862b22895016de18f7acd89d98b1ba3adb33177b7b6f7bad0ea8498e2ff3673b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
Size 4.8MB
Sample260818-ccapyat1h1
SHA256 862b22895016de18f7acd89d98b1ba3adb33177b7b6f7bad0ea8498e2ff3673b
MD5 b767d8bbec38c44c71c45b90ba805ace
SHA1 d94aae6a331afd5c81d977ff30815396e9f4c00f
SHA512 461cf22ffe4578bb64ca77f85a64eedf41d05465e42ef8b6f4cd6612623f5641afc2102dff835ed93a9eea5b2d74f44522282535e6ed931fa3b47102ac51683c
SSDEEP 49152:3mZbtrm87A0XPtyj7EF6piCja78JdYx+FcEVfDC+7EpT37iATbgoOHTemY2XmFJS:XVxbLLozmY2XW6jBYeJYLm
TLSH
T147368D26716A01F9D07BC278868BD977E6327C16032186DF02D07E673E7BAE45E3E611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2580	elevation_service.exe
4704	maintenanceservice.exe
1324	OSE.EXE
1668	PerceptionSimulationService.exe
3344	perfhost.exe
5280	ReFsDedupSvc.exe
1216	SensorDataService.exe
5340	ssh-agent.exe
2464	AgentService.exe
3444	SearchIndexer.exe
3200	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3b8c3efc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003ce7cbaeb42edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027bcebf0b42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2b519aeb42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000814323afb42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea8fc6f0b42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc307baeb42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4fddef0b42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d98f4acb42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
2580	elevation_service.exe
1324	OSE.EXE
1324	OSE.EXE
1324	OSE.EXE
1324	OSE.EXE
1324	OSE.EXE
1324	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	792	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	792	2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2580	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2464	AgentService.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5280	ReFsDedupSvc.exe
Token: 33	3444	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeDebugPrivilege	2580	elevation_service.exe
Token: SeDebugPrivilege	1324	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3556	3444	SearchIndexer.exe	104
PID 3444 wrote to memory of 4260	3444	SearchIndexer.exe	105
PID 3444 wrote to memory of 904	3444	SearchIndexer.exe	106
PID 3444 wrote to memory of 3544	3444	SearchIndexer.exe	107
PID 3444 wrote to memory of 2108	3444	SearchIndexer.exe	110
PID 3444 wrote to memory of 4264	3444	SearchIndexer.exe	111
PID 3444 wrote to memory of 2548	3444	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_b767d8bbec38c44c71c45b90ba805ace_cobalt-strike_glassworm_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1216

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fc0e217104cc537128846c1cdf139ef903aa28eaaa6a5ee9e7cf1701f34929ab
MD5 dfffe56ff6e42eae1666d482ad1fd2e8
SHA1 b0040add23881ae42829fbbdf3f1d5930f17b2a1
SHA512 d9231c74de43484b1469eeff78463d79224286f2c29b04728f1688d903aaad16c2daf544632893154a37ad55fd4d78bfd8d6e59436a0e1616c8d71f1f2c2fad8
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7Q/lFTjN4:t3q6HjBvLm
TLSH
T1B2D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cb1da0a317be03e82de10eb0e3bf74aee14dcec95532717e01ee7a61a41c6836
MD5 a7d0c9c9607c3732dcd3f43cd1942aea
SHA1 6f5fb0d4311e291943dd47e7073b51f04e4de93c
SHA512 2eba4ad3dbb82227fc3c7dd2899abd511249467bd605c50979a2aa6af2836cb2cb824eb2aec4647010fda226c764ec4a9c5f67ba1fd19a820c58015a36820f62
SSDEEP 12288:G1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:kXYfDtczA+nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1CA65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 405adc405351a52fc459d4d58c0c3396a9a5c064aabe156cb603f4fa2b937ed6
MD5 539ac94fc7b680baaea32df5e0b44a5e
SHA1 8e92839c63d475af130b5c0b050455a420fb108e
SHA512 a320435ee72277c68aab093c52a7e14071b839ccafd6a9ba7ecbef23b68e760aef1cdb12b17536fe6bf4112ffd7f1121dc7a8c771af929df07c60148eab72260
SSDEEP 24576:e0Le5ji0hmxLrMNnQ/tbw/2Mkjy6Fr7g0oU:ePji0AlsQ/lFTjN4
TLSH
T130859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 88de0f738c5c961cbfc57804182224b2c9d14b13e598add33262002242095402
MD5 6af75954b1bff147c4f9729b8d855b9f
SHA1 541dfe0702e1c224c718111de260afd7b4d2ae2f
SHA512 4c752b364323120c66e79ba7bf71bfd2bff25144d5f736d8d501f3254b2d1a87a2c7238e78d58ff9e57a4bf402484934d3656977433a0c6697a9a483f0fc93ca
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWE6q8wyuXnQ/tbw/2Mkjy6Fr7g0od:X/ezSC6vUzPvxHjyAQ/lFTjN4
TLSH
T178755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 943dadf4c92b393d93b9c60e8c371ee7027dab402420eea772e9addbc0c975f1
MD5 f6d7f6da03c1142a09bd539a85f998ee
SHA1 048d68b35d4c7c43f8ec02bb877c4751307552e5
SHA512 14696675508093f7574f151c67bcba0f1447c7c07300b36136af39008e0efe4b0db0db8874ed3dd8a294b96544d5364944284597da8889789786378a38193750
SSDEEP 24576:yVbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0ok:yVO88hXl+hQ/lFTjN4
TLSH
T137559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ad12e53a9c7960e6aabd0e0ace5e84dc15ca55904ec15078d35b61090ca07d18
MD5 66334c6aafd9023b361470e5ac42b601
SHA1 bc553cd17f5d4d0226060dad7ea4edefd1ec324e
SHA512 c5d317d700dee08cee4f0c483dae4f2efe8b24b0832987671f528ae04bd48b412ca384e2a807ca221c6bc2a5319a4b728b77a8a69e95f59a8f24e552842268ed
SSDEEP 12288:Fz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:FzJnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T17F5523796A24F897FF2B06B15C9384826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0da35fc517d0a421ebf146c6fd77f0318ce9873c9baec36aa754fb33168d14ac
MD5 18efd279a4443ff99347b68e0febc5da
SHA1 1cd14233edd7b53f09abb1e8dfc0ff15b7c8326c
SHA512 7984d5b80b2e2ffc0a698bd946de02a442755f9b3214573143c828f407b34b508d51efe3e663580d724e9958f06b754f0a93d93252667556c12709ec2ccaac47
SSDEEP 12288:EeBNUbTVO86UiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:EJIUinQ/tbw/2Mkjy6Fr7g0oC
TLSH
T17675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a57beca8c699cc17450db632fad0c257b5a8c42eba5743a4b167597b1abe9c30
MD5 9445bd95bf4d92fd3059735d4e3679a9
SHA1 1cd4c3d6be323dab804a8deb0511523eb957ac1f
SHA512 2a393c5e8877b9bd3bfbe28f771feaafd1f24af339a38cc95888c9fd0b596c930414cb3dc56e44290e1bcb97eabd59074acfeed7fbb0f320c1aa06425fa9c3b8
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:zQvGAdlCEL8c/yRNw5CsLm
TLSH
T109267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 03db438f701e25f97485aaca2311b7d84ec73ab76c970d756ac449d2a5c15f18
MD5 4ed418cc3654a35607b49dabed1f049c
SHA1 f67a862a0be45df459ca2d65ba2e0d97fcea6c09
SHA512 ab9f2f0d6e2daf0899607bafee71837ae379bbb4ca37b7aa3977f0441a6fccad652ee3e3254b3941410622775cf574542fa7666d3c990e60f9949c80ef05acf8
SSDEEP 12288:cAwSfxL/2Dc39DLLmt0LDQewsAjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgW:BQewsAjcnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1F075E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4e1f9e0d1034b533050c148df913eaeb5df4ada751022a1e46ac2ff2952bebab
MD5 e0ebd1503b6209c247e87db4b66cf596
SHA1 4c17a36f8d4be3dd35dc525b170f8c61cda51762
SHA512 b4486f096f1ba8d9820dfb8a459dbff264674e8f7fd55b3480b51c679435ddcf0f1d7c3a953049a830bd062c92da36d489aea597e8d71f74bca67cf52d677d3c
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXL:hUEtQevvqc2W1cpV2EI32
TLSH
T15D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7173e64aeedc92ede6297eaf4cacda45b2a38e39f85e82a69aa500d790d170ef
MD5 7acd331e66898f24679b633df8d60cf9
SHA1 918e20c6b5e0ba30028329827d16dc95a92f28e2
SHA512 cb0e458c4c144ab19cd5f67033f8903781d48e8a62e5190ff8e5ba2862aab8f1b8e5206a34732d0169048302f7ea9d125d220918cca8bc01ba160a76ebe930f1
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/z8Q/lFTjN4:3oqtVjnmgLm
TLSH
T101D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16183d9d2c97273fe78d7d70d7bf63c23f47fc043ee8285cdb287988f49ad4ad
MD5 e73a39ae6b5d1d8444c55aaa1614988f
SHA1 55777332372661b7690718209dab2dca09a4d7ed
SHA512 46513bc4c3427f9c27a4b317bbe4cc048c61ebc1b9178e6111db803bc49734c0395ce924f8596191f02189d76f2aafb33adbde73b0938d26e6d75b466b519320
SSDEEP 24576:YAhGLJIFoiwtA5l7S53LnQ/tbw/2Mkjy6Fr7g0oF:YAMyFoiq5bQ/lFTjN4
TLSH
T14F35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 89e11de245c74dcf345236bb325b396194717a979d9df73daf9a76ff93a4ae9c
MD5 8808d73a56f4bf7525dc8567012aa29a
SHA1 716f5331bc5f9d3ccf9c5559ab4d4c724afcf053
SHA512 fe54d2614283a9dad1716626684cf6f7b89489aa6759a986be0922b5c11e6e267c36bf51e292f303b7e9364155c02cacdb6ea1942db1dd6b12274fd79d517622
SSDEEP 12288:6mw5HEjsChN2BFgl0WDm+CXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMn:TwuHOWgnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T17B65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 06881d2996bb00171b759c07455225f980377a31703f79ec8cd590fc4c5c828d
MD5 2343f44b84509e71b6609f284baa9017
SHA1 875b96326e98938e331ff2b56ce64f21d402c32a
SHA512 542478fd6f242c9bb30e1ce0ab252bd7c5a03ed2af643dab5e21a9ecd4a2465e37eb1d1c094c9b54b2d11cd15b319766e0dee0cdf69e3be81dba78a203b1e12a
SSDEEP 12288:qXZ1IyMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWXN:iZulnQ/tbw/2Mkjy6Fr7g0oXN
TLSH
T15155126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c70686fa3b655036ebd290274c61e4c72e08b2987d8edd2b56d1166132601745
MD5 ac3a0261e9cdf6213f7ae9d65a8a0823
SHA1 9444ea69ca23493bde710bbab7794b6b1f4f91c4
SHA512 3306c22c70e502cb2ec46abba4490bf2ba5b186eb65eefd4c608a8d01b526beb319461e86767ea7b43ddb3f8cd4c319d8f53dadb8feaab02608b9a2308b68ab7
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:RQRQyi36YOcPQLvw2gAf+PN3BLm
TLSH
T1E2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d33a2a3bb5e94fa78143775f065844f95dbbcee93e000af35ea5dfbfb8d2c71f
MD5 16d1424f39d357b4d0b265b4af65cd8d
SHA1 aa93f19e5232ea06ab78d1ed3391c0c5527ffe13
SHA512 f483a79a802370280c40dd0f31aec481580fa2b147dd5ae05ec068dc4d4bc9674e844dabde42bed644273586a9e4c34a989d936fac41bebd942fc15093e80932
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:qQRQyi36YOcPQLvw2gAf+PN3BLm
TLSH
T13C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9bb9ae261cc2f150dbeccf23d8773caccdcaa423c9af7378a2da58dda904e290
MD5 b5e1f44e6a461132fd0168fe67171d9f
SHA1 904de8e5a7b3338bb8fd4c37f8117d482fa69a34
SHA512 498c58722cf6c8cef49391511e71baeddb524bddfe5e8bdb3628bf22d5b6c8e7c30043fbbf9ecc2d0a34834dfc6a0fb3f161f8ec51a75338f531301a0e1bbe4d
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01nQ/tbw/2Mkjy6b:e68Qg55nhheWu7PNU3/sQ/lFTjN4
TLSH
T1DDB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b83a791c81a5983b14c2474c11fe63396c96bcf9ec05f14345e02aad801e1235
MD5 d7bb5a8d45539f57b1b665d4e20d9744
SHA1 ee5051233b63295bc3dd41bb8c3e1c05f29ab30e
SHA512 887e73e323ea1e161a37437b03c278cbd179fd5178acec6909f6e3cd2183cede1c89b33d821b74fd1c30bc5eaf9ec44cb5ff3a8c4e2e3f8988a8f906e38bfa80
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:yy5112gYy5azzVvL69nLKnhZ+Lm
TLSH
T11A167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 120f3e10ae9d60acb5afcb428fae02b2f742249852d81c9328cae46ef16d4a34
MD5 4149f9ab015faa7e917f4868de0ecbd6
SHA1 d1ca41ced08ce8b734d45dd158ddc5070d71271f
SHA512 e85cb5fd93ed3fedf5abd6107557b965d7d3bbe58f3412afd65effacd40a862c8b45b5f93cf839fb77c1845f774991e6fae9957a750a9e7e91b20cb9f60d8469
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Q/lFTjN4:Cu6JmVxd2dfLm
TLSH
T1B4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a318f285f6ab9d13418bed55fabe108feca82dc3f787807b30424d2b071267c6
MD5 75438ec2e49fc6d66d5fe49887862f50
SHA1 128302c0592f476b9e8a9e064797fd9b09701a13
SHA512 6dea1334453ff96e7594949cf838f94276ae39242044189df31c568cb20dff871a86772fe36fc6a1edea1dcfd292a6d2969e830487bd73444e2262b10f3e10d4
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xCQ/lFTjN4:WmifPbRgLm
TLSH
T1DEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e03ae37335176234ad05e3467b2712970d8fc5d2f9ebe951cac77e2f5b8f28a5
MD5 a17879712b32278bc1f050eeb712efe8
SHA1 777168abd007d4f0719c035bb6d7a1e949ca40c2
SHA512 248c3837081f9abffd7646888c59791c8c158258a93a9b9492f189dbecf339729949cedbe3d58ed67eadf3a0b5a843e9a56026e478145fa6496c68f4af0198e0
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqlQ/lFTjN4:Z5dKTi61KLm
TLSH
T131C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 83bc6be6015eaee655854d4eb7278536bd42380f8c00cc1191986cbb290ed518
MD5 c49ce10875a12481f833ef6b0d1b8fa6
SHA1 15c962ef8311e075306fbf76b5813cebd24ea33b
SHA512 e394efee93bc9f36acbbe085b9c3e331ba3951ce23a62a264827de48f175cbcbdd2079eb49d77a802e1978d8e704ed3a9848519ca58ca73e4704b2e464bff103
SSDEEP 49152:phtSn8EApI0figngiDn0AP5w+Q/lFTjN4:YX2iyphELm
TLSH
T17E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e9065ec643234e7589ddb69b8ac3d31ea61f932f9877b7000301300f66814c72
MD5 ff6bc5e3a30ef54e9d90debb11819947
SHA1 61529e7682e8743063b9453edc4afc77ed3e8b72
SHA512 29131ab9c5e8cc647d07ae13182ef4139d74bfcff56050fafbefdf6b941f0ce91ba3de713ab12df954a889d00e400d0b0889db506f31a5f9f67ed08c43e4041e
SSDEEP 12288:7RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:7hnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T11C5523697965F98BFB1706F18C828182973F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0f87b408dbc2d67bffbbefcc2f8ea1936793466c0b6c05e4c44436e1f94fffff
MD5 bf7e4495592a20142dfd69b45811e635
SHA1 577703b29d012bfc972763831bb0acf025b9a238
SHA512 c0dffc2261664d57942730811a86182269cce3acf7a68a488cba05026a9842020fdbce415e346f9d6bad5fd196e0a1812c46f5a5782d540518ceeaee7b3e8629
SSDEEP 12288:7oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:7onQ/tbw/2Mkjy6Fr7g0on
TLSH
T1835523797965F98BFB1706F1488281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 538b247ed1159516f7096fd9f23d332fad39a7418a0b8793e43fa1676450e44a
MD5 bf687b22998fca8efea4ca0dd1bd6011
SHA1 41b91b422bf4e7b6e665cff43285b98d7db6598a
SHA512 936dc6e157b8874d178a12ef975159ac15e50626a5efebf0c3ac884fa81b2001dab203cd0c3d428a48dba1f2325cffce5201c6c2b7bbf2a12a43dcd620b9f68a
SSDEEP 12288:g6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:g6nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1065523697965F98BFB1706F1488381829B7F0DC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 943c81c95adaf1c06085e350cf493ea83ccba1e61380dd287e4d514c50ab2cdd
MD5 0f8905ad87e4c1513326466de54fba7c
SHA1 1135e4a6b15a5657d4b15b8a1ed7f8632ae581e0
SHA512 e285ab99ff435b810d72a8e39edbbbe1c7bdac38c38f047e1a7a286e1ddb863afaf87cca73be606c349f671f7c1faeda81abfbacf1b4572939e776a755d0b3ba
SSDEEP 12288:sV7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:OnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T14D5523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 665c2d0458e6f797c5d7c262ac5023af5e2653cab5323983b24b2c5d9d8e9ba7
MD5 3cf10cd3521b0dcfb0c0dcd2b48d81c2
SHA1 b60f74de3ebeb3d96bc0be938a673fda6f8e2383
SHA512 29d4544ae7578ce66bcc5bd66834a97e057a4fbc83993899904a9daa4d479a41c25358395133f7cdab2822375ed10f723d976f8d0f07cafc4bcf5f58f7b659cb
SSDEEP 12288:7DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:7znQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1D65523697965F98BFB1706F1488381829B3F0EC6BFD1A38F77481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 56e1916900bd031a53d9c5e47269fb80f28d6168025a4605a38d606c8d2632ac
MD5 121eb4b3c230bbf1d093f91a378291c8
SHA1 c89c9e707251d11a4ad35c1bffb8053373b85f17
SHA512 f5762c84bb95b356725c2dcea37f4c32d2ef93b2bf6f8ae7d9fd6441ffb994d0701819c54c9822349ab161a3faeb7eab35f1d6bf11adad10a398de015d4384c6
SSDEEP 12288:O0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:OUnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1285523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2951a07884715cafb82a637b4433f136b8cb11b93bb63c6c0a8887f052666c67
MD5 c3f4a77c3fc980c3689f09fe7730f126
SHA1 736258ccdffee88d7b5627b17274497e592ee7d2
SHA512 b160c4037461a1ffcd68939268f10c7495a8c4a7365a806793568050dc2f1eabf2896a8fa32f89d3b18e85c0d9be7c1ba3fa9bf9168d41294dccc2c515e6c384
SSDEEP 12288:RQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:RwnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1ED5523797965F98BFB1706F1488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 440351500f83bd75674c03708fc637db53601f2cf0a04c713ef7b9cf18ec95e5
MD5 4a58fef2a0d832bc13b244789fe2f5aa
SHA1 6b1126567f279ffc1659b7ff99b2d97b612f32fe
SHA512 98a44960c25145182407dadd9854ed513989f83ed102dd2151189fb61134bb98cafbb772fbde7a22c6c1723b53f676a4164cd0a708fd0dcd3470821accc8f39e
SSDEEP 12288:TiZwbDzzFEoS2cPvyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:+ZM3zFVSOInQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1567501A5B39058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a899032834826bd8a202e492821f9bcfa11352d746ac1a8bfdc770febd6573a
MD5 25a971aac6f7644f3aa01b1465885f47
SHA1 1b7b412fad3043063a11b25db68b203dc927e6de
SHA512 df1485983e9a4e7f6d82d8c7816b11400282c8ee4fbad70524d4b148d574d8f231ac1bb1732a92da5b22bef6c2556f1f1aa94eeaa789270172eb408735c29272
SSDEEP 12288:x1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:xVnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1C95523697965F98BFB1706F5488381829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9208bb6153ceff55819d412af53d29e7a33eac5cd9be3aeba74b3153e3cd202b
MD5 81da7291126729ac72d1f30aeb73d900
SHA1 a41c255f58bf24a3f4588e0873ce85f0e73358c1
SHA512 e4b18e09bf2a5eb41a18ae88a9eab78a84c7cec233d7ecbeeb6704d109bd9dbd1232277083d35502870662c5eb8ffa34a455212058c536cc29079765ec80f6e2
SSDEEP 12288:5pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:55nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1F65523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 32adc765a0b6a9683b8194feb82a0440ab089a6279c3c3afdcc5b9c4480bb20d
MD5 eaf86adf91fcaf022902a85fbd13e535
SHA1 0ef911a3471a201007a60c8a61a96e3526e75708
SHA512 ef7e16b7b74bedf99c257bbfb28a7043a5611e8475ce5eccd08a4c354e331e4f970dc97e2faf82c2acbfee235a903577f844f4e4224004671c6be9d55d70eaca
SSDEEP 12288:lyPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:szyMnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T17F65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 973f97b7bb19831bea6c1e1629fc80314ad50bea16660e51b00a0602c546b2a9
MD5 1c5959051ee886b1976acaf3d15d4687
SHA1 e466b7b9ff7adc77df0efea9611dcd4871f32c1a
SHA512 c8478189d4bf6004d0fddcdf1e4abf2a5024d70c41afd53ee435307a934b70cdc88bdadb6e549ed8e9143a45da869255d1f72c45a44fa780d02173cd6022213a
SSDEEP 12288:J1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:JVnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1F45523697965F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c0ca5edbd935b6cc3e0c1ea6cc960281405446efd55f32aefe985a987ef7474c
MD5 9bfe643bce2bf9beba7b6dd499fb17b5
SHA1 5d8c1bbfbe6a3d25479b74fc50e294625ac03eb5
SHA512 5e9276c5af215bfe3227a7f62d30b5be853e6f5a50b52c96a2be07c21f1f748a02a4baf386e0f26e57944c0590de5a1c632d786e3047f512ff4769c831aa0b80
SSDEEP 12288:n1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:nVnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1B55523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2f0eac766ead2a8eb504a89b37705ddce72dc787fee50ee5af50a3321697d0e4
MD5 f15633eb1d0f449c9e271b57ff870294
SHA1 2999003ba5860b78fdcdde1b8d8b7d21babe5468
SHA512 628f7415a7cad01731d657bc76fa8a2e76bfade9a1ca2bcb37781b8c7dd5af699b3acfa2f096de1247d4d0cfb1a6d58ee7545d178120e4e000ba72a31191f4e6
SSDEEP 12288:CyPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:fzyMnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T10F65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9c33ac2c0772dd6a2edfcfba6e8f7808f29015b1bca3b4adb6fd87c6e3e31bf0
MD5 4472ad6ab8e8237542f61e4f62b10bc5
SHA1 251ad7a5c9ace5a3a6ca3231e62632696f4e417d
SHA512 47cc201c2920729c0656dc2e97351372f6f5a8628a0be07721011d3a6aece5c7f93b879d969a8482925c053406049673c9e540fb6dc9af2072ff99269f28e196
SSDEEP 24576:JT0aLl3z0zDKnQ/tbw/2Mkjy6Fr7g0ob:JTDLljXQ/lFTjN4
TLSH
T1967501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 19cc228bc7a7e84f67faed777e7781739da44005d7ae26ab6e61b1f656912f5a
MD5 7a458c4149c91444cf5dfa3f2d2e38e9
SHA1 eae2419a99556072ca8b930dd055908788ff2efe
SHA512 685f25ae6d6cb45004cac402bdc272a89622fba77f6d9159d11e540b5db756f3632110bee3fa153549f0202a54f887d937dda9b60b59c089cc98b976d5294697
SSDEEP 24576:731d9CHKy7GZWnQ/tbw/2Mkjy6Fr7g0oi:b1d9CHKyaEQ/lFTjN4
TLSH
T1F085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 27b6d315331bf6a29a56b67eb0f0163ad281a12449c3b8a6f46438816021fe4d
MD5 29720ecb01c0fb80f39f8e32a26ad382
SHA1 595ad151e77e101ebfd8d694f6afa2c4d6bb5f30
SHA512 86fb8fdb53d5acb8f43e9614e6b15417d910d47a1392c00a8f312e347a3644072542d8597b302b59b71695e5688b45b79565f3ea4e52687fa704c6a84a947ccd
SSDEEP 12288:daGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:danQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1755523697965F98BFB1706F1488381829B3F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0edcbf061439dfec3875095f6a5967355ffd8a5745f428ee72026b6dd80e6b98
MD5 c8a311964afd70fc018c9bbbf20b8d1a
SHA1 8e44b48e772d43cbe7148e2318ad1009af75722f
SHA512 759b82d124d875f44989bf37ce2bb83faf0b8588155aeca4448eb3826198861d23967e2eed0644fbb9ea8052dc68a76aee4a7a8174a60a982fbded7fa88d5c99
SSDEEP 12288:ksGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:ksnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1FD5523797964F99BFA2B06F1488381829B3F0EC6BFD1938F7B481129967D39406D6384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5d1e042e08f9697c0cfeb7b9f5e78fd160fb2bb3676d86a35f8c106227e6ae25
MD5 15de9594cf82a37a579bbc3c6de7f645
SHA1 2736b4eb467d4873b8de3db1d1b9cb5cc8f0fc50
SHA512 152f76d3e1039c116a179f46c71479739bbaf2b42c8aff056b4d34889efa606f35ea5dd10218f7aa5d1d184ee2c9366230fac2c474c42089977ac0f901b3370e
SSDEEP 12288:ufGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:u/nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T11F5523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a3816f072fd7913b3c3b570d78ed3ae1e42e621cb2567aca1c312ee41b9402b2
MD5 408a5ecfd8e0d31543da3d0d6759a1d9
SHA1 037a5f3494ab6db4200f15b90c19eb397ea38285
SHA512 5529965c59a5af9435d5e4c843e40e190ee50895cad2faa6e649ddf3bf406572f3fb82b65715ef5c909f6a86293a87561af71ef5bef9d91614ef1414ca15edc9
SSDEEP 12288:R1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:RVnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T13C5523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 faba0088fa1d9e46f59c629484f9e6429e8edb41f5bf4c8b825db8d74b8084f0
MD5 6a3d6b185d053f25b7e776e759208d4d
SHA1 e09ab9085e040eb8e82244bf2a366f36e6d1281c
SHA512 ead7c0f854c3bfeecb4a0ab866b76adcb2aeecc24d7303b736fd3c42b415fd61b3be3570c4ac367f38e6ed591c8217071d8e8c390ee22156f2cf4a17a1b1ebc1
SSDEEP 12288:naGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:nanQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1EF5523697965F98BFB1706F1488381829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f409ae55736c49faa0092271f11c7e48bc6628961a298171694d78a89512939c
MD5 8df8f0e1c42500b374ba0c79eb1de7fb
SHA1 fbfa0297b4c035000d1a3911d3173b3269a1b6c0
SHA512 dcde11235804618574d003f673e2fdd8e4cd978116173078b16435ceb704deade1616d7b5f73cc125c3a23ce728797711c695e09e1162b2a369995ae85c0aaf3
SSDEEP 12288:u9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:udnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1485523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cce96eaa33bd3b5d92146b052296658d4d21f14828f187b1a245b2694b47face
MD5 4fbd01be277afc9c510871188645d500
SHA1 3c97bf3ab62bc4fb5c2cf3b0ef54d336861d27ba
SHA512 62ce338313c5c3411bef43ae1df3dee17d23aa36e3fc19d6e8ef9d75e8ffd8e3922722e563f5f1b52368ffb94427595fb8bef780a0d1eda89676b76d82c2723e
SSDEEP 12288:qDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:qznQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1965523697965F98BFB1706F1488381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4e526f0618e8830f72c574ff99143be4287f08b3b8c16385a9aded9e311ad9ab
MD5 52ea113252a2e60e1c86b9f25f07a5f4
SHA1 f99688e3389d12f6c015a0d96343570ee876c8f4
SHA512 b1e4bf66fc4fe40ffebad58938113caf1174a50930823d94bfaca0245fccf97310cf8dbde7bad3194fa0efb0ccad8d7df33c017f362832a4c5cb966626422f5a
SSDEEP 24576:Jfwv/k9RX6wkyAIpnQ/tbw/2Mkjy6Fr7g0oW:4MnYIpQ/lFTjN4
TLSH
T10F85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b9d1205b8cdbb2ac89ae6e9d2ce45a591d93e1c7626a2cd23fce77668dc71985
MD5 548c004d2462a2f2b7e05206c15659be
SHA1 fcee0fd1972bfbf7b8a41382a2fe2eb4fbc4ea69
SHA512 b8c149401f9d0c1f59608fb24256564b160043ed82b9aa44266c12f275f2c085eb433d86241cb3be417f3c895dc244257a66f57f2756f22a90f76a461aa2bf1c
SSDEEP 49152:yYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:sySzPhLm
TLSH
T1DE066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 40d55f1747e61dcaf8ea2d7e0f297c537e710d2022481015c20b2d5fd2e82062
MD5 41bbc6b27ac07c83f376345c620736fc
SHA1 5d545383b636e63ba6f64e337547185225250121
SHA512 18f6ea99559186bd6c338e1ff105cd7e6089f67dd33d92dd699c9f20a99eda95cbb2bef9c6426dc466ece9aabd888273c3242c10a96ef4cd9900245796481ba9
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4nQ/tbw/2Mkjy6Fr7g0oq:u47JUQj1irIhCnDHUPfF/OQ/lFTjN4
TLSH
T1C165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b413b60de1b81ed50428d7119cd3b14aec556f58b3686d8d4895a6562ae1f406
MD5 fbe11715c1dedd3612f20fbfbc5ded23
SHA1 703b412a33f46e7fee6bfb75896c46eae14a7d48
SHA512 b42148efa6dbf254e57f2863ef4a39a8d9fb025c2f034a74e8917266b2c0f9566aa334b82e9ae8026a1f8a33e8252ba9e03594b7bac84cd4a7861fcd172fef33
SSDEEP 12288:SssfFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:ElnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1B065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 c8c3bcabc676d08a8f41c9993a9587e523a85db914831986fdfb503106bba683
MD5 99b737aa96c2d35401b452b0292b110d
SHA1 edd86d6d4e0c1bfc7144b2318dcc0f4748543f10
SHA512 f12bf4fd01a02c0fcdf05b00105349d38d3ecbbc9199b6f35c1b43da4422752502718f46bc8e2af5bf5796fde9c417f087d9d9ef5317856fe0c9f6c94f8ba285
SSDEEP 12288:RxDzvU3fmgpEJmwwz8XLHrbZfW9EuO9f:RxDjUPmFNwsLHvZfWSuO
TLSH
T1C7251850766BC75FC6AD40321E32D5CCAB707D05EE05AB0372C84B2FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 152d546035a73840ffa498817933eb3cbc6ffeef30c2a0e9e3fcd0a658ea7471
MD5 12518a227b928cc119decb81e7a1d821
SHA1 2af5c470896175c9de64c2dc3b0a97b6062fd4bf
SHA512 2b9002c5065260bf62aeea461387c55423c177533d65ef8df452e8e8c825d6f17d985a9962dbc92ea861baab73cf440d3fae8fc5d6b425b8eb91982741b4fd85
SSDEEP 6144:maqe9sps2rxSeb9nd+I7SvzLUVEmqRp8DL8RPtMxfRPtMxQAmlrek/BeUtltiehq:maq7s2tIIGLLUVExj6ROOq
TLSH
T12365C7816537A3CFD1FB6032072A5B4C67A4EC0777096F26B3C8557AD82A721B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 afed03031963b6cc051944c9915007e36c5dd03af12a34ad71381d9febe8f1c4
MD5 7189434d1e8fb5d03ce0083faf364801
SHA1 d048799a522fdef9dd7c864d6c7ee1f9fcff0b95
SHA512 5f8e5091616c476a628f7db96862502313674645582d72160819890af7d52458f434b0b0640544b9a2199d75462a2fb2991945c94a386cc8184aeac0386d39e8
SSDEEP 12288:167NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:8tnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1AF5523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0e36627207f553b1fdce0640c6d4781236d3bf266560741349c29889a5bfacf6
MD5 05ea61015dbc8ebf28d0ff41897ff4a0
SHA1 9832ef8e6c548da5bf27cdcc6a2d9b091d97db9c
SHA512 bb3ea40e881e320bc592eee42ed785077a3bb35b51df719a8ad63574aa7ef30cb47339c7d741d568a51f60592b603986b0b6fa26faf645a905c0e34c60117cb7
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYXnQ/tbw/2Mkjy6Fr7g0oJ:Fgb4mBIBhGF4Q/lFTjN4
TLSH
T19A65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7c52d518a3399cadce32ddab2587496a47c197ffc26a75547a517b87eae5d69c
MD5 a6dd2e0aa4d4109861462991a9c0a696
SHA1 6dfb696cb5bcf97c4d880913ae243725cb1827fe
SHA512 5f26df5c432afa17607c98c419058800b049f4d223f2e0a05210049bc7d7f297e7ca855e05f45b6acd0e1e5c1fc220932cc88253ad2a558e733908ca07a6395b
SSDEEP 24576:tG88u8FpJqH1Qzria7/mInQ/tbw/2Mkjy6Fr7g0oD:g7ZFPqVva7/fQ/lFTjN4
TLSH
T16785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ad9e5aa013f71b30fef0b03d065f3e54f6047042f6ee8c0390bf22921dd7b6d4
MD5 040870a5b79dff50e3a4bc63dd50cfc2
SHA1 1906daf5252921919f99b9c80197a2a25fc70676
SHA512 2b029345b559347bc067af0168edeb0fa013df25be2c1fe7a66419a956c59d567e6045215a86c8de18e1e59f708026d195c965c397d8b4d3b2aacb46d57432d0
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUQ/lFTjN4:lG05lO43b2Lm
TLSH
T13BD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e5b1449f9fe0bdc086b929b0dd9c856f6bda2f4c3710a81294cea4a10f891014
MD5 8a4f3a5d1a2cd3232a69e6c7ddc373a7
SHA1 1f842d2f7193d85f459958060e66c1169e5cb8e0
SHA512 27e30aaa95679df50c4a328086d233efe69d87d4e9d2864dc2b376673253b96629f9f0e4aadf78f1bc8cd36164f00b754e25f7ff533e8aa2b60ba79e9eae048c
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0o1:wa5POZ3+Jt2pasx2+msQ/lFTjN4
TLSH
T1D165AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9600d10b7e9f71bdae3cb322b30d74093f539de4db16a5ec031e287bb27c91a7
MD5 602dcc11bebcd83304c9ba60f4bd0ccb
SHA1 6f67d5f65d5dfcb23349aef8de4e104ef21ef727
SHA512 e082b9bfd93588506438dc815565acd0c49fd42349152a776f635bdf2c96810417c084fc97de9c8b9e90099b9a29798c42b212ead53d254dca311c1f0403a7a2
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkAnQ/tbw/2Mkjy6Fr7g0oZ:5Nc/zEOVHF/Q/lFTjN4
TLSH
T178858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 83c6dd1f2ab13d1e46bdedaa997be3f0910c81909b88dcf5d976b1b03a08b39b
MD5 8410c5529d287f7bef52de0a5dfc154f
SHA1 d2588696b9498ae77db1a81b5ac387e95ab063f0
SHA512 7b324a54cf187d80b12632092f5d8994a18c6ed31a6c13b3a7517345d750a00b65e29387753b37b235ade9a81e2f860f77381b18649b00fd586105e6ebfcef95
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmInQ/tbw/2Mkjy6Fr7g0ob:u8MwBtOmIQ/lFTjN4
TLSH
T12555AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 242b270e4778fc257aca685af808bfa08b3086f9ef7c829ce8237806a91fa46a
MD5 d5ad22beead881c6b6bdcbfa794f5ed7
SHA1 90cce56b3f7b5780810a461f9ebd5b0e8504e94c
SHA512 d87af55a40a9c2ad7b531830cbcdc3d1ca2a0b54be300421c8179dc23b42ade83cf81504e7777d800063af880104198f58a6597047fec9bcb6fe16bcfe4bfd0f
SSDEEP 12288:QHvUrBFrEjwaQkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:QPUr+NQEnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T16A65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 60be738cdac220a61a21019d54eb4b8d1bf246de40c9a174e39e3052b5f2fd11
MD5 0073786d3a50b1863cdfa1e8e87a0402
SHA1 a0723d3dd7881b9c0f194321d0cadd24c49ccacb
SHA512 51c6390628614926d6510072ef00930ab91ccf9cc7d8a5a083d458c789670cb4cf54296c7a7599a01686e34cb813878b6751a074584861d825b1817be575fd95
SSDEEP 24576:BD3FHshBIYQgABnQ/tbw/2Mkjy6Fr7g0ox:BDVHeBIAABQ/lFTjN4
TLSH
T12475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-29-0x0000000140000000-0x00000001404D8000-memory.dmp

Download

memory/792-0-0x0000000140000000-0x00000001404D8000-memory.dmp

Download

memory/792-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/792-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/792-10-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1216-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1216-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1216-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1216-304-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1216-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1216-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1324-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1324-48-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1324-284-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1324-47-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1668-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1668-60-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1668-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1668-58-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2464-119-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2464-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2464-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2464-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2464-125-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2580-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2580-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2580-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2580-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3200-326-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3200-333-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3200-332-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3200-385-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3344-70-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3344-76-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/3344-71-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/3344-300-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3444-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3444-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3444-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3444-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4704-45-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4704-31-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4704-33-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5280-87-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5280-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-81-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5280-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-320-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5340-107-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5340-113-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5340-105-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5340-303-0x0000000140000000-0x00000001401E9000-memory.dmp

Download