b01a8fd86f234b7105e67ec056b92d812f5e62a80edcf46c37bb57ccf6f89b82

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.2MB
Sample260812-pywwhsgn5x
SHA256 b01a8fd86f234b7105e67ec056b92d812f5e62a80edcf46c37bb57ccf6f89b82
MD5 f0e050e4469d0e919d793eae405500b3
SHA1 4326271b59ab4f2d63af1fb2aa88f9835b33eaf3
SHA512 d2e310a2c455267b6dc926587e79bf649e4ca1a04ab106db519c820d0a23e81a06a83fed8dc3854a4444a8cae01b3bf9e33cc2289dea29597229190f1ad5cefc
SSDEEP 24576:4Kk9p+L8zGgKdz3ru0HsqjnhMgeiCl7G0nehbGZpbD:4Lp+VgK1r5Dmg27RnWGj
TLSH
T18055D085A69C03F5D47A8535C9428779E071BC2547A28BCB82B43BAE0F7B5E44F3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3400	elevation_service.exe
2856	elevation_service.exe
3668	maintenanceservice.exe
1180	OSE.EXE
4600	PerceptionSimulationService.exe
4796	perfhost.exe
5996	ReFsDedupSvc.exe
3036	SensorDataService.exe
2488	ssh-agent.exe
4592	AgentService.exe
4648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7281ffc9238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018a29d67582add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bb87d68582add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4372	2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3400	elevation_service.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4592	AgentService.exe
Token: 33	4648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4648	SearchIndexer.exe
Token: SeDebugPrivilege	3400	elevation_service.exe
Token: SeDebugPrivilege	2856	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3004	4648	SearchIndexer.exe	100
PID 4648 wrote to memory of 2988	4648	SearchIndexer.exe	101
PID 4648 wrote to memory of 4500	4648	SearchIndexer.exe	102
PID 4648 wrote to memory of 4352	4648	SearchIndexer.exe	103
PID 4648 wrote to memory of 3084	4648	SearchIndexer.exe	105
PID 4648 wrote to memory of 4976	4648	SearchIndexer.exe	106
PID 4648 wrote to memory of 2512	4648	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3036

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dfccda9aeda361d73872d1351f7f7c66c7f17549bf80212df04e5850ca1e7467
MD5 1fc01cbf627b0960b6f9ee744f34c5d3
SHA1 53fcb026ec252ad76401babc836e5a29790c87ec
SHA512 cf1bc087f445ce993e03387d6490d8585c31fbdd4a65b3adb10a45ee3c176f42d63215aadcfaa64bc1f3c0dcceac1ec398b1485cd2e0422280729afe057afb5f
SSDEEP 49152:Lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnoDmg27RnWGj:Z3q6sjBfD527BWG
TLSH
T154D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f86bf946a36a213150690982c56f90640eeaedb922da3068448378a6291862ba
MD5 555169ec72d19062969f632be2740e28
SHA1 0a12333532125e74f8131805c09db84f0a1f7b51
SHA512 e914541a8e5289ee653d6ae9cf80a65bb4c1fccc77ae5e97d355263076825fe4276152e65dbffd0cef0d6ae50a336bf1bff26c8e1b1cddab868b9a18cf6ea6eb
SSDEEP 24576:8XYfDtczAnsqjnhMgeiCl7G0nehbGZpbD:7tcaDmg27RnWGj
TLSH
T1EE650129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4bfcc66ecc33e6d8750805e1610616de0473f235e622a128707caaa58d7708b9
MD5 22786a3059e007d12b25f7e5278e544a
SHA1 f680357c2be39fcf75cbb82df259f0d4e0ab2a9d
SHA512 49c44f6a3396e66ea8b55067dd842284deb764e6191a399a3e4bf533338e2fce4049b5ccde874c3dcb4e4b4087e253644e93536477d95b918b8064f6cb2f63a0
SSDEEP 24576:f0Le5ji0hmxxrM0sqjnhMgeiCl7G0nehbGZpbD:fPji0AjxDmg27RnWGj
TLSH
T101859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 922f73dd7df44679b94e83ad9b0cea2a16f16b55a16bf55bcee63c9dff18da4a
MD5 32e35101ddb351319e6adb84a1756d08
SHA1 3eb151b5da0ab00ed9c92098f0ba44abfa7fb50d
SHA512 569d2a39a29c5b1e02de2cb7e79179497af49161b1edccec188d0bc85ef93f69def907153b932dd4c6113b32d05e37d1c7fab5c20f327508ff6c76eb58b8f6de
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyuGsqjnhMgeiCl7G0nehbGZpbD:j/ezSC6vUzPveHjydDmg27RnWGj
TLSH
T15E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c930a939d36e06337d512e20cc0f279f3c11ba2388ccccbd3e9fce1af21c0228
MD5 1c0c89591acb8cc6280b973d9209e9d9
SHA1 1c5ffb7a506102ca2d250a9f3836e3f686fdaf40
SHA512 e5e1d8022479214817bb7684548f60e305853feb1d8bd703856756f226d8cd505c4c054202f900be126d246dee0ec68fe42b58755369e617c25fbd1226bbb6f9
SSDEEP 24576:nVbqPb88hv/l+YbsqjnhMgeiCl7G0nehbGZpbD:nVO88hXl+CDmg27RnWGj
TLSH
T105559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9d67bd04ddcab7daeff83ba1184c5cdf6028c156861353a790290f55d20a0f30
MD5 908c143a92b23d2ddadbf7b5b73c1665
SHA1 424cf5e1928fb648795311566468bea26372eb86
SHA512 1f2618a9570491db1612752bc9cb8405480db5a46ba5e4d78969f676d0e1d96529bd38d98e066f71ecbac4985c29ff5ae09a59fbfd7cc663c32b63a9f2536264
SSDEEP 12288:jLoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jLosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2081c3c5354eafc2cb6556eed9ea308c42399f8c1f8fa74f2b883770255eecc9
MD5 7d0f856d98dc2ad6a6514dc187ed1be2
SHA1 a3bc463561aa64a56caf9a019b5d204c7de23e0a
SHA512 7e5922874833b78fdbe688a11f0ae5abfbd1f02e01335b6d46c6d5f3a0e011c2d07e3b887c1f81072b9f1b0b3f17fa5bafc6e94136485a1cc9dba1f8d16657f2
SSDEEP 12288:teBNUbTVO86UzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:tJIUzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A65CF7BEE28FCD2C27A8DB85791C600E77278314B6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a7e3adfdc3e063b40559fbb0fe437d8bda99d67e311dd3da3130bdfa4142bae6
MD5 43d0ef85aca312e6601d051129100028
SHA1 75fa35966b49658e74bec67efc36d1a1cbd982cc
SHA512 cb41b8da37726199633114eaf2e1a222e47e204660a5cd295530e401729f6a8da50377d34929a5bbdb880e1040d7e1a240bf07061b69dfae5441fba86991ce59
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THu:4QvGAdlCEL8c/DRNw5C6D527BWG
TLSH
T198266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0a3337d002a09b08c307967262e4e463bdd5ad7249748c2c4cf814f4c7a8b958
MD5 96bfc3232c24972548b23cda32f1c9ad
SHA1 598c2211897651cc5fb2e82bcc1f225ae341c7ab
SHA512 2ec212f773a6e99b96b1bcc60de1e5c1a7f35b24e8c12efd8a2ad9bfcc9e1025671c64e425355ed40ecb1a7b330f2b95c51ae38bda9459dbeedd6c4eb951097b
SSDEEP 12288:eAwSfxL/2Dc3RDLLmt0LDQewsAj9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:D0ewsAj9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D475E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d378ec7345315098598b7075cd5a95dee163691e5fbb9cb6867a761ae6867787
MD5 ac8e0bcbd7b3cea58f596dc9e0d181b8
SHA1 7a306f54663e2e3f3c9578971f313ee1b5810095
SHA512 5f1761fa64b821d5732eb29ff766e268e4c09ec51aa64262871453cf435647d0438255957b96aad20ad3c69687b30fb876678456c5798a160f49638475015315
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHZVQBWG:PUEtQevvqc2W1cpV2tI32kB
TLSH
T16D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 750e453da84709ab078f9f35f03bad0617bc628d70d19511effb7f39398bc5f4
MD5 d583babba027287c9476ae38fd71aca0
SHA1 cf68dbf11d3870b6e8e3a3153bf88dc44a4ee6c8
SHA512 abf41619a3e63092093849de276e3b45c34f8a0eb556db316f8ec8c5e9569b8a4cbc8d1933090140ebb1f1629a6aa038caf6e2051eed4e22ec85d32f8173d8dc
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zBDmg27RnWGj:EoquVjnmmD527BWG
TLSH
T127D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 860d499ef31a1e6ee162be12725526c75432d5e0e2d5ffab3d14c9e02041b857
MD5 80d6f9d6e94cd5295cda1cddc91df8e4
SHA1 1b019bbad4a2ee10d4a9a157f8e13503eb94354b
SHA512 69f2ce44ac380a7e84af54e1fe4cf1b6197f08706170c10bcec217130228edca4a68a2bc120a065a50af3ac12c81574430307c41092d8fe1b022432d4c29cc58
SSDEEP 24576:WAhGL3IFoiwtA5l7S53CsqjnhMgeiCl7G0nehbGZpbD:WAMUFoiq5WDmg27RnWGj
TLSH
T1BA359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 05aca9fbdf8a9938535f5b3f4b0424555cb666eb569ff114936ca68212aaa942
MD5 8455d6265d68e8a69665f595eddeb759
SHA1 665fe947cf2eae423ac70e50f3a90bc3effbdf37
SHA512 ad7644cefa4c64b3138d44d0fce905393804b1a4c210b56f6d8ad8ae74bd88b779f42a69ba9d7f492cee3d0082c8d6fed4c62fd83915b2828e7408c0e55fb6f7
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:9wu4OW5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F65F15A76A81CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 54978c8a6d855d7b6669b53bbfb9e71c497c4c54409efcad1aa65b4480df5356
MD5 f81a562bcd14c9f2d4beeebb48a878db
SHA1 a8c50dfb3315712baeab99b3362670b94cdfb436
SHA512 98f4410563cc9381f1c28997e3b6ef09af7895bff9ff31bc7d88e11d3250e3adedbf1d7a9e3591caac4931d5826f93cb1c3518be520823cb774207b736339585
SSDEEP 12288:reZ1IytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KZussqjnhMgeiCl7G0nehbGZpbD
TLSH
T1685512AE239820FAE163417CC5E5E609E7337C62673003CF166659AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 96a2d0e150a0fce8284450995e1c56738000352f3fe5bd61a6843c951a2a4b18
MD5 81f9edb3d85d0eeacf4269542a49c546
SHA1 918704207616e7df5f910bdb2884bee986d583e7
SHA512 9c059e8b33449c7c0785ede56f1ed838fc29be1c1f0c84f40bda0d6faaea7dd9b27fe330e0d45e6eab80bd9edf9608a240f057803f2fbfcc00ee48ee42bc81f3
SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN3jD527BWG:7QyiKa/X+PNzVQBWG
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d3f33457a6be9006e39c5ff708640ede625e372174c3803c62be9dd71c1c4b9
MD5 1092ae7063615ef48ccd9ea48a4b486b
SHA1 1651eaeb208003367440f1bbff9f93ca51100d68
SHA512 12672c205dc4c01257ba4b9f5bb4a1881ba429e995a5223a9bd82210c2b1af7c12bba9f017d00794ed49c205c87b0856b9233681ef071a8eef6709d8747285cb
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3jD527BWG:zQyiKa/X+PNzVQBWG
TLSH
T1C6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 91c7e514d68191fa0bad28a4fbd96590993d013404050527a7224b05bdf4b69f
MD5 211600c1c5a4bbabe9c89ce50681187b
SHA1 bfe8a8d052d1e3f913bb7ccec9847943bba1da56
SHA512 31dee094e7a8c6ca1fb19a52eec499719ca140af80cf925af50567338708cdb41abb3954a6e58215f32b53fdcb49207949d532eb7a13a43b2c7bca1b2d5a4c51
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL08sqjnhMgeiCl7Ge:y68Qg55nhceWu7PNU3/xDmg27RnWGj
TLSH
T156B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 23b1b1d5af8bcb127d3ec610e616beb21115bae4f854b94ad853433996b22fe3
MD5 d314b76f0416a41dc618ae06731699af
SHA1 7cf8098613885e84b6253c596220b71c0f37ecc5
SHA512 0486756a2efc1f7763f17271344d6f79069e1f838fee1e9bc0c5fd9ab2fdb17eb13989d83e88fc286997c67c919bdb48d31d423bbdf3c7b652cd1db2df668862
SSDEEP 98304:Iy5112gYy5azzVvt69nLKnhZUD527BWG:hLIHEWheVQBWG
TLSH
T13B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a9a391bb7d05e68698bebba533a8893b1682946ad206d54abe61f1384ed39d6d
MD5 088ca34f67c97f5466f5096b4b7fa9d9
SHA1 dab4f30e3efbd3fe6da0326ef87752afe8f9931a
SHA512 497f3c7de3ff014e9b378d038db9fee3ca3c6ebc09f6cdb844ec78d7122d8b4d8f5af83b746ed11cc4b978b6f1e625ddf7bed5ad0526a088a3894580d114b676
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnDmg27RnWGj:7u6Jmdxd2dnD527BWG
TLSH
T173D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 215b2ae8f89aebf2f6ea37779ac30764bba11ee1877a6fe4b01ffbeacadd527e
MD5 23383554b501216634874f115de548d3
SHA1 eef187e3c257dde95405e726670627ca54aa5d0e
SHA512 c1e3ab42fb127e028e12c7d9b6ecadb76ff5bd24e123d209724de207e54c9f9ae580963458a825f49d346727c5f146918e8ec6f61edb00b343f346514fe59f4f
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xXDmg27RnWGj:GmifPWRmD527BWG
TLSH
T19CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 14c94b87749bfd452b84ce1dc062d4cea69b9106d160e0a1c6551b0c08e2909c
MD5 abec078aea4d127be722f40543a0dfee
SHA1 1d35740ac0642a81ba731000f644c0e305846619
SHA512 f3aa71fc9d6b8a784a9ad4381702af5d8fcb314a4dbf5d229727d97754d6df0ee13605935ac0f6933351c46195937d62039a84f0e4c83385c6045401ad0ca35d
SSDEEP 49152:9SuZQIY0Be2KcRVtOnks6NMHqYDmg27RnWGj:T5dKii61YD527BWG
TLSH
T1DAC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b69db729df1bb11b6c7e2ab7f489584d4b07512e699cce2e6f4dbebc53bcdb7d
MD5 c06b306e924ded4a1a74e9f1cc0587f9
SHA1 59c972d7393725d43b04f51f9b5a2e54a22a53c1
SHA512 31b2b69893f7b5e4a3adb6f71068a403596b5638c2849319d27d1d27de725b3ca6227f95c43e03d213507fb8af8c10b37c87da7473e959880e6e50920d301e79
SSDEEP 49152:bhtSn8EApI0fig3giDn0AP5w7Dmg27RnWGj:6X2imphyD527BWG
TLSH
T19095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4a75a14da2a77bca8afc314715e3f2eec5bd4c777251ee23a53fe93753ef36c1
MD5 62b2eaa211a44c42bc082c88933bb2e0
SHA1 8ece4818e3039f8ce8ae1ac8e9b1c668c6820587
SHA512 7aba6df207e8e9cca19a827708bb09785b5b3189272119aa5c439a6d3de1bca573f6b567c1d0e514be944e33cd08d0ac2a0e98c494000d48dd13966db194d023
SSDEEP 12288:FgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BE964C41CBE52644B5C3E9F14DA8073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cdc1db313ed61d18086df4a547a26c6955db7c264f94f723bd063aede1671faa
MD5 2d63dc39bc2fb67d62146561b94f2eb2
SHA1 c06c38be159cbc181fb70e545a4918d5357b6001
SHA512 9a6c1569151911a702203947057b02eb4394661ce0f0b01313733220aac62c5cc0e8f120e9e254d0be010a9d2cd5076d0e63c212682fbeb845d9d9afeb0a942a
SSDEEP 12288:lhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BE964C41CBE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 28f2e36a0783e762ccd0b89f7425d72c57964e8f96734ce1e3851968b359a085
MD5 0117c4646cfb69e88e5cdd6806c1a39d
SHA1 16b7c0327a0726e1034c0bade240a8e76f7bed41
SHA512 f627ed6f2a95d740a50b3431397e7f3618f1986b38569bf0a15a8e34b8f649bfe5cb6e525973e213b8afbfdfdd822baaa537bf71a8a8dca963ebcc8712692b3f
SSDEEP 12288:0rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523BE964C41CBE52648B5C3E9F14DAC173E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 1b26b0b8dace6721ecdc13845f83a4c509a61e083a6551d02e8fcac211591674
MD5 3a8379212b15541656c6e2ca2ba05a45
SHA1 125963ce09159a1d8a3496e135adbf1bfc9dc873
SHA512 d24be670b173c9e7ac35e85b505c681cc224ddd0f3251447086ee086b0a1bf827ab5c3d22b51c12a01986827cae5587ccfd9056b2ac4606b09b333c2e65d3ce7
SSDEEP 12288:0ViXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10045236F675C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1baa05f779e9b332421837adee24e78f7e92e1f43e994a7d948f0197f0b4f947
MD5 603efdd22f2e0613bb9cd343ed44ed98
SHA1 8d96ddccaa6b745161bf9e79fe1d4f1e84a03fa3
SHA512 e522276165cf7321ee739b0dbbd1c02db68cfec415752844b138b817050f5ba7d0b4d8bd7a303433ed8990a4ec3d1c644b2e6011c7e8d6b87b6888c246fd6b12
SSDEEP 12288:FqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BE954C41CBE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 91d052ecf03c3df213ae881c045d09bb28c28c9829b9066653d7742e39b37c5d
MD5 6cc9fe08408219364ecbc791cd08df17
SHA1 c81a06a69fcbd4d519c0836ba195b190eab024f3
SHA512 36da042d876799560b2bc250f2fa3a98bca5fd690d43ca2203d75ded6a0b411c7b3b752710092bcc9caa055eade86bf27d29616def77e8866d92ac42cc5840f7
SSDEEP 12288:nVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BE964C41CBE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6912ebf43ff04904b6417f7269d7e27bf4fb7053d561a2003b43cbc57bc8ac6f
MD5 c2cb87117ddacda3662b369de706c3fc
SHA1 2adaf566123932955b6311a4a36acd1a72561974
SHA512 bd6ae90d936fe86d72f32203205989869f25c3aa838e0b54f34fc29c67c68e111751c15a7b73d67d00cba5b566c5a26d88f73bc13b02e9d58ff947f60bba7392
SSDEEP 12288:gJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BE964C41CBE52644B5C3E9F14DAC073E5BE9200493BA5B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 598c5482c85851b72a019a6beee18d8975886079443a589841d62063b0687e7e
MD5 11b587b1e34c4dd0b9fcf88100b62cc8
SHA1 99a0f09c352f5b8651da8e91fd6495fe6f941004
SHA512 fc6a78c3c41bdac8d4d8759ff352644e6936638c008205f6f586e0739e2c993c53e5f9e8e66f57b83516ed898e20dc4555dc89549934824020708f46eb474f37
SSDEEP 24576:XZMRzFVSOBsqjnhMgeiCl7G0nehbGZpbD:XZMRzf5Dmg27RnWGj
TLSH
T1986501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 71391c6e60a03535334849007b301298aaea075628e9dbc4f8c0685097bac097
MD5 806bd279b78427dee2949e38133f4e6e
SHA1 1a9762e63830a4a7323030c3464ec592bea0d5a1
SHA512 3d8455c06e4d996425ff806b3f23dd56569d57143a6c4a547dd823efbcb352259783f40e6bd1ff297f988abc6547a0c745d408654bc9d1bf9f3201337723c162
SSDEEP 12288:McXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:McsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 197fccdf766e40646a168bf472bf15add6c13a5f9324e4c1275f8066b9306976
MD5 742f0f78f206a6bf0b3dd4a87d6a0a1b
SHA1 c8dfe07989b82f9c446dd3a78ce32ee2d40c2b2b
SHA512 47f641b29b94d9bf41dc77f61bf6a45de4b7927f72039bd7e645e21e8285e7d213c849b99f14301e9df30f00a91a7745132df0f70eaa0f3fb2fc1a45244ae732
SSDEEP 12288:kYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BE964C41CAE62644B5C3E9F14DAC173E5BE9200483BA5B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1501f218573a0c28a944932a518e8c719ad4f3cf8382b577d40e77ee9a64065c
MD5 dd7da9defd16a56284de2a6e573f3f74
SHA1 cbede857d8e18e76d40a1be91e61c3708a53a88a
SHA512 151665e9e94251f0d91f659f1b9e00d5eb40eb84e6f90d752a85f803ee7bac7b1e3651c4aef81f8e472a61efb4984a7e544537ed41e6850403b99b68b2cee1d3
SSDEEP 12288:5yPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14155125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8d6cfba74d40cf3194c23865a7e3e0b7a231456bc3a929910ee556bd25c12f5e
MD5 8f48786bc193a3de4e51d6c1ccd81c3e
SHA1 5878f290be44e0d7004196311a9952ae5d84c1f1
SHA512 1af08d2630ecdb77feab470d9c18467a9d7bcdbbe529ddaf824ec67f9dc7343d7c1d86cbd0daf40f290b12f327b24f8e67d9b66844008bfcf07d4ee9255a1da7
SSDEEP 12288:mcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BF964C51CAE52604B5C3E9F14DAC173E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ae19257089000f5428ee99393ef0b8c42fb96d2288a0abde4520c7e92952da0c
MD5 690660a9e179f4310759fc182470ef14
SHA1 6bdfcaa15528c011b4a901555ab7dd883895824f
SHA512 84210c455b0bc7055a725f6becbeb12448afc91c468c692a35d392132d136e0fbb0e3840f61bcc50a666433ac51d6f2ea00c667ab9c18e946f1d87d77d9aabda
SSDEEP 12288:gcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1454523BF954C51CAE52604B5C3E9F14DAC173E5BE9200483BA9B7CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 687f466bc99ccb6301f65f4f19839cc7fd720caaa5320b38eb2c20762003cf93
MD5 5b54c6422013a5830e5aed9ca2d43a9e
SHA1 7b8ed3f0631024b9bb9702fe9e0ce70857f31308
SHA512 d4261ff82f289efd1686fe61f71f86e2f45930938e1ab52f358cc3965558b308f36f69982d69c07570f70ca5f162c05c24e8b7829857e0816e517e79d549c81d
SSDEEP 12288:oyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A855125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4a68fb89fb4fa67f4d6908f2e68dccd102145b275a95e0af93df2a2d4b909bbc
MD5 21cc2a0f08c78de729c51f94f36281a5
SHA1 9f23291a8d9fa679fa958f9303b85918fcc399cf
SHA512 73d445ad8e9360e88027615584897afc6a9b41b88666e47f52bea3edce378b587db01f1b01f108b6fd342eb89a72b055f509144b427dd5a97d2a18e2aaafb045
SSDEEP 24576:dTDaLl3z0zD7sqjnhMgeiCl7G0nehbGZpbD:dTuLljKDmg27RnWGj
TLSH
T1816501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 579c2f2976a27ffca5ee3332b3a1685cc80481022dfd679576fbe4f189ab931e
MD5 41e9b1b0a90c2bc49e255f0a36b45d7f
SHA1 d323125bb3a597623f755a7c1a17569833011f08
SHA512 f5ddd9958fb64c9191fb2db029093827ad0a15516dd6cf7c419fc18b3d1c8c6b2209d19815910cf6aadfb87f8712ea806263baf4fead4c533a28423652a94b02
SSDEEP 24576:u3vd9CHKy7GZfsqjnhMgeiCl7G0nehbGZpbD:wvd9CHKya5Dmg27RnWGj
TLSH
T1A175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 46e3d9eb9a64fac72fe5159d5832bec2bb559e9a862e1487b7eee7dfe5be0481
MD5 45445b77ecdcef9f3d47692a463c0fa9
SHA1 9dc0d5a042a2c8cf70c594910a7e3cf2790bd88f
SHA512 fb1cc14da35816f4aa58d03e5af994f0347a938c6c748cf622b80fd198efdfccb326bd9c380535699f49819e5a8bda2ee5159910db35f1809f0bfda25679280f
SSDEEP 12288:iLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE954C41CBE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4f00b6e21add4c1e06a88f96054aa807eebc099321bc0dcd637af180a2ce77a7
MD5 29decbcd0caff1545964bbcafd101c40
SHA1 e9c15a2144b660a806d7b8c0baf24d9f9b614e3f
SHA512 264bbf8bfa6cb812c6ef978988fa95bd2535e69767138369c4ca168e2ff248607f4609c1e15b1ac1fcb1ef59c8dbb2f85f9a48e7d0d293f41d556fa747a80866
SSDEEP 12288:rNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B4523BE965C41CBE52644F5C3E9F10DAC073E5BE9200493BA977CBAE7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 71f7c60c59348522cba7a1d28eabc8051127578e91ed315e0601f23dc3137dba
MD5 671736e2e9c078d721015b4f46547a74
SHA1 47d872abb769d63b27274325e1c5908e51201e09
SHA512 d40f83b9eb46c851bf80bfb060847b8c9902c3835946a98689a0b06aeaf89497c197279d74aa7927f48de2d4abdc8628ac031f80311e6ab2ddaddc5a048ae081
SSDEEP 12288:lOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE954C41CAE52644B5C3E9F14DAC173E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b453aa6f517367edbbc6e69d9c77c20633821e0f784c91d24230eea5eee234ab
MD5 48d3d8801707ed78ee3257a75146aeea
SHA1 3606f3f9f3bdaaf264b1640ae7cb73a1dd89c61e
SHA512 98231280cb6b0ce8ed845e31e0ca1e643afa24bff221355242366bed041bef4cf070eadbddab183203f13d2fbb8cc942dbc53a8bca7b432d5a33fc8ff197eaef
SSDEEP 12288:2cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2csqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE964C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fb567a29adb0af815b4501527d4fdf409282a78b2612343a2add40da1f6ff3f1
MD5 0b61a6003799fac24056868229bfd5ef
SHA1 85655c002c87237e918fe1027a05aff838dc27e7
SHA512 ff899805e27126b9e2bf71755705c59dc3f3f7e26dc15b000ba40f2086c8b274a5d38d783733f9181f831d75aef694e86c4f5cfb137badf0e6b8071fe98a2986
SSDEEP 12288:YLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE954C41CBE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bf6dd51748bf9bad1418a092c1ea9fe9e6fb1161fba665398aaf728e1d195ab7
MD5 e231774e8dc95f471b349cc924eeec3b
SHA1 10fb5fd68bcd8854668fd05286cb1c0a1d1111cd
SHA512 69c701b1d3a04023f89f76054b419b6e9657f02e1d98c88626153e9676790e233cb7b250fb17e2e431be6433e299d5e8091b4a1b335f0f1dbff6e895f334d7e4
SSDEEP 12288:sEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BE964C41CAE52644F5C3E9F11DAC073E5BE9200493BA5B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2f43ef3ffdbc49ba0cbb8b44086fc1a22d7e478b0d10f2fad0e25a9f4b40b4f7
MD5 e3b478eb5a9440b92b56d4100f2deb13
SHA1 68fbfea05dc44efffde835aa5674c3eecfa2bfac
SHA512 119668030d6c803b01e4f574d44cbc009b30c15a8a53b42ae3c8b9b0b1ec5553dc3846aec2319acb92b37d14e64e385dbb2e33d626c1e9384858b14ef682a4b1
SSDEEP 12288:pqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BE954C41CBE52644B5C3E9F14DAC073E5BE9200483BA9B7CBEF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8e0575dcf731a4e3a2438c1595a18ae048671e10bee8e0e843881bf594c1e9b8
MD5 954563ff853a81e5b401b805adecb6fa
SHA1 8eb58565246fbca197f2042c054060a5a41737a9
SHA512 2a953f47d8ca65ec0699b9ec028fa4081f8fcb14b5bccc1e73ffa8b015f014842132be40c0e583c5ea040a420caa6c5232883d42078a23567ecfddc4f612aa71
SSDEEP 24576:2fwvUk9RX6wkyAIIsqjnhMgeiCl7G0nehbGZpbD:+MnYI0Dmg27RnWGj
TLSH
T16885D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 63979fb50bc5e67df7e981f71b17bb08e00220741835a7eedb842013c51e920e
MD5 04cb19f6a3b6b903461f9d2b608ebdd2
SHA1 a42f86c107b26b9a36ea84e3ba44868b72ca6525
SHA512 1caf1fc47f1b5595de58a2f0da91cbb663ed2db1a4ba84090dcbb0d4766d16e47bec30ed7efc9bef42c6e82502c8f3122b60e5014e12c282b5b04904c42a938b
SSDEEP 49152:lYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bDmg27RnWGj:IySzPDD527BWG
TLSH
T166066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4ecbe5657d8c1f89183ba69bebbb49a990fd4884322fdf361ee5cb12ea066c0c
MD5 ef5916da6104de77c25c972c15a1f03c
SHA1 41e5a4ff607b20d3d5163c387035b868b75a88ec
SHA512 f00b4ee9408b4b486570d275bac7bb917f729e88e0f96b351c88e886edb88c56f6f7bdfbd8a805582a0d68ca0f40f715f310316f7acdcc92c7248c6e7f7e6963
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYxsqjnhMgeiCl7G0nehbGZpbD:y47JUQjTirIhCnDHUPfF/LDmg27RnWGj
TLSH
T17B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f8b1a35e9448e645f97e321e03bd9798d6493b6b14c90c36643b32d3efbef794
MD5 1bc1d3cf863ec738f6212c81f3e861bd
SHA1 693aad570afb47afac0679d08aeef28b374761e8
SHA512 0bd3d064aad21b6664349aeb371b5ccfb63e292ce49491506a6fc9319c7d24858a614487cebecb83ce93662e0461dd0e68841b4caa1d07786f1d88bc94a32394
SSDEEP 12288:ibsfsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZssqjnhMgeiCl7G0nehbGZpbD
TLSH
T17155011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e77e06b8a5877207965e9f3a1382d71f9980e9769cd97dddc041ed4d6bde122c
MD5 00e8933d5972e26ffcf68315403715b6
SHA1 48915e87ce4b5e0af19a538fca1df297f1dfad00
SHA512 ec284d97fbad1382ec81e61ec211c9ea5ddbabd5bdb70453b5d0b6700ca556fec233239f133923eadf8473186bd67c1632f06bd95176be7e12ebc194aa7ba8ed
SSDEEP 12288:Zjgi1y5pDefV5yFHgNz8G/5Gjrq8fk7DkA:ZP1QSKpgJ865Gjrq8k7DkA
TLSH
T199453950B62AD75FC5A940325E33D2CCAB707D41EE056B0772C8973FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e6223f12e2df79d8605d6b1b19ce67fdb3901215a325c71603e50be6b01136bd
MD5 c3e65a67e38280b7726e02d13ca7f1a1
SHA1 2579b6d1f2859f6c8094e8af94a09b0c194cc8c2
SHA512 8ec48596bc50ba90a9f74975d8d53e70127b5dcf4d5dad95452cdebd0881a51f7257a8f204df586447b7d6432c3e1d5c4a8277fa3459de537ad6ca0d3aedbd38
SSDEEP 12288:bEpFZZyPwceuIAk0pjz5PIHeyCoTiU6XJ+O:Tfy1TD6Jp
TLSH
T10C65F781A137A38FD1F76031072A9B4DA778EC07B7056F2673C8457AD86A765B0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dabb884021f94ca5649600fc47b72d807ce7997043da5d52a73fac2d2d98066f
MD5 b83349946da983c22684e5b1dc88021a
SHA1 eb5e91b7ae9659864a41d5a7d2c408edde918b7c
SHA512 8ee1cfa064f4245acfab4b363f34e35db13da8cccb02947c8d9ef65cfc4876468e0e610adb893bd42331fc90aa35082adea755b161cf945bcdee2b57eb466945
SSDEEP 12288:+07UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15245237B934C518AF93605B482E9E12D681B7E669F1044C3BA0778FEF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 66c664965e62d234f3c81354bd958748ba51fd89393f253ae3fb70789da9a18e
MD5 8b93aa8e22931b1c01f3f6972e17ead4
SHA1 077adbe6af880c9637de44b07d43b520dcfc5b4e
SHA512 ceae56b3979686f4d19b65569f40ac23ab9e2ba74b0992714db2877095fb6cf86034d95922137e95cf32d7a0e69c354d38ac53b3dc18ecf522a4b58cc7f9c7ec
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYGsqjnhMgeiCl7G0nehbGZpbD:pgb4mBIBhGFFDmg27RnWGj
TLSH
T156659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 276d9e5d059bd2e8b626c5daf92c2189bca20ea48b65e1f7f2a17324594a01bc
MD5 fe73f583de182df9542e5692a8a2ca7c
SHA1 b695569e6a3605ff3a60b2597d13bc302c6254aa
SHA512 56d570e2d1637215700c599afeb1e49b3d1d2295dc59689e93abfac39f28b1fb17e83e3483c88bac1f419f514a9fd5184757cf0a88d2282ca72cb46fddbc3e6d
SSDEEP 24576:OG88u8FpJqH1bzria7/mBsqjnhMgeiCl7G0nehbGZpbD:F7ZFPqVea7/CDmg27RnWGj
TLSH
T12F85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f1900856d771a5846a1d3bb4a105cb8112769711c801efa9eecdecde6feb686b
MD5 7a2d3e69c71cfde23da4f84df7bcba40
SHA1 7f220d5e2a3732c2153dc04c542a6468d97d79a6
SHA512 dab5069bc4ae1abb80828425dcfb3a61603eac9fe4ac3539669e2afac11e99bf0cd394a1798110ce682cf0261d5a656761a2b1772b1d6da96acc5a5a3ce71b6e
SSDEEP 12288:MHvUrBFrEjwaQFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:MPUr+NQFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 51d4ff33a6cebd7ed99b299e2149f7a72a3d76a314c1453b3938479d791776fb
MD5 586c95820eb231682c48445ffc8ea329
SHA1 c114eca7234197cfa6774c041c2aa88577dc2ee1
SHA512 ea3d497dbb9726654f325b14eafbcd2500590d38f6f45f349bde7c01b28c2f4335d00f9b557954fbd0d7685f7d8f398ad734a1a4e1ed6e9f087f9d6f77166e98
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJDmg27RnWGj:gG05lO43bMD527BWG
TLSH
T1D4D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2287982bd9ed9ee98b7ad36c6a4ed332ec7c2d2a878444c92010bac55f15ba72
MD5 7cbf9261c48168e1547a6897b1b486f7
SHA1 f981cce7ee3c34ce22f8be31abe27cc1445cbde8
SHA512 82a4980e4eddfe0a5d48c83ef4b8932b355d13f7b5cf8577aba9f3f68b9960a8b07c39d6d891bbe1164adb2049069a46c126cc9d66e9f49356dc9b99e7fa02dc
SSDEEP 24576:Wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnHsqjnhMgeiCl7G0nehbGZpbD:Oa5POZ3BJt2pasx2+mxDmg27RnWGj
TLSH
T1E665BF5EA3FC01D5D179D17CC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7c1e0550a9c9e755bf2f78516af094cec2f3b5e75ef13fa72f815df5b5841e1
MD5 bdf5d34c4f739a69d1faff2dd5152df6
SHA1 91be9512db92b81560990dfb9695ee7fa6a85bd1
SHA512 d7f9cfe4cdbd432c34c26cdb3f233c59a62d0f07bba204e89ae694f71df3d044a3d0e01d5629a3a95f4be5c9529a0864c51471b68c25c6e3e71cfa1cd2b59da9
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkZsqjnhMgeiCl7G0nehbGZpbD:6Nc/zEOVHFiDmg27RnWGj
TLSH
T185857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c8a70f62fb2f37c5c936110cbb5f2a27cc54e15d1e23aa4faeddd33a72c08dbb
MD5 dec1cc9cad7f6098c3ff00a6d29d5bd4
SHA1 8a623548b07f994da781da06a17569a4aeeeaf84
SHA512 8246fc232254e0e11824329ca6ad45d18e8fe1bbf01716dda7b36628d9a0f911e5809188e6117a4d7dc2bae3ec2084fa93b4ce0745f6c0f71fe150190d3fb322
SSDEEP 24576:MTkNvNnaFeYhJNtmZBmXsqjnhMgeiCl7G0nehbGZpbD:MTMwBtOmrDmg27RnWGj
TLSH
T1B755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7ce5170c15f6cf1350630183f9641b4aba64f440b6f94339c4b35fcf8b23ac12
MD5 ac4a94934e0b8a4b01bc2544adbdf652
SHA1 315f33bf06f0b6eb6765c7908dcda2735d8784f5
SHA512 a66f1c28ad9d76a4a5c86f4529282197d1c927c43a2f2e00a273746929802f82c2d7eb837b28d637d51de805a2a514fb8f62c313d797ac9f0540ef8b32c23812
SSDEEP 24576:fD3FHshBIYQgAAsqjnhMgeiCl7G0nehbGZpbD:fDVHeBIAA8Dmg27RnWGj
TLSH
T16375E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-268-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1180-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1180-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1180-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2488-117-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2488-311-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2488-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2488-111-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2856-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2856-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2856-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2856-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3036-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3036-103-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3036-97-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3036-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3036-309-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3036-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3400-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-18-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3400-25-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3400-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3668-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3668-44-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3668-50-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3668-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3668-54-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4372-6-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4372-16-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4372-13-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4372-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4372-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4372-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4592-124-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4592-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4592-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4592-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4592-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4600-290-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4600-71-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4600-77-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4600-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4648-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4648-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4648-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4648-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4796-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4796-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5996-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5996-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-85-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5996-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-324-0x0000000000730000-0x0000000000790000-memory.dmp

Download