15bc2738eeb
MD5 3234ac776e62cee27cf14b6261a09f9c
SHA1 741d6662c5c97c8e769526f67e42e1852bdd2ab5
SHA512 ea1aef1f604877d3e88c15aee736e7288af02b933b0c44250b89c7e67f78082a0455ecc9f167592590fa5d016790d37e4fd56acbac9cdcc2fc00b939e586bd62
SSDEEP 24576:KTWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:XxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T19D55F089D29842E9D02E1275CB569605F3333D6687E193CB56C0F53E1F3A6D09EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6fcb47cf602452fa140c790a761f53b7c9b7c0cf368af050cef9878d7e1d72cc
MD5 67c3e6dfd6a8ae70e01eff386fa2b601
SHA1 18ebca97b9cc5f84d8e24de3ab141933cfc2aa66
SHA512 1759d48ef0043c03375ee4eefe23cdab981f3dae45af6c14e67694774181e69313014e899cfb90cb4e09416b6516d7f3b242ee286ee979f66e55a904e4fe57bc
SSDEEP 12288:LDBLnU3fZ+hc+hNssZNUsNv0p3vcykFasw/M:LDJnUP+c+roE9Fbw/M
TLSH
T143351700766BD75FC6A940321E36D5CCAB707C41EE056E0773C89B3FC576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d12e64b6f2f44ed7a49e3c98e725e61b68345dbec0c5bc49d70d4ea90940524a
MD5 7c72459d02f119dd0b623e5db200b247
SHA1 c09a332dc4275ac0113cf9d8908827324240b55a
SHA512 80242fa03d27701e82d5b8dfe8eba81892b0ff9616bead2edb6d1b890dab02f9bb173bd8775822681023085c2cb89514d3772bf1060dbfd384915b6baead17d7
SSDEEP 6144:Wms5crVTU/uhp52TdMu7FpNJSjFEcxIqPac/E8cO0LPptMx1IRmPwOgqzATN4kOP:suw/uhp5YdBNuWcuhF2ToqurnpDQJB
TLSH
T12D75FA415537A3CFD1F76032072A6B4D67A4EC07BB056F22B3C8443AD86BA25A4B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cf29242a85175276e0993675bcd5b2437f9f1fc406d5725a8a5658e2ad73e1d2
MD5 c4df87f97e8f342d9812ffa186100ba4
SHA1 cc2e7d152b0926da93878c506b5ac85fcd3d77ae
SHA512 6f6bc1bce85247476c6f939e757ca7425f6cc0f8cde46c1315060ff8cc89dda9c009643436e4e2d9b3059411e013bfc09c55769a838238960dce02a57e575033
SSDEEP 24576:D7WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:D6xlMPdlR8v4UC0Eg6ET7M/I
TLSH
T1594523C065D8D55BF0360AB04C6FF03A833B6F565F5160D3AA022796FE3CAC19EB561A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e1bc7b1f2b9ef9725f5e270997aad14bc381064329ba33c5cfef6228dcd9006c
MD5 d9bd6833b2ed0a804c867d6baa304b33
SHA1 8a945ea8aabcf7c842eda7d13a9eb5bf4db74993
SHA512 65fc34a13da39d5fc445bf8de043c1a2e33a0bdf14b2f65708ea7aa80c04b2850ac1cdd161812f870914a6e22d1528f89166fa9faec404648c2731a0b5c77f6a
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYdWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:3gb4mBIBhGFHxlMPdlR8v4UC0Eg6ET7F
TLSH
T19F659E1E22EC02F5E0F6D2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9150dd2dc37711ff585a071898a900164574c3378d9009dc4cf95c9d82989bf0
MD5 a5ed7cb21c4ec33cf4bfd155483047dc
SHA1 7fd45f3b87d022c8beae36759a015de9e85d4138
SHA512 f8041d1fc46b63b09758cdc16a89eba614e395cb2f59b94ad6cb974e46dcb42e0b9f6f9e5d3bb865eb6b0428cd804760fd0f9e6bebab14da8bfbb72dc17ea950
SSDEEP 49152:Y7ZFPqVea7/oxlMPdlR8v4UC0Eg6ET7M/I:YtFza7/Ml2/V0cETQ/I
TLSH
T10785F1A576E001F1D077D13889864667F6B2B8250360EBDF0BA88B551F27AE14B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 de3b5dd581888225c4e2fe66b9c694995e6dad65da4355ca72b8ee7c7920cd98
MD5 d7b678a8df26dc2bd4073752ff7e2419
SHA1 951039f4ed8e98d730c5d9f3b8fb94a3ff507b08
SHA512 a98a6ffcab075e5e06b954de3522af557305b8fb54e8395ba6b53141fd908916e4f142dc5191b181f38eceadbcf0002e6e0a335acab2acad6f427a48d2a09edf
SSDEEP 24576:+PUr+NQ2WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:+JQjxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T13D65F15F22EC18E5F276A17C8986921DE7727862171292CF02D1817E5F27EE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bacbd3ef74b4d14c117735cecfcfdc9ff23e4819c77095405978a10e1289f50e
MD5 6db64630a3356af9a33ad0ceb18f4dd8
SHA1 8fbb55519b3ab146c5f511908d70a103c847c438
SHA512 ce3373b60f69703ff0b1f43e61dc0a20a27d75189419843b347e9740132bec98daaca8b5c429fd6cfddac61013a5eb36d0758f31797a2c62a779fa80e999c816
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTxlMPdlR8v4UC0Egv:0G05lO43bKl2/V0cETQ/I
TLSH
T1D6D5C06E62EC11F9D1BBD17CC9C6860BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3d646db91b80374f6cf323307e359fc1628ffc2d0c7c2fd38c65d5e65454fd83
MD5 ad129fba989541377088073552614dfb
SHA1 5295a531e032f2755bf10056c116bc209b9e4af7
SHA512 87eaeb4a659c9e7c1ded1779142890c52c55b738cfdbeaf5feeb15183ae31b2f5263ea7ab69b1d2afae83566d57460aae55a0c243a70063b8602e1f0f11ca4fd
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnIWHRlMugdD+JsRgZRJ4fM430Eg6j:+a5POZ3BJt2pasx2+mLxlMPdlR8v4UCo
TLSH
T16365BF5DA6FC01D5E179D17DC583861BE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 064b17f56dce3d8838e99b00383cc5f62071c7259fb9301b6eee9c6e6d81963b
MD5 632cb72f54058105b4b06c2bd010d212
SHA1 3e6dd817228eee272d6074dc0bc881b1a89511cd
SHA512 34e4a9e72349252410a6df25c4c06610b29c15f7fbc378ab9a79654f56ae7ded6ea916c9c823fa286c0f5460efecc1bac19797d24b6fa8cb9abfa53859dddd0b
SSDEEP 49152:uNc/zEOVHFIxlMPdlR8v4UC0Eg6ET7M/I:XIAul2/V0cETQ/I
TLSH
T11D857B5623E901E4F1BBE1BE897B9546FAB17865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9ecc55055ca24e382534a81d42695ce88b897794638bd46a40e5497a7303c7b8
MD5 11ab653363e42c9fd7e3abcea0e7ac22
SHA1 b4bd78f4eb633adbd4914f83c5ffc11284f01321
SHA512 e7885fa89a7eb832cf55c7ce7a20cf60922ab93628473cafdcef294f48574d0216f68e4e301a359a1bbd50678d8950b1773e1beebd581b1ec08a94eb032c551a
SSDEEP 24576:QTkNvNnaFeYhJNtmZBm4WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:QTMwBtOmBxlMPdlR8v4UC0Eg6ET7M/I
TLSH
T13855AF6EBAF846E4D1BAC6B4CD238112E6727861073253CB5390C13F5E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d54796b14769395592396f9a0590449a354c12212c36c9077f4f6686f0f146b3
MD5 23597acbeb8669d4706f3330942d68e7
SHA1 7d90230fa2640e039cdb25ea1c27061901d942a3
SHA512 bb44854b5d542880e100f8285c3450f5e45fbe8d2dd17a21054aacdd97b9ef41140ddc440075905b02ef8c82aeeedefd5fe057dd6ed57ae382aec9fa2c72e584
SSDEEP 49152:kDVHeBIAA+xlMPdlR8v4UC0Eg6ET7M/I:Vl2/V0cETQ/I
TLSH
T1AB75E17DEA9C00E5E57BC1BCCA638506E77238A9032265CB06D481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2160-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3572-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3572-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3572-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3572-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3572-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4620-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4620-309-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4620-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4620-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4620-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4620-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4940-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4940-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5468-111-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5468-118-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5468-119-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5468-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5636-37-0x0000000140000000-0x0000000140244000-memory.dmp

Download

memory/5636-6-0x0000000140000000-0x0000000140244000-memory.dmp

Download

memory/5636-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5636-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5636-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/6264-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6264-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6264-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6264-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6264-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6316-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6316-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6316-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6316-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6344-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6344-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6344-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6344-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6344-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6724-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6724-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6724-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6724-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6724-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6724-86-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6812-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6812-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6812-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6812-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6908-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6908-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6908-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6908-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download