9e1f1e82da397530409f33973adcd5efde7ad952a25d275a9d24c9ad285c8cb0

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 2.0MB
Sample260821-cbv99aha88
SHA256 9e1f1e82da397530409f33973adcd5efde7ad952a25d275a9d24c9ad285c8cb0
MD5 454693514858795ecf43c18f6848687a
SHA1 d4302d9ca4053c7b2b5bd9cb29d5036063522b47
SHA512 7fd6cbe1a4a74d1fc45b8c7050ff9ef77146f6fb8cc9edd4a9ce2161794d32ec51d767fe523963cbaf05c0528842c1dd9ecfb2c2f9366ba3881afdce031f424f
SSDEEP 24576:OcTyYv0FteQUk5I2kjgD6iQacAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OuXv0Ftpp5606zOILNiXicJFFRGNzj3
TLSH
T15DA5383672F200A9C45EA072DF46473196D27CB18FF0D3DB8152725A1BB29D47B3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
932	elevation_service.exe
4288	maintenanceservice.exe
3864	OSE.EXE
2276	PerceptionSimulationService.exe
2268	perfhost.exe
5504	ReFsDedupSvc.exe
5832	SensorDataService.exe
4540	ssh-agent.exe
556	AgentService.exe
3252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a98adf424febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000538838551031dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d8d36111031dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b02ee111031dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
3864	OSE.EXE
3864	OSE.EXE
3864	OSE.EXE
3864	OSE.EXE
3864	OSE.EXE
3864	OSE.EXE
3864	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5020	2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	932	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	556	AgentService.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: 33	3252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3252	SearchIndexer.exe
Token: SeDebugPrivilege	932	elevation_service.exe
Token: SeDebugPrivilege	3864	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 3160	3252	SearchIndexer.exe	102
PID 3252 wrote to memory of 4676	3252	SearchIndexer.exe	103
PID 3252 wrote to memory of 2580	3252	SearchIndexer.exe	104
PID 3252 wrote to memory of 2540	3252	SearchIndexer.exe	105
PID 3252 wrote to memory of 720	3252	SearchIndexer.exe	107
PID 3252 wrote to memory of 4804	3252	SearchIndexer.exe	108
PID 3252 wrote to memory of 2496	3252	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_454693514858795ecf43c18f6848687a_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4288

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9ec078dd7edacf89f9126e82a70a8268f629859c0f3f7796c4fa19ce5428904d
MD5 2cb409f9bedc8bf3e4dbf7262099c507
SHA1 7dfcb39131ceed4a4bfb6e8ee9d61999fc18d982
SHA512 2d0071eeda583eba376472d3ae483c3971fbb9b7985feb64b613cb4eea60208e69e7342d3e6c1988bc9928c1ced205731c15ef829eccc220765af22036566603
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnqLNiXicJFFRGNzj3:63q6mjBZ7wRGpj3
TLSH
T17BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 de580e3d4be0931fddd3ee9da5061753ec0e207d714dbe6bdb0cafdc182e3625
MD5 d3e30ac23953c35707bb72ad6c8ca2b4
SHA1 28e40ef75c091ea52575f539b82d516af2343248
SHA512 0836139db2a0aba76d024fa8dd39b6e73cf49f00dca5a2dc6cb28fc0c3db6cf9cdf53f06bfe19353dbc0f37db1cb5a024c49a65616d4a287a4d52063d6c30453
SSDEEP 24576:pXYfDtczA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MtcpLNiXicJFFRGNzj3
TLSH
T12075012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9c29338b6238ce34fd153900659bdff5030c3131a7f86535c7f59f11001d3103
MD5 ffbebbc40bb57c33a22d5f2f7f0eeb23
SHA1 16864b6c284d6b35e2526aecef0ed79b3b66cdc1
SHA512 5b07090a07650ab14f844fed6a7b40b2c6db47699f6d9a56e230437a1b25196088d48e36bfc3cf6a49f50b354f78d44dcde9dbcf1f57ecea1f56ebd352ce2a45
SSDEEP 24576:o0Le5ji0hmxhrMX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oPji0AziLNiXicJFFRGNzj3
TLSH
T13085AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69346eb500f882a901a36c72606f6fdb1b95a6d3017bda6f6ec87a0271bbdd82
MD5 cae6e78cdecda9344969afbf9c4246a7
SHA1 b267f6af6487e6e5af010708906c4c48acd77145
SHA512 87de2c7554ba7215aa8e7b53bad91deabbaab9d65cea977db3efe6a240fb4287b82ef947e1c78a27f70875e404377d3c16a8c18d789450257a3032b63c15e585
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWj6q8wyu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q/ezSC6vUzPv+Hjy2LNiXicJFFRGNzj3
TLSH
T19B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 437c55a80e379f4eefba0bb554c994aad9709eb3d4d45ddd2b5960c5f07da56a
MD5 202251849a6c7f4034cd849311479301
SHA1 02e64885ad0f4711bafe790ceedcb47d1777f46c
SHA512 3da03cc5dd83fbb6f3f1ca0b35337045773c097f541202c3ec9cbaa874bc1f789a7dbfd880801b8ad4d6564eb847ad53fa00b3d8c5b7f8015ff178aa039f3c79
SSDEEP 24576:jVbqPb88hv/l+B4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jVO88hXl+CLNiXicJFFRGNzj3
TLSH
T1D1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7eee5dd6dd766c4ae744e2b52d9b23c05e73bce9b9a153be02e7a761044f294d
MD5 6cb41d79a54e29c9a2c279a61425f04f
SHA1 cd940ca5ded1f599b63804fede65b8ef1477aea4
SHA512 0718507f9f0b8707cd98fac7ecb4a35ff3cf9375b2e73de59047dabc416675b1c6a229449261454e610c46f94df3c5f3c32d6ca7f14e8416376b6cd7c5fb3310
SSDEEP 24576:hGD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
TLSH
T1075523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ac05db2fb3cf9951200b55f91d5385b41a9bc5343d1d50ca700d6f60ce19b684
MD5 252fbe3642a470ce3629ae0fc0c88a57
SHA1 043b75a25b56aafd4ed5de55577ae68d6b0d82f6
SHA512 5e04721cfa03206dce6bd6fbbb7e0b201819ad1edd9f40b5732d08b8602a5d4e53edc0db9a37d391b9272c7757817b6166efeb7d6010d031e73305ca699383eb
SSDEEP 24576:AJIUA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJIUALNiXicJFFRGNzj3
TLSH
T11175CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 75437da7735d14e71cc65336de9a326053b97fd8f1c51e035d95b470ee2e2441
MD5 fb636a425d936e5fb67bad3200208916
SHA1 77d32b1ed9f83bef73450768c0d266bf16b17cdd
SHA512 c760079f595a29229622f971a038576dd5d3e849598bdd6391814e9ebbafc7aee1aeaa684f7c2e7b9204c4289891bf9f61222911bdb2f5be6d6a4dac2c0a8c31
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:tQvGAdlCEL8c/WRNw5CJ7wRGpj3
TLSH
T137266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 19f5014de4d3d94ba9cdb6c38bdb8a9cdd825a2bfd405de2fde501d40ea1a359
MD5 fe69bdca51860a1ac4b5f2319b3a3083
SHA1 d5b95ec014c0d948efb0190fdbe9c6dc3bd93b01
SHA512 b92f7743f5caeaf39ff09b2e23222a17d76469b63fb3634b6b87cb824f6cd08c2c43d2c00a716294505836e00c7d9d614e4df6439ac904c07d517ed2700ee257
SSDEEP 24576:sfewsAjy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OljyLNiXicJFFRGNzj3
TLSH
T1C375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a980489cc6f5a77c962daa46be881bcbab9cf9eb5c351cfffb49a50d7f2c46a2
MD5 bffdd2448ad360389e0d2835d94545b3
SHA1 24ea1feffa1d34337678e8d6b3b03e932af85f18
SHA512 c034360afd90750cc5780aca84eabd80b383b47d860433d191ddc4cc33b91b0506e661a55c196a01f7e4f3ab77fe6dc64480566939645b6849353ca235fa1db5
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+F9:6UEtQevvqc2W1cpV20I32y9
TLSH
T1F9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 936ce32f81862fa537786531c06e511739622c3e3b6aaf85afa2036aabee5efb
MD5 b5fbb9144f4f7b102b0f01ae23481aef
SHA1 4ba7527fcf7aa4f6bc1c934c87497ed1d2d3ccf6
SHA512 75cc84b5f4aefaa6a4ace379363b4ae768669bb480f1a87c2d3863801d22a23b3e7a02bcc0983cad74c9f091264eda4cf297d00bdcd2b9bb65bf2a8646b491f5
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/zSLNiXicJFFRGNzj3:goq2Vjnm97wRGpj3
TLSH
T10AD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0fc2345f4203347fe371c850459ce49d76a11d40ccf93d40171aaff177f2336b
MD5 a540faf1731b6de1047aaccf7ba63175
SHA1 76371f6fc1adf4ce6341367df86933ca1b0ad0ab
SHA512 4ef8e2a7199d55ffb356c35716d19c32a3a3a0e9c8906c4970f8885a26568161e9807e0cf0aea05e374399fb9504b286cb1a2e43365488550a28f3da03ecd04a
SSDEEP 24576:vAhGL6IFoiwtA5l7S53d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vAM5Foiq5NLNiXicJFFRGNzj3
TLSH
T1F1359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cdc94b606ad963aebaa7e2902629fc6f25e4b1116c23ae53cb5bf1571f8db6d2
MD5 e04c46eaccdd145ebd4c670fdc367a09
SHA1 2789f4b0094b54a541c6460dc254f37a012647d1
SHA512 67447111387419de3f1382eeebc155544074fda0d6b4c1887e57c6558cc0d58096a7d4ec3055d931cdc03eec26b6b0358debb90fa001e264ad09cf2ca382f75e
SSDEEP 24576:xwuROWW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOhLNiXicJFFRGNzj3
TLSH
T12A65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c460a6eaa652f0fb2d639b220b2d02b83b5561696ea0cc2f9d8803b79a681a76
MD5 e8573b152a84ddef0fed20b2972f54f4
SHA1 be5f8858fe6d456f3dc1fe4d3290e646488956d8
SHA512 1afa83a0086a0dad836ac7221913aff70307b97fb34997b14bb8b0d122d90ac8a111b17c163e6b794c2835ea04344664571b3529318114a475053bafaaec3171
SSDEEP 24576:wZuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZLNiXicJFFRGNzj3
TLSH
T11755129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b64e177c40563b0ef2564ef86188789fcced6ba612aa1df72c2f573698e96b50
MD5 2fc13046a72b7ee6ae676f433ad2e7f6
SHA1 ad3a577e429ec2d032fc61cc6a6967e1e7a0d820
SHA512 8c83d3145abd1ff6a1afd0f3e3b802e3d153d25e35dc55ec85bb35a71ee39ce64391be9de13fd5f3d8c1a0e5b3b2c0212f79bd9392788013c4d86628416a8b28
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3k7wRGpj3:aQyiKanX+PNAF9
TLSH
T1FD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 edb09a782e291fef340e6c91c6d0564faced0e9c0263bb7d62d44483bd5fd687
MD5 23dfafbb53bded2a95cf243b8e623cfb
SHA1 ff114e9ac20aa9319d3d6622053a4c543972acca
SHA512 0bde0659f0f9c116698d5440a546d0ad109d006c19690ff061c74ec84cfb1e240966067dff3348e7687fffae3597b669cf6047ec05f0bb2cca6ee4c9a7bb082a
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3k7wRGpj3:WQyiKanX+PNAF9
TLSH
T1F6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6f43cc131e285dbb267b62a95849c22e5e531ba39179d1fd0cb449ca409cf249
MD5 c79eb9c8d06bff83aa159ca5fea30c44
SHA1 abf19221377731480f1c55a9f297399ea0ffec84
SHA512 a6ecc941211e4bb84bc0aa1cfefedd9344e67315ae7d14212905765ac95239fb8bc18f0f51f8aa009d2bf413e99ecacfd3effbc2b51362940add5ae6e116d67e
SSDEEP 49152:R68Qg55nhkeWu7PNU3/iLNiXicJFFRGNzj3:PthTRc/i7wRGpj3
TLSH
T124B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bcb1e7b8547f6cf0adb98b03f048c8f55ae9d58f6b251d2729da9947bfba747f
MD5 1e84d502233f168ac7d32c62dd43b3ad
SHA1 4c7cdf66bb1e7f9d16927682087c0428ed69cccc
SHA512 c8f9547643648f79b9455f4c41502efdc81df2378b3dcd645659d088a3a4207d35ebc94b4945b1655f5b47d871d7fd3f1d24522a26187e06c3350a721859740f
SSDEEP 98304:Qy5112gYy5azzVvU69nLKnhZD7wRGpj3:pLIHRWhpF9
TLSH
T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d9009704ddcf8ca392c2e420614b4bf33d5202e0faedb26b960030f37682e71d
MD5 8ea133617645a468b338c0d32d6f9120
SHA1 005252394267482608139f76645956d565c6073c
SHA512 94e4303fceef2b9f26b97c3c0502a6aabf08e830294a5f070fcca0725e3f08b241151d55f97669d3a81359ba6af01571f7adbc478359744076e9884fc81156de
SSDEEP 49152:8B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1LNiXicJFFRGNzj3:Wu6JmIxd2d17wRGpj3
TLSH
T1EED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 425e11bc3941bb9d646e4a83a469ebf86da4b3098133246ac306386fbe843415
MD5 af61538931037b4164bcf0066bd62632
SHA1 0fd7f1847a3cd31d95490a6d6a5b5970414eb10b
SHA512 88b5e3b90297fe2a2b724c057c67e83a823189afedd95c483395c3b97d3e4c1aa7fdc3925b4d292447d17891948032790d994345f355675683464f8703be08f1
SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4xgLNiXicJFFRGNzj3:ZmifPqR97wRGpj3
TLSH
T155B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5bb60eeb9916faf3ba0eb6d8aaf523667c2191a32ed258b3709851ba9610ee07
MD5 a93b0ef20adaba5663eed56b66996db1
SHA1 79915ad49d9467da7df977368475c4e43c60ecde
SHA512 995ab7ae7ebdc77a39aba8172f4b526952521083e3f63b86d5ae212fd8646b1a14695abe174deb0b05bc89f50e8d10f333425889ef846afec081e3af39a56fd3
SSDEEP 49152:ESuZQIY0Be2KkRVtOnks6NMHqfLNiXicJFFRGNzj3:W5dKqi61f7wRGpj3
TLSH
T1EEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 85259fdda017ec7bec08a90a92d2ecf33b16e9a7f6bd484d3b5789e84e94962f
MD5 44f2ae5d93e92017c45ffa7dbcbc882e
SHA1 00a9454d5d14bc8f946583d8ae7d37dff2ddb2c6
SHA512 dc0027e8e1fd7e365d5bb8f4709f286878b6492d7d36c13d0c666c60a025cf48d6cabaad08f2090eaf3da84fef6741fef02c2d4e1ba37fa042c704142169cf4b
SSDEEP 49152:hhtSn8EApI0figjgiDn0AP5w8LNiXicJFFRGNzj3:wX2iWphB7wRGpj3
TLSH
T11395BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2c080b2093c4fce13fdcdc5997e0905c018c7968949690feda187904640db100
MD5 92c28ea3885ad81f06e2eaa791d16c77
SHA1 59da868ce5ee3e4cdca4b3ad8c9e0be9f146723d
SHA512 c5f19c9bdfe9d9beb7b038ccf094f9a16203f19e089729281d7af01542db3a99a4e01e97905dd62612b193956d5045f1de99f0f3a43efe72a1c4bb6eb3979978
SSDEEP 12288:BfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Br/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3558955B1FAFC0039C6754428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e2bc150c52796e9c0ce610e94dd10f1439cfde9454a059a9e0e0e626a9d0fb25
MD5 3a7ab035bcb3c1fb1ae507c5f62330e8
SHA1 412a9f42dae92c7786c43bf407a8fe54fb6b7d93
SHA512 7f5a017e6caeb8914933974e5d90e66d09517506db9d95d056e7f122b6e67e07d57845284fc69f95cb74f20afb889fe6c46a554a3931b2c99c5da40a3f0540dc
SSDEEP 12288:EkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Eu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D3548955B1FABC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cd628e04d5993602121fa5fa567ef586a1a1f97eef27e48f0d9c5b01bf739181
MD5 0460da81a94ee6f4a2ad8334d3c34211
SHA1 b6ce244fb34b938b7937eab418206010d52c4fe3
SHA512 3aafac063bf81c8ed545b4fbef6c4c1fc8708736747a1a31e936b12d5596e9861699ef99cecd1c1ff52b765f4a984d3867eec2adb3c3f144d6dd3cf77460f31f
SSDEEP 12288:VeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2cb2e72925b1b94179e5a511b8f1ddbc8749fdd77ee3007ddc97bf716b9162d0
MD5 adfc573ec268857bc338822d2a9ef122
SHA1 b4d4d430ed4faf7e0859d2c28020366fdbb79562
SHA512 1f8c140a28c7f4f4c2afa010d4b36959f72e0782e471792d781273bb81891c47a2bf00232836f7241a4decfcd1e19f05a6eea339b5d88263dae207909eb74065
SSDEEP 12288:nVxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A552392168900E1E9FD803DCA764424F2A47D6CD7325AEBD3003D1E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bd42734165da4b9cd11b3356959c4406b851fb2946afbaecef185f9c22b5eb5b
MD5 b1cb7f9d1cdd9ca63fafd396ad7bc4eb
SHA1 fa85536c13ba2eebf24729c5f3d43f5f0ba2a5a6
SHA512 fc50ac0572d0fee213fe2b1620f5c4d8af0d40abe96d4dac554c86e90d54803c8e07922eff0dafe011b6ffb217169910f388a431a47ed950a90d282cb249a84c
SSDEEP 12288:mpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4d3741ec0f6afc41f13b946152e66aaa48c74ddbfa91a41881092694ad02de91
MD5 013927bbaa90c492ad2406ae961a1a4b
SHA1 b5b57b4b4f00ee0652aed3776bf664b07ca0fdb2
SHA512 8d308fb95b5325475302c919be389ec1210d8e69bfaa01dc36b80ebdb7b03459bb678b37d9d03902e7ff26d20580e54197e67fc720cb34a286adb18889037529
SSDEEP 12288:fIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A5523D3558955B1EAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e0444541801c0ddee31314a2150b540c1ba3dbc26ca97936a84ba32c83141517
MD5 bb257a067e298268482f9a404f43396e
SHA1 6944670b625c4b622ab93e2353d7ba6b6dd892cd
SHA512 b1179a4356f51094e1bfcac5fd435574202eee49ec23539de43b61100ddf51c197faa298788ed8accf3178af17dbf2b6cc910dcb283fc84c0344ed9ed9fad21c
SSDEEP 12288:h8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D65523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ed96d8035784260fb488fb13eb019f79f8165501f8e37ad21ce6e59f83c3d004
MD5 ed63e117debf0e6ee43a5557e6ba746c
SHA1 5c6f974dbf6715fa12692b8de56a55eb40a03266
SHA512 b8a7f29833fd09f135738879e0fe1a9d9636f305e873fba4894105be7270fed5f4c03a40d1eb74e6e62411677d8211cedf9ae705293a19d3cbf7f44cfc2c6969
SSDEEP 24576:fZM3zFVSOO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fZM3zfKLNiXicJFFRGNzj3
TLSH
T151750295B39018F4ECB7813EC9258815E2B27C194B70CA5F13A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b4585c96daeb3a6ade73d51fb11d76befc411b627356ed149f3ac05ccf53890e
MD5 426b4f127ab89f5a0bcee4e232d13c88
SHA1 1446135f9c96cd11ffd2e9601dcff5165f448ab2
SHA512 7f41d0c0e8b8e4d46f1f8468620f3afd65c1547b4daca963aa0fc63e9ec3df26a1489adc8e964c891df67bb992a0549eb518e8a925dd7ae70d39dd2b91425f88
SSDEEP 12288:E7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ev/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E65523D3558955B1FAFC003DC6764428F5881E2DEB5658E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 742cda372a60a9e322e1f52337d388f6519c82dd0f4a63e577deed8f3f505ae3
MD5 7044e450714f71a627200be5092f61ca
SHA1 84ff6d0714cd1c0eef73889afa44f7dd72c61cff
SHA512 bb38a741c7f7c00e52a156114e057dce81db7540c6e11c1262b8674e92b14db316b23c3a86bf226f0dd2f5127e0fc8e835048916ae70a3e9d8a5cf003652a5f4
SSDEEP 12288:jniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1FABC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 09dd2035f41f217cc50a3071f687bf6cdea2c60ecc26e5d0f624ca20528163f7
MD5 4ff81c497052bda288f99d100efd5f13
SHA1 e8b4b67f33f870e9b4cb40b50c93cc2fef251311
SHA512 8246bfbae786d7967b6ce47d01bff5a292821fa38b86a01bcb0cd71b7a20488f857afb9263a9ef63c0137af5d4dd8cb15beb47c9549ef3e28daddfc3b5b29d79
SSDEEP 24576:qzyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qBLNiXicJFFRGNzj3
TLSH
T194650247629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f02d462149fbb0df59038c9658d4fe788f387999274adf759849f7a213c884f7
MD5 44183836f5a63ffe854755790f5ba944
SHA1 e33e070872b8fb63d9c4926f8ad627d2ab96272c
SHA512 acd57cc86b3833ede02941548d849de6e13668d650c160779a1748bf9884c112d1bcf508fc4a71081257703b894f40f6bcd7cdc10af020dbdead5196f8cf10ed
SSDEEP 12288:f7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4fd4b3c181ebd49517cdce7d611b1abd9ad2f0046e990d2bc42093e37edad770
MD5 5bd9e1d8bb4ab1ba43c649455bd597e2
SHA1 2b7144bade8752c34e6ae0587a114d07c4e3a073
SHA512 c8988f650cbe187593a5d7aac82f8e7ebae367edd397cf34f4cd872e7c35548c9b55e76d1f877533dd00cdf55f8ae03d1be2d3ea5d62637ad75873d23c4ac7ef
SSDEEP 12288:q7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1FAFC003986764428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a0783940c5d8f4e567fa96c5f8c7e573b572c07dd7ca8641c625b7168e2b1434
MD5 c8b8467220ba40a917e8644049acd44a
SHA1 b1326557fa53eae04fa29ea4699f778abbc33426
SHA512 93731537dfb2e1b2a47aa3557e3f555c2d8fc404df5138073ec4e1806e4fa75c0f26cc549c2697256970fad8c939af9f4d932d6362d01abddc11e23f3fb333dc
SSDEEP 24576:bzyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bBLNiXicJFFRGNzj3
TLSH
T168650247629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 036c4fed73321c4f05ea254f01b7ba0a82b9da0db05961b9d1392290db98ef72
MD5 dcbef31179d2f9ef42d8875050e2f247
SHA1 f1815e8edaa82f44717313689052f37254e5a9ad
SHA512 50fd4f2327c41bb726a7527df842215361e5dddb0987ef44a9c0cdbb6b66bc8e4fffd83dab7e7d76a000584e6050d3015f0919aeba5295f51d2bb2baa6ca963e
SSDEEP 24576:uT8aLl3z0zDY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uT7Llj5LNiXicJFFRGNzj3
TLSH
T1D37502A5B39018F4EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d8651206387448ea1883b8c5e81d0dfdf505a55e75e00b6868f012480bd5425e
MD5 a6ab710c1bc9346835dd9e5c76964f0b
SHA1 a36b85d99f98c79a15bc17ec173ef412140cc853
SHA512 aee35b95ad9930d56db026a0c331323128d16c68f73eebc921c30f0875388078a4e5a72111dc3bf8f9a555c5d80be9fa098146b866e05a554d578e7da95375fd
SSDEEP 24576:l3rd9CHKy7GZE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Frd9CHKyaKLNiXicJFFRGNzj3
TLSH
T18485CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0561edaa06bdd3cb5e5d9a17e2f03746b4470636cf152a3a5066fa90390218cd
MD5 a2f54ff5bdfec2508b199526a32950be
SHA1 9f1993f05a42b070bb462e3b8b9639e600c90604
SHA512 1dea6455a480bb6a471316385a826664641068f27fa236ec8365df6dfd246d1196f8bfdadda3f481797ff484b211c418d786f9dbe65cd445caccfce4aebc72c9
SSDEEP 12288:y+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 022adf6eb9ccff09ca99b3a3986f5c98090605bfe899c47b2f35afed5d131558
MD5 f3efe4c4f5ae3240ecb9e07f868e2909
SHA1 dc7fd9272b673f236ee3e8ae555fe7e0887c9b48
SHA512 977d448920d9cc41d892491afa060dadd47303b209abe9019f766baf36bf6dfe30b16b5bd373410e17a61e65ef9ed777ec6f36da44632bdce9b12b7fe560d508
SSDEEP 12288:iwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D2558955F1FABC003986764428F5881E2DEB5619E3E2443D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6e3090f37eefec0e6ec12aae41d1234231ccdde8c6ba3e8151a909fd68871091
MD5 d2a4c8ef0b7124d1d4e8947e0be3fc10
SHA1 76000a8ee84b5b15f9f7eb4862f1b3824b11a46e
SHA512 e5d6b5c478826eb789c67f11f8dd5672cf2e483669cbfdceeed6e7f1bf7685eff37fe5569d31d7443f91687f22984ac0ecab95f39d3b08ea11db5f43daf2cbae
SSDEEP 12288:INiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b06e38f745c883f500b678e2ec2356fd10261a2524c2504452deae31cf94ca20
MD5 31c20c3a48a583cf0504420dcbb2b0b6
SHA1 5e8e424d8458103d0e58548adda357dcaffc73d7
SHA512 94420f782ffa19054fb97046290e1fc5a9ff3e5bc7d8801b0eff320b33db06b01aedf23bc2ab7d20765775d6140e178f04a43bbfe24d6ae1a06864d2ebeb0048
SSDEEP 12288:47iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3548955B1EBFC0039C6754428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5d31b2b1f5223632ecb792ca4588fc2f50a7cb74dee685dea4c52961feb86c4b
MD5 91db1899cc08006ac2a4d3cf2457eb87
SHA1 56fe713da2d3f0c2988b76c83b2e70663c178027
SHA512 d7186635426487ad4709543673656ee055c68e8a572e9fc6806e22d7017452b0276e052d69fd6753c34167e1476fc333c5f80b38d62e476275648d04b10625b1
SSDEEP 12288:1+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3cb5922bdd9fae1df3b1212776314abf9b7e44502b53cfecb6edf19eacc50c3b
MD5 910290744c595c0e057e291b49b35c99
SHA1 6d608d2f0314f8bd7587a0aff55c9a0357c18f1c
SHA512 f5556587ca1a024153a7c09935b413a8a9a8e2faab3073c69c16c351d94d25b36913066cd1d9ad143a59789d9038be9728599cc5514a3d24d1a53c90d2da47a0
SSDEEP 12288:aziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D2548955F1EABC003AC6754428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 380af66bdac14787d2592852c76ecd95504e9d8df0a6a9e5729650d52d78f8e5
MD5 260c91c320ea5cc824f31d59b695610a
SHA1 84a149d0961d018ec10e84a762726015051b7aa4
SHA512 686a08096f0d8028229d4caab6a573ed33d849de3796a5703954beae5daf5b9e2c00de95e8127f5942877d4230295b9f5d0e904ff5fab35cc077b8fb5530587f
SSDEEP 12288:9piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:91/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4e9618a8af5a2ee9be1dcb965222127f87301ec1d9783cc0ecbc1ec8848241ac
MD5 04aed903ab6ba9c8e4d923d315dd5bed
SHA1 8536e522972f6734b738a7a6171efc7369eb4218
SHA512 c994e7c4e7d412710dbb87dc91b8ac9d1e6bef347b7143b4e2824b3eaeb0ed918ab9fd049e2051522ff19fa942bb2edc2e9827e828e650ee746a79cfbd32c3f6
SSDEEP 24576:Mfwvzk9RX6wkyAIj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XMnYIjLNiXicJFFRGNzj3
TLSH
T1B685DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d350b8a50543ce09bd93f78b28794e215f6c8ab07427847334efd15b5988aee9
MD5 57bf1e56c121480ab6adec9c371c9dc0
SHA1 eae7d526ea754b33113669a6820476865067b962
SHA512 7bb6c49591a98b44c4f893351ecffe8f38b4105ae56c628b304dfbc3afd3ae01b0ccdddf09632f4d359e9b8e3f2942177618099df288ba2c3ab9fa8213367a0d
SSDEEP 49152:NYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cLNiXicJFFRGN:8ySzPE7wRGpj3
TLSH
T1BA066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 add320a839992a4fe383c6ade9e7f543d0a54766bf1845559783a9cc2f568ddc
MD5 b1c64d1f5241e083529a33103c837502
SHA1 2eea2746ebe6d34962a85209b626f1e40ec1a851
SHA512 55479eb35168baea37063b1f1a8b2502c0e7e9927f39e1f325c9c70d3fab1e008bb1f17d25934770678bf5d1873932029a654e8df405874e6ebe7726ec1d6cd0
SSDEEP 24576:A47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A47JUQjqirIhCnDHUPfF/sLNiXicJFFS
TLSH
T14C65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c039de31db336ea614301d4148682e35c9e0995ce3f516efe6e0586be569ff3e
MD5 1af21cd071ad40f281002ca2b47b8fbc
SHA1 75d31ed6ae74b843fd3fec727180dbecd6006800
SHA512 c3bdbf990af5ad81a7d72bc84d6357e8ea16a605a6477ae6031118126de004c133535b4ff4b3da07f4acce8cb46ec407250b97736d3a8f59aaf4e068950dbba3
SSDEEP 12288:JpsfLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17265F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 6c63ad2324272aa85629c62beec42e4ade7a05e0f3727f329e6d3b4c448f8e33
MD5 038ada31050031ec5f55b7fd328fd16f
SHA1 a76448cea896ebb9fc32ad04a9c5cef2d2d78023
SHA512 505577350e54de3d0693e4f2cbd499c809496b328af2e2cf45178641ddf944f3dbd279051c55b486e8cab0c3b80ba544a7e9e4df1731c96e1190c07a0af864b7
SSDEEP 24576:kVeJf6UP2GpPvSGZa5tbtMRg13UPpv/I:tf6UdSG45fWg1EPpv/I
TLSH
T135553841722AC78FC6A950325E32D6CCA7707D01EE04AF0773C9873F9476669BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.0MB
SHA256 c36a24aca5e135c1305b13a7fef1295700174eda57cdf70c7d086cf2862346d5
MD5 7852c4ac5ffb34bc1a53ebc07b912e91
SHA1 c71b382e6f30603a5caed389da5329076ef5fc10
SHA512 0f0594daabb265d0fd3b83c1030a8947f5346c248e6e79b4b3560665dcc99ad59d66b329908f08860bee99dbd397e5b64ff107f2b8a4713fae5d559dfa7dc89a
SSDEEP 12288:V36GjW+N8UDwUhPoUynZWMj0z+l6EiBQ1zX3JJNRi0N92JYyB11DJC4tSqc4V:Z6GB1hPoBZWMjVApqNHJJbwj7
TLSH
T193351941A5B7E35FC9BA90331332968DBB746C06F7492F047344893C886A97EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 eb3e6d1e72e677138434847fb2be170920f0f835733aa16b5d649cfb5460c640
MD5 0ba65d443135b2d64037926276c13d59
SHA1 ab7f2357025261771f2895138d33c461693c2d82
SHA512 3eacab18f7e0082b38bc5f6373b57bf306fc3790ef90e8e2fc849503ec359581730a3bffeb55af664551697e687abe69324b288ee951f0e688d0a26710db40a1
SSDEEP 12288:jF7DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:53/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523A3568C59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b40aa68320067a1bad9a9397fed9fce13c2b32a2be18bc7125d0ac56fb26cc60
MD5 704a9c804e5161fe2a0bc401ac5d4f8c
SHA1 3211b4c26e3271354db27c5e5de30eedbdc91187
SHA512 d563b1e05266d9ab49f6b167fcf722467b614598e57ce43410abded084a8e8ddcb1ca47ed575a437b577c25823608c662427ebd81048674f14c33553f724b508
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bY5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rgb4mBIBhGFeLNiXicJFFRGNzj3
TLSH
T16065AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 078b12ddca4e3826d3f8f3f6b543b8b07dcffe0cf3976d147607c14a95e1e1db
MD5 0e16841c5252cc6e273c159512699521
SHA1 091ce37de353e54d9e3e7e48cca1db3aebc6190e
SHA512 afc8cb88a54ed98d2ed40f1693b94b8a9f02f03b85e643522444c2bbf37b7e5dff09cbd63b8b9d9f539fb29b76f2390136a2e03cdf75324b4ef0e6a35aec4569
SSDEEP 24576:cG88u8FpJqH1vzria7/mO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f7ZFPqVya7/xLNiXicJFFRGNzj3
TLSH
T15C85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f105dc1ca2cd1c315f1b8b040198b68471bce886eb4feaaba08e9aa7c27fa0a6
MD5 436c7685d1c7a2e3a63dd54b03f64eaa
SHA1 20a9a7a4c6888d798672f1715cf2b6058b4e78ed
SHA512 9ca557648923aa3bdb5e373c3467c6d3f8f80081c2d1d40b80fbabff31ff96c113d56eaa5034d35c4436a79256b63e813d2d8d54d962df47360176d593f5096f
SSDEEP 24576:dPUr+NQK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dJQKLNiXicJFFRGNzj3
TLSH
T17265F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a1eea86dada20092b875e904ccd229a4823a8a55c7147d7157269701588f2b81
MD5 24e9b56b29a167dba5beb34ff186c768
SHA1 18385ecf866f3d2ce3a881cbc8ff35c590effd8c
SHA512 6daf9dc059e1aa0901c3d39d36467c4ca2a2c006ed1e286ca38b9d68aa7bd6b511aaf1d564e7ca0990137f5f1f607e988e673206c85ecbc40c13b42b09bcffb3
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6LNiXicJFFRGNzj3:HG05lO43b77wRGpj3
TLSH
T170D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 172b5ac59acd72ff6a52e591c292f15e3efcdc6f4eb306c8c2afa188f39eb29e
MD5 ad1fd7f6f2dea4423851489f9247e698
SHA1 64ab3cb4e411ef39c3c0afa3b435e72f84600f85
SHA512 690a066db722d2b0cf3b0ad80dc8b85c82ee14f9e5fe20f022e5286b363dd7127df311a5e88b0b4da8535bc6e9855df9a93ec908d02ec7e7b239a2723a2cb81d
SSDEEP 24576:Nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnc/TwSfVcYG3K/cJHlnFR+IGNe8jg:9a5POZ3lJt2pasx2+miLNiXicJFFRGNf
TLSH
T1F165BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 12fb99bf8e8b622a43891b924c4e2175d63a40eb38a76ccb85faf82276e00f41
MD5 7a1653c089488e946ec6c9804de43974
SHA1 47fe6ca4bceb7c21ca0a0dc9cfe52df2de416d8b
SHA512 c475ba8ea9a8794613bb10db8a770f37cb287c249d9e4ab58f1539e4c4afca2441721614405d4356495bb2aee6bf6e377b40d8375c4e613ecae4791efd2424a5
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7Fk2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dNc/zEOVHFRLNiXicJFFRGNzj3
TLSH
T18B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 587037ea7c258ce87e78ba64e6a372872dfc06478175eeb9eeed84c22228ff64
MD5 69f24b800e949426ce019a4bbcc2a7b7
SHA1 39e77f707280606efc28c8fbe43f47360aed4b5d
SHA512 037b3c231372b4687572572a4f559e79b84770f9c2786c4afe1d5a1c522b5b3d03a6c720b38064b2ca12e7cb46c5f834f1c69e3018a2127a2075d2b52bbe6665
SSDEEP 24576:1zkNvNnaFeYhJNtmZBmB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1zMwBtOmBLNiXicJFFRGNzj3
TLSH
T14D55AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7d8ace02a8c34004e05807f976671930967f3c4725593ed01775607d4450da02
MD5 07c7b5a113a32f5733eb6a6af9cf4a5d
SHA1 689c5c0ee48be28979f1e7dbfcc5e3f4e69f9e83
SHA512 23f37a7e1156f6129df6eeb3a9d2c002072f9b84bdba85ba8e139d60e6174b0271a36ca207193460bc0b2daaddabf09ca39fed406a51a2d2baed81749224439a
SSDEEP 24576:mD3FHshBIYQgAL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mDVHeBIAALLNiXicJFFRGNzj3
TLSH
T1BB75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-127-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/556-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/556-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/556-129-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/556-121-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/932-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/932-14-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/932-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/932-21-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/932-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2268-72-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2268-73-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2268-78-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2268-303-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2276-62-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2276-68-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2276-60-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2276-294-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3252-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3252-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3252-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3252-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3864-52-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3864-44-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3864-242-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3864-53-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3864-45-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4288-41-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4288-32-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4288-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4288-55-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4288-58-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4540-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4540-109-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4540-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4540-306-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5020-1-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5020-30-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/5020-0-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/5020-7-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5020-8-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5504-322-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5504-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5504-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5504-84-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5504-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5504-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5832-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5832-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5832-307-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5832-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5832-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5832-96-0x00000000006B0000-0x0000000000710000-memory.dmp

Download