b3d51f449476fd58f6f9db50f7f5d543b01ee1af54a506e01b94eb820e0b65dd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
Size 1.8MB
Sample260816-c7xsysbr6w
SHA256 b3d51f449476fd58f6f9db50f7f5d543b01ee1af54a506e01b94eb820e0b65dd
MD5 bf1862481d4de3576c794f2dd8ecb676
SHA1 80d90ab0ffcfda8d0b83a4d1dacd67ca9aa430e4
SHA512 6d6af7e9f7f93b0d96ab2f11d3505ca87e624677e9eb1742fdaff82ff70e45dd2533e25a035274c0ae79c74ebdd7347261edb7c6c3ab28a9063bff2cf4ee8b65
SSDEEP 12288:ixDGMUHJwljyjwoTxcRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ixDMwlOjwGyzQPI9hAH8CzQgAqvuG
TLSH
T14C859C79E6B804D4E6BAB53886638555D222FC09535196CF3A686F063F37BD0FE7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4708	elevation_service.exe
4572	elevation_service.exe
4500	maintenanceservice.exe
4216	OSE.EXE
5648	PerceptionSimulationService.exe
256	perfhost.exe
2568	ReFsDedupSvc.exe
1056	SensorDataService.exe
2512	ssh-agent.exe
1568	AgentService.exe
2788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f2c514e7763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040969457292ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cfb6517292ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0073258292ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003944eb17292ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1452	2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4708	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1568	AgentService.exe
Token: 33	2788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2788	SearchIndexer.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4708	elevation_service.exe
Token: SeDebugPrivilege	4572	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3752	2788	SearchIndexer.exe	103
PID 2788 wrote to memory of 6068	2788	SearchIndexer.exe	104
PID 2788 wrote to memory of 2804	2788	SearchIndexer.exe	105
PID 2788 wrote to memory of 3536	2788	SearchIndexer.exe	106
PID 2788 wrote to memory of 2712	2788	SearchIndexer.exe	108
PID 2788 wrote to memory of 4792	2788	SearchIndexer.exe	109
PID 2788 wrote to memory of 3316	2788	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_bf1862481d4de3576c794f2dd8ecb676_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f04f65306cf12edb3a6f395914bf654beeaf835d28837b261a7fc920adc2d027
MD5 1b6b9df709082bae967e1a8e6b6829ed
SHA1 32af8ee154b63d9e0f2eb51868a83887094c230b
SHA512 ee8a57c7e3a8ba17d4a281c01705b9c1d69812344d2146728d5f8cf3c4cfca1208d72d8dff316e783ae22b93983f8b5bd52c7248b3d433b8edebaf5bec68f6c0
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQzQPm6YgA0uG:S3q6sjBL6YgAn
TLSH
T1B7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 fa5424bbc6c0c0e8505020ad2d46128a2db1b600532dbe829df29085645fa3f1
MD5 1aa00752f638504ce51d3eb98ec7c8d6
SHA1 c22fddbb4eae958671acfba0a20148683e8540ac
SHA512 0c41d5cac5397f9f535e70cb68a9717b7459d16052785c0890cd64b16352275e87765e9f7ffaadced499a9efcd138e4452e3a238c4c12ea236302608b0fd14e0
SSDEEP 12288:i1XLsswWkxy2lRq2czAQRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:oXYfDtczAWzQPI9hAH8CzQgAqvuG
TLSH
T1F7750129B3E409F9DD6B827DCCA28951EA73785047A0E79B03B489654F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 032f4c02a8507840b1a297c1674f37cd373a3b90366d28f38503d8012aa0ea82
MD5 c0fde95a9021e20ca0a4ac51ef3dece0
SHA1 9c4679e39f687b5f3a76fef4c3ceb5b8e13363d9
SHA512 0bff452f9bb7f150e73d0fd896e5361ed15796fd569baaf76606c56b14878b7b8ae0d3113e077faf978b3dc4d41502308a36e92d44a024fe82d8f62fde88d592
SSDEEP 24576:X0Le5ji0hmxsrM5zQPI9hAH8CzQgAqvuG:XPji0AKszQPm6YgA0uG
TLSH
T1FC95AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 457a8af14b12fcc7504bf153764f8a7c8ce31c322d7672181a30d3b2b4170cac
MD5 05f45ba92053deed0eb218f7baaf475b
SHA1 b5bbaf7e844f9dd803390113e5a5269360309f93
SHA512 910408b45d55501c4615df827a88ea93d400bd3f22f8ff3d484ef842a2f21ed36a27a4ad8be66f057b6099340d42127478adb4ca7d228ed18a204737e6916ca9
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyubzQPI9hAH8CzQgAqvuG:U/ezSC6vUzPveHjyAzQPm6YgA0uG
TLSH
T12A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f100e9393bdeed293cb88c3800f546b515bcd18de5db88a35afb39607bcd7f6f
MD5 e90546ac8bcaecf4545ce84b22154aab
SHA1 cd3f5b58a43622f2687b1518a24ae8308e902bdf
SHA512 fe2ccd9f2f4ff393265bf9f3d3d5a8c4e7c8cc26bfe5241df6e5dd0315240c2fa802a02a58b100c59e28bfa048e044ff6c1b69bd711f81d26ef2efea5aa234bf
SSDEEP 24576:mVbqPb88hv/l+YyzQPI9hAH8CzQgAqvuG:mVO88hXl+jzQPm6YgA0uG
TLSH
T18C559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 a3101eeaef19e3126de50a2304fffc02e5ea1f169ed6050b13e9cfe8bc9c6c07
MD5 e9477b37195ec54b8b058eb77d7e36b0
SHA1 e1e3153d090ed635971ba2c1478b425699b99dfa
SHA512 d8ac1cbda8825ec6a5023f846a4711dfddca54c6dd226b31994b29fc6c2d6d87d0dca0d0dfbb4260d8bda8563e67782106acfbe76736592d75ad61557e8252d1
SSDEEP 12288:nf7RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+P:nf1zQPI9hAH8CzQgAqvuG
TLSH
T1DE552347F59805E5DF5F0B72586B5FE2087D8DB43BC0A76B02326DA68E7F0C4E906292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 adaced2b9096968c369d9b6e547ee1e4def1ce09fd5039b0e364ac88e542af49
MD5 f575621ab25c58db17fd9c5a8ec40875
SHA1 8136814f4bfe3c57470ee2cc48acc4948453fe41
SHA512 7727ddc4cfa0ab1db1a498bac48583431b1d9ee5c06979f5a7e587e4482408df0772fd4eea71a00998b9ff0542d1e1d758fb6f985a728370e1bac46a80e50631
SSDEEP 12288:QeBNUbTVO86UURQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:QJIUqzQPI9hAH8CzQgAqvuG
TLSH
T1B375CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e7e9019560feb6fea9698652b2bcaf5914f0de163c59ddd306115ac608cda00a
MD5 5be9b252b6ce4ba33869b0984fef96f4
SHA1 390b89afe7ce743b12906b2b45084a94d44e4b89
SHA512 1ced97b3dc7fe5c7d037b83ae32290ed9d543150d0a5986ee73be86f3d12523aa5b4e2ea539c0a4b422ca8e3c46307d0ff9244b0624b56b16f111318dce0046a
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THP:iQvGAdlCEL8c/DRNw5C76YgAn
TLSH
T1DF267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 3c3e0a4d12fdeb5bbd2ff5f83c190e36d858dbfe4263a7abe801258a38e378e0
MD5 90c5b810d522301d6e1bce6dea0115fd
SHA1 65dc7e2dfac7836ae23692a47e873f53d5bc884e
SHA512 4aa4a667593a112ec0453f46ae74804990db5632cb7df666fbd35d7c2a0b3a0cdeec5e21fe97656db4efe225a9ec9610f516c2a8f060264035d2465a8ebfc7f3
SSDEEP 12288:PAwSfxL/2Dc3FDLLmt0LDQewsAj6RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:YwewsAj8zQPI9hAH8CzQgAqvuG
TLSH
T1CC85E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 03698afb2c827daf545e25df41a10b930014b9dd2b4b01a8a9aef982ec98879d
MD5 ce40bd8515f2145669c6fd414da839c1
SHA1 3d1f4168a96d3e368b89eb46d591cc1efb430d78
SHA512 69fba4a8a19e42242b7340e08c1b36340cc549f66b6f002a55afd37af3af573487feca163148fff87b629e5c903c2d05346944d147628b078b44aed647104569
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHzp:3UEtQevvqc2W1cpV2tI32zp
TLSH
T1B3474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 18ce8e7199c31406575c486ea18b72c6780d8f05e2b744bc043db9c4f450546a
MD5 d0a006beb16b9033174055eefd008811
SHA1 1b8b738da4122baf56939fe836d5d853cceed844
SHA512 3cc24621e2c1c8ae686a93b1fa7d3beb127a376911c7ac6306fd46a436de8652e44fd32aadb2491d706337f57c5b186b22f4754fed2591d227fed2b359a1e9a9
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/zczQPm6YgA0uG:doquVjnmP6YgAn
TLSH
T10BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ec29fe6ccb11babedae7a74a468988cb56b60732db107e3cd7c874a2f6b50489
MD5 1a35e32187ae3019181a219bc605bfe3
SHA1 005f2ac63392443d2dc9ce959930c874a7d95508
SHA512 2af30f43d9f994022a42007cd676449f21cc50411ccd34d3d927e91f0dc491db4ebbf010f1c6fbbb0e55d4a89289ed583d665f9398fc2b7b3dd806f7f6ad820b
SSDEEP 24576:HAhGL3IFoiwtA5l7S53fzQPI9hAH8CzQgAqvuG:HAMUFoiq5PzQPm6YgA0uG
TLSH
T195359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 74965c08d75b2a1ee292d861b277390b036ede5f50ace53b094ebea72f6c1005
MD5 90523880513a031ecd0dac4f636d5b14
SHA1 b72359058c5fd81357f2232ae26596ea1073ed28
SHA512 d99c89cde1c4ac9907256ce2709777c7c567fc3c82620258937e4c5ed3f12a87a413ebcfb09604c170aa891e6a86395dfc9c99d0e5efe3b2f7b6399a0dc0ccf9
SSDEEP 12288:2mw5HEjsChN5BFgl0WDm+CFRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:vwucOWgzQPI9hAH8CzQgAqvuG
TLSH
T18B75F14A76E80CF9EA6B46398557C632E7F2BC112B21D71F0320C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 9f1a3699eb9e1cc5d1f897958dd78932616f131dffa920e2be8ae25a0615e82c
MD5 7220ccedf183f5456cee599a4802ba2b
SHA1 bf3534d654c33b9e11eb1811f8cf39d1a94d83da
SHA512 1c0236746f45fb426351bc16942058e6eac3c9b3b8d6bf50a551d2b7483c5e571750c626cf9d1db8fb814e2c42b41031d32cfa97e0d4b60cbda81c0b06ec0528
SSDEEP 12288:46Z1IyqRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VZuxzQPI9hAH8CzQgAqvuG
TLSH
T1CC65128A72E821F9D6AB43798CF64F8187767861377193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0728715265745ea4a24b546e4daf32e103d8be48d77edf281ba583604cc2dd77
MD5 91bb213e7e44695ae57ef2be52297a23
SHA1 7158aa76b573683eaed61a199ce9709060c819f5
SHA512 206bcac3fdef81194711883cb12bc219eab5d71efd25ecd0b0b0e141499612e661659db136fb26b45b472f4df6e48505cfdbe4b4e0d5484d411236c6bf80710c
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:2QRQyi36YOcPbLvw2gAf+PN3Q6YgAn
TLSH
T160666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 36b6d79b6e75c456f362487f6f72351775e7af7070f1dae3ec62f410a06a4856
MD5 0811542bbf71acf93a1f648b1934fbd9
SHA1 790acde9c458cb7ace48d4363c723270f6e4b6c2
SHA512 81841dff8f6d6fd44132b621d00d29d74d4a2f0155c77a7f2b447d039744f1dac695b8559ffdcb2be31cc86d514ba1f66ad121e2b02bb597bb79e57e47090c25
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:VQRQyi36YOcPbLvw2gAf+PN3Q6YgAn
TLSH
T18E666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 86156b217fd8c243907a57f2010eed8db6230623bcf0bc453c5fe59fc262d10f
MD5 a6e2b49ba66ac2418a144f6aee64b359
SHA1 333c7c29296be9b710e4756c99f8f3af633f72e1
SHA512 4eaf8f7d841002880a39146e68a38313403d2edb73fa498c53d4a46825e9b7b6f799ccd0381c0ec16d01c6e8bc5ec76ea00e5b1c47c668acdbc7c44fbfe55b3e
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0hzQPI9hAH8CzQgv:w68Qg55nhceWu7PNU3/szQPm6YgA0uG
TLSH
T1C3B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9b4f53b312bde7744f3716d67dd45ea8141c001ff4fb8e5146980dc9a11165a
MD5 ffac9c4e454101715481fb2b0a3d1c93
SHA1 990b3d83ca786777127117daa49275af4b93df64
SHA512 d5116c13ea27bc3f9dc210e0b94ce056c25b9831302adecd3d3c65b3f563bc8721deeb3b8a307892d5e2b65252fea9a67990b41f7c7e22d3ece13c299a6cc58c
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99F:0y5112gYy5azzVvt69nLKnhZV6YgAn
TLSH
T1DB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89e4ec2e082854f1f2683c1c4403de9482c59e7e6b6e454ff6b038d6658c92c2
MD5 5b7f16a11e5f6392c7e272038bcdc499
SHA1 10319244dd00839c88b8d9f7f8deaaaf1eb25f4f
SHA512 74da72c86f7e4c5b7e40d7ab85029a89fe9199b1817a287cb99b819b927878ad333ff52fbfc99ce1811bbf2c2b1208ca829a9d00995a02981a548f6b64baa088
SSDEEP 49152:GB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnzQPm6YgA0uG:0u6Jmdxd2d36YgAn
TLSH
T1C2D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a61e093fabe7131e1d83a552b24aa6d0ffc41bcdc0af2574f7df9df31ec234f
MD5 70cf50be3d72ad07b27b1574748cea25
SHA1 0a7b35352fc80af11502ff4e7c31fb577e41b431
SHA512 deb7311fbe669e6b339eb950ace17935cd2c2ea9e3373c949d75246f5c3c5a2af685d8ff0322040f5304e9945281bdb40b353d72f60af16eb964652aac1dbd49
SSDEEP 49152:t1hpsNoJpF1A63U44CwH7R4xKzQPm6YgA0uG:tmifPWRP6YgAn
TLSH
T1F2B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ca4033ca0a9cd6a30e684a057f63ed3e0ac4479f225c451284d75862da6930b0
MD5 47c9a30b584fbee44db2073401c6be41
SHA1 571c1d704a24fffc80cc630434839847fcc6c4d3
SHA512 0484316f41bd911dffa2c7739bd7438a915dcfe704dc75a9fa1f08429d28ccd2078bd550c51909228c2c8857ba85116e4769b629bbf5ffea58e2e83c41e8a6af
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqxzQPm6YgA0uG:n5dKii61x6YgAn
TLSH
T1BAC5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2cd3a8d0090cc5cf16f51278c65453dd15ce6fa3aa6b4dc738efbeda24b21e35
MD5 f128815836b531e793745a18641675fb
SHA1 0d6156adf3949b3ffcdbd69735830bbfe64a023d
SHA512 722060a49614671b977fac0c5516cb73513bad5d47ff03d19a624f9ff8c88937ca37fd910861cb0f128b26d91e5643b1df3e2c74a17a57530ed6b202f0ce8478
SSDEEP 49152:ChtSn8EApI0fig3giDn0AP5wWzQPm6YgA0uG:jX2imphD6YgAn
TLSH
T1B795BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 5b6c2b0e16d371f076194e20fe3997573858bb38cb1c0e4b8806d574f9c7aed1
MD5 f4af2e42df6c704b2d53ff967d06bb1b
SHA1 1a8ac74a4787293d5d5623ba22d998277c225c46
SHA512 343ad9574e41c7166722c65863b0211fb612ec015b1ac5058d296d15618c13a63909963cd6175dc24a6f1d928349ee9150f23ee2e86a3207de9dfde838ece390
SSDEEP 12288:AzRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:AtzQPI9hAH8CzQgAqvuG
TLSH
T18A55234AF5A80AE5DF4F0BB2486B5FD1086D5DB47BC1A37B123318628F7F5C869062D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 aeacb82de5772212df64eced64c1280d6c191609def6a089ec8cb9cf3e3dff07
MD5 d2a6a26621c08057edfcaa8b57ddcb94
SHA1 442fde1c6d1ba0524140b2fbba3007376d72c47c
SHA512 dd59d475b0a220055fe57326ad027ee408e418c5c0884da56794e2d7688c7255b3deeeb8a3f30d7d04246d627005ea8277bde689c2845f25bab8799ff8cd8a63
SSDEEP 12288:RWRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:RozQPI9hAH8CzQgAqvuG
TLSH
T1BF55234AF4A806E5DF0F0BB348675FD1086D9DB47BC1A37B123258628F7F5C869062D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 14df7c2386d9ac6271b1ec1bcbd4f7f678138af10b1cd0479940ee6b73e02a25
MD5 6e1c424022ded12c50d43642492e5c5f
SHA1 d03a2577cb478a73db6375166456f08e93103eb9
SHA512 29d855f102ec7e1012334ea927646fa3c24bdc23a207c4fdef91e7504298de15e8cb681dff3a27a0ae1407671abc38864b2f47944e5f31cc557f4960459cde40
SSDEEP 12288:AsRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:AizQPI9hAH8CzQgAqvuG
TLSH
T17855234AF4A80AE5DF4F0BB3486B5FD1086D5DB47BC1A3AB123318628F7F5C869062D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5b9500d638705fc9b62e9bd26698aa9e9492f3f907596030deb219947c938092
MD5 2ccaba0a74741b696b8055cdd1c3b068
SHA1 a27535d6c345bf76cde1445de263876a8cc95a23
SHA512 9b8905ecea7a5249c1e1b4a98457741668c875770d6c9049d1c0196e71c83077930596b6a26a0098823c81d9b42287d13bd1630c9b318fedfab8329d7da9ebd2
SSDEEP 12288:GVJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:0zQPI9hAH8CzQgAqvuG
TLSH
T17A652346B6A801E5CE5F87B688778FD144BDBCB47791A3AF032208A64F7B2C4AD15790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 35f62061da9582beaa95717e459b58fe3bdd762a3174eba94bd082261416e3c8
MD5 cade2e5826ca657bf146ac4751b5e223
SHA1 a22e0765af2594555f149f03a41112cd5649edf0
SHA512 8aa765515c41f1e7aae2ad24c07b70992f156748993106ad89e02d07e973c1504671d08f8ad9de8f59275be3e6b855dbab5d8f953914ce25d4efb6ba6c54cefb
SSDEEP 12288:KRRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:KHzQPI9hAH8CzQgAqvuG
TLSH
T1AD55234AF4A806E5DF4F0BB6486B5FD1086D5DB47BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 c6a63134dfd06cb74033000434e1d505a2893ff96d3f65f7a60134b56849af47
MD5 b33f17b85260b8b632a1e6e98456482b
SHA1 6dd91dcc041006cb66824e37f6a4452478ec4270
SHA512 e169912829c71527462476f0c01c64290f4a1accaf0d39a7872b1f8c3c6421a05bc4c64c2e5373dc98a9fc45b47e7fe7b973d9023c728023b4fee83640b68080
SSDEEP 12288:wyRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:wUzQPI9hAH8CzQgAqvuG
TLSH
T1C555234AF4A806E5DF4F0BB248675FD1086D9DB47BC1A37B123358628F7F5C8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 d1950880c3ac45262e3b30e7e9adc02119b7b11bb2bf61e17b7e23bf240936b1
MD5 2bf3aad25908e3d00b9a5555a7611f13
SHA1 a1b9efa1fb4111428ce34cf4a46a301e9235ef94
SHA512 60528becb1a0cc99d212b0c6b8c7fb38315094efaa58da84a97bb925041cd01e2a234583d7ca8111566369b15f38d5ac5b398fef06c146316f317509b60935e4
SSDEEP 12288:AeRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:AQzQPI9hAH8CzQgAqvuG
TLSH
T19F55234AF4980AE5DF4F0BB2486B5FD1086D5DB47BC1A36B123358A28F7F49879062E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 938ffed757202626c04f1a58be7e3153a8a1857be1ce46011ad724d49900606c
MD5 a5acd9aabc2c10d0ddaef6d92ee425ec
SHA1 fdf545ca6f3844f1f6ea182bbcb4661371f22c22
SHA512 2552340999861f98e3af8e3f29bd1a2763c54c3c7524a3749bf82e16f06f65ad2bdc679ba912d299f08180b7a3af64f9424bebdc58144e28527384db1db0d72e
SSDEEP 12288:wiZwbJzzFEoS2cPvy2RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:zZMNzFVSOIzQPI9hAH8CzQgAqvuG
TLSH
T119750195B39008F8DD67823ECC268E52D6B27C691BA0C61F03B436675F373911D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 9610c9ac431dac279119c862b782ff9a9a01ed48c07c94029b0d0191d93c41c1
MD5 fd7d1c5c112ada7da529fb2eb8677d43
SHA1 d9e93ee19f65aa51b625cfcdb2671fb8276c2b28
SHA512 fc0c6a264d4c8ae96e621c77774ff7464732e732e05b40b9e8fd3be5dbc15a37c5aebcc4eafdb20dd9ef46383a4a898c1c6a41fd099b5ee96975ffa3a2336105
SSDEEP 12288:Y3RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:YBzQPI9hAH8CzQgAqvuG
TLSH
T17555234BF4A806E5DF4F0BB6486B5FD1086D9DB47BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 7d15ac40680296158614d141d42be97986d5799674a6720b4cc35a522416687f
MD5 086f0d333cb40ded582d969beb88c956
SHA1 e7f83a8dd349488ab8588bf4d526861adc06385c
SHA512 089d1b7fce897d3467d288c28d363c3a978731859943cd83e79b6824f96eefdf6b2b29f730bb4be3a3faed86303f266c0f970dfb939c980bbf47ba8c8a6025df
SSDEEP 12288:1rRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:1FzQPI9hAH8CzQgAqvuG
TLSH
T13055234BF4980AE5DF1F0BB248675FD1086D9DB47BC1A3AB123358628F7F5C869062E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6010113fa84aef3884396e7f005f14f9bc76b5c0852038b69e1ffe49e6a3cd8a
MD5 cbbb7cd03e58785b355f052a6d8b2c63
SHA1 041580fe206e0fe1bd58d8ac427e905b66b158f9
SHA512 6151fc7ba2b74d54be360a55b63600e28c298094e8aa381b650e922cd86ce80f984fd7cd032a702bd95c4087597c529084f1ba10e630ba3c15906589652cb965
SSDEEP 12288:NyPz5L8qRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:kzyMzQPI9hAH8CzQgAqvuG
TLSH
T103650247B2A421F9D56B8375C8631F82E776B87117609BAF136006761F372D0AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 e0da72b04aee35f9c116c3a5c30738b33427d4f59dc3d814a8840cf1bc5b5fe8
MD5 c7abffefaed68af80f6ba70b7ad27f15
SHA1 530a54972e2c84ca2223c4f206ef7b293f70f3b6
SHA512 bd74b83ac99301ceed66c7335d61aa5b2e20aae428e5b9cef081198b0e3f9492d047788bce9e3cd2cbb90d036f90236dbd73e79f4ae6619b84d7d75e02fad972
SSDEEP 12288:b3RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:bBzQPI9hAH8CzQgAqvuG
TLSH
T18E55234BF4A80AE5DF4F0BB648675FD1086D9DB47BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 588f8a262e57556c8a789283652a1b5e63e2b6f77f68c384de084b358d412670
MD5 0fd67669c9537f412580b701f896f4f4
SHA1 c73a22b24ca5be5633cb87d30bb30e80235c2d2d
SHA512 5b111aef34f7235d36f0aeddeb603206794b745f90532d0f1432db0f91c96eeeedf1bede49fe623087bc5949a392708a2ab6cb5e172b00287af506ca2b9308a1
SSDEEP 12288:F3RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:FBzQPI9hAH8CzQgAqvuG
TLSH
T1F655234BF4A806E5DF4F0BB6486B5FD1086D9DB47BC1A3AB123318628F7F5C869061D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 01b2111209dc08b69d9c79cb64d68a74a18cc00b895efac3590a3e2f849c5c1a
MD5 d3fc346b3a60db09a993c90f2084df5a
SHA1 5e9d2ae1a82a4d4e863400b2f32ec174c7c18d04
SHA512 48b8659e6a2bc32189a2740429b99bb1b8b1e51778bbb98f43c1437ce51161c64d0ce55cf4c954f797901560e7684f166df927a2cf5a0f2912cb73a0c807821c
SSDEEP 12288:4yPz5L8qRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ZzyMzQPI9hAH8CzQgAqvuG
TLSH
T190650247B2A421F9D66B8375C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e84f5f6f836ead2bf6675e55682d5d3175393495a3a8a5c9699529712cf342c7
MD5 41a343e7657bcc9b798d8ca994950cc7
SHA1 0b74c4f61005682832304f7604b7e963a6895c9a
SHA512 c90fb58c37bd4e750beb6d8636225c7148c415af1a25af3bf9d40c174edef23d8611b4409432531dc1c8f4101384017bf2b16db67f8fc6d78826282e4ac603a2
SSDEEP 12288:PCd9mWYoaLHF3z0z04PDvh8RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:aTvaLl3z0zDSzQPI9hAH8CzQgAqvuG
TLSH
T10E750195B39018F8DD67823ECC268A52D5B27C691BA0C71F03B436675F373A01D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f86754563cc9d9d63275279933242e08022cbfdc56623f14513a3d0dfafd85cf
MD5 593c14c4ebb72514a2e0934a9a075f30
SHA1 6b0400141347692c45a247fc0120fe388d2692b9
SHA512 ad89d48f76c02a0936545c2fcc3a5915645f53253568771ad864166b0d476448a2d8f92729216f16187ee86512eb3c630428e28d490ad2bd9972048e9e14c62b
SSDEEP 12288:ki4e7mRdTfgwCHKy7GLbbdIvtRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:k3bd9CHKy7GZOzQPI9hAH8CzQgAqvuG
TLSH
T1F285CF90F3E414E8F1B78A358C764612DAB67CA91B71DE8F03A4255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 97b77f625fb4bce77974df17adab5d39a2cb108dd43fc23b41d1fa3061a8b0d9
MD5 1b4adbe48644b4ec27b8243072b1152c
SHA1 4bb0d6581c561b9f0b7c5c1996364b312319aa2c
SHA512 7f756c49bb9413593d4fac7b8b4639eb6395e385d1b76636b7218371d3c0c635d3a348420da92a9c349cb3a70b74884c6e4dd75a65a6fd1745993a4927df79af
SSDEEP 12288:fMRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:fCzQPI9hAH8CzQgAqvuG
TLSH
T15355234AF5A806E5DF4F0BB6482B5FD1086D5DB47BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 d4fd616223b95de62161b82ee5062b95c61cb851b3784b462338e657bf9337d7
MD5 bfe38ee07c5f6ec4a8618b06e56c6ba6
SHA1 a48c4546ceb192fa8f148cf9929ff2ebd97cfe44
SHA512 26eed2bff0deefe6aa93fcbfdcd1dd835a3eb8b74607fba35c3f0bb6760124bdc12073be9ad788281862c103a0ca177b554ae28a23c1d6aaf44e91e305a2c903
SSDEEP 12288:cKRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:cszQPI9hAH8CzQgAqvuG
TLSH
T1A955234AF5A806F5DF5F0BB3486B5FD1086D5DB47BC1A36B133318628F7F488A9062A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 1a768050442f8231a951c6bfa71569e8f488c5640dd398a17373b37518815d92
MD5 5aef2a584ea9f321c83e841c08bcaec8
SHA1 fa19097cb0e7e6072d918f10719ff0afa113dfb1
SHA512 36256c546ad41535f7249a87153a4cb45361a01ae19a9e2ec116bfdd95f5fbfc71ff11b1702656f0903443648a229f61be4d75d1ceec3edbd2237bf506144181
SSDEEP 12288:8tRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:8DzQPI9hAH8CzQgAqvuG
TLSH
T16F55234BF5A80AE5DF4F0BB6486B5FD1086D5DB47BC1A3AB123318628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 de2091e91ad8da17210fdba12de7d80b7ec09d831ce432472a3f03e19e2310a2
MD5 8cc97b1a04229f510be32897462faa65
SHA1 f0f838c4ac6a551da04e487f7b2d23dd32a48b15
SHA512 e6bdb539ca47c4f52f759e2a1be685c98a91fb9bfe8befb8e856529ebbeb558926fb58a8e2c0fe2f082f63f1e85e02854ce5216609590541fff559b505a6df69
SSDEEP 12288:r3RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:rBzQPI9hAH8CzQgAqvuG
TLSH
T14855234AF49806E5DF4F0BB748675FD1086D9DB47BC1A3AB123318618F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 db7170230111566230710a78af0318ed20fccd4ee7725e43f83c95ec3b012dd0
MD5 f5de0865215c1505023d80df5576bef6
SHA1 90983cee92ef78d31b657d0f04aa777eda1c79b4
SHA512 5cac299ecac617e1e155360ad77e7f5a3e1871851bfcf3feea5ea8352f79e00727fe7a061c37be08eaace0e70be61538418c66f6ca98b9a7112ba17bd25c9489
SSDEEP 12288:hMRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:hCzQPI9hAH8CzQgAqvuG
TLSH
T1E955234AF4A806E5DF4F0BB6486B5FD1086D5DB47BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 6e85c4ccb9bf3df389ad0b105db0abaf823416d793222549efa3f33bbe691e42
MD5 9916f382840a9c14e6b5c9ddfbcbf51b
SHA1 a1b42bad726e22732c47e5cfa5b5813bc1bc959f
SHA512 71470f81cad299e4913a1597d9ae51d5dc79f3ad9650cf649127bfa8a6f66bee3335e7cdb375264f76c4f6bd6f37052d86b3ee489ee3af92c79c6f7a040acc08
SSDEEP 12288:LfRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:LpzQPI9hAH8CzQgAqvuG
TLSH
T14755234AF4A80AE5DF4F4BB348675FE1086D5DB47BC1A3BB123318628F7F4C86906191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 e8c51e567867318c69109180eab24b553be63f2ce59d1ea143bbdad0daee1949
MD5 2863e887de338b0f1fab1eb4ec0e2356
SHA1 b151a383448a712e898f8c1bcd016f0dd903e7ce
SHA512 9040bd777d8d439c405673cb940b788bff46525c593ac7b973f4b9328bb5eec8eadd6b063e99f8041b3133beecbf01ce79506117047c7f5d5b49dc8b5817a857
SSDEEP 12288:zRRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:zHzQPI9hAH8CzQgAqvuG
TLSH
T12855234AF4A806E5DF4F0BB2486B5FD1086D5DB47BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 614692e71bc1360d311b2ddd25a7448ade4fdc0c8545a05bdb12cb29dbf5ba32
MD5 1f903cc8c19e2ebfa7a9cd05ab5c1069
SHA1 6448aa4229144a902729c4b18d644ad08433f68b
SHA512 8ce1fdc4088e2f60a0a5b7099442bf304e2f5ad07fb1c21938073fcc0ed3f7f45a116e531f0bccf477349c1efad79effcec1aff35542088ab0382a89ec6e20a7
SSDEEP 24576:3fwvhk9RX6wkyAIVzQPI9hAH8CzQgAqvuG:QMnYIVzQPm6YgA0uG
TLSH
T10585C029EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ad969082a95442f2c1aa747e45b1025d31420bd157a248a6f341c169d657b65e
MD5 c8966b28ff29db3cf32a91c5dc126363
SHA1 66655fca8b555edd033f0bce6e76b522f5c24eb2
SHA512 48fca2b9917c5df9320b4eb2cbf809a3fec9c9bfa9555504c60736a171c057a60ce5fc041959a49c22c84e45d4ebcda4416b61b4a4646db34b2335789429cbaa
SSDEEP 49152:kYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02zQPm6YgA0uG:TySzPw6YgAn
TLSH
T1C8066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6759047ca55c3810c572e90981a67b9e13d2acded5d8dac79250cd86577f2bd4
MD5 657dcac201125ffbe287fa627a33d1cc
SHA1 d3a1cf1c071527ade89a6adc7005963c6719a110
SHA512 d0e64147004f1ac8cd28abfbd76708429f91155a110dedaaaec152f6c524f063e0e071a9ed08e6920388d1299eccfa90e14eee3ff85a5f6036d73b577b768827
SSDEEP 24576:r47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYYzQPI9hAH8CzQgAqvuG:r47JUQjTirIhCnDHUPfF/GzQPm6YgA0V
TLSH
T13B65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2d7bc9c785771ad5a4da1c069f965885620c7900d5b453679927cfd010cb2fd4
MD5 6600a54ff08733cbfce007320e344819
SHA1 85556b74737928588cdcd2aeb70414177e38ba8c
SHA512 44b3de42cb75355a57bd7e53b0463dbf5edb194578a5d24fc3a441f42b97454b53f1f4842204d9bebc8130850e0d99c0b3185923cf253b83294d12319b789e06
SSDEEP 12288:WPsfHRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:pxzQPI9hAH8CzQgAqvuG
TLSH
T14065F10AE29802E8C56E5276CB564A81B3377C6457E1D3CB13D0F87E0F7A590ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 d699f2e5d68e920d3b1acfa4e3f66f8e0c1afab859c2976aa2a3b1d6cdbe3e8e
MD5 ca51252373ff72824366ca63bdea8299
SHA1 b4e7842d0a23756ab9728bca5557c9c1f3bf0a65
SHA512 85f7519119a2d85a7b6c97d83bed0acd80de15ea1a0d276b28abc745636801f2ec1028bf8dff92e8b283d342a44ba6469ba07f3ad82483e44ecf7639013c3b9e
SSDEEP 12288:wcRGU3fxvRNri0jULWprr94lJrWPmcEg:wcYUPx7ilmrWlJrSDL
TLSH
T191250710766AC75FC6A940321E72D1CCAB707D01EE45AB0773C8873FD576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a8704e2056a691ba6ff9314c8da7f6a4bb4c6fcdd3c0b8ec76b0ba781acf9ce8
MD5 071f9c0d2c6e6c62d2d89aed095126ea
SHA1 91bfed416ff6ad7cd373371936ef5c1895ea277b
SHA512 43a5799273af1467b42147dd21aa6fe9c98b7a2392df16459648fa82330fe976dd3241ecafe929196dd435489228443ed94b2c43964560dc65ad507721d62470
SSDEEP 12288:GC06XwbH7QMtKdLYMfLBro1mvqNrfN+soN0:GC06XwbH7QM4x7Bro1mvqNRU0
TLSH
T14D6508816437E38FD1FA6071076A5B4CA764EC0777456F22B7C8053AD86AB26B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 de7482a00dad7e40de207c365947ac8e09d8bf41b1532ba19cf15be004964365
MD5 816e2ce7008dbd93267f58f08ba9a186
SHA1 52e723f0bf971d11b280226aba20791a22f6db15
SHA512 02cf471ea92385729b556aa7ab33c20050735a01ea0acdd57083e3f8736f178449df04f3082ed071868de8c9f2a0d5da2bcb14ed5772399d92355500a293b31b
SSDEEP 12288:Ro7vRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:OZzQPI9hAH8CzQgAqvuG
TLSH
T1E7552347F69C09E5DE6F07B1482B9FE1142DADB43F80E3E7122219A18E7F5C4AD25352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dbacc797a09198f14c12cba8857fbfcd705a8e0b902df231c47b2203deb221a6
MD5 ee8dce3e962a204d5d79e43b289a014d
SHA1 dd4ab5e9f4369710475b9b47ae8cbe535548c02f
SHA512 1e260c205d2a65506649344474a249e3740eb617dff6898ea36bb722f189f7f216bb5ce733fae20b9d795791c75e8adc43a1c3e7cadd7f6fc4304d6dfb965f1e
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYbzQPI9hAH8CzQgAqvuG:Mgb4mBIBhGFYzQPm6YgA0uG
TLSH
T1A265AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 df3d753a0c60eacf88471804f3d048db1ef8090a4fa03e1a7efe1b6e63609f48
MD5 4a1086c6b693ad99c91cde265126cc5d
SHA1 c42d02331460074b05e1b00d5cf19dd1ec5a82ed
SHA512 8e6d0c13f8cea1ae13f187dacdbbfc7abb2dcf793622f5018f70259a28bef669b830b40ba17460c9cbfbc410595d9d806000ab974d87859637b1aef76b989561
SSDEEP 24576:CG88u8FpJqH1Hzria7/mIzQPI9hAH8CzQgAqvuG:Z7ZFPqVaa7/jzQPm6YgA0uG
TLSH
T18395F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1e71709c4f47db7a1799699d5a89d54c7aeb7282db931a5147795781820251d3
MD5 e782fabe77e7d3791458aaeaba0abdae
SHA1 a2ea2add0977f45eeb3069862acde178facfbdad
SHA512 7c83a7e07fceb6ccbd04149b1d2411b7aa6ed01d2803cd4492e482964421301a4550c64c5015a8e59b5f81ddbc75b62011b60affec4908a9a3ea58378c8723f2
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUzQPm6YgA0uG:sG05lO43b96YgAn
TLSH
T1EFD5C06E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7a92f3cf988903b8106c6414dc1952319e68634b006f35f8314d6380e48c5f57
MD5 288c0263e1cdb6bd082364813493038f
SHA1 6072d6091bf8ebbf77866d1ffbf3b1687834e7ac
SHA512 2158537e6eff66544c5cefb1445d87393eeabf5f92ad04fc3f962b1755f3fd6b8d1abc9e8558d4b5679be627d2d1a51a0bfa194bdbe5f29a31db57ebcdf99431
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2zQPI9hAH8CzQgAqvuG:ma5POZ3BJt2pasx2+mszQPm6YgA0uG
TLSH
T11D65BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a156ea438e05d8158f6c8d7bf6034370ca6e43af5cd657135d513ca1965a6270
MD5 a4b4a61036e4ca05cf48a329aa241a09
SHA1 ca62efc09f20d5678cf24deb44ddc348d43af572
SHA512 e9299ba368629503fb671528a8eba4e04199c7cf03298c8f31307ee7a023e2b138b9a3d90e1188ca19a8e4019e7adf6275a921959b3243ca007b89a571410ba7
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkAzQPI9hAH8CzQgAqvuG:3Nc/zEOVHFDzQPm6YgA0uG
TLSH
T19C858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9f33a545da93ba0e5f2f662e82ed96859892ee62078d5b422f058aaa5fb7e535
MD5 e9afc8d8322749cbe3a605b3fd97bd9d
SHA1 3cc955b8dd15d93fc13c98876501ed7b392d4db3
SHA512 32d6707f41b4219de2d986caacbdac9d4167cef5dee9ad98beafb0351e3cf4c1c50452b5cf09b8bc689a5236aa3139a7d767775dc606da508bb182aac5602d7c
SSDEEP 24576:ATkNvNnaFeYhJNtmZBmzzQPI9hAH8CzQgAqvuG:ATMwBtOmzzQPm6YgA0uG
TLSH
T15255AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 cfd3d3f98e9073c8099dd2debcbbcff93aea10ba0cfb4491c2f35dd9d1313619
MD5 2090317378c03e3275dc5fff711d9d52
SHA1 612da21fcd4def58e67475dcafd637058d55d6a2
SHA512 c8e0ee53ede0b02d8653cc65aaa97fcb74603b76348489f7cce79491e8bd0ad5428ddcb025af838ae17b2dba7a01f8d906860dd769e7ca92eea95bb4ffd328e7
SSDEEP 12288:IHvUrBFrEjwaQiRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:IPUr+NQkzQPI9hAH8CzQgAqvuG
TLSH
T14E75F11F62EC18E5E67AA17D89828749E771B8621311E2DF02A1817E4F77DD8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 b0c9cb9f1ab94d4acf6233d183646a1152d5204950a2954e1f9ef36ab9dbf0f8
MD5 41dccf6076f257d0ceb45a208d341960
SHA1 5731cb0fec0edfb144c6f22c7e7098102d2a0d97
SHA512 c8cb54ef82fcc573fc27ce1c50214adb2e1e65db97eb8043c35e6ee953ed18973a010d567234392c6c57d7d4313b38564f2a8a553ca4cd51dc4e97faededbb48
SSDEEP 24576:PD3FHshBIYQgANzQPI9hAH8CzQgAqvuG:PDVHeBIAANzQPm6YgA0uG
TLSH
T13285E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-306-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/256-81-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/1056-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1056-98-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1056-104-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1056-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1056-310-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1056-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1452-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1452-8-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/1452-30-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/1452-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1568-130-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1568-124-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1568-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1568-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1568-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2512-111-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2512-309-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2512-109-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2512-117-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2568-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-86-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2568-92-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2568-328-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2788-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2788-313-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/2788-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2788-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2788-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4216-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4216-290-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4216-58-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4216-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4500-43-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4500-224-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4500-44-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4500-52-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4500-55-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4572-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4572-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4572-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4572-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4572-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4708-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4708-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4708-22-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4708-14-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4708-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5648-71-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5648-305-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5648-69-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5648-77-0x0000000000750000-0x00000000007B0000-memory.dmp

Download