Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/09/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
- Size 3.8MB
- Sample260915-1chbsaha94
- SHA256 2f025e7b7a17db593f07bc9d0581a9327dd80b5b6c04791decbefb12ccbafb01
- MD5 d45f680ea8b75b4c23c2820f6918ab14
- SHA1 bc456800c5a2e029d99999a092c3a3912d7f42dc
- SHA512 026d31f6361bb371265636abc8af64e9a5eb3b86a6d1eecd0ffdcc0945141092c42b15fbeab6a678b66f5157872550a751085c622abda29bd17eed2861a2b650
- SSDEEP 49152:DO321nhCy0kbyXPvXYu5e9IhkehSAdToxcDNl/OdARSTq1t3Bj+LNiXicJFFRGNf:iuby/vXYCnTNXY7wRGpj3
- TLSH T1AF067C57E6B941E5C0BBD0388A469A57FAB1384A873197CB47A0475B5F23BF09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/6120-29-0x0000000140000000-0x00000001403DE000-memory.dmp family_stealc_v3 - Executes dropped EXE 11 IoCs
pid Process 4636 elevation_service.exe 3216 elevation_service.exe 5932 maintenanceservice.exe 2124 OSE.EXE 2864 PerceptionSimulationService.exe 1892 perfhost.exe 1604 ReFsDedupSvc.exe 796 SensorDataService.exe 5140 ssh-agent.exe 5272 AgentService.exe 5500 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5357604e67fac3b7.bin elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004af6b7b15945dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcaf6eb15945dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4636 elevation_service.exe 4636 elevation_service.exe 4636 elevation_service.exe 4636 elevation_service.exe 4636 elevation_service.exe 4636 elevation_service.exe 4636 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 6120 2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe Token: SeTakeOwnershipPrivilege 4636 elevation_service.exe Token: SeBackupPrivilege 1604 ReFsDedupSvc.exe Token: SeRestorePrivilege 1604 ReFsDedupSvc.exe Token: SeBackupPrivilege 1604 ReFsDedupSvc.exe Token: SeRestorePrivilege 1604 ReFsDedupSvc.exe Token: SeBackupPrivilege 1604 ReFsDedupSvc.exe Token: SeRestorePrivilege 1604 ReFsDedupSvc.exe Token: SeBackupPrivilege 1604 ReFsDedupSvc.exe Token: SeRestorePrivilege 1604 ReFsDedupSvc.exe Token: SeBackupPrivilege 1604 ReFsDedupSvc.exe Token: SeRestorePrivilege 1604 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5272 AgentService.exe Token: 33 5500 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5500 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5500 SearchIndexer.exe Token: SeDebugPrivilege 4636 elevation_service.exe Token: SeDebugPrivilege 3216 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5500 wrote to memory of 5264 5500 SearchIndexer.exe 98 PID 5500 wrote to memory of 4860 5500 SearchIndexer.exe 99 PID 5500 wrote to memory of 5432 5500 SearchIndexer.exe 100 PID 5500 wrote to memory of 5392 5500 SearchIndexer.exe 101 PID 5500 wrote to memory of 4300 5500 SearchIndexer.exe 103 PID 5500 wrote to memory of 5980 5500 SearchIndexer.exe 104 PID 5500 wrote to memory of 2476 5500 SearchIndexer.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6120
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5932
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2124
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2864
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:796
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5140
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5272
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5264
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4860
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5432
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2616 2608 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5392
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4300
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5980
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2616 2608 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2476
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 3aefaacf4d038faee603ce61633c2761affc4069d87f77c3ed70035af6f16fd9
- MD5 32bf7b0a76400b5ceb793286e0901094
- SHA1 5003229e31d8fd17538ce40f80552243af16aa07
- SHA512 5595499c2d9c4169fcfd9b7afd3bccd1a41650021f5a193904009c1ac64e11b7987404b6ea9064268c82dcd83228d452986b68d53e04050c5e254dad74524727
- SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnaLNiXicJFFRGNzj3:63q6mjB57wRGpj3
- TLSH T119D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 eb5722cc65e0ee93463d57fd19ea855b08d3d6b0139000b0f4293430827eb7c6
- MD5 7b3b3f4994a1c3e14a70ab600e6ec463
- SHA1 e342b2899548e62ea104cb728f6625ec2a88724e
- SHA512 adf39e6524fa0367a39306f55b87944942d5179eb03c82cb1d5e1f93e5348fa95cc98cd688f9016c79fefd60b44bb1e77a6d74b740e5b6b906a66d8adb5bb23c
- SSDEEP 24576:lXYfDtczA1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wtccLNiXicJFFRGNzj3
- TLSH T12875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 633c4d8d21e601d65146320ed0dce7d205cc709ad49f4c964640740c606f05e3
- MD5 00d3419f64747089e447a1566c2719fe
- SHA1 b9b5037af66986b289c24657bf25b2391bcd8e45
- SHA512 e55ae11b2b42191b1a05fda054b273f6998f38ecdab4876bfdc986403002c3aea98fa74eaaa2383fdca6705ec2c13af92aa0bb926c42e04725370a02de2adeaa
- SSDEEP 24576:M0Le5ji0hmxhrMC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MPji0Az7LNiXicJFFRGNzj3
- TLSH T130859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 6141dce69d9d292aad3e0043f80401dd791f393b22acb3346e3c74bb5ecd8361
- MD5 0fcbba4e1573796437cca6b090160755
- SHA1 51238b8bf286181e883323208de8677534da990d
- SHA512 fdbb25baa7ee31505dc2c91bb7c496f2a9c5f96dd941b013c3f5940d34e5000c6954b09b6d980c61490697101b2b501d458abe2db4ec18b73b7a88478cc4d851
- SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWj6q8wyus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O/ezSC6vUzPv+Hjy3LNiXicJFFRGNzj3
- TLSH T1B8756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b9a41908c8955d8967bc2f5a03bf4db94c4996ce0995a2f437aca06b7d594189
- MD5 62eccc111f6f240fbfff52f36d77dd7d
- SHA1 a0b3618983b79c2a039e4f72681049443605505e
- SHA512 28280d0bbd7c3ba980465da00a7feba7d595193283c60dfe2bba4e53a9cdcbc8abdf99af2299ac7ea8778cbcd14311160fc5b8b7bbb09b578091a68932450485
- SSDEEP 24576:RVbqPb88hv/l+BJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RVO88hXl+bLNiXicJFFRGNzj3
- TLSH T11C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 2111b479ad8c9858e83c65fe12c6f99abd25d2709a6804381bc2f931d8f4b30d
- MD5 8fca8b74d40f5b031f2fe5e16de3ee98
- SHA1 9ec530d0da906d5888f7925291fed2eb4cd908ec
- SHA512 5ec337b61ac6633c4c9b79b5efcb4f5fd77a248704d997e58ff6dfb707ea03953515cdd70aff1046673ec195c6653d0570d18b32b3cc867baaa96aa4c6dbaa1a
- SSDEEP 24576:UGm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
- TLSH T16F5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 b387e988e6889dab84a4bb9a207d0ce15ce75755fbc1280395ef4a52ba5217d1
- MD5 fa47723d48296d03f340c3b71e42856f
- SHA1 12019c5e306f7f08ffc14ac849d20701a602ff10
- SHA512 a3cbe20a276efc4984244e0708429215ec59450f6fa2a1c2580d89763c6ea89dc88ebabdf73300901a36eaf2c5a03161ca01be45a57031d19e00da3987b16eaa
- SSDEEP 24576:mJIUx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mJIUxLNiXicJFFRGNzj3
- TLSH T1A275CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 888059bc783dc58f3954b1495a466e44d444784e5211c7858e773388ac00751b
- MD5 503431c548959010613951fd86e901d1
- SHA1 4baf281adc36457ed4ee8c854d2e0dc9941ec456
- SHA512 bbb9eade5d4fc2b39420deb28b26ccf8dca25b1620e6ab9d2d86d68f22c032dc21088eec6c300d51cf78b6468f03fc8e7ea2e17450b3bab9f655dac557a6af0c
- SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THx:gQvGAdlCEL8c/WRNw5C87wRGpj3
- TLSH T198266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 56b9cc4afd0234f3c4846cf6c8ff74adc0e10fe3811aa0530c24ec88ab730e55
- MD5 758147992c5fe34929b6071abd39b549
- SHA1 0642c7f60b7d3bfa2638e494605e25ce83889ce0
- SHA512 fde1ad8d6f9e47cc0480b8f5a1d692c0d12c9b25afcf2b8615dd2cfa8f06d85465659cd644e4d37916f6bd030a9af5838430ca24787c5d9e9fe5d5a328788784
- SSDEEP 24576:wfewsAjL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aljLLNiXicJFFRGNzj3
- TLSH T1FB75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c8fb315c5a2720318718a110ce7c977eb82051677bbc97f1c93387a1ee4a0b51
- MD5 1d8a93bf0d319189716f2ff5000672fe
- SHA1 33ab279ad942f0d455840a23e398cd34288cf8d7
- SHA512 d0b5fd42b12211b1199105624c9d414adf530dba2a992e57595f4bfc673fbb284f5ab0b63ab3d3946eedf871a60a66f8a90d21ce106dd9c86ee449f7b4d84db1
- SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHXF9:YUEtQevvqc2W1cpV20I32V9
- TLSH T17C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 b89f9a7a371fc7be0adc1d9950bab5ee7ffda76b40771e0b983b2b282bf7420f
- MD5 49db6743aa9e06ea7f1cc8938b092a4c
- SHA1 022a4e1b45655fae813c6d6dc83975c5b60d9d7b
- SHA512 f7d254674e87495d2bfecdaa7237c3be31ec78f8e9cdee3d6323db6ace93f76767649f5c0439549ec92299c7f26fe62273cef5fb3ac9bac598a5666799d278f2
- SSDEEP 49152:eCbRquA/m2yL5zLfFiV+XenmE3/zrLNiXicJFFRGNzj3:Toq2Vjnmo7wRGpj3
- TLSH T1DDD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 29b2efec6832f50b590fa70eed83c7c6ecbe1cae0843e6691eff515bc85e1477
- MD5 e23842b914da213e6211848b054c7996
- SHA1 7948db51803a3956ef7f17e13de277ddeb28ba05
- SHA512 fb24d2c0249082764b15d3b6c4e556891fa16c8cc3c98ee61cd6f736b6bf9e537f45c7c561b22acd72c9af98065d93e8d4d683086903bead96cf892c0555e1f8
- SSDEEP 24576:gAhGL6IFoiwtA5l7S53I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gAM5Foiq54LNiXicJFFRGNzj3
- TLSH T12B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 a2342564e1a6cd27077c963d7af031c7006d541a9936cbe099c8d7c4b4bb40cb
- MD5 aa836aa47c5b3a2c5353d37b4b6bd73b
- SHA1 b882eeb2e9918f86bafcfa71d244c2c9634660ed
- SHA512 3c324be31fe1080dabf41dd98db029f47168bb4d9d8bda61206733a06dfdf6d070b3b3ffadbf9db327f08cca9e2679b56540cd56b96a2105b539bad109dc2d1d
- SSDEEP 24576:AwuROWX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AwSO0LNiXicJFFRGNzj3
- TLSH T19265F18632940CF9EABA41398657C035F7F2BC152A25DB1F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 f70c1cf793aa5baaf3d6f47a0d02c666037c51ce86c89cf783ea12f6ebca11bf
- MD5 c870e1d35d02e4b6b21b5865b4ab2d52
- SHA1 f592c1161d4ea2c98dc57b870dd77703830476fa
- SHA512 b9a42d00533d7ebba9ddfbf46181d20285ca99fb2eee20179553ab41b06adb46e2b4f3ed361b4fe73de291e760117f5bc5cc756b6916ad722b6e00dc69a7f5bc
- SSDEEP 24576:AZuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
- TLSH T19055129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 61d838604e534d517cadd4312f8b6318f3c2c13171cfc823aae65ab4b9bfc157
- MD5 ef4aafb61c847807dbfaf48537fd34cb
- SHA1 6f883840a7481bbe608dd934af884e79b2dcac51
- SHA512 7aa12a1722c0c4f3c0b55b2c5ff855e886530f476996259f00cd6c07e12afe7e774fcdae3eb1abb7b52850cbcda2cd5541647e762045ea79f90d8a6e34eb403f
- SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN397wRGpj3:WQyiKanX+PNRF9
- TLSH T10D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b75f77982d85a9d662c1c7b360b989939bd1b02aeccb0f26e57a1105f55f57c7
- MD5 099cf4b368f173150451f25d032e9ce6
- SHA1 023990b547940da447495c4b265daa173557b962
- SHA512 10a8620a01c14f50b6cf469491f6bfcfeed538c10aba538527c9ccbfbd19daabb0a6b8b1bf6f31858993b8261d152b404f47fe057ecd3a84644447545038cff5
- SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN397wRGpj3:YQyiKanX+PNRF9
- TLSH T1A2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4a66bee9dfd4a84001e4fd4daf0e8e243d77eaa6c396502c900de5cd234583a2
- MD5 4d2e8404f29c1b29a29f1770a9ef149a
- SHA1 f7b3e2023c9d4fb1845781a09f24bc5ccf0b37aa
- SHA512 bb519e491b8bdb10cef382b5047bc9cd97ccfc41126fa50b720012d83bfb725c8d630a8c98edea7c0a518eb988162ebb5943bfbea5f245dfd169fcb6a4fe23ee
- SSDEEP 49152:W68Qg55nhkeWu7PNU3/7LNiXicJFFRGNzj3:0thTRc/77wRGpj3
- TLSH T1ABB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 baa12c107adb2c6a58866a78687481669ebc828943be00b26dc8645c5cbc3e43
- MD5 7f5bb33f29af56120886dde3951c0700
- SHA1 7cf00d5f9ab003e1faf186dee53b8dea66f65104
- SHA512 3eb37b6a34e2722ab57a6e839989071f0fed08dacffd0d7ccd8883d962dee0e0e241f41c305dba4fe725ea26a072f80515a02e76bfa531e835e5dcd7770eb38d
- SSDEEP 98304:Xy5112gYy5azzVvU69nLKnhZm7wRGpj3:qLIHRWh8F9
- TLSH T151167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e7ac9f745d880ca83f7bb4f0e80006178e0d59bc678ee1bb9ef9f99d70ee2377
- MD5 e96530e7ad891660861c6a0f5f3dcf46
- SHA1 de1cfd9be06f998bb01dcd12cf1a6bf3b6c1f9a6
- SHA512 eddcd1700d657de9ecb1cee2358c6ab6809d1970df5e96fe585da3acc0291c92697022fcf5ffedd5b329e7cceda5bda189cc1ccc6f8fd0d8f187bb7aba2341c8
- SSDEEP 49152:8B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllLNiXicJFFRGNzj3:Wu6JmIxd2dl7wRGpj3
- TLSH T1E8D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 49e293cbb6a42b804d6cc2ba5da3db8f3bb358f759310ad450e7962bed3cb650
- MD5 dcb308bf2a088feeca18cc99c17a0933
- SHA1 a01033bda1ef049a22416e244bd482c635cf48b9
- SHA512 2eb883945450b74437b76529d069987045a5527be82f0c5a056cc525660a93ef51469d75c138e9a776b31bf1ed1db2a99f677659cf82afd4c48513f607e4fa07
- SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xRLNiXicJFFRGNzj3:JmifPqRo7wRGpj3
- TLSH T145B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 8c01187e55bdf138bcc933625ec730ceba0cb803fb779a62c7c2cf790a483aa0
- MD5 6169cf6fc39542ddcf430af9ddd43814
- SHA1 57df446757e24cc10310b4eae5f8656353b2d6a3
- SHA512 79d8f3acd2b8d696d465b6de7065a61d6a1463f83738c11759692b9fb31e90dccd22c7548643971575a20279a331f3eeae7d972c637a8704a4285fe074ef73be
- SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHqqLNiXicJFFRGNzj3:15dKqi61q7wRGpj3
- TLSH T1BDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 2de9a46f0fe4f7f8309af27bf9822fdf29c907f3a778fde17862f9baf0caa3a7
- MD5 15bb5014b12791ea8795f3063180c3a4
- SHA1 846e3a409af630bc793572f2c93104a5ea900eaa
- SHA512 fa656f5301da2db8e446e6543bf4fa10fd541c02e095082264258089cd74a60e8f560c0ee8ccc453d08907e891d1078f54db1ddea00c45937bd1abdacf98208b
- SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5w1LNiXicJFFRGNzj3:GX2iWphU7wRGpj3
- TLSH T1E095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 21f5b784f544f8b7f972239f18d8dea4ce41133759c1512f0b1dc40a2865f30f
- MD5 1bce9b95d00ca56fe5039b97d3224261
- SHA1 5269d31dfd40ed88069683371dd3f03f01465c53
- SHA512 39b17f4e0a7117038f7033222cce7849e1d4cd9d83de2a5e8843e90101acdd3106d9247257ea32e15fc0ac865e9ef9958eb949657e0e79d8cd06c30fc9c525d9
- SSDEEP 12288:xkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F25523D3548955B1FBFC0039C6755428F5882E2DEB5618E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 a183925aacdea63edee068f3dd56de650a0f80c289f7c1a75ef388b360cc02b1
- MD5 0f552e412ab97fc6d21ac39168851b7b
- SHA1 ca9e0d89d352e948c29a92901dd29f749b067fcd
- SHA512 fb46cc25146dbf9433568ba773c4eafb2e6c38c037a46a0e8e48473278d1724d7e3d8c9e90a7f3108302d83c02f82e51d009819c985e160a0dcc3cf98bfb9342
- SSDEEP 12288:j7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1FF5523D3548955B1FBBC003986754428F5882E2DEB5618E3E2483D1EA278FEBCF38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 2a022b99ba09bc6149cc1b72d2fe5e39ae3651783c670df7c8d0df729469d7ed
- MD5 77522cf75abe53cff9f77a7511e5a9b7
- SHA1 1b89f3e52074c5797b5187b606dcb2097aa0aa30
- SHA512 f4a854fc8a1c8451b432da68492715253a739938cf39bf3ce3a8b9c6d9523319e67e91d1f511878794ac37285c42227a8f6616ed39296f85b4e9ab8e720cb0f9
- SSDEEP 12288:2ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:25/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1975523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 483fea4e2d15f8e3f7ac6a7d75595ae26f4c741c26eea75e97721b1b81af2d9c
- MD5 1995bcab04c84534e40eaf592050401c
- SHA1 54b6908cc40c3e5d470f12b4b8cef5308d83a21d
- SHA512 0ff2d3b0e32c2f674ec292976a9b8277deedef97d41031ef09df3830b26f6a20ebd2935872d09ecb58b35a92fbd10cfb586c2f61fa7c8ef31340cbefb85612df
- SSDEEP 12288:HVeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T153552393168900E1EAFD8039CA764424F2A47D6CD7365AEBD3003D1E5674FDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 4969408fcca3915902278c9ccb25c249419ae076541d0e75d0ef6b07ab08735d
- MD5 bc968a99f78f31966b542ed17241431a
- SHA1 1c267b3d44eaecb083cc405c2457d5125f7be840
- SHA512 de222cffed3c7f5b22c65d347f8d16d0e9b293925a95d52160d52cf330b30d1014a8f847814cdc95de0720aec44ad3a7b8f2bc6c59dbe84281249f34fb690672
- SSDEEP 12288:B2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A25523D3548955B1FABC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 bd9251c2f067ef021d050ed50de4faeace82c493cfd08c9fdddd9c7eddf8d493
- MD5 4fbd985636592724fca1e6195d0d57f2
- SHA1 33c74f42f8e182b359de8546405f2098b5b45bbf
- SHA512 5cc0ca41dbc30c97aab95bd8d4b0d027894fe6124accfa46e2d730ff137b3a9092e7a366c3aae280e95e9f19d1fe9573c6748da4b468b511a78ddebe065f734d
- SSDEEP 12288:rHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F85523D3548955B2F7BC003986754428F5882E2DEB5619E3E2483D1EA278FEBCF38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 d67749c21bba784d16f13b05a6c007f86c9557453f5bc020ec6dc79e58501939
- MD5 289f1fa09c398412504f2a5a8bc0659f
- SHA1 a8ab96aedfc6520e971db8f933df1ddfa79940e4
- SHA512 e8534d0c3deadcea87811b3420b243e36da75832de7638004a391bde3af7ec7b8509a5370b5f5c8c7af6bfed8652764b9f704fbaf511214a9054146377a44a53
- SSDEEP 12288:2ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1185523D3548955B1FBBC003986355428F5882E2DEB5659E3E2083D1EA278FEBCF38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 c61fda5e234c311a8f9d4c3e03c88b1aaea89fafdb0dbc5e342084a605750bac
- MD5 397eceb3847b8f5bda41112e855e55dc
- SHA1 e66ad1894b083bc80fa7c531d87687351d8fdc2c
- SHA512 30a82a8bea66a8a6ce8440d10af1a00e3533cf8c04439aa384b5a59573b46465af7796d0912d54fd7e04392ffed6c047028b42b64a542add5b8c8cdd5fef1e28
- SSDEEP 24576:2ZM3zFVSOP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ZM3zfDLNiXicJFFRGNzj3
- TLSH T1DF750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 25d391370cae0b1fe61e37507445c1238667c6f0c30d7318503c35ef1bdde488
- MD5 0efeeedced0a9a06613489d2ef6af30f
- SHA1 a5a5a7502ca3dc0087de28547112655b8a493054
- SHA512 4a8a9ba32dcb11fb092a30db9115c5d100ce84c7783c88f43dca2c83a05b82a90e306305efc30f429b64f4a38fb9507e934c439ead513ab38f2b8bfc6a423c2a
- SSDEEP 12288:cIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T11E5523D3548955B1FABC003986754428F5882E2DEB5659E3E2483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 8b136b3a2f15fd681f4c4485b8a25f72cb5379a011baa35a225fa9faaf427705
- MD5 5ccf67d45deb1f5252efcb89e178b166
- SHA1 0560693267b373da5c100d376299e5e3c9252dbc
- SHA512 0eaf494cbfecd90d4ebd704f4afb91b5ec0d982e1db74a3b51d19172f12196918b0f48bd64607c445dfd86f73b8dd070b403617970ab8a68f9afd7e7fb7e05ef
- SSDEEP 12288:NMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T11D5523D3548955B1FBBC003986754428F5882E2DEB5659E3E2083D1EA27CFEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 46a7e35146ddfb752b16f00b40ddbf63ee800a0eb7651cada42e24d9620ad159
- MD5 b0898d9b4784f4918cd21a2a8e248c81
- SHA1 e6b980b4240f689127a020b6740b586003f23a7a
- SHA512 a1230b342620de439ca040b76a1342d458636af8b27dcf8c1c5f62361240a1f151e37a5cde97722526e5800ea497019b1d890108dfa2d5c8136ac93296d8cb85
- SSDEEP 24576:5zyb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ULNiXicJFFRGNzj3
- TLSH T11B650257629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 e0512bef0241bd99aa1513a03b4aa00b1bf50c82c0bbb4174d3fde816f95fc41
- MD5 f47e0f1eb006f6aadbd2853bafce2666
- SHA1 5f13df9c5e01c442b40c469cafe2189b41f87163
- SHA512 a3374389942b7c69a26fbf0f6bc5b5236ba2394af78478a632ffed651658e9af09be93dd95ba0b7b469688363df1243b6d8f3cd8028c381f69e814fbedcb0306
- SSDEEP 12288:mIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D45523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 4afeb12c75053bb2262d24c942c5a43030c9470238f3c8fa1237a314669db504
- MD5 31d01554efc5473352eda89851ed38be
- SHA1 6959e21730eba70ab5ee8dd07b6ce0d4d20170f1
- SHA512 ea24f0c6f40ed838bf4fcf4981f29208268a15b44bb774692ca87e052eb8a5f3f4b9aeb8115bcf076973182e48a4d2a44edae0d7dd5e162a2da0ef1991e6d4a6
- SSDEEP 12288:BIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E95523D3548955B1FBFC003986754428F5882E2DEB5659E3E2483D1EA238FEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 f087c4f665747805b32573479c6c4daf259376ec9f6e8a8ad48d18e251485fa0
- MD5 9b98965dfc48d00a4dcc947151267d8b
- SHA1 44ace23f79cb229734ec298663ac60f4f4014718
- SHA512 ba242bf0aac61bc18b203460046777655cc1119262bfe8365114a1571c0366200cf71d25277d15aa75953f9f665fbbc8a24e3cfa634c07de77d017a85d9f734c
- SSDEEP 24576:3zyb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3ULNiXicJFFRGNzj3
- TLSH T11B650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 53750f264495169974e0e499b5d99d92a04b1d8c1e690406d16c5e5fc64bf624
- MD5 c31b3b3f5c0551bd600ad19941a4e758
- SHA1 cc37b1db856559a738fd56d3aa81f88e66d55114
- SHA512 0eb52c14ad51cd8b8a273f02e61327e18158b74e973bdc61c39dc1505c21b99704d25f6c7a883d74595ba90ac23051631f6ea79b69f6a142e6ae72b970c50335
- SSDEEP 24576:cT8aLl3z0zDp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cT7LljsLNiXicJFFRGNzj3
- TLSH T1217502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 7640077cbc5df705fc21ea54719676c0d83fccec50e27887cb5e901ddb664619
- MD5 d537a0523f5c1a216f3e732c21d752f5
- SHA1 37e262373fbdb0d0c55bceec8018e0c11a01bdb5
- SHA512 b697a3c0bdb56766cdba071158e43ce3764f79390588354f82344bc7424883ec32fbf720fb22fb73625958610577331627f9ec66ac68395e7f38cbad909d8ab1
- SSDEEP 24576:63rd9CHKy7GZd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:crd9CHKyaDLNiXicJFFRGNzj3
- TLSH T1CA85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 f59601770e25bdf55419230485bc4d31f67ff2aa4b5ab37f073beb142bba3b46
- MD5 5848620fffea5e26263dcc40131f404a
- SHA1 05786eda22354e5f69fed77d7d5e3619869f9095
- SHA512 164e6899f184c0c5bc34ece7cc13e0058a8d42fdcd22ae6298d6785412becaf07eaa78b773e19cc195c02edd1c1182c2009ffe8c0a14493d97823751f8e2101c
- SSDEEP 12288:b1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C95523D3548955B1FAFC0039C6364428F5881E2DEB5658E3E2483D1EA278FEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 9d4c157ffe0bac7657c81e52ed22f8f3456322e86247c147400d6a6a7b0ba566
- MD5 02b7fef2f1425a648cb1955f5a57a68b
- SHA1 4a4de5c1eabb7d8608d301fefe92cf9bb82a2e7b
- SHA512 9b713bb29cfae6c9c3f0e721119cdc572403f449e6838d43031ebd3786b5f4058fbb906974965c2ac8b5304157d081baed345dc1b4979b1c7ef08967c63a2b0a
- SSDEEP 12288:NPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T12D5523D2558955B1F6BC003986794428F5882E2DEB5619E3E3483D1EA27CFEBCF38076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 bc1272256d2a61a7ed5488387b13483f710a4358621cbd8591bda2e197af9a62
- MD5 a5a9363ba0a39a27856fee6c15b66149
- SHA1 cd4a49ef335c441fb93fd55009e00da932e7b6ac
- SHA512 4ad6181f3fef24abf865630ddc1db0af8c2bb3d47b423a068a02b08ea52fa7fbf6a57057fc6ee19df370c45290eb5d61ee55660850d6fe577b3c0cb97f4b85c1
- SSDEEP 12288:YiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1135523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA23CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 8bdc201df6eab0558fb83d3362ef1eac2d011257668bbb89b50caec56b6b4a0c
- MD5 624a91d6373e711014fa74c37fb350a0
- SHA1 dde031ec48ba251c948d6e4ecca05bfd90e56191
- SHA512 8b2b85c001ff66e58c2d74ba80ad3633ba6f82e6cc698097bb4f9dbd305ffdb6979a11384ed47c3bd424e846a8d8522ad738045d014d51ccd157f9159e15eb26
- SSDEEP 12288:bIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T10E5523D3548955B1FBBC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 bed80f588aacac6c5334bc08b05f9992b22d7305ac359cbd947525dc15da0c79
- MD5 618ac8f1e83977a4c1c79bfc37e99589
- SHA1 78c2b7c0ed52d6c5d5c4c3bfb3234704a30e74f3
- SHA512 0b83e5d7acdef97011138756a7e653a9c526ced4d1cf7141084f577e627daba80491a2bab426b6a880155dd9bd98e928132fca79c1bfe409dbfab221c14d488d
- SSDEEP 12288:r1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E25523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 32fee1d43bfb8716e869056fb695127c9e82c7e34015f9a2ce046c6909a1f9f8
- MD5 da28b74c676e4649720d2a2e1007f99c
- SHA1 a72f1f1148b94c686ae76450f51803a6124eddb6
- SHA512 9955bb382631deaa8ff5e941c0134bb45e20b82e145040efc4e9e4d623a202be6ff2f8b08af466796ac4fff0cdb773e641ed72ae5079882442ed265613f7f39e
- SSDEEP 12288:DgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C15523D3548955B1EBBC0039C6754428F5881E2DEB5659E3E2483E1EA23CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 a8fbaffb45f6ec26a383d267cb36b5fccfe52b7f65ae7c8f38c8471c93dc7dd0
- MD5 f447b856276ade54667fa3f4fb41ae0f
- SHA1 ecd85e71a620224e82fe53c07f0847d5aa3d3978
- SHA512 7752e31c6e8d11b8f7d87032ccbc4e91b762f55da9cb8b9292afd31439e5083a6fa1c28a010c96f584b954eb6df64c2cbf668944a8bc4f31e9e71303411d744b
- SSDEEP 12288:Z2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1135523D3548955B2F6FC003986764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 79c4acb5fb22beffdc7c8225c0142ab16c696fdf25133e3671a64d3e37b6883d
- MD5 9df78b5ec7ddff59f433c572e655e6a8
- SHA1 4ef6aebfd356308472f169124f68bd23b56bb547
- SHA512 7ed659cd23e2e85f4c86c23196b6ae368e40d2970e37a7d36f9a95ed9b3df644a62aa5022e0497f4f6b3b7fd8bcefd7d35b31cf7190dff243542014fefc226b4
- SSDEEP 24576:Vfwvzk9RX6wkyAIG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sMnYIGLNiXicJFFRGNzj3
- TLSH T17685D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 986f2b6c171dbf1d717709d65798fc22133477f640a56b5efc8954f20558056e
- MD5 81898fb3318774e41b0e17ebfc7d8643
- SHA1 798d4da1c0cb68df82269564c2ff5d14558e6457
- SHA512 ce55fe8cd097e518f65f2d16b9710f4d523ff325caca9849096da524558a1c7f23357b0bbb3935c294a28616163bc392e3d69bd993a6d6f5840c90bdeddb89f6
- SSDEEP 49152:IYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VLNiXicJFFRGN:HySzPd7wRGpj3
- TLSH T1E0066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 fc248abba27e27d19717d3b5a35b259f4439323cb282a457e8ba02ab3266746f
- MD5 b8c1bcc426c27f0f93cae059a88a4c2c
- SHA1 3cc0035a18d5f7bbb0179aea88c6dcafd31b2a97
- SHA512 0a82f05735d225b1c0397dcf1e7c31e21ea3dc882208dc6c01a78d8e4308e25d4b95bf621f5ac1594391708a8adb84255d9cd93451f365c14a17dfae4e157e89
- SSDEEP 24576:w47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w47JUQjqirIhCnDHUPfF/lLNiXicJFFS
- TLSH T18465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 deb383cb6d75efa5ac6eb61d1698b77c4c979058af2d5d3698a75e5d41e3a45a
- MD5 4869051e9d22e988ff5d10f15e2f24e3
- SHA1 0870423105d598dd0c17b7ee7e416dcee611220c
- SHA512 d48d0f809d52c89f51478fc25814bd56d101c5473890fcc89ca92537346ee70ed4d93bea8020f8fb437afd912349029072fb929ea53e148829e6963027683c47
- SSDEEP 12288:VpsfYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B565F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 c55800d991ff29428da65a378d2efe48c019806ef147bdda02c3ae665cf9a4a4
- MD5 ff34f6afe8e72df3c712aef900ac1df4
- SHA1 ef5805c4646b17e150c7b48f2ed27a82d1767702
- SHA512 c48e2989a89cfe75c92dce1652f4c3c90d1d8d6fd946459d1e7d29eda98e7aea81a19afadc651ed7f4cccbec95d272ada64e4b8af303b2e6f446eb8bcd091ecc
- SSDEEP 12288:8yphU3fOzouGZR3EiqEfNBB2y1zrf6T9EOMA1cr:8yLUPYaR3DqEF7hzrfk9jZ
- TLSH T1E83518117666CB4FC6A940325E32D2CCAB707D06EE056F0772C9873FD576658BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 8ae2937893c6870aedf2a5ca36723842e0eb0c26c5d27ebb8ca8fbbecb743977
- MD5 c77cfe51630a02827c5ef5d56df29994
- SHA1 5487b3a1be6c9d47ae9453ef21f3329f6edee7b2
- SHA512 d38f36e3defaa716d7fb701c14e7a37bbd01b7f6ec55defd6a0cee1c386f15534fddbe385d57f472a484d973a8c5bb85c36178aa60f0708c927bac770831403b
- SSDEEP 6144:IXw4zdm4X2RsNy556/Ql1mNkDnpzQvEtMxqvEtMxmNjLidiDEbeGilSW5Yc58+Yq:dLskq/YCimEbli1d5nYPzYf
- TLSH T19165F940A136E68FD1BA2032072A5B8CBB64EC17B7055F2673D9493AD877B51B1F93C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 08b5ff02dcafcc82d54220022ad0cb9fdf4cfe5b2665b8ae006c28322db4704f
- MD5 c68c387eb858a58ca77bbd59db6e30ad
- SHA1 3c0c4dd537fe1f62f8ce7d9a3f5c4645c4a635d8
- SHA512 fce9b2b4a757d700f9b07530fadf100b80ebabbc56571e8c8d3e4cc881287f97da674fbc978bf363e6ae5c0c1d8b7eacc3e157c5e98c4d9e67c9d53960f86174
- SSDEEP 12288:IF7wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:si/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C85523A3528959A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 dd572d335b248e3cd97bb89dba5edd4e0fbd8d8cd19e1432012f3f6f3e499593
- MD5 fe9a3caf2d919c99571d7eb9a7738b2f
- SHA1 073e93ef57b38b4b94123a44500141524ae3dfb4
- SHA512 b4d079382cd654bcc4926c212a2c988d1496a5a1e5890219a5962a8c12dcbcd3d0499b32192e0dac15d1642c0e30a1168a74f3533a44df2dbb52638d50478c0a
- SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1gb4mBIBhGFfLNiXicJFFRGNzj3
- TLSH T1D265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 f2f0b348671299e6f4ea0396959fb8c822649b8c10a58353619c59acfb3137b8
- MD5 0fb032669b75e8e598d44e7ec85b90ec
- SHA1 efdbfe9fa0677663157b263e060c959ec9fdf0cd
- SHA512 184cbaba7fd87ad9a25fabc464063c2613420a476ae744b7b380444fb5fa9f6cec9823b4b0387f4cfd4dea83caadec48214f8c887fb2da3b0fa5b2c4cb0afb6b
- SSDEEP 24576:UG88u8FpJqH1vzria7/mP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n7ZFPqVya7/ELNiXicJFFRGNzj3
- TLSH T1F685F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 035dae1c3814660ea8334d21e70ab74c92026f232853e8a8f77f9f08ee6875d5
- MD5 d293ad7c8b6e969cff37df004c5bf113
- SHA1 288f8e12f730d4893d6cb044898c8fb8910cb07a
- SHA512 2aa67ec6e58cf28457bda0f57d22db3b0e12c2c7363e8cc8999235f929228e5414c67ef37d67dbafdde12820d43685db093866c6122d5df4931643847432998a
- SSDEEP 24576:NPUr+NQD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NJQDLNiXicJFFRGNzj3
- TLSH T19665F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 8ebd4e2788333855d87ac25cdb11c58aa1eff852a7e4ca2ec11d6864991e032b
- MD5 c3161d259fb18614cd1a8421d2ac49bb
- SHA1 4f29feb1dacc8aa7e08dfdcf2d587471dbab7d51
- SHA512 6ffc162abb8f1160094b37b6ca2dbf66981f3b661245c0cc9342c334973872d2a39996a5024b0b1141729edeefd8c38cf9d54257c4f56fe539ecd9e660d975a6
- SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzLNiXicJFFRGNzj3:lG05lO43b+7wRGpj3
- TLSH T17DD5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 89f6452c7d0b3a75461ac6958e35d555a006cb09f4245097155354b47464a38c
- MD5 1878be2f0c90a62d45911c6f3dcdf59d
- SHA1 bc1ba6b91c98ff0081013a08ff6126728fc5504d
- SHA512 346286cdbad838e50bbcb2e1104584ebf8c06e58b1fd1ae58493c83e0b40cc09b9f7f8810e1be4698facb8e5847e38bde586afe6a78f9eab5e4716c73b07ff10
- SSDEEP 24576:pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnV/TwSfVcYG3K/cJHlnFR+IGNe8jg:5a5POZ3lJt2pasx2+m7LNiXicJFFRGNf
- TLSH T13465BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 bc3bb050d2dbf5268deb5cea6df5c397a7bed2e3b6d18bdf36e9dbe7089ad63f
- MD5 577f3d4e3e1179e05eb1a121893ce0d3
- SHA1 f321c23810093c30a433e279c50d413a3fdcd482
- SHA512 0a9e63a046366171c667236f779b87697c3ed9931ee9ce93b129f5efd9f994e9ac50c11e878373106cd7917d9e4870feea63771352521b4aa309a33af6a42a70
- SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fk3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PNc/zEOVHFkLNiXicJFFRGNzj3
- TLSH T145858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 14b7ddb9c1ada05a2ee8fbaf906bbdf76af53b25e43ed8afb34e314615e669e9
- MD5 59afa784cd6e2264ea0f1a0190c9c03d
- SHA1 d208d7b9d936aa8c40e366fc2d542b2a03038e56
- SHA512 9f8a7f94b6c3c8528bff9f4ab35a1567ed53a0819d30a10ca17c87f8ad008870a2129ced1c27a016afbf93c7eb9414cd92a76e05d09e68312eb76c84dfd03ffa
- SSDEEP 24576:FzkNvNnaFeYhJNtmZBmh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FzMwBtOmhLNiXicJFFRGNzj3
- TLSH T1DE55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 c629363fe122d0e0a68b25c3982b57d858d945643d5cdcb3465d19628cdf8ab2
- MD5 48734de1cbb5e571ceebf87c2ccc4bce
- SHA1 1c165695a9966fda67c24a86e0bba1fa0f820df1
- SHA512 a469c2be8fe4e748a408734cbd37689d9672542c4572d0800f770c2a88b483f740abb054c3a9156e40e52b8f8d6f90bbf98bfbf94c2e47253906625dcb691860
- SSDEEP 24576:CD3FHshBIYQgAO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CDVHeBIAAOLNiXicJFFRGNzj3
- TLSH T12775E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH