fd27f9249cc5f920ac3019f332438f3fec9e119cc42a6b2b5e0ec023c9789e2f

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260816-g71xtsem6y
SHA256 fd27f9249cc5f920ac3019f332438f3fec9e119cc42a6b2b5e0ec023c9789e2f
MD5 cde1c20dfa2bf3ec6eb829579d15076b
SHA1 5a5f67201f113534ad8d7eb9c1ca6d78f2d225cd
SHA512 1529408a04bec4db351d80661b29b241de327d980a1609a484b33552204cf8cd54e7f6dd8614eec357aaa3733d87992304b370e1f8fa522c46ca7ea36cb4b251
SSDEEP 24576:yCQ0Pw9qAmqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:Rd49Dh8D+rC9K159d9tq38/hL
TLSH
T11775F119F75514F8E477C238CA529906E672BC5A07B08AEF23A047572F276E09E3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2900	elevation_service.exe
2680	elevation_service.exe
5000	maintenanceservice.exe
4344	OSE.EXE
2292	PerceptionSimulationService.exe
236	perfhost.exe
5724	ReFsDedupSvc.exe
4588	SensorDataService.exe
4528	ssh-agent.exe
2864	AgentService.exe
5124	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6d98ecbee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000159d4f5f482ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d186ca1482ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000023a1c760482ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e532e62482ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004487455f482ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b30291a1482ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2900	elevation_service.exe
2900	elevation_service.exe
2900	elevation_service.exe
2900	elevation_service.exe
2900	elevation_service.exe
2900	elevation_service.exe
2900	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe
2680	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1300	2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2900	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2864	AgentService.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: 33	5124	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5124	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5124	SearchIndexer.exe
Token: SeDebugPrivilege	2900	elevation_service.exe
Token: SeDebugPrivilege	2680	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 4772	5124	SearchIndexer.exe	104
PID 5124 wrote to memory of 4704	5124	SearchIndexer.exe	105
PID 5124 wrote to memory of 4708	5124	SearchIndexer.exe	106
PID 5124 wrote to memory of 4616	5124	SearchIndexer.exe	107
PID 5124 wrote to memory of 1144	5124	SearchIndexer.exe	109
PID 5124 wrote to memory of 6080	5124	SearchIndexer.exe	110
PID 5124 wrote to memory of 5864	5124	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_cde1c20dfa2bf3ec6eb829579d15076b_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c9a10a2ed27d05ebff04facfa9f39c674e7144286a996f10caf887c31869a732
MD5 8f14fb6745dbf89af21ce92da128f2d6
SHA1 33b401bf3c65ef5309e1274f94636235caad746c
SHA512 b193bb8bb5e9207ba30e64475b826ae940d359cb9fbc551bd9a424ec768a7318335f8325fc31170377ef4eeee8cfe800408f0e15b6833e77c324e1a0f3c02baf
SSDEEP 49152:Rb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnG8D+rC9K159d9tq38/hL:X3q60jBt8GC9KJdys/hL
TLSH
T10ED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 04080de38299aab2f43a8eff5929cd54aab086b32932266c4f3bf36bfe72bdc9
MD5 69b819bd7c0fd6a2c665ceb6ceb5350d
SHA1 5760928c3305fb09c1c57e549f455bc6beab9702
SHA512 a717c11353362588ffb893abe7c514c0c21b892f0bf0eae0a8fc7f26268b1dfff24124fceac09fae196c5e47467a5526c36b255ce2f5ae91ee525d96f81fdc71
SSDEEP 24576:TXYfDtczA+qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:2tck8D+rC9K159d9tq38/hL
TLSH
T16975012867D408F9ED67823CC9A28515E633BC9547A0EBCB03A496661F333D85E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d7211171bef7c15ea2db1c1a28e9e7ac15d4319d70c25f478fc653a0fbd40b37
MD5 90f28e4014e3c5273b5171c9f88274cd
SHA1 6b2ea54a9377c424b7d4de288565be9ae111dbc7
SHA512 ac4e4c452b63f91a8a04358c250b643a1afe916a48f982f7377e9852480ca6aac8b16c5387b996fdcb930b1c6bed6d1c2de4c308a8ac95a920760d8455d89f9c
SSDEEP 24576:U0Le5ji0hmxZrMlqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:UPji0APz8D+rC9K159d9tq38/hL
TLSH
T1C295AE16F6788731D073C0B9C5D2A69EE93130865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4cf3ee10b4ed95e148aa271a38a75eddcbe77f8ea6a54f07879297635d56e8ca
MD5 eebba8826147f615e4ab5312680f6d60
SHA1 c71dfd2d3303211c0c1efe1c7aea0019f952f4bf
SHA512 f8d574855c102c84365a67d2fb626a4abf044cbc3a09b7955cebdb3d50d849691f344db5a7db23855cce6e99a24edaba2ba7cfe6f49aa399795be0ff62b04035
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWr6q8wyuTqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:n/ezSC6vUzPviHjyf8D+rC9K159d9tq6
TLSH
T1FF755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d05ff6a49be650470407bc53f2bac4eb7d7546c109650318730857e53e6f8991
MD5 adafff161c59e01e342f9cfae0ce9057
SHA1 61d2f8359c26e808b1e11984faa462f7a49c4490
SHA512 6ef88a4955a56d82bc854fb45145341ee718a8a9364dad351d6813b1162f65fcd92579395268d010aecf5ade9d5246600c32009d4e07da20f292841c0e7e3f05
SSDEEP 24576:nVbqPb88hv/l+biqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:nVO88hXl+B8D+rC9K159d9tq38/hL
TLSH
T10F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 489358e819258548d9a56add875cfbdd93da30589d9bb733f8a084db1e919696
MD5 c282f6222a8a388eb69bdff7a5cb8235
SHA1 5e9496dcb0d9720a3cb41ec96fa8fde4c49bace0
SHA512 e199e6dfc24c165301543984cee81f9aa8a6a606f82bfbd35bb4fffd7a988ff78f88e777f51ee656df909888cc1e525426bb5be9c2a65bbb270ff262c65b5fed
SSDEEP 24576:myZqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:U8D+rC9K159d9tq38/hL
TLSH
T1C35523A58B0C78E5E33BE330B66999E95130CDE85CE49C9B8B10B7AB553E2D0C523953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 75de779feb6cc3b8cc35dbc47fa458d09b560f9f322029c2381f6442ba983094
MD5 c900ab45adb127e6069117517687f932
SHA1 ce78ebfaa52faad87f1f1aa2487ce47d45f51ea2
SHA512 d846bfaee8db19cc720efb7ed5a747d1fad1528cba3be9361533d1a0d62df3507966cb389049e4d6ef75f5d1b98ad4b6d0ab32dd0e96325c7533c526cd0e84e8
SSDEEP 24576:pJIUKqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:pJIUF8D+rC9K159d9tq38/hL
TLSH
T12575CF3BEE28FCE2C27A9D785A918640D77278704F61A3CBD165830EDE235E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cc3c4747c9e16db897363343d8cff695cd00d5706ca88817847424fe2e340535
MD5 dcc54764d9038224e3472c4d966d1f1f
SHA1 5da4b6fd563a8a723c50af5bf80bbe5b57d34385
SHA512 173dd1a55673cae80ac373f6185820c4bcf0048ac1676622c61ca814a69f800011730b371fd82eab8eb3f8321592f3f227aa092e1d3d669c6d62cfd7304f8c8a
SSDEEP 98304:6QvGAdlCEL8c/RRNw5CQ8GC9KJdys/hL:bvyEYc/R3w8nd61
TLSH
T1F0266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 326b6fda63c158ae65e9784619c2a0c1a9927f524b6e7d0e154a52d861cfd2f0
MD5 b05a6392dd4d2819cf46f394d48bddd3
SHA1 13431004e8bfefc24cca959fa6d9026ecdb3e6c3
SHA512 9ba7e75fd7f8b36e0a05946a05267ae31992e7daa3c957661553f9b5e99c5036c3de5b8e63994fd5a7a13c54f8ee85ff98e12738b5c61751d269596765439ac3
SSDEEP 24576:fmewsAjwqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:eljD8D+rC9K159d9tq38/hL
TLSH
T1B075E031FE74E436C37F0DB22B26C716543CA9604FA119C3E3A89A9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 80d41ae3eba8cd7a66359c4ef09b05863e536fbe4d3521a47a5044c738390f8c
MD5 925e1637816f6454e6d0f499b4d089c2
SHA1 8f75818033fd335291c6ad6d95f65690422c0571
SHA512 a854093170a7d518e661f2dc52e9d0863d0da276f7bf0ee4bb852fdb4d36f2a146cf251cfd3c3d7d63fb3d88cb32c008ed97e211628ed6f85bda0b712cf74d77
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHwd61:ZUEtQevvqc2W1cpV2RI32wd61
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac38801082a6633e2899fb87b42e5949aa5c1c5083843976e91aebdac3ddf76c
MD5 af154bfc4a49661261386091c73db409
SHA1 ee6b60c8d9686feb620f695414dc5d859b4d23f4
SHA512 68637f3fe869d0b517ab2e7aa0c7fdda6073f4ccffc6ea9fdc451c4c485aa35f32996bdc02b7041598024cf73c272f372bb7348f916f1d6308cb31db41d25687
SSDEEP 49152:hCbRquA/m2yL5zifFiV+XenmE3/zj8D+rC9K159d9tq38/hL:OoqHVjnmM8GC9KJdys/hL
TLSH
T18AD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8d6787bdc93b6fd2c46eb34739b104f8e9246ae23066689e0e911ade5ac19ffe
MD5 64e15b08de180969b084c4320ad92186
SHA1 1583880b45cf74daa5f0d001f6131adc13427e38
SHA512 77e2d912decd1566083689b7284853907da3699c7641343095eee68d69c853e13289b527b53d946f84e36fd348ff295667a865efdd335386efc8e381066ae673
SSDEEP 24576:9AhGL2IFoiwtA5l7S53vqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:9AM1Foiq5c8D+rC9K159d9tq38/hL
TLSH
T121359D81E7F955D4F5B3AB7899B68570EA76BCA95E30C20F2150D21F1E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6dd4a106432c5b755e065eb43912152d2cb918d7ebd7a48079245c71481170cf
MD5 d9775bc246bfd032fbdec3f95c8b0b26
SHA1 e234b86c37f7a3b4e7417d44520d18291f31913c
SHA512 8fc9fdd2f211570f5d23f844ccd273835a8a28f817b600fe3e78bc9410b2906b437eb527db7e890e1fbd03ce505b030b78d2e2db8835c0ddfb1bfccc89a2ce70
SSDEEP 24576:pwukOWcqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:pwPO48D+rC9K159d9tq38/hL
TLSH
T16D75F14977A81CF9E66792388557C536F3B2BC512A21CB1F0760C75B6F37360AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a3d007eca16fea451231329ea46ce52027ce1edfc1f9ad780caf4f19ee838a2a
MD5 be2cddc216262b28260d894153ce0f1a
SHA1 15ba89bcf63274e7de02794f62121bb4aac8599f
SHA512 e070e7a0c12adb1d3ec48eaaead890dd2eca147976358e6c6d431c909538ea166bdefedd3d7b1634cdefe86f43b45d68eab1055bdfb4203416e5e3b5cb302aaf
SSDEEP 24576:DZutqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:H8D+rC9K159d9tq38/hL
TLSH
T153651299279830F5E2779338D9A54A89D331BCA52B7147CF062053AA2F37BD15E33722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 202764b99e1042a8af7ed46b81eb2f06b7dfe5b24190bc0333c8da6512e20775
MD5 9c6f2f69ce782dbb068b694b98d5551a
SHA1 5efb95a2adc633a807d8c97d251c9641717124b9
SHA512 d6902e2cdbaf11318d76714c51629a6c178c27aefc7c83d189b1c0cbe52475e9f9713929c44aa464de42a509e271a29c1631cff560aad6cab2e4399937b16668
SSDEEP 98304:pQRQyi36YOcPhLvw2gAf+PN3R8GC9KJdys/hL:AQyiKahX+PNWd61
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 70e9d573c4a43de8c4ba640cb4fdb29687b6798597172865a4a9aacf23546240
MD5 b92c0d7a921e1b2433981be186cb036c
SHA1 26e98fa88095484602633cc4d0c6a007c5e1441c
SHA512 429d86c314a2f6f48ecb5a9526e27847ccbb4493a5a017b75ff86538394d3049bc317ea4d0ede1abcf2dd7d0707a450c04ad0b909b9b2ba9328aae7af3639d2f
SSDEEP 98304:PQRQyi36YOcPhLvw2gAf+PN3R8GC9KJdys/hL:+QyiKahX+PNWd61
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 732af92f427bb8b65048e581d199cd536d390a5ed8017141200917e1bbc99af2
MD5 4b74e8d87da7e5b22a6e2c43e1d56f55
SHA1 753a05180600d8b6fccb0567bc8040977cbd7f49
SHA512 0e0cde8eabad3fc69f213c5050a973017b8e5b5c50ce40b352e0e2aa403a651b030320ad89e269c9332d3a4ea6ed6fc7b94632af03c9f12e05db3b40f03bdcd3
SSDEEP 49152:m68Qg55nhceWu7PNU3/z8D+rC9K159d9tq38/hL:EthLRc/z8GC9KJdys/hL
TLSH
T1A5B55933B2F600A9C44DE1769F4A873196E17C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 21fc411b022bbb0cecdef185a188d7dedd056c793f356055f24e8a5b7061198e
MD5 0ce98d8d6d2450409dbfb5fed4218353
SHA1 f164ba59fee3ec7db97c42cdc89d17e2c027943b
SHA512 b303cf2f3046052c73977e9ff762f2e73279050b9bfb12ddd0248c4d8ae04eddf0bfb46a542098b0dfa62069877b04737b2b3761987060fba1669dee59671f5c
SSDEEP 98304:Ay5112gYy5azzVva69nLKnhZ28GC9KJdys/hL:ZLIHjWhrd61
TLSH
T15E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c59281116ce21070df6e73748466e8ea792f0fe5676cc3dad371db891c200e07
MD5 dd83a300f102ed6c29e6b0bffd8de338
SHA1 fa31bc94c735fd271fa0f1676c7d3a43fad69c8c
SHA512 4482f7ab19bf87bf891c0a15e7ab30b929824dff2e05ab87dfc83a954770932e3de1b89a0eedc6d7723d80f7b4c959c932d371e9aee0b23dda2093ae1904828e
SSDEEP 49152:cB+taZ3usBWOBr4tEG20bqx0z+n217aau1glZ8D+rC9K159d9tq38/hL:2u6JmUxd2dZ8GC9KJdys/hL
TLSH
T193D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 806cf4ec0dfb3eae995eed2faa1b69b61f714eadcf2121a89d51720eed46ec76
MD5 c8ffaf0ad833e52b9c68ea7c4423c298
SHA1 fbb49d83422e97933d5e9966a2a72ea08ce3058b
SHA512 d8fe624840b11c3a18b6a75bb35299c44e38e97954619af1485103d5703352aafdab06f79f055de7127b9c2ae7eebb5594c136fbd03aee0785d52463d49e5de6
SSDEEP 49152:i1hpsNoJpF1A6BU44CwH7R4xl8D+rC9K159d9tq38/hL:imifPkRM8GC9KJdys/hL
TLSH
T1EDB5BE13F29800E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 645fb8185d9de896ffda74e412b4fa920f068d44862c468e2d2165a4e1536d34
MD5 71480f8e0dd4f6e878dff63dce5c5e7a
SHA1 d6b5f4274b0c6a1baa55e201c498e096c12785d3
SHA512 498be4c345e22d4202d70f1fdb5b8b865f06b6d486cfd2b31763105c1ee189bdd0fb4c575c88fa001649ffb42a44e1021fedf87f89adb5720349ebcb1e5b8763
SSDEEP 49152:gSuZQIY0Be2KNRVtOnks6NMHqa8D+rC9K159d9tq38/hL:65dKvi61a8GC9KJdys/hL
TLSH
T16CC5BF13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c61a6d04b36269c01592e08db30c5fe6fa2e0d78b7ba0c9b1196ddf8414f46f
MD5 a6a35519cd04ee5585b22c74b08d53d9
SHA1 f5fefac4a677fa8aeed80da610c4d235b3dbabb9
SHA512 113addf29eda48a6f75ad8254c57037c02dd8f6ee7d3305628d97ad0a49fc6bbb9267f640bfb720741e2cfa64b466201e71a49bf45ec1e83240a655a5e71daeb
SSDEEP 49152:yhtSn8EApI0figXgiDn0AP5w58D+rC9K159d9tq38/hL:zX2iyphY8GC9KJdys/hL
TLSH
T13695BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 84d86ad1090b8ef788ba7019bcfb61c8db2fc39b7cc94dd865cba8ce38d70c70
MD5 d99366a4b594b38d526974aeba3ccbd1
SHA1 29555e5fa8471c9932a05d5f97b2086982d85dda
SHA512 1c87a178ffcb39f9639364a6ffab32f8dae7e4d5e3673687a4d133e835605e8986586b959f7cf6dc4f67f22ab4ba8b88a111b39ceb89eb4112dba7ff5deb3ec4
SSDEEP 24576:EBqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:f8D+rC9K159d9tq38/hL
TLSH
T1475523A8CA0C6DE5E33BE330B61559DC9034CDEC6CE458DB9B1473676A3E7E01523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 94382f6365c8ddeb31505cf861b93b034911c36925e60fa97f3d9569d63e40bd
MD5 366efa71771eb8fba4687d31b21f5a21
SHA1 6552cd858f370764e7c3455124c0e9bcf7f87e07
SHA512 1634d5d3aa8d8d84e41650f1451c3b33c5afa88f52cfec69a4db20e294776c9af5c3e1956203f91c210326ea88c09736b62d4e98130107fe3ae95267d0ebfd0c
SSDEEP 24576:v0qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:P8D+rC9K159d9tq38/hL
TLSH
T16D5523A8DA0C6DE5E33BE330B61589DC9034CDEC6CE498DB9B14B357663E3E41523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 ef63548da23edca23d03f388787f482a51a657ab9dc03754b8934e90a217167f
MD5 5bd57272e861be4c6effb3a39fe34165
SHA1 369b53e35749e0a8fd224aafbd21071ccd3f3256
SHA512 43a4d64ca289051ac8f3608d6761990a0fa49787ba95dffcab267b3f113db1cde121f6aaa4dab6ff49e178dc5db13778a81efc24e24d14f1232e0e9951870d43
SSDEEP 24576:gSqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:g8D+rC9K159d9tq38/hL
TLSH
T1B25523A8CA0C6CD5E33BE330B61549D89034CDEC6CE49CDB9B1573676A3E3D45623992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6bcc11df4c90771809e8f6e9c9c1d840f4c098f000eb3cc697ec4c919517f219
MD5 07c5988dd14a107e0423caf14e609e57
SHA1 01600fe874c6aba022b78f3655b459bae565e296
SHA512 e880070a3793301be104119a20ba936fa37ae72948f1fb201b001f7d0b9541c5341e0a62f41341de93f364300d0b9ba06d29bf6149e25abb79ca1528d383f3a7
SSDEEP 12288:JVPqZJDmD/1WOwCoD2XpSWKE99T0pz59d9hE77tiZE+E04VEKLXe+0/UyuI:bqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL
TLSH
T1E05522559B4C24D5D237E334EA2585E9E130FCE8AEB19ADF8B00275B1E3A3D05933E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 fcb71c397639d1deb73ad5d75661d58f730dc704b661a5e1c9a9dc2a9acc12f7
MD5 68b2d100a7c929e306ecdf7989679a0e
SHA1 48c02361fb1abf24f32743c43b0196fb7789611c
SHA512 ca0116ed9a0e433c681e3dcf027f72cbc937d6faeebaaae32cc5893f2aae6b9efe1a6102f73eafe19f185aec70ec2abb935efbad7930c9546dde033f3494c347
SSDEEP 24576:PHqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:c8D+rC9K159d9tq38/hL
TLSH
T1095523A8DA0C68E5E33BE330B61549DC9034CDEC6CE498DB9B1573676A3E3D44623992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a0244c7e468fa930c30a3924f3d74a3820472aa7c33b6cfc3d508596b9315656
MD5 9f0b03022b866f7d2a1ac10ecc3e4424
SHA1 b3e23ec9285cc24475ce4b57669dab5b803509ce
SHA512 1004f4a5953a9db24f226df28737dd7fa6dae62f561a9f470f4ecf10edc907f9ec944a79469791cff7d677fa586b00d4778cafeff9097d3092cb23d15e52e2d7
SSDEEP 24576:u4qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:C8D+rC9K159d9tq38/hL
TLSH
T14D5523A8CA0C6DE5E33BE330B61549DC9034CDEC6CE498DB9B14B357663E3E45623992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 bb1591d18ef437f9688c363624157321f65e4de25ddc66d67ef3c0c899f42eea
MD5 e701c898d83df832f2b547ae7b345e02
SHA1 2114943ead7bf2884a1a66e307ffad1e2a53e9db
SHA512 35b06964fbe5292a6f388af727e424290a4c7a9472e3890a095c650d88a535f43b8dfead06b2ee6c342ce00aa88abc2c7205f819dce3dced89d8c29193305929
SSDEEP 24576:XMqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:/8D+rC9K159d9tq38/hL
TLSH
T1835523A8CA0C6DD5E33BE330B61459EC9034CDEC6CE498DB9B14B357663E3E45523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 75fb15c2f82dde864191d3293c93c993d7a9f21a012b27e03efe832bcdff9a26
MD5 20c950792b658dd5cffc00797cdb1040
SHA1 ee1c98fdc007383c077786e2ff1b6b5cc2ef3589
SHA512 43b0dce884ed534903ff26b80b8a2550b76e92678a6b523eb30c74cb9ee5b028b1221b39bf759ea8d7e87eea722f7c3dd542a68d7ab7627b47f21e85d6ec8e29
SSDEEP 24576:6ZMozFVSOUqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:6ZMozfr8D+rC9K159d9tq38/hL
TLSH
T1757501A5B3501CF8ED67823EC9158946D2B2BC590AB0CA5F03A437675F373A01D3AF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 f0f4c559847d9330fc3a1679039ebf57daf3b48783e00a24e57d88f60104106f
MD5 dd9a444444d1ae69a66f23ba8960126e
SHA1 dfd46bc7ffacde17404049b2222dfb578159faf8
SHA512 2c96c67720731b173c03364b06fdabb1d3672722078ea478f4148a767aa8ef49530ce7071e54075e9edb893dc0a1081ddf3cfd30dfadcb125530e3cb94dedba7
SSDEEP 24576:Y9qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:R8D+rC9K159d9tq38/hL
TLSH
T1A05523A9CA0C68E5E33BE330B61589DC9034CDEC6CE498DB9B1573676A3E7D40523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 5987732b31f2bcfb434a60a8508d28f654e399f64f38426cef90cd322bd7a531
MD5 f8d560cb9bc195c031c4e6824a7ed653
SHA1 5142227aa393a0fe5ba30cc5d0e039b2421d3dbf
SHA512 769682005c5d72d848553d2f245de16be3b39abe7bbc555460545b5db6cb8def85412a675259cfa3b88dc47a95065371379a95e44ef3f1026e93a378b59b561c
SSDEEP 24576:OpqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:z8D+rC9K159d9tq38/hL
TLSH
T1AF5523A9DA0C6DE5E33BE330B61589DC9034CDEC6CE498DB9B14B357663E3E40523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 82d180fce2bc7497f3a055310805c1008a171794eb165df51f100e91e10e78fc
MD5 c5770ac80db737d7812b5d5c5dedb1cd
SHA1 c31dc73ced03013026a0822f2054386bf0ef72bf
SHA512 b59a8557cf49d79bd609c7553f0ffa5446a76c049055d263f6845953dcccd0e2073813e2b665a8b3728d38c9cc6f8f5ca9eb6328243318418d9d232791f2f6c9
SSDEEP 24576:7zyAqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:7Y8D+rC9K159d9tq38/hL
TLSH
T10D65015767A430F9D237923889621A46F331BC750B608AAF576057772E372E09E3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 56af9c9b5b8443e3bdcbd53f210a6e3ab178a3ea5b66bee6c08132af6d99e174
MD5 7c20826c3c959ccda8956489216790f6
SHA1 22ae1294fb0420b7dbea49aab11f4d13853b584e
SHA512 d13ac98021412732236378afb2014f50203fea2286fa3598a3bb241a5071c67e983fac432060af3b4d67c4e0e2413dd561136904877372e00c3b91b17d6cbc66
SSDEEP 24576:A9qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:J8D+rC9K159d9tq38/hL
TLSH
T10E5523A9CA0C68E5E33BE330B61549DC9034CDEC6CE498DB9B1573676A3E3D44623992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 5b3c0bc4931adaccae1884ab62fe89259b08fb4fe56d888041f18cc0e1e249f6
MD5 695d09e8381cdbd952c29a5a76694236
SHA1 1d1b999a87cefd9a12ac0328c085729d919333be
SHA512 5e9a079d0337ce3f05253e3bebb2c325b14db86ffe24d90ede6dd7a6127126a6d27c21ce6ab0afbd7ef878d7878f90626c4fc09aa28ec28a843842bb9d0cc3e1
SSDEEP 24576:Y9qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:R8D+rC9K159d9tq38/hL
TLSH
T1C45523A9DA0C6CE5E33BE330B61549DC9034CDEC6CE498DB9B1573676A3E3D40523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 eaa0b6f3959561230df5f2cf026596793d357ed77e20f64efa466218f7d1b99e
MD5 00bb5d00f033a290bdc4360e7fac5645
SHA1 845a5259af0a2d243ce45d4619b542abd31bc772
SHA512 3104ad5fba8eea53a6239acf42947a3c1e9e446eee4a3f7fcdf2ce6c64a139279691485ad2a5e1a2f35bff460f8eaf7efba4a30736027247cd90234e5c2cba0a
SSDEEP 24576:CzyAqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:CY8D+rC9K159d9tq38/hL
TLSH
T19865015767A430F9D237923889621A46F331BC750B608EAF576017772E372E09E3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 28ecd3075e22a385adf6a93b620c6a7d6361c87ca0f81b4003461da12af9eeee
MD5 87e16caafeb999721f95f692b73d5a4f
SHA1 f65414ade2c1c3ab58cb7b45eabce30cfe704810
SHA512 4d9cdeb1beaca49c8a9662e3ec8cc0fe2e110f01f4445c95f5fb686d1ffc9dcbcba92769d1885425074ebb4b95422af40dbc6beb877ba5b47d0f5ace42089149
SSDEEP 24576:XTBaLl3z0zDCqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:XTcLljA8D+rC9K159d9tq38/hL
TLSH
T1697501A4B3501CF8ED67823EC9158946D2B2BC590BB0CA5F07A437675F333A01D3AB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 302a3cf494a65667bd5189a53fc711882efaa408a26a28e483194f1888a0fc0f
MD5 5302904cbc459b4ab6cb25a11c8cdc5f
SHA1 3af73bbd1c6af99a329648ebbb2ba8620b22ffa6
SHA512 a8c265c70ee0c367ebb1d16d164072ac49a519b9752e6857caad3f52f4952059d829fc6cad294eb04eaf595fc79294ae0db0b674aaa5bfc203f3026c81d90f8d
SSDEEP 24576:+3Wd9CHKy7GZ2qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:AWd9CHKyar8D+rC9K159d9tq38/hL
TLSH
T13985CE90F3E814E8F1B79A3589764511DA767C991B71CE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 ebaaa63ca91355b559092024e6d29a57e36ac747b668c5982e6f91d01fa55907
MD5 8cdaa1ca356ea666e26861b82876408d
SHA1 3a5f11345d4788889381f4980094e852a07c993e
SHA512 4980a431c1897b34cb3d91bc4cd940f4695ff7bc162bd8010be2f637f78c734bd2660ca9c8fb26a09cbd1b3b01588857cab688539fce62aeec2a588a049cc921
SSDEEP 24576:iyqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:y8D+rC9K159d9tq38/hL
TLSH
T10B5523A8CA0C68E5E33BE330B61549DC9034CDEC6CE49CDB9B1573576A3E3E45523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 10e45d8d2e23b049d794ae6783caec0c20dbb1a315e94dc580920232945a8fa8
MD5 a29e5fd4e784f9c0c51ff9317ac8be6f
SHA1 d7540c546cf93c1306657ef8e004ed2215404cec
SHA512 5442b65adcf1fe90e935f004fae2f05f2018393850a1d6c6765d7ccbfedb5b7ecea7df87a8a164dc74bd0f0beb13700119d1d273e3877aad46a1ee0a26c99b66
SSDEEP 24576:wgqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:O8D+rC9K159d9tq38/hL
TLSH
T1425523A88A0C6CE5E33BE330B61989D89034CDEC6CF49CDB9B1573576A3E7D44523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 7897c3c2d6e58aad648e49916f370324619a1080cef7739568719635399cf375
MD5 1cbf05206e62ebec8d9afdc9c5a6a7bf
SHA1 ad2e55baf68c0f44f43dd10c6080571ae6fcb6b8
SHA512 8fb2507486c3ee7de8fd5804dd186cee3ff7d4e54076c1c0475905bc212659e0566bb8c86ab2b6992b3fc84699d8729769dfc6807fc8fdbd820f9b3861aa7dc4
SSDEEP 24576:tLqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:a8D+rC9K159d9tq38/hL
TLSH
T1D85523A8CA0C6CE5E33BE330B61589DC9034CDEC6CE498DB9B1573176A3E7E40523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 f2562bdf1ed84aa57b3f06791e157a75468508962d883369b3fc6b204478df9c
MD5 4be2273f89d48ba3632b0fb3814462e4
SHA1 0520ab6b0d6fce94548fce3c2f513cc3468ae0a3
SHA512 e4d26943d9dc4ef6c0c141a21b1ab691481bb5d340c2164e2109af834ce5a4e71db297fb85b60269eaf62ea670a792ca5ff16e6dfc0a172ad75bd629b17c1e47
SSDEEP 24576:m9qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:r8D+rC9K159d9tq38/hL
TLSH
T1E25523A8DA0C6CE5E33BE330B61549DC9034CDEC6CE498DB9B1573676A3E3E40523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 932dc0cc4765c785e9bb65b9c94b007ca463ea162a6c1366f26253c1ae7939e2
MD5 e751804d37d1aa3c2404d3c9c403d1d5
SHA1 8a023a60557cf51b75acf5372a665fff20e114c0
SHA512 3ba9b3a1dee5191a87c156599e96a4223a0ddc9ecf0baace7f4fda9dd431a8c14cd941bc64ee53c4cd5442f081f2aa4ed5d8efd2522ed6d68ce959a8e66f42e7
SSDEEP 24576:eyqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:u8D+rC9K159d9tq38/hL
TLSH
T18F5523A8DA0C68E5E33BE330B61549DC9034CDEC6CE49CDB9B1573676A3E3E44523992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 8b38cb65491da125948363091f610baa97b79551e4038accfe6f18004664a89c
MD5 950843edb1fc4eea79e1c7faf16dc993
SHA1 4b3b52c7626c27d53e4478d0c1d65fee19261a90
SHA512 907306243593c6a5f18460115832eb4d44ea07a3fce0898e3a3f17de063aba87efd88035a63673f4d8600a2cf16806879f714eb125a577b3e6e801dae938e527
SSDEEP 24576:qVqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:/8D+rC9K159d9tq38/hL
TLSH
T1EF5523A8DE0C2CE5D33BE330B61589E89034CDEC6CE598DB9B15B3576A3E3E44523952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 11196acfb2b76eac312e64f83a0f00844a96c7fd29f808cfc713c50a03cd981c
MD5 747245a794faccc10b637533837986f7
SHA1 0e956e730afb5f3238c2f00fc80502e709c7a1e7
SHA512 6ffd2a2d0a31997efeb193b79e09ebc088c047b36f9bc6d714d5e58177d7207dc43cae764ed26efa7825b253120c98a188b0e97f1ca76982b26e655d13cb7693
SSDEEP 24576:nHqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:U8D+rC9K159d9tq38/hL
TLSH
T11E5523A8DA0C68E5E33BE330B61549DC9034CDEC6CE45CDB9B1573276A3E3E45623992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 984de3f39d5b2bca22821f711f58775af5664e89a6a6cabf7214bf37b0665b4a
MD5 d3a553d613bd4ebf2a0d7374229ad550
SHA1 271d7ec9370f1969dd12c8a5f254e268089f5a21
SHA512 a249e9f306cfd6aac0906e8a563a32425cec97bbc9e9c15f3dbed7d822f0fd8e7658bad46f3e467757da33fe3279350dbc531891b9e3c41ae448336be557d336
SSDEEP 24576:+fwvck9RX6wkyAI5qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:uMnYIW8D+rC9K159d9tq38/hL
TLSH
T12585DF29EBDC04E5E177923C99B7464AF2B178681B31C6CF025A53AE0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5a67007f7d417d089cc9f235b060affd0b7ebc9b7aa5aaa65dc2f9df938cf940
MD5 be352cca5e38d979672e35395e4da2e8
SHA1 87cf8d2c91203563f8e838d2d3440ca9e19079bc
SHA512 448d033b12d23531f7be376e6042a41788d37952fa09681a6d2372f2bb701db3f8f240f0508dc780311b4490bf900e23f751ccdc82ddd22f334bd58bdfb21376
SSDEEP 49152:aYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Z8D+rC9K159d7:mySzPx8GC9KJdys/hL
TLSH
T153067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 87d9e458b7d3cfc65c6b2f03d9e3175c205d1d83c30094f59295e1a079069069
MD5 fee7945d1661658f6304d5e5b3b339f2
SHA1 2c085b693fc833bc7c0b025bb67e1bb744fb5ac1
SHA512 996810d8484d43ed1a567a739e4c0bfb2903229b858ee71851fd00ca7df26bd85c879882b71e8ab7ec31903e8205f87d1a725d48ebb61dc2557566b51938d715
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYkqZ8DkOwCnpSC9K159d9Ciq9JL8/Uw:A47JUQj4irIhCnDHUPfF/p8D+rC9K15n
TLSH
T124659D1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED45F36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3bc12dccc54cba34b7d686357cd665561aff9822b72872137c036fc1fc91ea28
MD5 7101c57b3ac48b4d235abb1e50b40daf
SHA1 cfb4c9c6bd936ca9707f44afc3308dfd3a1a6fe8
SHA512 da3c8dbb78ecbd90dd9f2df7b88f6a26621b05e8487b77b0b4b90635820b115cf433f12b40f6e65cb5858cd6cd3f2a9babd4262cbb7a3de3c3bccdaf19163f96
SSDEEP 24576:+tqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:b8D+rC9K159d9tq38/hL
TLSH
T1B865F059D24812E8C16EA234C7554A85B333BCA88BE1D7CB57D0F63E1F3A6D05DE6A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 20daf7fdcbceab19b0200d3a35376c9b51e0e20cb5fbc1cba12ad71b7f608420
MD5 368342ecc6fb8935be411e9d603c86a6
SHA1 801d212babda0bd27f51cfdf829ae21ce6a3383c
SHA512 088097c2d4db7008935ee59764dfe2b1d60feef41ccade9acf1bec799c24c46bee985e4b20f53c14b694658bcb962f44fdb84ff1c4f5331b41da5afcedf4bf90
SSDEEP 24576:e8plUPR4Oyt4pCB4o9khtjOtgv3PwgLA7w:jlU54qcB4o9kTjOtw3ogU0
TLSH
T1835538417626C78BC6A940321E76D6CCAB707D41FE456F0773C8873FD476668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a7d027783ffb9bc2e44ab34dd662d2ba4a4dd8fc3e8030d6cdddc1697c4b6269
MD5 0b9d02a552066d2b95723c228df48fa3
SHA1 991150a19d80e87a6ed69e41e6786585bc35cb13
SHA512 1ca76027eb464a8b67dd46252c3e1b84a519ca66a5d393d8f6cb716bbbf1173f82a5dcc1e1ab2242a566fa16c1e8ba4cb7cd6ae504d6c25fe0b57f7adaee9b43
SSDEEP 12288:2C7QoCfT9RWjWyxG8QRkggGaAxfP8z6qdf9rY:2C7QodWyUXCXxA9P064FrY
TLSH
T165553A00A5A7E75FCDFD54370372C6CDAB786C42BB45270573408A2C98B7A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 aeeb31f25bd9881b21dd9ed514045bcd9d694ada0debbef4d9f12767310d42aa
MD5 bd8f1899c72e5a03ffe1662f257e0abc
SHA1 c1c2dc70c7f8a07ce610e5c6ab190b1daed846f9
SHA512 7b6b8fe82e4fe191b0c53d981b65b7db67378fe98d65dddd8ac90573e6b08d78018b5e5bb606cca6b9b3fcd439c05ecdcc4524c5ad81f7d2562bfab277d05323
SSDEEP 24576:1FqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:1i8D+rC9K159d9tq38/hL
TLSH
T19A552365CB4C6C95E23BE330651985B86139EDEC5FA088DBEB047397693A7D08D33A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7787bbc2afb23d423358337cdd0a971ba30812fc26b17cc8a9b64a30b4593174
MD5 a0c6189c758935a5eb2145f79db9338c
SHA1 8918527074da22cc5168566c6d58c843e46fe2d3
SHA512 a92e489ac41d3d97453323d0d378810ff1a9142d612e5f283cba9e2a4c2a493d75fdc990a367fd3022bdcd1dd4867645125bcbf6235bc0c356bf49227c11369e
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYTqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:ygb4mBIBhGFX8D+rC9K159d9tq38/hL
TLSH
T19365AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6ea89802c79d85b4f951d97eb5d013f16211c89a3714533f3e58b82ba862d763
MD5 3aa97d4fc44f7bae720ff20de1106a42
SHA1 f5586f54b70f7a351648e5083cecf639ebf1e23c
SHA512 54b1e2c4d33293b4bb362fcf3ca3cf3ecaa15eb00fb770343682d74292c9d1c3aececf0465625ec28b6d85f7bed59d64d6c8e105c8a2e5fbb454bc608ab5c83d
SSDEEP 24576:9G88u8FpJqH1Rzria7/mUqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:Q7ZFPqVYa7/I8D+rC9K159d9tq38/hL
TLSH
T1CD95F16567E401F0D47BD1388A4646A7F272B8250364EFDF07A88B561F23AE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 291cad22fa9540ee28e1c3620d7a7802b450dde4b726b2fe45fb026342193163
MD5 7049583919ea05addb7048037838043b
SHA1 8202c55a41f7b17e9a1cf93aae21365583a0706f
SHA512 f60bc947d83beecd16307de4fb19af9ba78657e9fe245cfdb0ce226291ec022c518c822398412bfed81008876774e3b8381fb181d2d14e8cc19e9e973105ca51
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjb8D+rC9K159d9tq3K:yG05lO43b+8GC9KJdys/hL
TLSH
T1B0D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23815033456CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 136387d19692a58639fa30e95259f1d8994f850787ead3e49ef5e8016846ff18
MD5 30e921c85e6537639db2854e2711aad5
SHA1 c3c27105e595a20d524a3664ddfb701c542601bd
SHA512 91662665f5190e98f579ea62f1d9e7a27112161d2c01b04c79b064e4634ac045b4a73977a6dd5e304e3bcf2bf502a4f2b07157dbd43482b9fb6f868dc64c4dab
SSDEEP 24576:Afa5POZ3dpqWVM50JicR2hG0lasx2+47eidnuqZ8DkOwCnpSC9K159d9Ciq9JL8R:4a5POZ39Jt2pasx2+mz8D+rC9K159d9N
TLSH
T19165AF5EA6FC01D5D17AD17CC5838A1AF5B1346553319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b867020355e4e117a832f9a24fa88744edf91c14fdd3e6446fa7b11a6bca17ba
MD5 7c737471819a25cf9d8f1815ba2edcb4
SHA1 226375dd820cfa8b2af3837198700d7238b9d761
SHA512 0ccef1a56d37722ac67b3f2e017bbdfced7267d7482d7bbe634084db810b16acda721c5a4dc185827ae1ac5c9befdcbad8dd0157ef27694fa2a14d60dbb557bf
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7Fk8qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:NNc/zEOVHFo8D+rC9K159d9tq38/hL
TLSH
T10F857B1623E901E4F1BBE1BE89779546FA71786917308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f344064400274722722622a492279eb39b2686957f20629b4bd12c46c28c7175
MD5 7278193383b132da8a8f2431ef36481e
SHA1 52971c73ca3c560634ba2ad53c6ddb77c95b07f3
SHA512 8b90cdaeb6e58850fcd0f46fa9eeddea1e6777a1607eca47aaddd05f32336d3b73703e09dc0feb3f798ab8dd73a7c50fe61d2836f06b110eac9ef0f8c69e3cf2
SSDEEP 24576:XtkNvNnaFeYhJNtmZBm6qZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:XtMwBtOm18D+rC9K159d9tq38/hL
TLSH
T17255AF6EBAB846E4D1FEC6B4DD238512E6727861073292CB5390C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 65cac7a3f3ab27f6b382dfb1e821f2330559eb1f762066b2bbce2ac6c1c1dcc8
MD5 c51a7d71c7cd0d0f2eedce40d8dd8c7e
SHA1 1a79f08ecc8aee040e959f61236554ce3bdc3c44
SHA512 c122979a16af55ac6f676ae454a50a8b75d8663edae981a7465da1c6aeae4849350d5fdc97c1afab5bb85f930eb6583df44b9378d7e02ce40553e6412eaea5fb
SSDEEP 24576:sPUr+NQIqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:sJQr8D+rC9K159d9tq38/hL
TLSH
T1F775E12F669C1CE5E67BE13C85428619F371B8621711D6CF02A0817E5F27EE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a430a4f3c49646af09b9dc6f0c31476309851267d96b89fa1eb92a8040eabbbe
MD5 12a37ff1ae90eb6d8e68941a4aaeeb72
SHA1 feeb57bf94398156a38c1de433e587392a1cd008
SHA512 1206ba687c6b5f5874305e1aa3d457eebae52209f3492eb56aaf5576ed7d2a0ddda51e3fe3b1edecb3580525473f74bf12dacb88ddaf1dc17e353e70e97c5499
SSDEEP 24576:cD3FHshBIYQgAhqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:cDVHeBIAAO8D+rC9K159d9tq38/hL
TLSH
T16685E17DEA5C04E4E57BD27CDA638A06E37138AC073155CB069481BA1F6BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-315-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/236-83-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/236-84-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/236-89-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/1300-0-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/1300-43-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/1300-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1300-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1300-9-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2292-300-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2292-73-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2292-71-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2292-79-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2680-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2680-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2680-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2680-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2864-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2864-143-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2864-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2864-139-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2900-16-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2900-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2900-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2900-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2900-23-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4344-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-60-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/4344-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-283-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/4528-121-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4528-119-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4528-318-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4528-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4588-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4588-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4588-320-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4588-107-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4588-113-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4588-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4616-333-0x000001BBAFD10000-0x000001BBAFF9B000-memory.dmp

Download

memory/5000-45-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/5000-44-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5000-53-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/5000-56-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/5000-58-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5124-155-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5124-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5124-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5124-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5724-100-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5724-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5724-335-0x0000000000560000-0x00000000005C0000-memory.dmp

Download