Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 4.1MB
- Sample261001-vbwj5agf27
- SHA256 befb6231d3dbef6bd963ead08d014f793e0663703f4d6d74f6cd9f0d8a645e30
- MD5 2d88c74beade40c7d36faa93aca02527
- SHA1 67ada1a145ca02bd729c47df3e42460df62f0144
- SHA512 4fccf1a2e202e612c77efd2050fed1612f2c3059380ca794ae8e510def1146aa74dd3cd2e68a3daae7e6c5cc7d47fc0164eed4e6fe4367be2f4dcfc980f89eea
- SSDEEP 49152:+TAtjNPJxkkevJKGUJO0xQF1Aae2yDJfEccfuDoUIMuT3j4DYf5zaCpXxPuR6E92:nH2adMmUGoDw/z
- TLSH T16F166B07A6B940F9C0BBD1798A569617FAB2780A873197CB4791475B1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/4596-49-0x0000000140000000-0x000000014042A000-memory.dmp family_stealc_v3 - Executes dropped EXE 11 IoCs
pid Process 4828 elevation_service.exe 1436 elevation_service.exe 2636 maintenanceservice.exe 4748 OSE.EXE 5680 PerceptionSimulationService.exe 1756 perfhost.exe 3652 ReFsDedupSvc.exe 3704 SensorDataService.exe 2596 ssh-agent.exe 2936 AgentService.exe 3504 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2b11c989f1788cf2.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca5e6ae1c451dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e62ce8dec451dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000873967dfc451dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a39f9ddc451dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4828 elevation_service.exe 4828 elevation_service.exe 4828 elevation_service.exe 4828 elevation_service.exe 4828 elevation_service.exe 4828 elevation_service.exe 4828 elevation_service.exe 1436 elevation_service.exe 1436 elevation_service.exe 1436 elevation_service.exe 1436 elevation_service.exe 1436 elevation_service.exe 1436 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 832 Process not Found 832 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4596 2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeTakeOwnershipPrivilege 4828 elevation_service.exe Token: SeBackupPrivilege 3652 ReFsDedupSvc.exe Token: SeRestorePrivilege 3652 ReFsDedupSvc.exe Token: SeBackupPrivilege 3652 ReFsDedupSvc.exe Token: SeRestorePrivilege 3652 ReFsDedupSvc.exe Token: SeBackupPrivilege 3652 ReFsDedupSvc.exe Token: SeRestorePrivilege 3652 ReFsDedupSvc.exe Token: SeBackupPrivilege 3652 ReFsDedupSvc.exe Token: SeRestorePrivilege 3652 ReFsDedupSvc.exe Token: SeBackupPrivilege 3652 ReFsDedupSvc.exe Token: SeRestorePrivilege 3652 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2936 AgentService.exe Token: 33 3504 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3504 SearchIndexer.exe Token: SeDebugPrivilege 4828 elevation_service.exe Token: SeDebugPrivilege 1436 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3504 wrote to memory of 5020 3504 SearchIndexer.exe 100 PID 3504 wrote to memory of 3872 3504 SearchIndexer.exe 101 PID 3504 wrote to memory of 872 3504 SearchIndexer.exe 102 PID 3504 wrote to memory of 5840 3504 SearchIndexer.exe 103 PID 3504 wrote to memory of 3084 3504 SearchIndexer.exe 105 PID 3504 wrote to memory of 5464 3504 SearchIndexer.exe 106 PID 3504 wrote to memory of 1180 3504 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_2d88c74beade40c7d36faa93aca02527_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2636
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4748
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5680
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3704
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2596
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5020
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3872
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:872
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5840
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3084
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5464
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1180
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 73e2d8ab1962abe26de40e488a3a7713f46d3c2ddd73f51b7c1d5d432f2a8218
- MD5 208fee7ac0e26ef4da8552db7278b882
- SHA1 fa805e6a049bc3836bf218845123bc3456064dea
- SHA512 8368276b0f55077a09dc670866cf21283687c264f65b56c3eb48c7a87e1dd2c4660041db9c204d208549cbe4ce036aec17a788f8e19bb47550e4e19ec5e5f8f6
- SSDEEP 49152:hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHDYf5zaCpXxPuR6E9dA:n3q6sjBOoDw/z
- TLSH T1F7D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 e96f6738452292151e459858814e3412666923c762752ade390c3bb2bd649bbd
- MD5 7ca062108c70097a42aee677b4c39d8b
- SHA1 88cdde100d661439d6dbe5c60130d3c4b3455353
- SHA512 d15587426062ab3e9e29b56832160daf6780e0c8f48643d963d373d0c947191f116a04cec16cd15bfe0e0ee04575bd3e45a758542f34bfd2f0d7c37625e843a5
- SSDEEP 24576:5XYfDtczAE0Djsf9nz4mloFQnpXUMPQDR6q79dA:8tcuDYf5zaCpXxPuR6E9dA
- TLSH T10875F129A79404F9EC77423CC8A2C511E672BC5147A0FB9B03E499665F333C95E3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 8462e9838c74a359297e54fbf494ef7b87fbeee4de0011cca56d264e737eb369
- MD5 3f6bdf29b4b66aa31a671f10da468e3c
- SHA1 963160ac39b7a971deb9ee9dad535288b4344397
- SHA512 8d19cc0c7506dde66655dc9c1b98839e3584a3a116e37d880819c67d57aa6cde6066e70bf9a682ccf1f70f6e997a73cf98882bd134092dc51651a4d6d6b99b33
- SSDEEP 24576:X0Le5ji0hmxxrMH0Djsf9nz4mloFQnpXUMPQDR6q79dA:XPji0AjlDYf5zaCpXxPuR6E9dA
- TLSH T11985AE16F6748331D073C0B9C5D2A69EE97130825B308ACB5286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 62dd3934ea562c2bfac138254d21083b0c1b54f19371401632f4c0e9b55c520b
- MD5 7c7d742301a7239cfbae2d2ec9b28350
- SHA1 2c75d30675af3f01ad964fe9fe15161ee3a050fe
- SHA512 aa12d325e6b978c0a580795f867cc386aa20692eb04e60fb909be647b376cd44e80c7d258deb27f1d3dd634ab4c3d4130648a3a6495204ae0ab6de41840a65c7
- SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyuZ0Djsf9nz4mloFQnpXUMPQDR6q79dA:W/ezSC6vUzPveHjypDYf5zaCpXxPuR67
- TLSH T157756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 5a2401749293f66124d104c97e242cf80def48ecb907ccdae08ac7bff324afc1
- MD5 97622e7d6c504ad2666f10e507082de4
- SHA1 1ef99041a0bba87dbaad2bd87de7961728236dc3
- SHA512 a7bd708326fdcdc5ee683c6fc2e4986257b533f294ae140474b0008f9ecaaa56a7f9baa83244c3843252c39c13941b833b3fdd468a95da614e2d8c25b0022ff6
- SSDEEP 24576:EVbqPb88hv/l+Yg0Djsf9nz4mloFQnpXUMPQDR6q79dA:EVO88hXl+GDYf5zaCpXxPuR6E9dA
- TLSH T1D8559E66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C2E777D6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 761e37290d412b9a12b190d064c959201e3bbeee82e0f945ef3fb6df32af0b56
- MD5 9ac0e39bc1cbcbb89fb92e93da3bfbfc
- SHA1 2de92a32f2441d14610ac0625398f0c0d1112cbd
- SHA512 ae3c85c7a442a042c8cd4f64a086800df701e8697d40d383b692b6da3213060faf982d6e93678661f908c62ac4b3fa936ef84f315b45579f99a343570c601502
- SSDEEP 24576:+Lj0Djsf9nz4mloFQnpXUMPQDR6q79dA:zDYf5zaCpXxPuR6E9dA
- TLSH T11655238ECF0910F2D4722F3C28B1E225D7D4BE207D953E6A77A1E68A8C7574BC4A5583
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 495f9b1b5ae939c2a7624f8d06f1d0bbc0145e2345a20825d3406bac77044c0d
- MD5 0722db30e8359f6b08bb50bd9ede25b1
- SHA1 ce5a5e219d1699b309d2f271284f700a83bf5365
- SHA512 ca8b8e337b674865ed0e37df42a407aff05667688f65953da44c818962c8a0d317304f04c61f3768ea4c6532488d175ef2c3bdf07f41c368b4a95c684e9e16bf
- SSDEEP 24576:wJIUY0Djsf9nz4mloFQnpXUMPQDR6q79dA:wJIUbDYf5zaCpXxPuR6E9dA
- TLSH T12B75BF7BEE28FCE2C27A5D785A91C200D7A278304F62A3CBE165C20EDE236D55D79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 893da88ecea44d33e6213314cfd6dba9d86110df36a0d9d281bd868fb186907d
- MD5 02e95a2e73739c4df68a60ed87ff5cb8
- SHA1 6f49c9ed76efd8f033ef64831068f7522bbf81d9
- SHA512 23b4b54f22fab12372cd780f7ecb380bde22ddf6f80f60a1a286cdc5def345c531abc90cd3da568c47a9271a69c928dfe49992979b0079fb451a824bb0b8696f
- SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:VQvGAdlCEL8c/DRNw5CgoDw/z
- TLSH T144266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 a7ba3b7eb40c2aa6977286ddeaaebb39aa58f3a7b8ec08e02c887964fd734a23
- MD5 b5e7617d391b3f179bf7d8d695c89295
- SHA1 074529a035cb27f09eb3265a264dac9a2055e1b1
- SHA512 8a8773735d0cf333878cab78188ebc521bd64bdf002a140a3b2d65c99318cb0e69c959508827ac13fa3a1e909181354932f70624bed9c123e2abd463bce23e19
- SSDEEP 24576:U0ewsAjq0Djsf9nz4mloFQnpXUMPQDR6q79dA:Jlj1DYf5zaCpXxPuR6E9dA
- TLSH T1C875E031FE74E036C67B0DB51B36D716546CB9204FA12AC3F3E88A9E59702C26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 4545e2c590487efe36f1d1d4c327e2971437ce543dc73d4b4ecf552ac9c1d566
- MD5 0fa0c0e28de009ed6b4b906ad41b6e0d
- SHA1 8d1f17af3f023fab7c4fb61e861341e9b4bdcee4
- SHA512 998251404d7eae2f0f106e3690a53b03c1a032d57f4475077e728bcd6a334ca5705a0b72aaa5b68564280b68147f6dad3e81f9e2d256d4a04cdf40e271ab06ff
- SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiA:iUEtQevvqc2W1cpV2tI32i
- TLSH T124474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 d2c01e3edf4840e989a2d217aaeb169e5e1a89a81b301e0ff4fee15a79c22713
- MD5 feecbd7131b6d1a3331c3f87a3e18f53
- SHA1 d20654e949ca7e74792ca2fc3315dbe7669048cd
- SHA512 3b06e0de4d99662300405b8f1edfa8928f8d4316dca0d818dd8bcabc46731ebc422fda30fd96be65055f982e57cc3990c08da6b9e49f7392f186f4a92ad93cca
- SSDEEP 49152:QCbRquA/m2yL5zLfFiV+XenmE3/zVDYf5zaCpXxPuR6E9dA:5oq2Vjnm8oDw/z
- TLSH T1EBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33BD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b5690e9e97062dd29317e5fd3bcdbd39327799c597714b5459e1a41fcaa9f893
- MD5 b3652c9a80ab88b337a1d0d5442f763c
- SHA1 bd010400028c85c2352874778f488ca15c884137
- SHA512 677ac86fa288e9a3301180f4df60b1f1d9ab83a4cd7db7f09b0c593e4880c38ebcabf448785f4d826807d1d02a5d10c135f1e9586b3d2b86d25241f533496139
- SSDEEP 24576:oAhGL3IFoiwtA5l7S53t0Djsf9nz4mloFQnpXUMPQDR6q79dA:oAMUFoiq5yDYf5zaCpXxPuR6E9dA
- TLSH T1E2359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 01144c46211a667ffccc217aec74d847ad725aacb3ebc9bfda8617ab590b635a
- MD5 6b0da21a6b97c88193193824c74a76af
- SHA1 faa051b289510578228ea84bc31ad6fe4023f860
- SHA512 d5b5447c7bb1a06975332dcaec7ffe0f3ae4d9707ff6ea0a3d13fbd5e972d4d35fa5005252a49df3bbafc2646882e19d535b041c70c2fc98661a52c31c076b6e
- SSDEEP 24576:9wu4OW+0Djsf9nz4mloFQnpXUMPQDR6q79dA:9wvO2DYf5zaCpXxPuR6E9dA
- TLSH T1CE65F14A7B9408F9E97356388597C136E7F2BC112A21EB2F17A0C65B5F33351AD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 2febe919715a88918d4d5d134b3772ea900c30e6f0f5f59f49b18af2d32b6285
- MD5 50bcfca3310249290c86a6349488e2f8
- SHA1 9a1291b9558c0798f80151cb2a80b44e4d6d7efb
- SHA512 c785bab779c816fca32a12c7e1f2e03a35ef3be7209d12c0335fd8dea8db74c8b98d8ee6685ca110c468b69c333940279dead005645098f434715ebd52fc6c94
- SSDEEP 24576:HZuf0Djsf9nz4mloFQnpXUMPQDR6q79dA:VDYf5zaCpXxPuR6E9dA
- TLSH T11555128E6B9420F6D0B31A3C98F19215D3B17C227B7127DF2660829A5F73BC65D39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 9736e4ad4bd15d5f2a227e791ed41cba5cf4634cd353d9ca993fbe8d0f119cdb
- MD5 aaf31a47d46f89b6ef90573e4f4b8b0c
- SHA1 815efeb8383ebfc0fae25bc2e0321338026517f5
- SHA512 62ae555108390d24023772fc93e188041fb3de7d773d1739576b4450a0578f566bcf423a5bf995560bb394d512189f91cddb8374ae1fb6d50d759f883fd5ca66
- SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:7QRQyi36YOcPbLvw2gAf+PN3roDw/z
- TLSH T13E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 4bb5a069b0254eec46a74a116f391f8d816eedaba087e447192c9a3326bc7e20
- MD5 f799178e6bfa692795519d9785946da7
- SHA1 282841f68b86554a78e9403d29c1a5c8da73b1a0
- SHA512 68dcc9713518a7dbc1e2548ea2a5c08b9ad52dd64aa512e52791bbfd0b84485c770bf9df5c5cf3abb0fb12d62fea47a68c166d2e6b7747b274383bd9be57b060
- SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:UQRQyi36YOcPbLvw2gAf+PN3roDw/z
- TLSH T160667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 e4dfee4d157e7ab582549c379cdc4fcb42bc7025f40dc0dd6ecc31cec646e698
- MD5 933e1eb7ac0452f13143982da1105450
- SHA1 edde7714a1d4620b67e9f2381dfa3d097a3e9a98
- SHA512 5853152620d02c7c3311a0a3cb1ae5c3822bdeaa7aff642f56a6d61acdb922d1422a325614516a0a7a5847813743d1430a51a1e8aaabe190b53b06888e0ca46e
- SSDEEP 49152:P68Qg55nhceWu7PNU3/lDYf5zaCpXxPuR6E9dA:JthLRc/toDw/z
- TLSH T150B54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 bce0c1e0e0cbcb702f5a2450b55ef0b5a0e7a0889e76dbf72240fdcb98a8fa2a
- MD5 65669d3289450e14dea7276692d7c1ab
- SHA1 662a63d7c54198ae40786bbff02851ad7069d292
- SHA512 3b79d460ddea17ec6a1804ec65bb800187f8559a4e714fb6cb34eed7ba4302e7f6db127ec6bc5e2ca1d4be9120495e46854d5997f974ac2ec999daecf8350043
- SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99y:Iy5112gYy5azzVvt69nLKnhZOoDw/z
- TLSH T151167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e8ff446bbfa829bbbd49ac82c1f9b31874764c650ad79baa885bf622ca3303c2
- MD5 653daec54821b8aa58abf8e624f3947c
- SHA1 bd95a1cbe894b1df5a09c5ff2fb6e13ef1d62a3f
- SHA512 ba08895be0412e7bb300e711c649291b33d3d640b8c01c5b1503ca0480b76183fc6b13a46a855ffc5f143f967df06d93fafb1bea2e74db789d684349e2e4e7b9
- SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8DYf5zaCpXxPuR6E9dA:zu6Jmdxd2dyoDw/z
- TLSH T195D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 b5d97e1ae4b11b45052daf62f3ce16d48f4a19b816deca36d977e544fe850ce9
- MD5 ee9bec948d2598cf8db39c75f5700617
- SHA1 cf5b6eea662ba98ec3e096123ad3ecec1e2ece6a
- SHA512 f788961a66f72bf69c52b4a52cc33f96c3c7558bc9cfa8030f68b2b336db334abdaac974be9f26457995efc96acc6b991b8deaf8135e0cf3fc754091134bac94
- SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4x7DYf5zaCpXxPuR6E9dA:FmifPWR8oDw/z
- TLSH T1E4B5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 837c7732bd01dbce43e20fbebff6e9368d877d5dc4a57783920c4ac250e5bc66
- MD5 d628b30ca408a25a5f0a777f8e7530d0
- SHA1 18f4ce8dcde081c0f61d6c20b2725463cdefaa9b
- SHA512 4e058ee2388256e545a9399132795e741f706b609ba8039e5b193b0575cfd65d9c22e92cb52a35bbafc25b54a7b6bff260542e725104dd853d8dcf046fb9733f
- SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqsDYf5zaCpXxPuR6E9dA:H5dKii61ioDw/z
- TLSH T18DC5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 abf7793f2c8719f635426afdf397d100cb902c8ffecaa217898fa0354ba97580
- MD5 6795a22e7b07ac3a7a57ebfa427532eb
- SHA1 4ccb7268bfae03c0dd20b9c6bb3cabe07fc428af
- SHA512 675d6ad23f1d0595849e5cd24d5b2d89ec3a625d77a9551e0d9ace1e190b0a1aee915b12dd1e12b94d8b7da9e01c6604d12a4f2eca98671ff929eccb1ffe10ee
- SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wHDYf5zaCpXxPuR6E9dA:TX2imphYoDw/z
- TLSH T12795BE13F2D900E8D06ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 ceef70815a93cd9f4c5488c72b06d11c6d2ab8891b7c20388b4d9b361a8fd5d3
- MD5 1cd1ef205d274449024821cc6c8a66e6
- SHA1 b2f5feb9e42b363af0611235d4d73c2e60734081
- SHA512 d8ca17ea32eb59e2352bcfa92a5d33921355ee4b070811068bd4097d9bf406b439fe9c7c492fa4da46b128f65cce676b0ce57e1e182773c82c7f9e06bc34f5bb
- SSDEEP 12288:2bOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjf:2b0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T12455238EDF0911F6D4312F3C28B1D324D2D87E21BED23ABA77A1D14ADDB578B4065886
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 d2663e9eff4d28b66e0d7cae639c80f235228f818f6a261b43d7fd57902611fc
- MD5 8689cd19c1f3a50d4040b7930af5a7d2
- SHA1 d1703589ce4deea6f88c668fd05074daec3557c1
- SHA512 01d255a256d38c955825a5e8778662027475f0a96d7ced08a604faaf8ded3d09ff829d46722f40fdbdf15a780090efa63e6b85a6ab173ad77149211a4c609557
- SSDEEP 12288:jGOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj3:jG0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T13E55238EDF0911F6D4312F3C28B1D324D2D4BE21BED23ABA77A1D14ADDB578B4065886
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 f9c99d1502f5a8a9f51b8c8da9aadd3bb595795667ffcfff35e555a83240a01b
- MD5 798330ea3aa24793ce2ea384a7b6a7db
- SHA1 37008f932ea3ea42e82d5900ef6f3fa374011339
- SHA512 e9371e886a075eb1feeffae1ed4426b60b462cf82d8523d21a3aba499018a8379f23e7924835391070b7ea07a17a3b00e1cac71a860924c6c7556359d806c0d0
- SSDEEP 12288:1QOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj3:1Q0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1AC55238EDF0911F6D4312F3C28A1D324D2D4BE21BED23ABAB7A1D14ADDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 bc975bcf271c820ce31121760001981b9ee3527747ec3d737218f243d9042923
- MD5 1c80a27f996f0892fe0c90f7da2b71c2
- SHA1 526824bf531ba92cafdeea75c175c8a0aa42210c
- SHA512 dc64d2073de89ee0707f85375c2027cf82e83a6e92f4b7e6a59c73da26bcfc014f4c72906fd61a1ec70d995a7cdb0b4e5076de9f31c6e00c15a2f05ccaaebc99
- SSDEEP 12288:uVNOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjU:q0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1F655234ADF0901F6D4726F3C58B1D225D3E4BD20BFB23BAFB750854A8D7178A9474A82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 1fe972ec5e6d2690f33146c0615f8788149296b8383d86035685fc12426f60ca
- MD5 107b21fe0275e54775a5ccfe4bb870c4
- SHA1 6f007a5973741da7d2fbd55006c3f85f1cdf3e5d
- SHA512 5a04c510dd7346111bf41e6c238e6d5050e8a68131ba5f2b4739dfe3797f5ccd01030cbbf3babac00fdd90001fdf4b697df563600cbea1d43646545b42fa6985
- SSDEEP 12288:c1OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjS:c10Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1DA55238EDF0911F6D4312F3C28A1D324D2D47E21BED23ABAB7A1D14ADDB578B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 eb6ab7172e2c43fda59a0dbe4809938ae6757d2f6b505240a2bcb93d86c231c5
- MD5 17096ef1f332c71d1e8a841575a8b193
- SHA1 7332b26d14e8b46f39b95e88211d7938dd1a79ad
- SHA512 071213234f7564f54441bb02ad9ab5483c54cfc3c15c0f3513d1e8d1e23c5c5da7d29a14c56f54d1b98c1594538c73a2e5462f06b0c2c95d8b86e9c656b487cf
- SSDEEP 12288:vCOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjS:vC0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T17155238EDF0911F6D4312F3C28B1D324D2D4BE21BED23ABA77A1D14ADDB574B4065886
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 5cbf95253758e0537cb768b9776a484b8b35330a16248118155770c23b7143d2
- MD5 cdcf843c5a86d8a62a4291501fd197b6
- SHA1 1f8550ef2af9da81736eadbb43f047e75db04822
- SHA512 7682da4b615419f7f8e8cb0bb8bf0b7c4ff2c558594ad24307c174fb9c8c7c13fc713c361859720bb55983c642117f778a5076828323792186d627c4793ff3db
- SSDEEP 12288:PuOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjY:Pu0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1D455238EDF0911F6D4312F3C28A1D324C2D4BE21BED53A7AB7A1D14ADDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 b061ced17b66d1ac70bd2aa16b4840173287124cb1df96285122577046e9de08
- MD5 0dbba9b19250dc758d49a4700f40b491
- SHA1 f2c06834cd1d42f5ac39c61ffa8adadd2bd2a0c2
- SHA512 cda8f17a4a6d4620bbfaaaad155e18376855a2b990f9dff9afef56145d84fbb88669da9398ac0b110b1c335a8c53d5d735aae88accb3dcf1d50de7dae71d0077
- SSDEEP 24576:wZMRzFVSOm0Djsf9nz4mloFQnpXUMPQDR6q79dA:wZMRzf9DYf5zaCpXxPuR6E9dA
- TLSH T10C75F199B75018F8EC73463D88618916D2F27C261BA0DA1F13E4366B5F733921C3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 858d65110ba3d1e7491a1f777ccb8f508b0e11239a274442dc2d5b7f053e7e0a
- MD5 02fbdf0a1f47dd2736bc6454ddc81ea2
- SHA1 2bf1eeee6541ff902979ea41a0ff72f8cea8874e
- SHA512 97599208e222476bf153f9acdce1fce8684eff3c4dc98ec334a7f150e5e2c5cc8fbaafe3e6be563e44f91e2cd444a3fcafda47ac34161bf8abff20c077d9f567
- SSDEEP 12288:XvOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:Xv0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T19955238EDF0911F6D4312F3C28A1D324C2D8BE21BED23ABAB7A5D14ADD7574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 19d5f1bf70c7004eed2d8b04f106248a176220c66da5a255be6b0e27a080b20a
- MD5 5be3dd362947fc28b69a8aba78a60565
- SHA1 5e4ea9d49d4a1e424c9aa0f1bc56ba9af72735b3
- SHA512 9a5f62cc3b5c4c94e1aa6d99941da5ed0cd113848b37ed339ee47f9f27b6e3dafeaa7a3b00548091830cb9b1bf6b33eb043debd78211de278976d9820c0c0baf
- SSDEEP 12288:EzOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj7:Ez0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T11D55238EDF0911F6D4312F3C28A1D324C2D8BE21BED23BBA77A5D14ADDB574B4065886
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 52156f693bc0a7b29aed8ae163d137d4c89f0530316dcebff7c45d8f96f99ad4
- MD5 fe2da6172f20b364b21e1baf29de6057
- SHA1 c06928918398960dfa8590a5913872fbe0617838
- SHA512 50943e85c788d92bba9fecd344cef61a75c5023adfe3647310a93c8138e82a739a8d25b411fb462600fc01342b20fc452d2cf82455dea86b4b350528d3f56a55
- SSDEEP 24576:Nzy60Djsf9nz4mloFQnpXUMPQDR6q79dA:NWDYf5zaCpXxPuR6E9dA
- TLSH T11965024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 dbbeff5a72e6e2e8e29e4ce41877d182fcddcd73283e91bcef8cd641c55f7638
- MD5 ed85afeb152f640e89327f5efc18e167
- SHA1 f1eb9ede38d85c9fb94f05a55d029d3932884c77
- SHA512 c56568aa6c933de144bd8b3299aa367e4f3fa217c8b58a8c67d722030ff4495a043e2c2e398b1316e0aa1317d5bca66c80c996cf55c98e5db246d9994d49ad10
- SSDEEP 12288:ZvOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjm:Zv0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T13855238EDF0911F6D4312F3C28A1D324C2D8BE21BED23ABAB7A5D149DDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 32ffce561b68ba79c40008fd3773208e28dac24a48f5344bdaf0bba0a0db0aca
- MD5 381c5f783f9c15341af35f828852259c
- SHA1 4845abd9208c7b3cd30e1ffaec8ab3bb629e16cc
- SHA512 afefe1436b349bf1e8f5fefb05762313d891a606829623d83fe6b5dd05cd662ba9c87e62ab3d867d0ee799fcf55e8f254993221d87b5d061b9f9925c6bb880e8
- SSDEEP 12288:+vOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjm:+v0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T12055238EDF0911F6D4312F3C28A1D324D2D8BE21BED23ABAB7A1D149DDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 0fd7fafce34e53f54b4440f8e4cafafce01ac9af28d03d0f879303486bf6cb3b
- MD5 8c4651ef2fd10fcc800a707728280021
- SHA1 3bc405c9436627a8e358cdc5bf29625527656307
- SHA512 b3fa8cdf93f7eeefb0077a2cb9eb94a9e5a0c84bc3cfa6c2eca72ca4c6658cd1dcacac28e424542ac7ee2c414d23e179604c4d759fec9d856c7a1392a361d855
- SSDEEP 24576:3zy60Djsf9nz4mloFQnpXUMPQDR6q79dA:3WDYf5zaCpXxPuR6E9dA
- TLSH T10A65024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 fddf3296f127e3a7c5d88f72c9590817ba08cb9e5610445489fc1d98985fd0b2
- MD5 2c5657db6a9c300824cc2ed57089db52
- SHA1 aa53c68354fe4d23177fabd11ce84042c10fa446
- SHA512 84890d412a867a0271172c1ad549c296eeb2aa16a1d9be34eb81bbfe11eeb14b2eace7b5fac81d054d42cfb7c734d4bf2a36dd45b5a46738a5a03b89f1fefbbd
- SSDEEP 24576:qTDaLl3z0zDA0Djsf9nz4mloFQnpXUMPQDR6q79dA:qTuLlj+DYf5zaCpXxPuR6E9dA
- TLSH T1E975F199B75018F8EC73463D88618A16D2F27C261BB0DA1F13A4366B5F333915C3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 a124bbf5fa55fb9343afd0da4076c85a2ea0a21eb1c8ed367164028bf5dda04c
- MD5 2eebcbce284ba27a44d695c2a0435e91
- SHA1 f89423521406fdf6d6e264874adfa8bd78c68c06
- SHA512 70d20a782df71bc6a0fcc451e0679af923fc45b71155a49a37257036578077adf2c530b590458197c6cf60b91d8c4bbd661e4bc4bb1007eceb01cb17912de593
- SSDEEP 24576:P3vd9CHKy7GZ80Djsf9nz4mloFQnpXUMPQDR6q79dA:fvd9CHKya9DYf5zaCpXxPuR6E9dA
- TLSH T14085CF90F7E410E8F0B39A3988729511DAB67C591B71DE8F13A4661A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 2187d475933c1529f207f8ada5156de10c651eb2c7f15df92b4dcf07df28619b
- MD5 55a468c8a9366db49e6cf10f28d58d2b
- SHA1 0b17a34bea2e6058076be4d69a286de5025bdad2
- SHA512 f0428c7811a1d5b6809f78d872082f33ce14c4d60968921309de4430ff7b194e5606f2abf01cfa08b3332214bb7e29d7adfc0bab496b8187a053bb0f2d34ea7e
- SSDEEP 12288:3wOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjX:3w0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1D255238EDF0911F6D4312F3C28A1D324D2D87E21BED23ABAB7A1D14ADDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 0f87dbafb0f1a4f5a7e193161bfb59298c3c82abe48beb3b71c8b2e614b7f86c
- MD5 b3e6660163800718536ac51e95a386ed
- SHA1 dce5860eee24c5b985458a391927586e4325e20d
- SHA512 25a93c9f01822fd56f5159e51796290472659b6b81dd91ef67dc7ce5ad21ac67ac1234d4ab400c9a83517929bec8d1f3077ecb688d26548fb25f6595e1d7733e
- SSDEEP 12288:CaOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjT:Ca0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1C355238EDF0911F6E4312F3C28B1D324D2D47E21BEE23ABA77A1D146CDB574B8465886
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 da09751e5799de53c32b0067cbd5376e1dd351c421428f36abaa9669d45a920b
- MD5 0f9dc5e16d46f694052fb6e723e96bbc
- SHA1 69675674cb447dde7c5fb8d63a688e365fd53f29
- SHA512 e4b00c1b436ba99e07e9509a8d371a3a95d49674dff57ec06808b63644298bcdf380c925a2a0e3ac31d0f970228fee606aa11a82a2dc7c6b21868f6ffcf1d159
- SSDEEP 12288:mhOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjl:mh0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T17F55238EDF0911F6D4312F3C18A1D324D2D8BE21BED23ABAB7A1D14ADDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 b63b52a0af383f6708be9e73727d48e855af2718997650fb0372c4df5e9cf3ef
- MD5 ddf676e4e36bf6ac83d5f9733e95966e
- SHA1 c35d4a47f645c40c164308bbe6f990bf838aeb48
- SHA512 3785cc73632f066606f4d3bd7563dd17dbbf62794c75357497992abd874451377b4af3a3572acf5f716b4275a29a985432b3aa67136b06a845e143ebb2b1defe
- SSDEEP 12288:8vOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj1:8v0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1C755238EDF0911F6D4312F3C28A1D324C2D8BE21BED23ABAB7A5D149DDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 f2c51e8230fdbb5bd750291161fff53cc7194d7e15e0f50919f68fcc44d301a4
- MD5 346be6a5a96ffad094606022fea35981
- SHA1 142ab50f3a3ceaca4f35dc2148ac8277e76c393a
- SHA512 de6e9167e3f023f96c9cc684dad6059c3c4c6b9097da48e51ff1bc9fe8855788bc1a9d6832b2d268b4b4286a2108450a5baebc7c06fb860a3d71551ac50a08dd
- SSDEEP 12288:XwOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjN:Xw0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T1E355238EDF0911F6D4312F3C28A1D324D2D47E21BED23ABAB7A1D14ADDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 1c051da128159c965998c38445aa4ee86b0a070d8b65b1827a7fc2de5f323886
- MD5 4e4c0d9ebba939de1c09a11294cc14df
- SHA1 33b9112ecd83fd8f1f2dea21c4e03ca073a3aa5b
- SHA512 999884013a4e19a6c70858502fea262e848eba96112fbf665effa140b64ad821cf5c1007cd13ef6418263c3b446497ce59e272f1c6a30450641ee40c2e20b63f
- SSDEEP 12288:H3OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjh:H30Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T14C55238EDF0911F6D4312F3C28A1D324C6D87E21BED23BBA77A1D14ADD7574B4065886
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 84c159e68dc97ef7220643cde8892837e6fc4b587045d7bb11b6775976f06e1b
- MD5 126c7397db613cc150fada04b24fd0ff
- SHA1 bd36fdfa04f8b0cee9cabfd610fca31727d61642
- SHA512 c83f5c069b27954a75e08551990c26c0bd907b2558bc0941d91491fa0e05a60217a068519b23a87b258baa4313dba5e0fb2d101e5be70fe286e3c164a6b7e59e
- SSDEEP 12288:c1OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjc:c10Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T19055238EDF0911F6D4312F3C28A1D324D2D47E21BED23ABAB7A1D14ADDB574B40658C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 66423a6b9c259614d2f1ec8d8d6780343cea5c989d1801a4e1ff2523eaf77610
- MD5 6e54aaa12839706aae4995eb323796f6
- SHA1 575d3ffe976ab6d66647c62c9a16dbd82b604b1a
- SHA512 f113954663dddee167d2ca41070f8afc6f38549e0479146b09a5841ce5e1d959a1499707c99dd84fa31ba89f675ecc014e298a1d0a21121717249d9318b873e6
- SSDEEP 24576:5fwvUk9RX6wkyAID0Djsf9nz4mloFQnpXUMPQDR6q79dA:TMnYIwDYf5zaCpXxPuR6E9dA
- TLSH T11485CF29EFD804E5E0B7923C99B3460AF2B178691B31D6CF129A53AE0E33ED45D39711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 90228cfc34d8297c869d9a1aca7439f0a926defcf75c8b1fe343f06bb79e3b41
- MD5 13bf687d8ae20de53ea6f6ffca9dc3ba
- SHA1 9c344f605138cc3a44dfde96791baaef7f79f6e0
- SHA512 ffe924fb3a8bae648b4ff429ae0f18a014f6d99c632150c133f237f4451b9a9514a7573ff87d892d8b94ddf95b59fea944e73c30a72fe244b245e5dbc45e43b0
- SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nDYf5zaCpXxPX:NySzPLoDw/z
- TLSH T1AB066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 f4a1756799df703cca27ac1d650489311d5856e3d3e9ff0d258604db9e97b840
- MD5 6e796a75e7e108729830f91ff17d2313
- SHA1 e5cdec263fd52580f45b4beab617d211d6c763d0
- SHA512 9ac246c03db772623a017c9a8c8eacf810e344b3aba42fbcb7ee1230779a65ee85ea38761cc713977fd280dcb06a91a066af32a2286c2f16735a9bcdcad0def6
- SSDEEP 24576:G47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY20Djsf9nz4mloFQnpXUMPQDR6q79d:G47JUQjTirIhCnDHUPfF/3DYf5zaCpXp
- TLSH T1D565AE1EA3DC01E5E1BA923885158A1AEA71782D1F31DACF2270837D6F63ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 a5e1a8716bb0823633816d988829777e5005f4f370670a4f7b1528407233fb59
- MD5 c8a49395cbad836850c10ee900768c5a
- SHA1 d24883e99b503f0c52541f8a1b39f4ccd16fb1d6
- SHA512 b686e0f913b6b7e0bd72289c895ece7751c1273744d87985332bc7f3df4a18ab1ed306ca9d3bb4188511ce21530eafc96e4f0434a124051f0d9805da5ed32b65
- SSDEEP 12288:ibsffOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjJ:Zf0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T18B65F14AD64802E9C07E2638CB519600F3737C21A7E1A7CB67D0F57E0F766859DEAA43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 ff2686f5cf830bfe6a4ac425521e75eb413da273a8b2ea543d524ba930fd5fc6
- MD5 ac6b50fc660be8d9a9e18cb60bfbb02e
- SHA1 281d60e5683123b7ef43cd5886d56992c83d8c3e
- SHA512 2f27b27d301626de707e5355ade48f75848f598b5cb1adde70d012d0f0cfa4f2f17dbd8d74008b02d76774dd5e41f3e4c71b8c82b5e45619f047cc47c690f358
- SSDEEP 12288:RqKpycvzU3fNOc7qyHIDKSTy7o0qkfOd7OzFmDrpDSO:RqCV7UPCuSTsqkmd7GFm/pDSO
- TLSH T1944528407626DB4BC6A940325E36D6CCA7707D46FE04AF0372C98B3FC476659B6F2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 f0011b4938bae18829812509b06464a58ce87b7b3c8705309ac2e42fc8346410
- MD5 4817576b8c37f56fcd09a74ddea19445
- SHA1 ccfa5cf28e93ef2212000bf668b901b403034a6a
- SHA512 bcc7ab4ae72f9c4248dfb5f87f06f84eccee6c370f65ac94e5ccc34d8a2118181cbbd3f4a40cd0cf1f169c28482e6b4374badf3721c52391c43d8d7a4438069d
- SSDEEP 3:OlH/lSNWal/PRaovBl3yjJ/llS3mCllltGlslslslslslsl68t:KANh/PR5rOjlEmCtEEEEEEE
- TLSH T1FF81921047002A2DCAA9AC322964BF19A365D01EB8989FB73357349A4C2828D5C11AA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.6MB
- SHA256 6d252aa7b5324b2a52c91f0a540b1ff8303000760049fd16600309f7b28520f3
- MD5 6113e5aaf2428805f59751f24fbedc74
- SHA1 108349e827a101d044774b647b216f9b70d4c8bd
- SHA512 99370d24f75dfdbb8cbac964bb8f36f70dbc89693c132ab80928a1e921432b2bfd2875cdcafe79635030637489487d74f3182fdbd9f8595a34c15a40977cab4f
- SSDEEP 12288:eyDIE2Xj8/YQe0EDubCoU4Jxtt6TDFQ/VVAt2myzDAhnNfkH7tS+pS:p8W55lJxefe9+7kxxp
- TLSH T170751A4155B7EB4FC97E803703329ACDAB745C0ABB493F01A385C93A946695EB5F23C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 2511a761a2a5165c146d4818adf2a0c4e8e0eb66cee7040c192ee10bfe6b8f27
- MD5 ed5b25a538ae1c4bd7b1442a85124b46
- SHA1 d228f359160f2dffb7ac8824180773c1250fb601
- SHA512 5ab89087af19a25a5b180c0b495b45fcfa0358f0ef3bca5e4a81b556d181985174f636ee629810668ed7a34120ce7920c0045a9d0c8d3e73d7ac548683732416
- SSDEEP 12288:MF7nOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjX:gn0Djsf9nz4mloFQnpXUMPQDR6q79dA
- TLSH T11555234ACF0911B6E4712F3C1465D334D399BE207F903AEBB791D28A9C71BCA8875947
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 4aac073867d4234b441325d564567826006d3ddcf2b95547c25f6874a2d011e4
- MD5 309a2b2445f5a8c36029c7b22a482087
- SHA1 6ba50771616c56317abb2a86fbd1ba7875219254
- SHA512 0be3a5e1b0cd8a6cb354c308376d73eb9e584dfc34c9d9d3b3e7973c5508bd4d8702da6f1e1c5901b09410df2bbd70ed45aae25d6c5e1bb8eb9d411f1cf76672
- SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYZ0Djsf9nz4mloFQnpXUMPQDR6q79dA:Jgb4mBIBhGFhDYf5zaCpXxPuR6E9dA
- TLSH T15065AE1E22EC02F5E0F6E3B89DA64417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 18099d87e88f27dbbd6087e837cde6013f523629e4be79da2da8c4a59d7f4ae0
- MD5 2190743026882a110056a27b99204e46
- SHA1 f68a70b7e9e3a71fe51131bc83b6ed76f1975bde
- SHA512 28c556d09b0e5193b68b65b503fceb87249bb3cac6faf967c4d9ed093801f3ea650f5cbde5cd1fd3bf10b56bac03a954f14a7c4936734e5eead2d5237d4560dc
- SSDEEP 24576:NG88u8FpJqH1bzria7/mm0Djsf9nz4mloFQnpXUMPQDR6q79dA:A7ZFPqVea7/GDYf5zaCpXxPuR6E9dA
- TLSH T1D685F165ABE101F1D477913889828663F6B2B8211360FFDF07A88A551F33BD54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 7a7bdaa637498da1e69d933eea38d52dbf606ca630c9caf7e434ce6e6583d173
- MD5 5a6a39030183a7bb2b7da8bca22dfc0b
- SHA1 7556896271876db4365337e4d6c8e945ff01a06f
- SHA512 b7a2635539435c14cbc53d0891491bfaf9ed20e97a366e8f6f5010ddd797f398d3c369e6d6fe28f0f33f6fe624c2bbfe87c47f505cc7107d578cf59150ceeec6
- SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtDYf5zaCpXxPuR6E8:oG05lO43bGoDw/z
- TLSH T179D5BF6E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 55838288ae0236ceff9b26f282cee7f0a71949d33b32767285e95ff4b3c74467
- MD5 0a7da104699b5f81aa9f5443808d5b1b
- SHA1 6c2cc0ac1648fa6f5e33c4253ecb2a5bd34818ea
- SHA512 6f63b38f08e33ab9544fa8cba0245dc757f4bc0725c6424f99d93b9191d176d88685833985ddd9174d4f9e8ea6bdf38aa97e18c0f3b9b1b687cd1072af3b53ce
- SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnk0Djsf9nz4mloFQnpXUMPQDR6q78:La5POZ3BJt2pasx2+mlDYf5zaCpXxPuC
- TLSH T11A65AF5EA7EC01D5D5B5D17CC583861AE5B1342253329BCF122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 c9df73baed9d830bd24985b8e21a8596345445da880c871790282ba885f4d2ad
- MD5 da5e83848db879e248702cd621c2ebd9
- SHA1 84be5e94702128ed720d1798030847d4f824d510
- SHA512 20ca5899abbe5e4594a2a8a0f181db805ac83a46b083d11bdc22767664cda25e17b62cd0954a7d8690029efc740574e0c7d3cbce2375b96eb8ba4fa312904198
- SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7Fke0Djsf9nz4mloFQnpXUMPQDR6q79dA:4Nc/zEOVHFmDYf5zaCpXxPuR6E9dA
- TLSH T125858B1623E901E4F1B7E1BE89779646FAB1786517309ACF0291811F1E73BE45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7f7198d8a2b86bc1dfd19500ab9b5cda322cc14fc8eb45efb499819fca26721e
- MD5 ecda9afc14a13916d18bf4426170497b
- SHA1 eb562254cb9ad83b9dc7c389c5be9a9a3ea63864
- SHA512 f908da309b207e9d03765fb0ece7d01a554936affb2a3441a7532872d8d11132537743cc7dedc4c48ab1d4a5a67af049ee0aae02a3a2b4599a35d23ddc8fdfc7
- SSDEEP 24576:PTkNvNnaFeYhJNtmZBmL0Djsf9nz4mloFQnpXUMPQDR6q79dA:PTMwBtOmYDYf5zaCpXxPuR6E9dA
- TLSH T19E55AF6EBBB806E4D1FACA748D238112E6727861173253CB5390C13F4E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 202ff91d0b2d03b995e948550c81af4d266d7ef55783e5ad48bf5b53f8cc73ef
- MD5 5266d7bf56d0ed1fc576cd94e83091b9
- SHA1 f293e86ef0052747a2d800525d9636544fad144a
- SHA512 e28bea7b9986b730a583e2f6f2797cac8fe3f4d39637e0601fdf466f365850a81e8781d277cd741f9b158858981877abfcce4b17ff7e5b7ed72d980adad4a035
- SSDEEP 24576:FPUr+NQS0Djsf9nz4mloFQnpXUMPQDR6q79dA:FJQ9DYf5zaCpXxPuR6E9dA
- TLSH T16065E11F669C18E5E676A13C89828319F771B8621712A6DF02E0817E4F77ED8BC3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 058e865d4fbdee5a38fdce876411367ba432c5e3d40a36037509b3554e6cd211
- MD5 db2e1f838ed97755848f14332b10701f
- SHA1 673041a3f97fc5afc5a4fe81664919ffdedd7e48
- SHA512 a12eddc3394abf4a4f1a4ecabd80f0f9daf6f6debe0398fe35b10abbb262cb95672e670eb8ed8d55917048d4a7e3668d6143ae4f264071d4846b399caed4f1a0
- SSDEEP 24576:xD3FHshBIYQgA70Djsf9nz4mloFQnpXUMPQDR6q79dA:xDVHeBIAAIDYf5zaCpXxPuR6E9dA
- TLSH T17E75E17EEB5C00E4E476D27C99638606E7B138A9072266DB12D0C1BA5F6BFD46D39F00
- MD5 SHA1 SHA512 SSDEEP TLSH