b716741682ff5fa776810e47618035b62c75da2caa7d6bc89cd14fe2293779a8

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260821-bq4dqszekf
SHA256 b716741682ff5fa776810e47618035b62c75da2caa7d6bc89cd14fe2293779a8
MD5 f6e0f9a114e79e4daf26d179ecf91263
SHA1 9184bf622516e491b08c59719017d529945f3575
SHA512 9592f82bafacb78bae4b34663795464ef874229ffb9d130ad815349c607a2848d4368a7b0c968deb56473366c3d19bb57491d04c0df7f0bcc5f471c82570d3b9
SSDEEP 49152:FqgLkwBTyhjBvqKHjUCQOrhjuwJSt3cZZM/DVAaTP/P3Bj9LNiXicJFFRGNzj3:8njBSKHjBGt8MT7wRGpj3
TLSH
T13A067C47E6B941E5C0BBD0398A469A57FAB1384A873197CB47A0475B5F23BF09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4756	elevation_service.exe
4548	elevation_service.exe
4120	maintenanceservice.exe
6040	OSE.EXE
4864	PerceptionSimulationService.exe
5488	perfhost.exe
3160	ReFsDedupSvc.exe
5796	SensorDataService.exe
5144	ssh-agent.exe
1484	AgentService.exe
4288	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c129fce9763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a1e1e800b31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ebb5787f0b31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff1c08c00b31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4756	elevation_service.exe
4548	elevation_service.exe
4548	elevation_service.exe
4548	elevation_service.exe
4548	elevation_service.exe
4548	elevation_service.exe
4548	elevation_service.exe
4548	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6060	2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4756	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1484	AgentService.exe
Token: SeBackupPrivilege	3160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3160	ReFsDedupSvc.exe
Token: 33	4288	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4288	SearchIndexer.exe
Token: SeDebugPrivilege	4756	elevation_service.exe
Token: SeDebugPrivilege	4548	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2120	4288	SearchIndexer.exe	100
PID 4288 wrote to memory of 4300	4288	SearchIndexer.exe	101
PID 4288 wrote to memory of 4172	4288	SearchIndexer.exe	103
PID 4288 wrote to memory of 4364	4288	SearchIndexer.exe	104
PID 4288 wrote to memory of 932	4288	SearchIndexer.exe	106
PID 4288 wrote to memory of 3024	4288	SearchIndexer.exe	107
PID 4288 wrote to memory of 2304	4288	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f6e0f9a114e79e4daf26d179ecf91263_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6040

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d45e0e4c5b250b0cda5945dcb7d066e4666e82df996399332db29eb9ad4045df
MD5 c1b86b60ee550b32e252353bdfc5d925
SHA1 c0b70bdfc1fc231d5854b068d2889852dcec63db
SHA512 786b08482a6cefc3baeff8fb8cae94bd75f1a2d30861e30cd04e6733bea050be3f934da7650c06b02875f326494b2c3ea03c7263f235228820255d6cee45b987
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnaLNiXicJFFRGNzj3:13q6mjBl7wRGpj3
TLSH
T1BDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 fd81d787287b0e347ebd6c76b9bb68b13a5070a87c61757154a63458cfae7335
MD5 9379f2907957854398a796eac9735ccf
SHA1 dc536e95f056caa59cfdf7ee8ff88a4649122d06
SHA512 03d03c77dc6a1e94b32f6932a72e36ff561d7faefbb3989519ebb297d47ae41f25ed3790049a83b2319b3b42a7122765bde9385853043d55c0f55801bcace579
SSDEEP 24576:QXYfDtczAl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ntcILNiXicJFFRGNzj3
TLSH
T14B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 10ff5b14ff3c5088e59b8cfd4f5eafce423b5dc596da44e493b42803a49f2db6
MD5 f78f1677b79b607de895f7d5a70c78e2
SHA1 726afd547e2924122cdb69b7621dd0317552100a
SHA512 aebd6bd5ee8ecb5a49b88f2fdc6a8449221339c1a518157ac60a6d54ca8ea52de045c1fc6a8ac8f24b897f3fae618c32160baf5319d1ce173a9235dbdd409c5b
SSDEEP 24576:i0Le5ji0hmxhrM+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iPji0AzbLNiXicJFFRGNzj3
TLSH
T17C859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b618fd290481dfdbe2cf37cb152ac93ebbfdd8ae2418bf23f2c5dc78fff19db6
MD5 f445773e3630722937629cace4e0d693
SHA1 4219b45e7521fd25bf9d740e08c0293084b5cbe8
SHA512 be37d33a3560c883c82d4384eaf64edde8efe4c512f3be305885c45e40c7d5c1dbc0398b074d124738c689e8f9a0d0e8e1168bef79d490fa01875b790cab467a
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyu4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1/ezSC6vUzPv+HjyvLNiXicJFFRGNzj3
TLSH
T13F756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c2f93117671bb53e8abcf40ceec1aae5061e4f47a68b330f4bf1aedd5f6c1eab
MD5 8bb5b722d3e1e40bbda7b4201910b1aa
SHA1 48926b8cf8a125acd964a24b4e04fd851f066567
SHA512 797519d467bb6b67fc50df93402430ac694a3804b0cfb033f2b077080b9180000c372312cec16f655e4ef33069e28cbd1941a3d8bc3ff8884688ab1d21defe67
SSDEEP 24576:yVbqPb88hv/l+BB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yVO88hXl+7LNiXicJFFRGNzj3
TLSH
T15B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9e5d79d444f98563092668179be1a866c7efa49dcd11d6665c2f786f94026b4d
MD5 edbfa2c735564114dd4d2126f20edbbb
SHA1 ce3a51fa90ac2f04c91a46e6cae714fbd2ff87a9
SHA512 0926da5a8acc9ceef0da51c5e317f21deec03762a26abecf9c7fb9b0a2173a25804f56fcd757c5c9a3ce7ed67212ea019ef1cd1b3b5609ffcb0109d92fe9ecc4
SSDEEP 24576:TGq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T1E25523D3468854B1FBFD0039867A5828B5845E2CCA595DE2D2543E5E913CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 10b225651fa13d0022a854f3d7492a12ae26fc9420054236d3c5d274c5b152bb
MD5 b2dbcec95200a993efdbc4dc33b2b6f4
SHA1 690c73912d1716347fdd87fbe500d3f8ef3ba959
SHA512 8699016c62669d9e0e807d6533567935d1ed392095789b610612f86458c051245f50c1ccf5977d24b9e015fd928bca553564a04d27bd005dc0563c330f59eb2a
SSDEEP 24576:EJIUZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJIUZLNiXicJFFRGNzj3
TLSH
T1E675CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9689a3e7db5cbf99129e4d84da2a528f3dcaf4da9eed61ff4b2d6a908ad8cbf9
MD5 527b2d8380c809276c4f4fbaff7f1fbd
SHA1 0dff1ac81c0f47bda44e05ce0981a5fe13550ead
SHA512 b77eaad38ba7e503bbfce9d60b56726c79d03fac6db58c6e53bdd35a88794a60e8db55a150021abd6be7f43f4f1043db5a0832aad93c30a8fa8c960542064564
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH5:aQvGAdlCEL8c/WRNw5Co7wRGpj3
TLSH
T125266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c10cf2da5b103aa3e4da8330016aeceacff970ce261fc3b9dcdee922fbfbe4db
MD5 dc9727faadb7a8cc9e95a3a28f925418
SHA1 f08bc35d9a426a20a595738403e19b31037d1e91
SHA512 753f0f3c68c9fbac53b5ec63c7818b6e857d77ede58111bbfb715d52be567e6bf7f5e07d0f2df6d9b4ee4d42ac8f4c7c8a63084e58046ef17899a4a0c93f31dc
SSDEEP 24576:YfewsAjL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SljLLNiXicJFFRGNzj3
TLSH
T14D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ea119e18bbda771bf0666e5dd3f4a224364488209072489260d1bf323acf334f
MD5 f63d30ec0313bda528cdcc2c9491c0fe
SHA1 d55bb4a130206cb0a0c746270fb2a3862a9d762d
SHA512 f4ea361f389a1ae33bb38a1d46ef6f3efe11da6cce135ea77282a95eeb29ccb3fbe65027d3e40b45653c4b31b7ee49bfc7e74863612ae1a3ed0379ee45165834
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHHF9:IUEtQevvqc2W1cpV20I32l9
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 63d82075a8965d171c28ef95223246ccbd891b1e032f2e185b8f506dc56d8e41
MD5 10217eed5fd0d67a316552d2dd729df2
SHA1 f2dabebdb02794605e7ddef55b1717e60e7b2f70
SHA512 17fada3311aa5bd1feeef81f225ceca6ee5428ff0b8924cc3066c99b3d9d5738561f264d9134581f04803837b90acdf04e1a8958efc897bac909c6f262a80b2e
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zrLNiXicJFFRGNzj3:boq2VjnmM7wRGpj3
TLSH
T119D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5a80535276de091c304f0b184bcb41f9c8cda296b3ab4c83b487a68bc868549f
MD5 20c90e8bee1f7d5d588404547290636d
SHA1 0a756da62fa6d55f810403ce1e48b1f592c12794
SHA512 35c9cf54c10dbd0b64e0f32e297f087ddcd2ddce8be827bd5b42e0cd7e0d035195a0328ecf2fa9fa1ee6b16cc4b43a72bfa02871186d03251263b68435f25a14
SSDEEP 24576:MAhGL6IFoiwtA5l7S53s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MAM5Foiq58LNiXicJFFRGNzj3
TLSH
T1D7359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 28eed96ebbc334773f5b6e8d0fdb6e0a57e1a94467e127cbbe8b82f09dfe2d77
MD5 f3357e58170887ae5b75403677112718
SHA1 a447bc65734d6a3dda3e35da520236341c3ffbe3
SHA512 956a6a394549f07615cfb7b0121d08bcc2c4ae0ed23c35e83d13e1312efe66f996533a43b0ce5fbe0edd2c8ff5b2d7eac92eb056a79d3b4e7e51230661f5949d
SSDEEP 24576:QwuROWP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QwSOQLNiXicJFFRGNzj3
TLSH
T1B365F18672940CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f3a9fcbb1a2efb28f63e07416dc5fe6e3210318f2ba1317e0d9425b55b11c795
MD5 c797202fc32708ad104179416aa7e377
SHA1 349e96a5c4917d0cb7045dfa42b7fda5375c27e8
SHA512 50ea2020079e048b62115942582f8489f9b7ae57aa2ebe8d3dbb2d7886c00ef461669d764d29b9cdb543e6051cade8a3c5d0e20e4fdd891dffceb8e6d7c2da70
SSDEEP 24576:MZuW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
TLSH
T1FC55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c1a3fffa08dacd669668682e2f501fc6c38ec7006328413c4feaa9e26f31e6d2
MD5 49fdbc443aa6dab503d028df25d724fc
SHA1 45808fdb621e3fbab4cdd86d5e3a6313e3d0cf3f
SHA512 1ea8deee0e6f12bf04d8210bb631c74305902ca3f2310a73f0b696f858e94d90aa0d8228eeaa8ec2e2fd0a66d127a8fcd63039992fbd718c3b977df5498a35d8
SSDEEP 98304:fQRQyi36YOcPDLvw2gAf+PN397wRGpj3:uQyiKanX+PNxF9
TLSH
T197667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 638be03811e1c41d29802e189fc57f938fc34ec51ce6f93782e16e0309327d24
MD5 d0124f803d9898a1a30d87e871def84a
SHA1 49d5c0e58946863385bbd7da5a8cbd2c64f51155
SHA512 76828cd963e6f0bc088e69c956754833283686d5efe5c1e00100d6225024b95ea22aacb4d794084172852159a9a0e224f5862facf0122bd4971dabfbfb048b16
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN397wRGpj3:jQyiKanX+PNxF9
TLSH
T1C5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c020fbcc31a15681e80fec69766e3ca6a33fd6399987c988803c75614c68bfa7
MD5 6d105b9e18b56aea6d6c67b7a67f750c
SHA1 93073b7f12211a52919ed563c4104f2f89968584
SHA512 111be64a554f16148dbdb4eb3915129f8f17040694c879f3a5d920e5aed3efe9707e78f7adb785509eeba4b86f6e66b1989dbbe11fd4d0381c113f9601ae1bc9
SSDEEP 49152:g68Qg55nhkeWu7PNU3/bLNiXicJFFRGNzj3:athTRc/b7wRGpj3
TLSH
T188B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 482a38b53ae0970a7a3474664e6f79f54b8f18c9571ad76550d7ff88dbe28f2f
MD5 02224fd975280e9efe7e0b1916ebd0f4
SHA1 3552f98eacbe050607c5af8c6b56d2b27a2e5bb7
SHA512 1819884c1d407f16033f7609879702ad86578ac4ec0aae49b9d2037d28e374c00d9c47c57d0415ba2d94c685b0350c830e02a744d3c3d2a31e53b6c8f88b0aa7
SSDEEP 98304:9y5112gYy5azzVvU69nLKnhZq7wRGpj3:gLIHRWhgF9
TLSH
T1DE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b8b7b2bce0a380ce83f013134b5d71ee8f802ead7cfa4fccf8ca1251586cef81
MD5 6df23d4ac43cdd587eac4c1c40ea1424
SHA1 334e34b2d57a91df8492a6eaf9892b8edda1b1c1
SHA512 ca46bef96762f653c324099dcca6b522e4f48576d713dc7328050a080c790713bc79588a549e02a17614e56d0da971948161935af4716a5e49995484a16d0f9d
SSDEEP 49152:rB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glZLNiXicJFFRGNzj3:9u6JmIxd2dZ7wRGpj3
TLSH
T1F4D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cafa44a72769998cb81e5b027e527c838342fdfaae46d73e9b8e61b51f66d5e1
MD5 0a09447f0f97b58c437a649452552b39
SHA1 a707f27097351cafbb04f2aea1c9e6e0afbc03e3
SHA512 b19c6deedec34044382290b9504dc45ee8051b84cb4ca559fbbae48fed3ee7cba817ce80119eda445a2541c6a2df5cc898a490676f5962c495e5a88594e44224
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4x5LNiXicJFFRGNzj3:cmifPqRM7wRGpj3
TLSH
T12AB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8bbc7a1013702b2e0599db1020a537a3748b553162c6a480c81fb6bf93a86e7f
MD5 1af620cace8d07f8f5b34296221f05c0
SHA1 143033d2d991931b4472b5c0e2cf12bca4998cfc
SHA512 9f02bd72ea9cebe6f3438e1e8d059d4a4ec13844109b829170bd1ff1dd74387619c6e77664de7bf0683a158216cd1c83ad9600ce4d1f3e319975f08916385dc8
SSDEEP 49152:TSuZQIY0Be2KkRVtOnks6NMHqWLNiXicJFFRGNzj3:R5dKqi61W7wRGpj3
TLSH
T1ADC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7f9795d1c6e716ed8f4decce922a7b60c8f1cfda96e01c8ff29fbce269349575
MD5 553a2fe4213190a039b4b40d818d9bd9
SHA1 3d45cb20141907d98a2888752e5261a10be11a28
SHA512 ad388ba84436b7c0dfcdc602e2793a1cbde948acc5413e5e843081f148c4212adb949dfebf2b9f8f05cc0acdb92466cc9412264f41941e4df053feb6d6a39aa0
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5wlLNiXicJFFRGNzj3:GX2iWphw7wRGpj3
TLSH
T10695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 707e3856d58d6d7960d0d7871a526dc74bbff96e5b0d428e591605252e78fb25
MD5 515bc3938b58cad6af7f401e63985c5d
SHA1 8090636176f104f1fd5dbe1860f8346c9ef77265
SHA512 6eba1b0d481fd9736d66453e49bed6e2ba8e08e00c9118b94dff662d80041c2ec74c3f50823ec3e1aad23176d39d8ad1d48830b415f588a9f65a140857326d90
SSDEEP 12288:WwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1915523D3548955B1FAFC0039C6755428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5d4c63e47f9b6570a76a51f7eb66188205dbee3fdc3f0137f2d4894b981918e3
MD5 3cc8adab4ca345ac87178c7c718e555c
SHA1 f41ab61742e705f541fb33f3183f76db0f9f8c47
SHA512 b307b7f3befabdcdd81e45f37de1d37851ab268b526a9aa81387df32600debcbd56924a1c0e25131a07e55bc113390a24f7546cdc49d44025e5a6b0c23469f74
SSDEEP 12288:oDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D3548955B2EABC0039C6755428F5881E2DEB5618E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a4cb4fbc2d9c2c7fe0917e5797638e5c68779cfc331b878aab6f61adae79ebcc
MD5 7be090a06acb9a55ab44bf417b706c3c
SHA1 c1f9a9599335224f738d7d9b9c3e41ff7b9cf039
SHA512 27f361471670ea1b208ae33c9ad512db6c12e260ac3db3da2caea91e9c53f0ae3943522872a75661ecc111f2bce91947b94bd6c1f3f98240b75e2cf45ddd3147
SSDEEP 12288:ANiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2a19a97c2f155a1e0ece200ab2ecb83e39722ef8c521726943dfacdf5b9b2d1d
MD5 16498f1f750722f4dfb15eb7f909af2c
SHA1 a3fa3ada6608eb202bb4b4412d409d7521e2072f
SHA512 5db78abd1cc4e91fdebb45ce2fa01870586059e38029902fd90b10299c7d127412ec98253d66da316cd0acbb3c3319a539a285c8c868dc44e3d6ca264335ebbf
SSDEEP 12288:JVKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T167552392168900E1E9FD8039CA764424F2E47D6DD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 85575226e6ffe03c3bd2b2e26be34c647e96b0d8d43d303f111a838a58f6ebac
MD5 56693619e4dd10922d5b5f81d8505af8
SHA1 14f6382e76fdc763981b0ec56917b0ea0ac64a5c
SHA512 596ce7040cc02c1207ad502ee4c1bb803ab44fefa6d03048440663f57472bbb0c188a1275fb1f26822643c000a8cb884386831fbc957c9319c22728a004df6f2
SSDEEP 12288:eyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 91efe3a837d5a4e9b408135ab3ba3ed0e34d53c6c191f2b460dff14513040297
MD5 f7a6a734c8c13f961116b8453e28933a
SHA1 0485e173b727427aebd0187f108cc35a43236be9
SHA512 15661fa7f0c37cc806f7e4f06fb5c1e071231c8edc28bf54397da1097ad9c696460638813ff2905452105e868ab8db53ff80a452bf01f4b315b41ace3ababcd2
SSDEEP 12288:lXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA5523D3558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 78c70c5f8760474de8eb3226040e55334ba4f283582fc997e9f9c865b88a94e0
MD5 f0d6a5883a309acced1bd34ca94730b4
SHA1 d238e916de261031230e9e099a92097fb3a79881
SHA512 ef88de78c053187941f49ae41f167338145258cb68f369c2b32a6c3a1ab02f04e5b225353c526a6bc39b0f22c873c8718fe9c3272bdf84b89fa284168aafb481
SSDEEP 12288:ELiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ef/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3548955B2EABC003986754428F5881E2DEB5658E3E3483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c7f8606de5fb35142622edbb145cb8f8b59629ec03a90f627cb4b936f0ec1da0
MD5 4d275325ba9bc65c0d7da8c6993e0042
SHA1 6fe47bd781a15720ada93e078a3a1373d02aac7d
SHA512 a0dc9dbd1fd19c48b7fc1281f669099bd2637cc43c43c2fae03cfd5ecd935426d7e0d9b8253ad6db2d9073327e4a945f067ce80d2f49fa683de38eeab82317a6
SSDEEP 24576:jZM3zFVSOX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jZM3zfTLNiXicJFFRGNzj3
TLSH
T11D750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7dabe71569513956daf952b84fde8719bd4eb39fca902de4997638e72977f6e1
MD5 e78f827001e5d13d2d3c0f00bc0baab8
SHA1 6aee76505307eefdbb0375c122765c2fe7e26cb4
SHA512 3b7dd6d6e98336d6a814871e6a9e3224f5b660a8a2d9c8528a7a901193b573fca8e61927f7aebe621c529ac56a4dd41fffa9ca90081c20c29d519f5fa86db338
SSDEEP 12288:A8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD5523D3558955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b4ddf83ef1bc8aaf7f4f4791b4e6cf7b3611d4370989b4d25d9522639d0048b9
MD5 14ce4dc005b9595ed4ae10024880d4c2
SHA1 ef603fd11192ae00dc9b9e24fda3f13e7ebe08e4
SHA512 a6775dfada9d5004088b6057fd0a2debd1862f54212110e630fa7e45c0567a0d49ee9edf3fa0bbf2b2fa56cce6690bced4d8a13e5080ad6dc0aae8fa123608c2
SSDEEP 12288:doiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:da/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1035523D3548955B1EABC003986754428F5882E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5ebd092fc06ea0c7ed7058eaba79933e3208ec15f2a5fb296f267a5d6eef8691
MD5 7e11695bb7c57397062df7b9de91b561
SHA1 b33ac9885b2c2acb6f3b445fcd5b48a51ca593e3
SHA512 dd07be38124731fdb46bd172f21ad6a0e8f2401cc5ed09b1cc566f072a8b93fce6bdcb49a959c19e501fc1dbeb22f79494d9c3b5db3f74e3915975ee0675aa84
SSDEEP 24576:/zy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/wLNiXicJFFRGNzj3
TLSH
T145650247629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e480933b36fe04840833178275f35d9f1e9b4b2aaf63d08518ce2a21fe76396c
MD5 93c3cd518542810e208d2a6e928574fc
SHA1 0317790e75e1ca5f8e99ba5cb5787ee0f675d012
SHA512 90104a8c1bbf6a7d799ef59e71d49b19cbe217ec0911556f6dbbd568ed3679f417a0f06573859f3fb7a14909f239a70e3ad39a1101033247896297dcf1c531de
SSDEEP 12288:B8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F5523D3558955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e614add9ed5226f7aa9c38c20a468be0b74da4f70fffc2ae2172107cb31bd5d3
MD5 c02231a95bdef9ecb4a75b4f550ddb31
SHA1 9462edb0026bc6aa49bd72e73081878cd4a58017
SHA512 cafa113ccfa4cb0bf44eca1e87abc090f1606df80bf4033cae4bc17d331e60c52a76a727f29cf6562e5bb0a6c6d62288c85ebb70f27c4d59143d0717c9476359
SSDEEP 12288:j8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3548955B1FAFC003986754428F5882E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c1a50d67b682106fae26441d3ca3df8dd1b317254f658ab20ccab3669a3a7693
MD5 2928e3cee8f0d16f7554fd5621a8ce5b
SHA1 dfe310e8555432190cf997be5ce3bd79f918320d
SHA512 bb66be33f448a370538c1e8405107f5f6fa2594301def235bfec86fd92910e96405cdacc32d8d1f9e0433c3618ad930ba306b5a9877dde343f811cad917a6b80
SSDEEP 24576:9zy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9wLNiXicJFFRGNzj3
TLSH
T18E650247629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 37ed32bbf852269b087974cac75e4a2a06cd9e6288eff50e12e0b53e08e5fc64
MD5 810e2918694cc5078a052241feb55cf6
SHA1 e2de8f5ba8333941d13942ca948b39b51c9a15cb
SHA512 c52974e4cebcbf62e4fe1c54c6b4d27c06f81c991fe8955d92e42e08d34f52f08a358a7682146ae04ee1d8093dc7b29f5eeae8c347229be96144b85765da1ef2
SSDEEP 24576:5T8aLl3z0zDh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5T7Llj4LNiXicJFFRGNzj3
TLSH
T13D7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 568a7e39093000cabe9537f1b1b61be887a630b3ba5cca64791e399d2c9656f3
MD5 d497f3f8476a533ad28172e27a0241a4
SHA1 d48a5b39f04d141787972a57d4e52597a783524f
SHA512 910d8531114714aec6873f40b90c979b6d9ea02dac9d81cce958f1103846f7bc1bb2a451bc6656a60f267d906999180519fa1b53b4d60b69737f30bc5f9431be
SSDEEP 24576:23rd9CHKy7GZd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Yrd9CHKyaTLNiXicJFFRGNzj3
TLSH
T16E85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cd26f6059739b2642502f44ef1cddc11b53cce28cc93ad22f2d10f9492d3fa24
MD5 0aa0b98ca9ba790fb124f177bdfac207
SHA1 fd948ff8e4e0a45e150bdb356509841a38019c30
SHA512 826a735cdd6556e99fb6f4c662a710b0bdf32f80f6fe78084952a3f78f412f7d4f149dede668aad41063cc1463512fc988c3f5d8c8b663d5cf917171a0af635a
SSDEEP 12288:BtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1865523D3548955B1FAFC0039C6765428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 540725eed4146b75714418610f684ffa807148e60e8065ee264fef3d31409801
MD5 ab472eced09c148eaf9342d2dc0ddb05
SHA1 cd4218490ef32b15808d9e1b6a3924102fb20e47
SHA512 ca1f18b58023328e47817faa060cf0f72287426631caf46d512e244294a6d371c4eb9975345a59d236d945a0a840e5ddb3589cd9025dc733c49003fb3bbadb64
SSDEEP 12288:aviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ab/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D2558955B1F6BC0039867A4428F5881E2DEB6619E3E3483D1EA27CFDBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 aabfa97e047b535a6ffdd6d4234ec57fe6fa9f2437f1500695c8a310bde1344d
MD5 6851094aa60e1d29be41a7907a66954d
SHA1 057a63ff0e3c935f8363ad3bc9a5944b5ac48bf7
SHA512 759f9b7a410d198156794573247112b0fd8c3013684ea2fb001ce0e5ab18b0d606d7389fec407734b886fe855d356719f9a0caa0d2741d7034df1dcd07db08c8
SSDEEP 12288:tWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1EAFC003986754428F5882E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4b5a1fb991270066bc9b8873cb8b72f8acabfb2737ab1e643ed37b90b9e43b72
MD5 27b9192dc53530c83ed29184161048ef
SHA1 64e739a2cb64c08732584387147bc1a62fbf78d1
SHA512 0e1fd2cd03e6acf0c7341e57d5b7223229fafb6537107e784713f7786b290f62d3544e1788d6f1c46ca67b3d204b1204cbbf2a3f89ef368452686f721d9502e9
SSDEEP 12288:C8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3548955B1EABC003A86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 37b88de78852507cfd5c673cc10d3da3af969194fa323669527bee28736dee54
MD5 5ffbe202d5c4de7a01afcb2868d3d88f
SHA1 691a200f8f5920bffc682172fce863ec2d7a9556
SHA512 4b3b6fafc5f9fc5aeec21b388179e7811dd0f9ea1e13cfcf36343dbd45f54e050b91fb9e79b378631e36e955e2f107c58ad7be3a40b39dc338b75f770a7bfa91
SSDEEP 12288:stiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ae23cce04b0cae955de09f4bc4f77dd190a269e90e41762a99b2f7b2fcde6ddf
MD5 20b501a1155e715ed15394078f57434f
SHA1 4d60656bde79d98ee59dcc8fbe177e52de9fdf14
SHA512 2983c45c961d8c657a9f90932792fa60e5a6ed28d31b1a3b36096605596c4078e61e1d918bd59c6d7566c34d3ab6c1154a00ae181b2653c013b592e8240105cc
SSDEEP 12288:jEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D2548955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EA23CFEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 078b29923f6c0e61f66dfd95fd457d9f6ef799802d73466a0761ee025f5b9ba6
MD5 abe842f81805371b33b6662999ff427a
SHA1 c9df26e0818343880b7f6de979c9ae8445b14039
SHA512 179d51ddde95a3c5a1fefeb72ea58e45e2b7a13a0bc7d3a7857cda04943d6b53f899980e30dd2cbeb45966d16b08c1cb67e21cb2f382e18055c91a22badf4489
SSDEEP 12288:LyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D3548955B1EAFC0039C6765428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e849b57bc467e08e06ba303e139d455b27a4846cad738082592823d649562ba1
MD5 d745d5fd43531413f9f33bffa84f0283
SHA1 1b006985ecdccf60406749c156f2b7699d4069fd
SHA512 2d5e1338e7668c8f9c7f739a3e602908aa909a0c886edfce72c0ed632c470e09971913583d0211eb249b2d007b83661a2097c52f45cc576730191d71566fbf05
SSDEEP 24576:tfwvzk9RX6wkyAIK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EMnYIKLNiXicJFFRGNzj3
TLSH
T14985D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e43a4c36e90d4c7da2395965b2a3528977588b1636dc4315dbd8bcf11bf6270c
MD5 9a6cbfa386ad689e37458e968bcf0769
SHA1 9bd77c2cfd6da90ffcce90ac2c4f3ec90106a340
SHA512 66c14c160fbd543fc7c98dd6ddf5217e3a6c476fa85c0c0866dddffe4b31fed70e795f2f06800c78f864216affeeaaa543f9909f1df34a11e8e0279bb34cc36b
SSDEEP 49152:EYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FLNiXicJFFRGN:7ySzPd7wRGpj3
TLSH
T112066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2bac01c40b1f00d1781d3923519fd6d630e9922ff3aa447e3ef6e440cabc10fb
MD5 ee181ce7018ad7a969843ae787fd8a8b
SHA1 cbd377e34f62fb7a207d9a199926187420b6a30c
SHA512 ebdb714f504aaea7601727fffd1d4be2ef559a41aa74d7a9a9f0f467168ee1df6f00e9dd25c9c89dbdb6cc1799cc28dffa411cf48ab22b0e5968b98e27bb91ee
SSDEEP 24576:V47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V47JUQjqirIhCnDHUPfF/1LNiXicJFFS
TLSH
T13365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2c66a1c6421d55ed93e2c251b000027ab47edb5c4c1e1305a694bc1b1303f9fd
MD5 a135d062766920386c0e9ad9b1f5d514
SHA1 603a9fc19ed4597ba5571c3285387af547af85e1
SHA512 a7678528576d684ad1a5a29eb58efbd51fdfcd97d696647aec110d9d6a80c722633439bbe235a7c71056e6c68742f123e3e199e7b23a3f97e2b70b1520b4f5d0
SSDEEP 12288:kpsfsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15065F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 804103a13de0d69296340f075673be3f59bd73615108b6a3cdd8a2d7c71b88bd
MD5 8ca90f416ab7b343c02aa7552c7ef1b9
SHA1 45559c9164cea1bc71930b3f64a095a366db1379
SHA512 3d42b9baa60d7f395049e60c42fd927cc2d44beb612d2c17688153ad266ba574c7cb825a6c47eb9fa0b2f140c23cb32437871d9ee59ee116164b86a0ca213ba2
SSDEEP 12288:WsRHjU3fbVCD+mEX+iOp0ANZvQISEifOGTE2RcU5X:WspUPby+mV2ANtQx3TtRcUl
TLSH
T1C3353851766AC75FCAA940321E33D2CCA7707D01EE45AB0373C9873FD576668BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d09c2e02a74b791889dc6c393663b5a813d8916d3d93066c7738dd02d5463948
MD5 10588e784eda8096505e2fed047a789e
SHA1 ce2071a41fa7a5afef0afe72206e0337bc48ada6
SHA512 0c5084afb8340d14da352e59f91c3c08c83c88470995fa4bbb33e2a334d43ab5561657fdf5d5947ba22b8a93f001a684daa8ce3d068f9fae2d1780e853ccf6ff
SSDEEP 12288:O+2lanqVuiamm33CsSSCclI+dZSnVg0iL8BdAKlr:O+5iamm3yBBd5
TLSH
T1B165F882A137E28FD1F76131036A5F4CA764EC06B7456F26B7C84539DC2BB25A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3a191cbdd07f2285fc2c36bbe7e085598a538ed3e46fcc3ef84d5bd6bc513c52
MD5 77d88345c468062e229d36e6275be0b7
SHA1 f7ab5b3cb5871f68fd9657350cf081c043a0b18e
SHA512 c5b269dc2bc4fa7177ed79d28ed126e079da5059a3b1e1f2301fd028f9c9296c7b02e8bfaeac012a4e8ad2131875553ee247d12af826328adbd5b5891957112d
SSDEEP 12288:2F70iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ce/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523A3568859A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3b913fc96a7e3a85a2ed933013ae23bffe3c2d52eed18c190df3803d3aba1de5
MD5 053eb7a04ab6e1954dae6ceec3a8113b
SHA1 bc26901193ef901b706ae0147b83da3c5d2b17cc
SHA512 a04b01014698fbc08c3d727cc823a97c0cd9912a077275632c2b563c0b9dae080d483e3761436c3598e75eaa6577452f9dd7bb82de7c04ecafb97d59c409ffda
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bY4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ogb4mBIBhGFHLNiXicJFFRGNzj3
TLSH
T1D965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a9656628a7c74579546aeba5790f3d49f91333530594cc67dc7ef2e71cf06c46
MD5 4a68b47fbbccf75a68ec824c72ddae6f
SHA1 daf79b46bf1039cd783d23f0c0c9fd7f07d1c8d8
SHA512 9064eec7dc6382fd588ada5ca6041e6c9070e084f16e0af683ed89aa8b1c234d615c119bf5bea4774337a4afc77df44c3954b59be9d1d1869dc729adae05c27d
SSDEEP 24576:aG88u8FpJqH1vzria7/mX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h7ZFPqVya7/ALNiXicJFFRGNzj3
TLSH
T1A785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 36bb53da22c94248f06c5efd2c864598dc7bdd81d27b39a8f4c2d5cbb01a2b79
MD5 e9084f0fca01a4c10a9a5aa18b2e6c68
SHA1 5e574bfe5441473263520e218e8ef3adc42cca54
SHA512 57e59b6af186238c0bcea3d07e0645f65a2d3c41d6e9545b024161918c40924430d65c6a3cc2d5546d6a4ddbc5ed0edecf0915403f5e6236244945cfb950beb8
SSDEEP 24576:gPUr+NQT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gJQTLNiXicJFFRGNzj3
TLSH
T1E465F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 25f0c6d993319a250d19df3c5d52ef6a877f7e790ac82085d156d2e3d9eacda4
MD5 a14ec06d56ed64e5c56c8d6bc117c8b2
SHA1 3d7802a0ed9758fc3d16c4058e0084c84e7d55df
SHA512 5974af8fa9e5c1f614f44eb0ed45bf85ec099a78ea8b7ea3ca17a51c0eae7a9d38642afe887492f9bdaa3e1960dd0fdcf869b0ac02eff4d50d912a3a11a5bda3
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjLNiXicJFFRGNzj3:2G05lO43bS7wRGpj3
TLSH
T1C2D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b70c494df784d90556fe9c1062ed587103b7260651427f900b3e8561501e1d4b
MD5 5521ee8cedb10032aadd42e65eae2029
SHA1 fd640a997159a7698b4cf46d596a52baa45d900e
SHA512 86718a32f177e50a39691fc8912a8353f1ae9f918e442ba51879531d307c7926521fbff98df7feb839a542cd92a9f49c967245024e12ce1e298e14005831ecc2
SSDEEP 24576:8fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnF/TwSfVcYG3K/cJHlnFR+IGNe8jg:ka5POZ3lJt2pasx2+mbLNiXicJFFRGNf
TLSH
T16765BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1884f17f1b53f75b8f484d6c8330232034417bddf7ae1ac9954f9f6328b7f21b
MD5 0fa873cd755d18baa87bff00fa854fb7
SHA1 65a75128f68ebce9b2d12241638011a83fa94210
SHA512 56bac850209c657e24deabcfde1a810d8ee4978bda07e1d54b638a9f8e7a273162ff20dc380b5bc259d6999313ad992e3b4374aee9425ab18278a3a880a59517
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7Fkv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Nc/zEOVHFgLNiXicJFFRGNzj3
TLSH
T122858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 958c31fd1b71dc17d3656f7c400efd48f9f16eb02506f2c1e1c629f99dae69da
MD5 eb06d5bdfcc6039c29b6370b363f4961
SHA1 b0881a160d3d47e1b772eb46b3786ddedd8027f1
SHA512 f639424cbe2fc85bede1257c16962a046448e8578a063cb3a92fd94fb12d8af1b32d8e31be9da2530fbe4d43879132d5da115aee1cb37e7835dc559b7c0b0bb8
SSDEEP 24576:0zkNvNnaFeYhJNtmZBmN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0zMwBtOmNLNiXicJFFRGNzj3
TLSH
T1E155AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4f6fda991ab3033f513a61fc18ed4e2f4eb6502d2f5563736abf2e6d4204d1d3
MD5 0d4a7a236f5fa734b9d2e9355fed8d0d
SHA1 0383dbea478099fe6b4d8b4bba8716f4c7e29443
SHA512 25a674e82c92c7e8b1a135da834a6f8ab226c34f8729d15b535716ffe6d4fc31330dd29cf8ab8bbdc0360e2b31bb917d6d924e6648583af080066b38711127ba
SSDEEP 24576:CD3FHshBIYQgAC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CDVHeBIAACLNiXicJFFRGNzj3
TLSH
T1BC75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-426-0x000001F858A00000-0x000001F858AAE000-memory.dmp

Download

memory/1484-144-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-141-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1484-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2120-417-0x000002144FE80000-0x000002144FF2E000-memory.dmp

Download

memory/2120-325-0x000002144FE80000-0x000002144FF2E000-memory.dmp

Download

memory/3160-103-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3160-339-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3160-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3160-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3160-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3160-97-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4120-59-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4120-49-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4120-61-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4120-55-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4120-48-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4288-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4288-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4288-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4288-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4364-337-0x000001D7B2E30000-0x000001D7B30BB000-memory.dmp

Download

memory/4548-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4548-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4548-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4548-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4756-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4756-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4756-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4756-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4756-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4864-74-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4864-82-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4864-76-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4864-316-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5144-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5144-130-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5144-122-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5144-323-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5488-87-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/5488-86-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5488-317-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5488-92-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/5796-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5796-109-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5796-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5796-115-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5796-320-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5796-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6040-70-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/6040-63-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6040-301-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6040-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/6060-46-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/6060-33-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/6060-6-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/6060-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/6060-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/6060-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download