Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 4.1MB
- Sample261002-krz75sec84
- SHA256 162d3806ae9fd480f19f55e22beef669400670599896493ae846ee54a143b773
- MD5 9216283f456db191cb8bb172cfc5dd14
- SHA1 ce763637b27b35362f8430a65bc14f670b6adb43
- SHA512 c57cd0a06f2d7a8481ed51d01da4065acd35191eff14a99c7b1f76e091538bbdb81fa90f18c1c93e0930faaa833322ed3ee7dcc2e979eec21d7e7ee7c3b83834
- SSDEEP 49152:VTAtjNPJxkkevJKGUSO0xQF1Aae2yDJfEccfuDoUIMuT3jAR+IJk/wP3sZlErx:zH2adMmUsT8wvsZl+
- TLSH T1A9167B17A6B940E9C0BBD1798A579617FAB2780A873197CB4791471B1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/5324-46-0x0000000140000000-0x000000014042A000-memory.dmp family_stealc_v3 - Executes dropped EXE 11 IoCs
pid Process 4304 elevation_service.exe 5900 elevation_service.exe 4232 maintenanceservice.exe 1256 OSE.EXE 5884 PerceptionSimulationService.exe 4796 perfhost.exe 5488 ReFsDedupSvc.exe 3320 SensorDataService.exe 5112 ssh-agent.exe 2696 AgentService.exe 5744 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\78c1cd347465cd71.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1ed94384b52dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e948a384b52dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d0a4e384b52dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007da41e374b52dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ebab3384b52dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4304 elevation_service.exe 4304 elevation_service.exe 4304 elevation_service.exe 4304 elevation_service.exe 4304 elevation_service.exe 4304 elevation_service.exe 4304 elevation_service.exe 5900 elevation_service.exe 5900 elevation_service.exe 5900 elevation_service.exe 5900 elevation_service.exe 5900 elevation_service.exe 5900 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5324 2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeTakeOwnershipPrivilege 4304 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 2696 AgentService.exe Token: SeBackupPrivilege 5488 ReFsDedupSvc.exe Token: SeRestorePrivilege 5488 ReFsDedupSvc.exe Token: SeBackupPrivilege 5488 ReFsDedupSvc.exe Token: SeRestorePrivilege 5488 ReFsDedupSvc.exe Token: SeBackupPrivilege 5488 ReFsDedupSvc.exe Token: SeRestorePrivilege 5488 ReFsDedupSvc.exe Token: SeBackupPrivilege 5488 ReFsDedupSvc.exe Token: SeRestorePrivilege 5488 ReFsDedupSvc.exe Token: SeBackupPrivilege 5488 ReFsDedupSvc.exe Token: SeRestorePrivilege 5488 ReFsDedupSvc.exe Token: 33 5744 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5744 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5744 SearchIndexer.exe Token: SeDebugPrivilege 4304 elevation_service.exe Token: SeDebugPrivilege 5900 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5744 wrote to memory of 3212 5744 SearchIndexer.exe 100 PID 5744 wrote to memory of 5504 5744 SearchIndexer.exe 101 PID 5744 wrote to memory of 4136 5744 SearchIndexer.exe 102 PID 5744 wrote to memory of 3936 5744 SearchIndexer.exe 103 PID 5744 wrote to memory of 4344 5744 SearchIndexer.exe 105 PID 5744 wrote to memory of 4160 5744 SearchIndexer.exe 106 PID 5744 wrote to memory of 2836 5744 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4232
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1256
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5884
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4796
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5488
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3320
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5112
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3212
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5504
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2872 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4136
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3936
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4344
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4160
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2872 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2836
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 0d5103fc40ccce21dd6ef7ddc961c96252ae7bf26cd66bcc22a601721946bb2f
- MD5 7d834e3288dade2860acb82a3d322f89
- SHA1 acb8f7299ea0882c2f84d734a6db4dd9a13a047d
- SHA512 a127015c14ac37d279c2417f1cb2e70f4e075b19627036e750f542fbe3da55156aad239076edc4f501b27ff3a9ffac80031118cbcf511099f21abe4e58310a01
- SSDEEP 49152:7b+632BuPkFKRrdE6ohQstBhuXjfS4LWxnoR+IJk/wP3sZlErx:J3q6tjBfT8wvsZl+
- TLSH T1DCD59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.8MB
- SHA256 25d136bdc884d7d9e8550e2b03ce1f7c0d0fe6b269117f01c0197c54cdec249c
- MD5 359ef9cc3985906995ebd98aad797b74
- SHA1 502f606fd07f053cfc2f67f7639d3dbe69890066
- SHA512 6f2e355e29c6716a9b811c0b1a24cf20ff4909c87a766bb80ed0dee64778fbe58c4b225fa59537189e11d4a63f7f17b8013afd8aefc5907a4d1dcec06497f8e7
- SSDEEP 24576:UXYfDtczAH1RDxYIJk/wPO4ps6EEZXH8VEtt7N:TtcWR+IJk/wP3sZlErx
- TLSH T16F850139739404F9DD6B8239C8A28912E773B8964360E78B03F899661F337D85E3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 ae900e6e3f04fa0568de938a335626b2afed17c7c9b15e22c2bcd078673fbc93
- MD5 c0e8adc01cda8bddc8d5e191c2c5c98e
- SHA1 5cabcf09ad4e84df6c18ae1713514fd3bbcf8a55
- SHA512 08df3fde5a88b5f609def001fd01b95f5be2fcc8049c0212c25e6640abe3ae20dc68befc8de17d57d6d1b7e883c0d5e3ea09d77f73cb158996920e5540c9652b
- SSDEEP 24576:e0Le5ji0hmxnrMe1RDxYIJk/wPO4ps6EEZXH8VEtt7N:ePji0AxjR+IJk/wP3sZlErx
- TLSH T102A5AE26F6788331D073C0B9C5D2A69AE971308257308ACB4296D77C7F67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 7c1bd91e49267d6885de3f1c04fc4860ffc62a588a01cba0ce0910669bf14ca1
- MD5 4e4917cfad9c8e7c218ce6d15d7e830d
- SHA1 8faf36b68fb376662663b178961d4a6c2480a32e
- SHA512 f69b088e2e9eddb9e70a4478aca9ac5b95d5a44c4854ef1c791760ee146b97bb07edfebecd8cf5622f3f9277e5eb04f39087d5e4c9a832efe49e8acbde24a38d
- SSDEEP 24576:Qa7/ezSC6vUyDZaqgrvWx6q8wyuk1RDxYIJk/wPO4ps6EEZXH8VEtt7N:H/ezSC6vURPvMHjyPR+IJk/wP3sZlErx
- TLSH T179755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 39b976723994cfa96e5c03582be60b906ace29f2608557b746f66fb5181e736d
- MD5 580c697ae4ceb66143e5858dfb7cf681
- SHA1 ca37eaf370663d6e60442f514554a0435f1a0c6e
- SHA512 a7ca6e9a8a484110898860c12285cd36474f60ba9d9b4c61526ecb7e6e908ebc92e115fc4a4d69b16215cb88bb6bad9956a95f799c39c9b6c53adf4a1f3a0846
- SSDEEP 24576:zVbqPb88hv/lV7L1RDxYIJk/wPO4ps6EEZXH8VEtt7N:zVO88hXlV9R+IJk/wP3sZlErx
- TLSH T1A2559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB124AD76C2E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 f03ff254d176f005e3257ea82640f81ada8f510417eabbdf9c45cd8f06de90ab
- MD5 b3888992e1ed4fc1f0da93b667c2fc64
- SHA1 d591ff439ade2f7ff8086724e2c7a48ab92a9161
- SHA512 8bea14da4efa55cd4c755daa841703701f876c94c1d88353bf52be0ac21415debcde44aec8f9fe5c0ff7686e02989cec5497554f4c57497ffed7dda839633d7f
- SSDEEP 12288:FG2X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Np:FGy1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1647523B6430C80D3CE9F4F32F1A66EA2A7B2CE97A094C901577D3847487CBD4ED6495A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.8MB
- SHA256 95dd2e9e55afaa48ceb40ce866fcd2da3aaaceed2679b825859d55d500b49faf
- MD5 1464a75c613f329ce7669dbe8e140b71
- SHA1 d73cf60a90c1184dfcfcaf8bcff6a0a73837811a
- SHA512 b25e79dfec283d2376550bbf2fd6d92e13cf4b110d87ad17ab57de0d945414938f6046678a569d73accb462f935031f6b6bfd5cc4d668cc3dcb22f46fb2fc2c2
- SSDEEP 24576:oJIUz1RDxYIJk/wPO4ps6EEZXH8VEtt7N:oJIUhR+IJk/wP3sZlErx
- TLSH T12285DF3BEE28ECD2C67E8D7956918700E77278714B6193CBD178820EDE236E05E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 ccc85bbca7601c02ee0d8b982a1aa66e60cf3d7aa0ff07bae1e4a9547179c395
- MD5 2804df36c874158f5c267535baf6d65a
- SHA1 fc45793b5140aa68f546b8bec8cea59904665945
- SHA512 309b361ce8e432c034299e4c7bd87a32699c2ccf655b7c8d6882a308a3c4034e4a1534606d33f4c1e522687a8c93bbd9756ff8691eb1f9092b36552b5ca80df4
- SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THX:EQvGAdlCEL8c/pRNw5CqT8wvsZl+
- TLSH T1CA266C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 82ea81370ec14225451acd69c4b9f36eb6a4d00026b50ad03933fb23e2fe5553
- MD5 f3bcf96cedf61c25dcc6b481d36367d8
- SHA1 2c5bd5ebec50899903b3e9f756ad1f843fbe63ed
- SHA512 804e4ba95a0aad77658d63419aed81854edf2693c58807cadb38a487cd551c54a70968e5702a2aeb2eca93452e7b5817e9f28126f0da9f218ae52e7168228946
- SSDEEP 24576:zwewsAjR1RDxYIJk/wPO4ps6EEZXH8VEtt7N:8ljTR+IJk/wP3sZlErx
- TLSH T17995E031FA74D032C6BF0DB22B36C716247DBA614B611AC3E3A85D8E59342D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 594f47964c2385f9d73403d88c22f49f1781b225befe187b9650aa4ccaf615bc
- MD5 69e6a323731e2a70e4e5da93c04b3aaa
- SHA1 4ebd74a9a451dec0164c4cbb3dc3ac2b3a498bd6
- SHA512 9c5972e6f9bae8836a4dd9f1e6adedbf2733799aa7162f742a0b3465e311bd7b57e0186391103c4cef9a390564b3996a8d495879cbb345e7e749168a00ff2ee6
- SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH94wp:uUEtQevvqc2W1cpV29I3294
- TLSH T120474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 072f7dfd44c30f1a9535416534e6bfbafb3f0f01cdb73bcf8daf6f1c13fc2eef
- MD5 8a9ebbefc97ffe6348b302c43cfe3428
- SHA1 8f214de4f4c82f341e063c7656fd3073b126d71c
- SHA512 a6af4fcc1c8544e2255bc2e5bf0dae414ab6cc8195749565b13fc71962eee92908da50c993c2fccc2955d3e7404e3297916a54772712bc6c0797405e12e1f4f1
- SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zzR+IJk/wP3sZlErx:5oqtVjnmuT8wvsZl+
- TLSH T151D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 83999221534a6746e075d8650f1e9179e897cc0adf12c901b1cad58c263c0d19
- MD5 cf11c811ba49e856cd49ed5120f380d5
- SHA1 85cf9da81d533b2eae296510e0d35e9be755b101
- SHA512 d222dd9bd41bea07a34d5423b001d8891c93e019e713abf0e5d0108abf8793cb33f33c6ec0f22fbdf3027101dd2766595d19528dfe653fe64d12b648291e34d9
- SSDEEP 24576:7AhGLmIFoiwtA5l7S53w1RDxYIJk/wPO4ps6EEZXH8VEtt7N:7AM1Foiq5SR+IJk/wP3sZlErx
- TLSH T11E359D91E7F945D4F5B3AA7899B69571EA72BCA65E30C20F2164D10F0E33E809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 1bc025f2d7d1c1d18fbbbdc2858ccc00fe20806b6b0eec6bb946be8bca7c8fbe
- MD5 4cbae120b604c6a2a37a88779bb164ff
- SHA1 2795ff8c918ec05c4ff73bd579e37d7d2df6f2c2
- SHA512 4a90fbede09f353cb287286b94bd4f3ad3d9174701f97fccd7d8dbc1fa39c5ac98d9cc7571156a7cef1caf8f111ca572e0f5aed1e42d1205a9d33ef5bea3ac33
- SSDEEP 24576:5wuXOWd1RDxYIJk/wPO4ps6EEZXH8VEtt7N:5wQO+R+IJk/wP3sZlErx
- TLSH T14685F15673A808F9E9A78639C197C532F7F2BC022621CB1F1764C65B5F37361AD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 8b99b3e5b32ebbf427a368090681ac82139d323aff73f88c1eafe5c9adba8ee3
- MD5 a7dbe5015416d89b9940feb9239f4879
- SHA1 ac62fdfc69785921ba8edeab89bf3aa3c5bb8896
- SHA512 01ad38f4cfe0b8d81ca3edb980ffb8159c9992c9b8a846db73dc65f0725ca3a0a0f3015109afcf68a76502b03719fa3836a2603f34d0c82861f66f810825a042
- SSDEEP 24576:3Zum1RDxYIJk/wPO4ps6EEZXH8VEtt7N:DR+IJk/wP3sZlErx
- TLSH T1A47512AA239C50F6D9AB4739D5E15A42E3B2B893637183CF137812571F36BC15D38B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 73828e77f5535f9b069bdf61b3a89ccc52a940703bba6c136ff2064949d5066e
- MD5 41c00655a5b016bfe511925d50eb11fb
- SHA1 cba8a154612bafee7d1021a84cade1059a81a895
- SHA512 6e278167b46886d3ee84222d2e74ef4986da699945b2a33219764d01a4951b7dea4098865aa06691defc7616388b6bbfb942bd7fe25d3c49ca654b1e945668dc
- SSDEEP 98304:CQRQyi36YOcPuLvw2gAf+PN3vT8wvsZl+:ZQyiKakX+PN/4wp
- TLSH T1D2667C13F3A501E8E05ED974CF3956229B357C4B8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 dae53dd8dc56545146cfb0cf63242fdbfa3f4e5fa6a174be10eeed7c94f54dec
- MD5 6c499f69cafaa234e5494adb36b0b5e2
- SHA1 0da44c2ddb4546268de399daedece8d4026062eb
- SHA512 ab8303547436c7177f979aeb4378c07eb7fdadd72e1b7856aa9bbc448fd9c881afb6057b2195007cbcfd17fa34a657547246d2f01df651e83e1d492637e550e8
- SSDEEP 98304:3QRQyi36YOcPuLvw2gAf+PN3vT8wvsZl+:mQyiKakX+PN/4wp
- TLSH T147667C13F3A501E8E05ED974CF3956229B357C4B8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 707c91da141963738bdcf0a7068c9f8dbe619684a0c2be9f295f9401f2542fda
- MD5 91da7c836a752f03d76d8146bd83fd2b
- SHA1 5107e08634b49b67a19580de9349b227016e316e
- SHA512 9086f4d3ae8eb596c0cd9718d627cb71995f29ad2d65fb157bb19eeba2e79f58bcfa06f538c125a6aeea183bcdae0ca4f09b6dd8e4d79ce6a090380c7ba08437
- SSDEEP 49152:z68Qg55nhxeWu7PNU3/jR+IJk/wP3sZlErx:tthGRc/1T8wvsZl+
- TLSH T143B55A33B2F60099C44DE1769F4A873196E27C758FE0E3DB851572061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 578f2e00168bbf7fef2a0231d6debb8311ac4fc48824107c99a664b97b4f0875
- MD5 a927784983b333b19aa1b60073b80a5f
- SHA1 982e733913eda22cc1a0ad72799ae113094f6dcb
- SHA512 75a9045f2f0c90351f1145c93a811f0cc556d70cfafc715b5a7626d1cf155dbae0dc9e78c2fb00324cca81755b52adb2edb1413be1be94616a25086a79896cc4
- SSDEEP 98304:Cy5112gYy5azzVvD69nLKnhZUT8wvsZl+:LLIH+WhG4wp
- TLSH T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 208c4a99ccbd9fe1f6034578b782530de6243e48175129d4bf6d75b9ff53bf3c
- MD5 4d2f41d4c696758d5993f6568b699d90
- SHA1 1e5588113b3b5bcd0a5eba54cd5bdd98e1b07900
- SHA512 163f29b60c91f96d6bdec4b439265c2efec0e82866b95728cbab08bffe60b2458c62c2c5c3693825f910496a6571f9bbaa0372ceb3ce0e74f9ddd9eaf4c57c3a
- SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxR+IJk/wP3sZlErx:Qu6JmQxd2d7T8wvsZl+
- TLSH T117D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7e12931f19287d3aa6350e74d7d17a0b13a0dffef2f7d1cd887fb88c0e1cc2ff
- MD5 29b10dc228c0648dc4d12b1b4c2dba9e
- SHA1 b2de4baa25ae892a8adcc14fe1e2bae9ed6cb606
- SHA512 985fe707e5ae7b2dec0ee79a8978bb93dd06bca03b8f4b0a6c382e9b7b9fd88167eeabf0ef5f00fdc7666bebc7b1e0afbc0929b99b7e123fd42b0de1dab464a6
- SSDEEP 49152:d1hpsNoJpF1A6yU44CwH7R4xBR+IJk/wP3sZlErx:dmifPVRuT8wvsZl+
- TLSH T1C0B5AE13F29900E8D05ED17887569632EA72BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 16bdb25f98736157cc13ffa82a959d78f20ad7e39ca435573960e770c1e117b9
- MD5 fdab2031f0754039715d52f33b8faefd
- SHA1 2e916ca614e4b715129d4d052c1e37deb4c6c316
- SHA512 61226f31b4a0d90446318afdfbb72d7aecfceae3bc6593f42a168a512bf165e2ee19bdf0b4d912360cf1019b9a0a66d37a8aea37713b948aa9e9557c11cc4d98
- SSDEEP 49152:ISuZQIY0Be2KIRVtOnks6NMHq8R+IJk/wP3sZlErx:S5dKOi61wT8wvsZl+
- TLSH T1AAC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 bac6b7b13c9a87e810730089bf59d1bc04dd5724467117d56dd1022e7318365f
- MD5 dacaafb3acef9442833709f5b0fa9cfc
- SHA1 a2fcee5fc864150c0127e9ebc60828fea7cf8f03
- SHA512 2fe4188abeda50cecfa95a0b46985b0f7f55a83ebbf0331e25f185cf251fcd2fecbb325a40a7521ce760cf271107ae29daa8ab8c457f882aa82eaa642ffcfc4c
- SSDEEP 49152:nhtSn8EApI0figGgiDn0AP5wVR+IJk/wP3sZlErx:2X2i/phiT8wvsZl+
- TLSH T15D95BE13F2D900E8D05ED174C7568632EA72BC160B34AAEF0A90B6561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 976e025821ec85cf7c14af4979ebb40bb3d7f95561e08f745cf742b521d1accf
- MD5 27bc44eda6cf26afb286d2aa065bf3c5
- SHA1 683744476fb8957e5e74d6fc345b41bf54ccf888
- SHA512 f221cef2d7958f01e04fe7ccc1202a30ef52ba11c7553afef8f1a605f3ee35d4c2c5ae147a496b8f77e627f174cf153089de036f36c8f7eaa1f4d5252c74a014
- SSDEEP 12288:NeX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N5:Na1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T17B7523B6520D80D7CD8F8F33F1A26E92A7B29FCBB050C541677D24035ABCBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 9fae4947fae63401116de88bb0e45e7603c864d78cc8b61c503c8af7cdf95ac9
- MD5 eaaed3c934f9ff468a4f425d907c30b8
- SHA1 ac0aa82e66cce688f446db3eb4eef7fb1b61dcfa
- SHA512 ed963aa2c68578f44b29d0d8d198df7b71e77e91b2cd7e2dfb5d5da68ab11bcfe18d27775a8bc56e65bd974c7f54ba8adcb69c102899b8d98cc72f414958bb99
- SSDEEP 12288:f5X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N5:fV1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1767523B6520D80D3CD8F8F33E1A26E92A7B2DFD7B050C541677D24039ABCBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 62c4736d1fd9fff1614e5a02b69aeb0fd6175a540ee86fbfa699c493cad29b8b
- MD5 70c6f4f1d7bd896c81f6008366348353
- SHA1 d42bd9d861a8f1714c9148ac676beae78e1f2c2c
- SHA512 af7536061bc55b8a39fa15ccf6a1b4a6fd7ff222bfafae9d80dc68bcff325e6f4482caf94e7e728796666bafe1af1577ef5af96f1f919050e72fb939f8687b0b
- SSDEEP 12288:PbX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Np:Pb1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1B87523B6520E80D7CD8F8F33F1A26E92A7B29FC7B050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 5fa81091ed30252387fcb79824c0feac56186f58f60f4997ec2b3b798c1de04f
- MD5 55c0ee83e07f3fcd49bf3a8df422f4df
- SHA1 a10af3192ae819ff1bd578533dde5d8fac753b9b
- SHA512 1c71c47834294b50f2110ce9457d07882c04d6017034b6c3159ce8e76c290f960d32295ca3a0308d0b8c3998d8c271252e393b6367c5df7a9df835e26f4a9861
- SSDEEP 12288:aVgX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nn:11RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1017522B6231D40D3CC9F9B32E1A25A52E3B2FED7B121C68B572824470E787D4AD34E59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 2d2ebf2d51ae988a03e1eee4483ceaee79745d5581bc94db06b23481fac4da6e
- MD5 724e26c363486a0b05132bbb762eea3d
- SHA1 c87d3dbe36b785450dcc80a48f6663f42211a325
- SHA512 cee5c0674c502d9c90f0e9864ae96aba7069bd89d49c6e2505b9eaa292d462e6a94922cdc7a111d996ab849975b333971d6875b03574ef1e4047b9266772a680
- SSDEEP 12288:f4X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NV:fo1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1DC7523B6520E80D7CD8F8F33F1A26E92A7B29FCBB050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 8a8c25d941b4e89d3e37b532c0df88d8d29046702ddd968a8e78a2495e5a1508
- MD5 a7f4a163d3ccff1993006edb6a62181e
- SHA1 aa07e130784026cc043f9deac2625bbc3fea0d91
- SHA512 95f4874870a2fa5008d2373891ecbac6b928fb379b5d89b9179f10461041e10a09b4d97e574aed63766b1cce61f9a21c403013ff541471b84d1df3eee2f01836
- SSDEEP 12288:9dX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NW:9Z1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T17D7523B6520D80D7CD8F8F33E1A26E92A7B2DFDBB050C541277D24039A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 4847fa9b75288fe86165a57d8e38144c115cf1285ee982b8082905cc9c215d0a
- MD5 87ff8552eb100a011c761e2fb4496455
- SHA1 81e3db2ac0eaf5ba2040e8dd60c23ccd591a0255
- SHA512 4dbc7d5d208b8a905b00ab818d1e2ed6b0479faafe356b00e59579be71c121f1828a5382a15c82a69443f8d32d375d084724e1ba16069eeb6e4bed90991142c6
- SSDEEP 12288:gxX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7No:gt1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T18B7523B6520D80D3CD8F4F33F1A26EA2A7B29FDBB050C541677D24035ABCBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.8MB
- SHA256 9be31ce9ca1435ae2cd0a71124bd759bf6ad798cd4720b3171686a001f52a15c
- MD5 8ffc2297af8cac7ac805e685229ee90e
- SHA1 82d32fda7f288e4860a38d46830914263006aab2
- SHA512 d6fe2dfb25c571d85121175650910228cacf54bde1d7dfbebffc678594e7474d5c5a87fa476e017c2e8b3bf3144ca439ef828e5a1654482ec9202086b512616d
- SSDEEP 24576:mZMJzFVSO11RDxYIJk/wPO4ps6EEZXH8VEtt7N:mZMJzfbR+IJk/wP3sZlErx
- TLSH T1C68501A5B35408F5DCA7863AC9658902E2B2BC5B1660C60F13B836275F373E11D3DF9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 5131c5978c3417f0b466f4dc5a228352e95d25cd0644cc2160353889a9af512e
- MD5 4201e1d5729782ef0eff8ed8f4412bb2
- SHA1 5011c590b192d299215e21815b6da2dbd5fc9ec6
- SHA512 3be9a2d3e3bc8ccd83a58a23d2cee58da0f44fd765660de9e3c7a9d6bb2471ac35212aff5ff67d7aee86fa672ea5be6da59554ded51283868815414577c39234
- SSDEEP 12288:/KX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nl:/W1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1867523BA520D80D7CD8F4F33E1A26E92A7B2DFCBB050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 5acae46328458c04851d0025b805c0c469197e1362aaf0bdca0cf74295d1795a
- MD5 b7f55f3ccdcd8bd9c73784b3702e52ba
- SHA1 dc9a484ed3d84a833fe32f398219a546346dfa71
- SHA512 71e4962988353da295aabbba9ae51849c811ed404cffbeda1519a4a97cadc75060734ce4daba0675516bbe0aa18cce8bc0322705aeee0d68e7e20ae272714cf6
- SSDEEP 12288:kmX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NT:ki1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1687523BA520D80D7CD8F4F33E1A26E92A7B2DFCBB050C541677D24035ABCBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 dc5ce15aa0f8fbea8f7639fef26f176f813839966463bee51932df12dde26d72
- MD5 b6ac0989b3de10aa398591fc10d15313
- SHA1 0da8e9e8a688dacbc48914be560a8d3962fa9b2a
- SHA512 2cdcd7ead38db3aab2e6ca918b726f6740326e6420fbcb28c7041e5f3668fc459793d989a4498880a8fa3c289572d7ac36bdc88cdd1d538301a7c5f550631051
- SSDEEP 24576:LzyB1RDxYIJk/wPO4ps6EEZXH8VEtt7N:LeR+IJk/wP3sZlErx
- TLSH T182850267736920FAD56B8235C4A21E02F772B8775720CA9F136806772E377D09E39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 b76cb38e06fc6f0e29db4481b41db4fba061379e63ffdd2c227a8c80ed5ec061
- MD5 727ac764fe96dbc5a81421caa0bd1cea
- SHA1 b90cde9f5e920126652f55c33983080d21097af9
- SHA512 fbe1fbdbc6c0b47ef5b86c0cb731ddef7a563b22f14345fdaa2c152d61bcfecd1d0b7032757285b34c0d604f226cecd7e3c69fa08e000ba729636c478d52b43b
- SSDEEP 12288:BKX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NH:BW1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1327523BA520D80D7CD8F4F33E1A26E92A7B2DFCBB050C541677D24039A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 5d8800e05ab51859f7f0f41062550c2c865fca64019ae61d1acf95c67e97ae98
- MD5 ca04ce916b97217a4997a667e465c8a8
- SHA1 ba8a9d80dab93ce558b6bc0a9d38574775196b26
- SHA512 15d6cc47bc8f29b861daea3b0ec8e599724d64dfe1619d0e9af4f025e97eb13f87b1d095153af93223c46f36440229b26f82bd95a72bc370c358b5c96f677123
- SSDEEP 12288:RKX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N8:RW1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1057523BA520D80D7CD8F4F33E1A26EA2A7B2DFCBB050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 6d3ecd105b239a04a69eff07477784879dfabf8a5d19f9a8328af0e895cb2f8e
- MD5 a3fccdce2efaa6e2cf8a03e4fa8d9ea0
- SHA1 0607ff045b0e440388704c30186304148dc5719a
- SHA512 6e5ae93892f2d227447c943f51ecb07078f3868c72ddae4ac9e72abf66bf5267b6c310457514c55c25557e1d884997f55c941a6e89440a02b4db5f27890732ac
- SSDEEP 24576:0zyB1RDxYIJk/wPO4ps6EEZXH8VEtt7N:0eR+IJk/wP3sZlErx
- TLSH T1D1850267736920FAD56B8235C4A21E02F772B8775720CA9F136806772E377D09E39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.8MB
- SHA256 df253efe4a80c2a9001e46c4b063cb877cf6a3db5f59e519f632b1ba0d45f331
- MD5 56152b7d7919b7b30b8915fda65b1abb
- SHA1 bd7b3567c721c581d65aec92e03daea76f6e4363
- SHA512 7c28c598238fe080d4ef31ec0139b5042c5f11ec6fbac9d68b7d71aaffb16f37ab6bbc2e36c3f15ef19328742ba00a64607255d29d62fd5a3beba6ca01d8edb3
- SSDEEP 24576:3TuaLl3z0zDr1RDxYIJk/wPO4ps6EEZXH8VEtt7N:3TdLljGR+IJk/wP3sZlErx
- TLSH T1E18501A5B35408F9DC6B863AC9668912D2B2BC5B0670C61F03B836675F373A11C3DF99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 3791e96605bc19d299486bbee169e23c1620bc0f993416ae47176bfae4e886f3
- MD5 0afba740c1aec034ddeb617ff108225b
- SHA1 f5dac284cb699ac019c90fae98c79aacd90fa707
- SHA512 4114b6166268ed6966380b1dd164f62478a0f7ef09bdb8d378a92deeca8d09ff3487e28b59fe1302e14f87d28ce7e6827c25c2de947346df3593b77864fb4a1f
- SSDEEP 24576:33xd9CHKy7GZv1RDxYIJk/wPO4ps6EEZXH8VEtt7N:Hxd9CHKyabR+IJk/wP3sZlErx
- TLSH T1AC95CF90F3E810E5F4B79A35C9765511DAB67C9A5B31CA8F03A8251A1F33BD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.5MB
- SHA256 22e3aa0374df11cc14be9880f9ab6410fb2680264957a2467f9021697820958c
- MD5 79cbaead0c6fe3f78f110de3b5e4b35e
- SHA1 39626f7208563310b805f495f5d7acc50265024d
- SHA512 61dbe943278aabea7f0d861d16b5576755a8f575fb7d32ff0192e4765d447b85a0838b4cd88fb0270540e4f1fb8154d97e8c646450be52eb6e393090842265e5
- SSDEEP 12288:G7X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NB:G71RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1CB7523B6520E80D7CD8F4F33F1A26E92A7B29FCBB050C541677D24035ABCBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.5MB
- SHA256 20d4483a4e42672359500752082bf82e5a591392c9f88f1f7d8b53fe4b4c2999
- MD5 9736a61e1c159bd5b1cf4d9d734cd167
- SHA1 4d8a6b2f2c7de05fc5fba81ae95b87d86cdb2bdd
- SHA512 7f97736c0cf8e7d83c5d40932f511ffce29d0bf6d1bd58b46bf54f68fb66945614eade2e4988f002fa482e5f7d9f408f8db61c4a292bffe9f3e8a938052d1541
- SSDEEP 12288:3lX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NJ:3h1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1027523B6520D80E7CD8F4B33F1A26F92A7B29FCBB050C541677D24035ABCBD86D24959
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.5MB
- SHA256 80d16b713948db8bac3d3723b5c1e12a0f7f6eb4c28ef081ca08b819d5e43623
- MD5 2a032c612ba9ada4c41141b4e044207c
- SHA1 c432a3520efaf1cb891e8cacb99884036f255ce4
- SHA512 3fe8a899bfe10a5780d4c44778dc9691c6063cd5645244b401eac17eae85db12dfe72a79cea7d28ff54f8bfdf23ec8dd562f3762135a45b511169c45d1343f91
- SSDEEP 12288:GMX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NN:Gc1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1EE7523B6520D80D7CD8F4F33E1A26FA2A7B29FCBB090C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.5MB
- SHA256 8bc8fab0bb00690e34c792d022942b168c75e56cfc0350d1100f8e7c2a6fab25
- MD5 51e4d48b8f85753372fac1e6be2f4f5f
- SHA1 ca75bc477f0b29dadef46096078a55a9821b5c22
- SHA512 9d0545d4141ac120c0462c4527a78a60a622114223834316722387372f11d406380ebc59ad259c59e84955313909960ada0085be98c9560cb29d6847547e01c1
- SSDEEP 12288:nKX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NK:nW1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1BE7523BA520D80D7CD8F4F33E1A26E92A7B2DFCBB050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.5MB
- SHA256 199e3c4c764335ad228985e9f0190cb9fcc83a0646e7c731c305e6f352574fe7
- MD5 311fd165a0d8f7be6977102f7c973b1e
- SHA1 4d7a1b41d86d89b21045a5a463ec771e055d801d
- SHA512 7237b6c71600643d93fc141d26268a8bc60788d39e800952f5f65ea4602e7b43b3034c04cf7dfa7586873c72c3800abe94a6c55b41476531898ea1ff000f023e
- SSDEEP 12288:H7X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NO:H71RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1DB7523B6520E80D7CD8F4F33F1A26EA2A7B29FCBB050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.5MB
- SHA256 1ee10c6c90e3062575cc3497835073296fdb4c8a5bdc8c56455c2614dd1df31f
- MD5 c37f37602007c9e11f5f3f1c30bd8bb6
- SHA1 1be6a6348110d75a4850d58199c26efba8ef8616
- SHA512 e8bc7bac923a84c4feeb19f1d7e0e67eea8fd9e5cbeaecd110ec112e23e21b8d2c6ff442468545714646cd8ea8abc9dbafb5caad9cbe4e5a7bb307b10fc227b5
- SSDEEP 12288:KCX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NE:Ku1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1577523BA520D80D7CD8F8F33F1A26EA2A7B29FC7B090C541677D24035A7CBD86D24959
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.5MB
- SHA256 738e1c0a09bfe09c9c906e23a5e7bb33e0dff74aed4feba89453f9d9d90c9e7d
- MD5 010fd307b49277594a1c6403d72542d5
- SHA1 5eb4ad5f3117eaa6fe694ee6e30017ad56c245d7
- SHA512 b581c56ab4c8f361c7541582c417c7071a5734840161a652524f51d500ac3979ba1aa8435560d78e80fe7488bdd24c19aee63ea221f2972625958ca0fb8df22f
- SSDEEP 12288:G4X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NQ:Go1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1627523B6520D80D3CD8F4F33F1A26EA2A7B29FCBB050C541677D24035A7CBD86D24999
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 2.0MB
- SHA256 4a151a415d6eb163d430831b932f3cef75c0370b6cbb67badbf80d6f93ebe231
- MD5 ea28587bce092431286735f8b069ce0e
- SHA1 757b4726419614410ffda92c845fa14d86719c8b
- SHA512 870d01b1dd853a7d4456a14e88986fae4cb76e9456ab5494629abbeb8563802155d5a545e7214f4263a76224adf814e978007e0aebc849571f8dbbd0dbe437da
- SSDEEP 24576:EfwvOk9RX6wkyAIS1RDxYIJk/wPO4ps6EEZXH8VEtt7N:qMnYI4R+IJk/wP3sZlErx
- TLSH T1DAA5DF29EBDC44E6E1B7923C99B3460AF2B178591B31C6CF029A536E0E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 49dc38d6027300b30207049259342f8a436f4392f5afd322351712ff417e0584
- MD5 29acc3339ac706d5d5d254221c8c3449
- SHA1 0feff241ea62ce526d4d310ae2772e4c7c1cded2
- SHA512 34194f784bdd06a9c829db08c4c8e8b976ad3453ec22eb4a9375b5920ea3cfaa3871b97fc256718f392df5d2adac16d9e6724a9f6d7ad3342fa5d495a79b3c60
- SSDEEP 49152:qYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01R+IJk/wP3sZo:KySzPPT8wvsZl+
- TLSH T196067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 04a0464da50ca010f2090367a62e3cf4172c81f43915ffadbd3226ad0643cbb6
- MD5 4f9788a37fba36153784998c78e35869
- SHA1 6d0b015d10e0e4f91e5545b43ca566caa3c978e2
- SHA512 2063681fcd831beb78663f031b70a0bd3510bc6ed3d351d9a290e3b6e71a1731ab27a316f42767b93d57ae9fa679ec46b38dd6d757dda480f1d3591633b85577
- SSDEEP 24576:f47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYl1RDxYIJk/wPO4ps6EEZXH8VEtt7N:f47JUQjairIhCnDHUPfF/lR+IJk/wP3R
- TLSH T1E365AE1EA3EC01E5E1BA927885154A5AEA71782E1B31CACF2270437D6F23ED45F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 3d8608a9c6dd882702a43f278a887e7938235740eb7f91f3c62e52bdfe9670af
- MD5 e031423999d09633c14418a9e1002780
- SHA1 9449636c686775d30333349dddcaca5a9c3d5295
- SHA512 9e6f8a679a3910a9b562d367d1849ac719e5e5800705f6d7d3f6a6dd70f767060d6e3ef62de98f143a26a8fb35ac31b8dd86c8d5c54eb06c9b0b3d093be8b783
- SSDEEP 12288:3ksfaX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N2:Dm1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T1A785F06AD25801E9C4AE6236C3965A41B3337C6693E1C3CB53E4F43E1F796D09DE9A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 77f832887f0f31e10e28cda677477c79902a832ad1f0963ad546496ee9a3ce5a
- MD5 b492be4b93a1be17577fe0a8e12a2ed1
- SHA1 80b26f7da0f0cd504a858f73a2483ba5043c3e7a
- SHA512 33a938856497c2e40a323b5facc9635499867b4f573809d378da112a1d846565ecd0dd9263c95028a4e02240bc32a8076f1912b03bda612fea23e06654894852
- SSDEEP 12288:X67+e1XqU3fShJsaDUl5Au1o1LHm+qW0RbMDAYaRBO0Dws6wZ6d:X67+06UPtUUllwqW06cYaRM0wDca
- TLSH T14D3528007266DB4FC6A940326E33C5CCA7707D01EE496F0773C98B3F9576659BAE2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 0f92861b5d11a11f4f1633bd20e1f9ea1876b4315187124ca98df7a47d152ba0
- MD5 3f6a56f1777528433f53f297c3805e1f
- SHA1 2471414e106b105f10fda9aee4e16aecd2d57e05
- SHA512 07dd4306d61e873425d84ff531f43903ebc33a710629b8c2c6cc18c4f513fbdfc71ef71608c679b0b0643b22f6154973640af789f8517bd935c37f5b665ebca8
- SSDEEP 24576:YXLtC3VH9Xs6utHnP9bS4rbKY5cfnOQbXhMB3CptXXHK2:QC
- TLSH T10F55D5815137A78FD1B66132072A5F4C6BA4EC06B7096F27B3C9453AD82AB11B0F97C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 77ac541791babc6d7de32e25b49d361c841f4e4123e11445a6675bafb56581e5
- MD5 734067e9b5494cf663482fd46f26f76e
- SHA1 cc540dca57a10f4071c1281ed0014a46ba1f67d3
- SHA512 f938af0f0b9f2d0c141042956d69f7607207d8518fcf2e2370dbf6d05ced543ff92dc1a88847d782923a434fc604dec84414c74c840e549978b61dd9d6fef35f
- SSDEEP 12288:tM7SX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NU:G+1RDxYIJk/wPO4ps6EEZXH8VEtt7N
- TLSH T156752372531D8093DCAF5F32E1AA9A227372EF97A750C4C3A72D20475978BC49D74A0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 0cd720c4274221477fa5bda89d49c88e9dbc2613d22ced7af508328465c46f84
- MD5 bffa829727e818572ad890b6fba02c97
- SHA1 27ee9a1be2f675f849f6865ad814c50bbf3f2d7d
- SHA512 49055ba8555da6f87e2b5a0b92033d1006e1950061a3073d6abb202e2ec3499cdc44f2098bc524dffdf8b22094fccf43ed7ff81dafc87c9b92cd2b3393bfa03a
- SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYk1RDxYIJk/wPO4ps6EEZXH8VEtt7N:Ogb4mBIBhGFnR+IJk/wP3sZlErx
- TLSH T1A065AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 7a4b587b964e04c5a7132078764892a4b170fab4ac1d0239723b5550b2ef4d54
- MD5 fcaa519e955f227f826ce0f04f71b49d
- SHA1 83392c91fe0f949dbb5fe6deb3efe5786dd75234
- SHA512 53578b8aa6457847de0a76037dcc95feee313d29b2d046ac55041a407585af252d94760e05195d6d93ddeeae8879191e2b320fe15b7f968033f50f4977bc05cc
- SSDEEP 24576:GG88u8FpJqH1nzria7/m11RDxYIJk/wPO4ps6EEZXH8VEtt7N:N7ZFPqV6a7/uR+IJk/wP3sZlErx
- TLSH T17EA5F16563E501F1D47BD138C5824663F6B2B8261364EBDF07AC8A521F23BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c09259155dac3d85183bb4f02a14cc36e1c3aee6b07a0cf4fc08290f9198b9b3
- MD5 81aacca0e0d96c670aaf0f619a705712
- SHA1 caba3d0332c26e2f0e607357f224473e3aeb2bcb
- SHA512 0dd9941001d8570cb39337d0ebf37a005c8c7769b90016bb4dba3bdaca763b511d98ca8969b3961665df8511f1a00b088c7c43e3cd2029e64572fca1b577dc89
- SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrR+IJk/wP3sZlErx:GG05lO43bMT8wvsZl+
- TLSH T1E9D5CF6E62EC01F9D1BBD17CDAC64A0BEBB23815033556CB02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9d6c5d24693745dc814ef48743e90ecbffa55e0c268543c22278e4f08b9eb537
- MD5 9bfe1744088c188d4e140939443b7e49
- SHA1 20f6cbcac330e75940ba4ff3edf9e0e93040b045
- SHA512 9f7d3efbeaf9d5c5a66c2b169e1f14ec8fee508223cfe87f3b59d65468f34e565a2f86f3aeb6b9da11903e78eadc4a58375d0c787f984634358c7e363cca0b0f
- SSDEEP 24576:cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnn1RDxYIJk/wPO4ps6EEZXH8VEttx:Ea5POZ3hJt2pasx2+mjR+IJk/wP3sZl+
- TLSH T11265AF5EA6FC00D5D5B9D17DC5834A1AF5B1342653319BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 e57dc9fb459ac9fd2d47f0985904226ea95ded0f712cef7facd8d8a497324148
- MD5 9a3c0c587eddc9e575cca44bc9102368
- SHA1 33e9650d18a127c1381753f6bb74f07b74b20afd
- SHA512 b7d1feee60595eee244a485c6f3adf836cc0d2b2a226db7d197c823f46467d4a659706dc2caa2c257d900aa1ae0281004ba7aae3905ab82fcc38ca1578bf2d69
- SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7Fk91RDxYIJk/wPO4ps6EEZXH8VEtt7N:fNc/zEOVHFOR+IJk/wP3sZlErx
- TLSH T100858C2623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 57a908289cadc9e88a18121f0296bc36421cd4ca0364a8ebac6207a4bf5f49a4
- MD5 94c3983f1c665cb805afa80792e41af7
- SHA1 9e524dca9c95e20013e08f7fcc1f995b779a20d8
- SHA512 eaad31e2e8ebc4b9209d33b9157c56501eddd830d89fcf1ded99009bb3ff0fe6d1e3dcad4e5838a94270952025d9c4628da1327b30334dda208e4f20b1f2ac5f
- SSDEEP 24576:Y3kNvNnaFeYhJNtmZBm31RDxYIJk/wPO4ps6EEZXH8VEtt7N:Y3MwBtOmFR+IJk/wP3sZlErx
- TLSH T1D455AF6EA6B846E4D1FEC6B5CD238512E6727861133293CB5390C13F0E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 165a514258c2d3bd4a0a4a320c17781e1ff6ebea7008d0ab33d4bbafdf579cfd
- MD5 e8ccbc540f178137c989f69d9c18f1e6
- SHA1 3e82b774ab71ef62580f4c28ff8ffd3c942c2435
- SHA512 7ff6d2caee013e2a264ae1a5225b88c5f392495fb229950c00c6cb9e3c0de3b39ea2f6fdebce017b2ac7cedba73072292f84c8854af19adc9266389ed6503a22
- SSDEEP 24576:GPUr+NQJ1RDxYIJk/wPO4ps6EEZXH8VEtt7N:GJQbR+IJk/wP3sZlErx
- TLSH T1B485E12F22AD18E5E67AA17DC5824719F772B8631311D2CF02A4817F4E67ED8BD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.9MB
- SHA256 0f15019524977bc9aecef01f8c746171d11162d14d2abd295ff70f1a37abf5de
- MD5 5b35aa8bdf1af53a6bb3cac6c4a70a32
- SHA1 407adb91af9c5e7edb9f77ca6498cc32d76fd4e0
- SHA512 6dd80fa823ef43cb59ca5d75ce4213af9898bec95e9723db57122a3aa6c1d1a6afc9ce2509054e4cd0271dcc0891973aec2353964e772acc1d7907422ae74a50
- SSDEEP 24576:vD3FHshBIYQgA61RDxYIJk/wPO4ps6EEZXH8VEtt7N:vDVHeBIAAQR+IJk/wP3sZlErx
- TLSH T17995E17EE75C00E5D97BD2BCD6638A06E77138A9032156CB029481BA1F6BEE47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH