Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
- Size 1.9MB
- Sample260721-eqebdsew2n
- SHA256 9d67fd3f47e5102d93cebfacef0a271c8479aa24b769e14a25fc94acb1be8d89
- MD5 67fd1359f3cbeb92aed8a8431d59e143
- SHA1 3fe1eeee3c6b22d40c420e68df38c219562ec9fb
- SHA512 0e439df5591254c723923b83d3df05aa2bdf832b2008b9c3e42ee51c72cf6d7b6d4f9a23821294924a4c8bc119a2570b4bc7473d25ee8654c36bb40c05a624c9
- SSDEEP 24576:8ihVy2WThFYlyN87NsHEVloNhOFPY74KY8fMCBTFKJo4IPpZThwS8N:Drt6hFYkN8qmlouFS4sZBAqvpZlw
- TLSH T1CC95383672F20199C45EA072DF465731A6D27CB18FF0D3DB8142721A1FB29D47A3AA1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 1160 elevation_service.exe 4104 elevation_service.exe 4976 maintenanceservice.exe 1964 OSE.EXE 1932 PerceptionSimulationService.exe 4440 perfhost.exe 1896 ReFsDedupSvc.exe 5232 SensorDataService.exe 4804 ssh-agent.exe 2052 AgentService.exe 1060 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ed57f2d024febf98.bin elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064ef9c9dc618dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfba58e3c618dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a67c5e9ec618dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000530bf19ec618dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1160 elevation_service.exe 1160 elevation_service.exe 1160 elevation_service.exe 1160 elevation_service.exe 1160 elevation_service.exe 1160 elevation_service.exe 1160 elevation_service.exe 4104 elevation_service.exe 4104 elevation_service.exe 4104 elevation_service.exe 4104 elevation_service.exe 4104 elevation_service.exe 4104 elevation_service.exe 4104 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4348 2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 1160 elevation_service.exe Token: SeBackupPrivilege 1896 ReFsDedupSvc.exe Token: SeRestorePrivilege 1896 ReFsDedupSvc.exe Token: SeBackupPrivilege 1896 ReFsDedupSvc.exe Token: SeRestorePrivilege 1896 ReFsDedupSvc.exe Token: SeBackupPrivilege 1896 ReFsDedupSvc.exe Token: SeRestorePrivilege 1896 ReFsDedupSvc.exe Token: SeBackupPrivilege 1896 ReFsDedupSvc.exe Token: SeRestorePrivilege 1896 ReFsDedupSvc.exe Token: SeBackupPrivilege 1896 ReFsDedupSvc.exe Token: SeRestorePrivilege 1896 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2052 AgentService.exe Token: 33 1060 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1060 SearchIndexer.exe Token: SeDebugPrivilege 1160 elevation_service.exe Token: SeDebugPrivilege 4104 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1060 wrote to memory of 3192 1060 SearchIndexer.exe 103 PID 1060 wrote to memory of 1432 1060 SearchIndexer.exe 104 PID 1060 wrote to memory of 5760 1060 SearchIndexer.exe 105 PID 1060 wrote to memory of 2580 1060 SearchIndexer.exe 106 PID 1060 wrote to memory of 4360 1060 SearchIndexer.exe 108 PID 1060 wrote to memory of 2320 1060 SearchIndexer.exe 109 PID 1060 wrote to memory of 2736 1060 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_67fd1359f3cbeb92aed8a8431d59e143_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4976
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1964
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1932
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4440
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5232
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4804
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3192
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1432
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2852 2432 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5760
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2876 2892 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2580
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4360
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2852 2432 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2320
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2876 2892 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2736
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d575b3e7b8b388a0d2755c943a6c7d2422b5b08d17cd9984c5138c4b2ba878be
- MD5 99dd23422d52e5bc19698ab828d27634
- SHA1 d799e9e1809b9696ef1d45653b23005f948f7d16
- SHA512 0e5e9c12b372480103ad7cdd45f32d97818952ccc1fb19ba37e9a15b1bf8c576071d53467223d0c8527e6fe6eb157827e02e58cc90fa9d69c67e21cfe68725bf
- SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjsZBAqvpZlw:t3q6HjBFtA
- TLSH T154D59D03F2D900E9E06AD178D7469133EAA1BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 212ba5f01fc928a551a754396dd8aa0c46cec9e8f2c0950e2fc56b6fe65c99be
- MD5 1b2bf96f95aeaf1721ca600c2b7b6dab
- SHA1 4d8e61f65e3caa834ae3f3fa06fcda3a53327ee3
- SHA512 4833a00f0f9438f84cbdca58945dfa619cc0f4e6950be8ec560157a6efe1290a4e0ee1d9af04e2d4a1e2a1a17987441c50bbe35a1c27158eaafb0679e7c28ce7
- SSDEEP 24576:ZXYfDtczAGKY8fMCBTFKJo4IPpZThwS8Q:ctcFsZBAqvpZlw
- TLSH T15905012977D408F5FD678139C9A2C501EB32B8910764E78F03E4992A5F372D8AE7EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 418161553bb01859c0edd44e3ea618de67712570ab74f7c61a431ba6cb6b241f
- MD5 4c4eb8f24f2192a973fd5d7008a5af9b
- SHA1 0b983ff1d7b6bbf6bcd560171108e066e1148b31
- SHA512 639bacf384978c6576536fd9a5cabeebe959a4c65de9ce21d60d25e426ca2a02f6fb02729aad9621fc0cc1c3ba3fb37487b4a7f49450acc1b75ee51c67707f92
- SSDEEP 24576:/0Le5ji0hmxirM4KY8fMCBTFKJo4IPpZThwS8j:/Pji0AcfsZBAqvpZlw
- TLSH T100359E66F6748371D073C0B9C5D2A68EED7130861B308ACB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e54fd0cca2a35a81d30123bd42b1673f534927fb7075f0de40e0263298d9cf20
- MD5 b6f2e5462586c13b37d65e5ac1931cd2
- SHA1 52ce535dc1e8f8b9dde8ecc5f41a7e5d0ea423d7
- SHA512 43f36a6b5e97b671f14ac7d5a507e4121dc80145c1be61e6dad875e9baee80b6af4d9b0da10ecf137e26c84068b2fa5a2654f5a1f92b5a47e69f7dbc1c62592b
- SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyueKY8fMCBTFKJo4IPpZThwS8c:O/ezSC6vUzPvxHjybsZBAqvpZlw
- TLSH T12A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 c43fa3f1276e9d876b6deae6d6d1c1400bfbae9ac0ee8a399820b961b700eec2
- MD5 41ee085bd42797fa0f5095cf46ee9825
- SHA1 3a5ede5a3402d33d75f98a35ec0ef0dcdc505d1a
- SHA512 ca29bccd40eff139815f85e6ec20e04e246fc0822a25568b7ce5f81533c1e59ec35a3769aeb60f05d9c197b7d5609cab727cdba4370dfd138624a32048c467a4
- SSDEEP 24576:SVbqPb88hv/l+6RKY8fMCBTFKJo4IPpZThwS89:SVO88hXl+0sZBAqvpZlw
- TLSH T161559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 1d05b384dccf28f63edd8bef718a926b2a701af7617897d978313d49ffcca3f9
- MD5 af966377b74c8d66bb238a378bed73b0
- SHA1 b487b22aad6c9220315f39693ab8950f6f633eb7
- SHA512 5990d02246045eab3ff9831d11f7b0c5a608e6c9e758394a02207efbcd0a2650ab35c781fc8161cca89db7c647614d24e5da95b818e2952cf0e681bfce89243c
- SSDEEP 12288:rR8K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rG:rR8KY8fMCBTFKJo4IPpZThwS8S
- TLSH T1DCC423A61E495192F2478573A16EFE08BB70BD91084CE6082354B85FD8BC5DAFAF7342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 2f66b31e8b6de9088d86c91c2bc6cd90db8cff058d8bfda237fed02dad635d85
- MD5 27668b9ca32bba8365f6d0b93db5d9bf
- SHA1 92b391ab67ea9a9e8e5ef4063f399d53740e4946
- SHA512 df2c5496ae3227597dda6482c8355895c9f76f2ba852c46987813aeb2eb3506bd341985dada62e655069708d7f52f3e9ae3f9c46928e6f6ea9ee2fc6b4f2c1c9
- SSDEEP 12288:teBNUbTVO86UpK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rJ:tJIUpKY8fMCBTFKJo4IPpZThwS8t
- TLSH T11705CF3BAE28FCD2C27E8DB95691C600E77278704F11A3CBD164820EDE275E15E7AD25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 9b05451b08de8e33a6d39b84132001e58897ebcbf9b5313cfaeb00b7109e4c75
- MD5 23e4c1c71f434b2d07f9add45e1978ba
- SHA1 2cd0dceadc7394962a00e401b40ed28f9f4e4212
- SHA512 95491e5178964bf5b2c4c1ecf79c3771f7974573f26d88f5c4dfc3c0bacbb1838cdfcf27d1a6b2351dd860eb3656742e8fb3b186356b6dea3c355f2af546d112
- SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:DQvGAdlCEL8c/yRNw5CxtA
- TLSH T131266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 98ec6034e54e3e140a3f05953525f2a770935841798ec59e37948fdf5d9bfd48
- MD5 30807bd9e67157727f96edb7ad6f05e2
- SHA1 94723d9c8cacd5f6ef07d97c5937c012814abb47
- SHA512 087bb37a9aae0ccafac497800547c4c40f46c643a4258bae9daafa74a7debfcf22a8028aeaacf1e61c5731256624e22d74fc034032880b9e97e7d3fe0bec2e7b
- SSDEEP 12288:4AwSfxL/2Dc34DLLmt0LDQewsAjvK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwB:ddewsAjvKY8fMCBTFKJo4IPpZThwS8B
- TLSH T17115E031FE74E032D27B0DB21B36D706683CB9600B511AC3E3A89D9E99742D26776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 df82528cdf215556de30f647119a4c42c6e3fc1c4e71a4c6b3d6023144b7888a
- MD5 7820ade03894835f807279909ee71c35
- SHA1 c08ef3794eba4487c4bffd8c009ab946c5b76689
- SHA512 01faa554917c0c0560a44cc610bf1e4fce92416ab9c58b9281835124caddc43fbdef9dd4cee4857f3776019452fde218c50c215bb8b8abf71730e0a7882a00c7
- SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHO:aUEtQevvqc2W1cpV2EI32O
- TLSH T128474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a869cca1da23c41943c7799922f820820c6d1182d1d997d4d2623036bb0eb580
- MD5 901c0b87549af1f28706567c30e7925d
- SHA1 3ce5a55f1fff659dd7da4e969c47a43e53f28899
- SHA512 27ef3c6d8f7689105ca9904afda0dd503b9a4bb426c78c4b86e303c35871a71ceceb927b9df6c9d8e7288e775acaf8d30caa5d1f00223cffcf15b1e7bf9104c6
- SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zPsZBAqvpZlw:QoquVjnmttA
- TLSH T172D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 0ece1814aa1605995dfbb43ccfd62175e9b0435b305064696ce942dffeb8f55c
- MD5 0ba21d7ff2b5c1f41eac65a46a82574e
- SHA1 9406ecd859dd6f3ea6cf69b2980106c1033aa211
- SHA512 5974284140b05f50a3708fb8c683c9ec38ffb231b9484362b2d4bd367f61fe96b14b50b475b6e9dc6adc91f6740e1de1a2989169335784a3c28ec56e94c4c403
- SSDEEP 24576:jAhGLJIFoiwtA5l7S53KKY8fMCBTFKJo4IPpZThwS80:jAMyFoiq56sZBAqvpZlw
- TLSH T162359D81EBF955D4F5B3AA7899B69570EA72BCA65E30C20F2150D11F0E37E809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 8e7928586e3528eb23bdb09cbc5a1ebe5cdf34d0c39e5ad86b6dd8aef1a4de11
- MD5 263e9acda74909d83b9c11f50dd0cf28
- SHA1 e94068799cecb43fa2f21d02da801c14b00f05fc
- SHA512 c51fed2c3884a412c338944db4c6e935af428e13f67e90934bee4782d589296c660ed118e94f1f5c4991beaee7ea3d210c585ca6815ad4fac1eb7a59a41ddacc
- SSDEEP 12288:4mw5HEjsChNVBFgl0WDm+C+K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rt:1wuoOW7KY8fMCBTFKJo4IPpZThwS8p
- TLSH T14B05F14A36A40CF5F5678139C697C536F7B2BC022A25DB1F1360C65B6F37261BE2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 ec38b932f7ca4fce75c603b446636afdb5a8c5ae79f8ae069978dd7484a911ca
- MD5 52b0997aa89cfbe66d9eb641425c1ae6
- SHA1 66e11341fc06d3cd62469144ca18f48e5e572f07
- SHA512 9cbf5b54c1472b751bcc0b30e05d65975cb8720b546a2b3ea45daae0657eab94a0e1474f45c2e703d6407c94da2c66f26689aa9c62ab5193d4c42561f9359a17
- SSDEEP 12288:sBZ1Iy/K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rY:6ZuwKY8fMCBTFKJo4IPpZThwS8E
- TLSH T175E4229A37D420F2F1538139C9F99A04F7707892173583CF1224556E6F7BAC6AE7A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 16e6451f1238f303a1d17ad82984aba72fa513a81c913323e37b9631a3f3a94b
- MD5 40d4f69f30885588f15539501d3dc790
- SHA1 6d2a54e4bc7559d1b6399eabc0fc99bb38cbdb99
- SHA512 c5479e35cf2dd6a7baa2ada8f393b1980a151a34a71646da34f52197826b76d5e24219114ed7632d2b1b8e46fd74c4e9fa46e6bea0871b6d7246d30bcb7be050
- SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:9QRQyi36YOcPQLvw2gAf+PN3UtA
- TLSH T16B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 059d92c65208d76eebeb07ddf9be6943709bbdaad08d1b5a11de3301df95c56a
- MD5 0de6aa1f5bf9475e169e7f5f13321fdd
- SHA1 d98e27e9190bd044f05b1b4a7bf6100cb0e5f0dd
- SHA512 7857dea85b123e276231c343931011fcba1acf5acdb0de26a936bbc67bcc51e38b2852ec2f12bc0738a7c829965a940976dc9575a9c8c6d0e7a34d87c198d88f
- SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:dQRQyi36YOcPQLvw2gAf+PN3UtA
- TLSH T10E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 c984ee4cf32d099d73000c123e48ed114a1f79f9bd638f59703e381eeffff478
- MD5 5a5f280bd87525632c566da743ab4a36
- SHA1 f819243e4fc312b1f42f71843dcc6bd081dcbadd
- SHA512 e3ab8e6cf18cd0531feb97866bdc317685bfd648cbc75172d9439e8bd29d1d1c7a75f1a53c84899d001a157cf9e1b67e91645b92bd84962c9885e79f0e418245
- SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0gKY8fMCBTFKJo40:468Qg55nhheWu7PNU3/fsZBAqvpZlw
- TLSH T1F6B55A33B2F60099D44DE1769F4A972196E17C718FE0E3DB8511720A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 72e1280a08ecce7d7d1bbd4afd80be82bc26648879dadc1035d497cb3103a815
- MD5 faad28cd2afbdce923fa2e0f946aa162
- SHA1 5dff58d63c5f5c980507eaa4ddd840f52b9b8a14
- SHA512 52c85d34fbd39f2d8954c5ea8b4e57aaf44667f074241e1672f73e359a7d0035ef661ac3700ec0b719608fe95fa4c92b7c2d9873f94798f408814d13bfe85e7a
- SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:gy5112gYy5azzVvL69nLKnhZ3tA
- TLSH T18A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 47637c319dc4f10034ccceef0e8031bddc42ac68be58aabdc7c6f7e9a0e1e329
- MD5 12524058ae52fd0c740120fecb0c313b
- SHA1 f8820f449af437848980e6c128bc4b16f0664d4e
- SHA512 b303260b44f43f92442391b1eb1dd8a04fa92a598d2a70bd811d14fd475865a7ce9dfa2c9c6f1cd342a65d558549d09cc1cd1bf8f6cc955cc1f84e90c7945d53
- SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWsZBAqvpZlw:Iu6JmVxd2dptA
- TLSH T111D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9072562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 cd145514ce06021e28fa48b5a8b0dff1f43580faea7b9d5542a7974db7ed4d61
- MD5 c657ec130bab8c4e39ca71f0e6b5a640
- SHA1 fa8f5062768c63a7c4fd69867310d53c1a18f2ae
- SHA512 42df91d5a374180c947bf9e4c10170a5612bb9eb73e8f3fcb89fe459b3c9461e276a88461f6f74669d06bed0338989bf851654a416243e4f5425b17914964033
- SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xJsZBAqvpZlw:NmifPbRttA
- TLSH T152B5BE13F2D900E8D05ED178875A9632EA71BC460B34B6DF0A90B7961F7BAE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 c9ef35b0b605a7b29e056fa4239b87791f5af0a419dc3739c9360767807a3bf6
- MD5 76a3f353de7d8d8861e3d4ed97d46898
- SHA1 d8759a2584bc964a0f36a707594daa634c0dda10
- SHA512 f4a947daf5743717cbb91c3c7d6f78d057dfb0d6c66c51bdfc420dc267e673470c6b621c663d05eb85cb4a6b0c19451ca51d5b893214d0381aedd2004eeb2e18
- SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqwsZBAqvpZlw:f5dKTi61btA
- TLSH T112C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 b29bb926af76db7c993968c325098ad0d4a2b59e81ae6d1b7ce9e3395f3dc385
- MD5 d447d5cd1146dcf772db36815adcb750
- SHA1 63a658649e1f2c641d33c8f0c42e23d2d360f527
- SHA512 2beab732e030de38aec5eebac427661227e628c81cb1f4036e0ee7ec9b081790e91c8e7be0035d950cce19e6035e5cd328a3e0a489cbf2d3e25a72c10f4ed067
- SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wNsZBAqvpZlw:0X2iyphJtA
- TLSH T17395BE13F2D900E8D05ED175C7568632EA72BC160B38B6EF0A90B6561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 55845b8359f6c9cfac1cff432eac9a4825f1b75a5ab8fd3e6aac9f220a764bf3
- MD5 b4eac98e3354d0f38798bfe05d6e333e
- SHA1 a185fe2d8209c5a44db640fe49f536fda0f6f9d7
- SHA512 ecef463a07d193a389c7e51182b2cd661f4519244744753f10affb0ecff693854e4b379c888db4e6a4a647fcdd20dc9ff90ca8e3d115f62faa46e20cacce2fb8
- SSDEEP 12288:d0K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rm:d0KY8fMCBTFKJo4IPpZThwS8y
- TLSH T142C423AA1E494192F1078173E16EEA08BB707DD21908D24C2349B81FE9BD5DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 f5a0ad79d8bfe620e5e7c0c6d6f8991774d71a812289320872ee00f13dd943c6
- MD5 8d30163f0de64af7d3e78baca17f4493
- SHA1 e8a6aac430793e1f5bac2ec95ebae8af3fd17f8f
- SHA512 b6f063019f3704d6e23f1d93da7fae56b33b3c27f4fc0d216c921a00c96b3486cf4e25d0b334b6a7fe40f15e938f43ed4fdb250432d3fcdf43acd4172781a39d
- SSDEEP 12288:CDK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rm:CDKY8fMCBTFKJo4IPpZThwS8y
- TLSH T11EC4236A1D494192F1078073D16EEA08BB70BD921909D34C3358B81BE9BD5DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 5b74543f4ffba46be00cf5b7512c7019a0ee91d1dd13c44c6cad9bdcbc0b4aef
- MD5 591ee43a4d4f8f60d37fde0fb1d20be4
- SHA1 19468d0ee1be53df4af170571760e293a29735b5
- SHA512 a8a161cfc089f3334b8630bfe3de4e2ab4b5c8d145d1c984ef7f2b8e06a99c09702e625927b78177c9546dcf692032ce3e916f3de8cf05ef37811ec1aff177ae
- SSDEEP 12288:oBK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rx:oBKY8fMCBTFKJo4IPpZThwS8d
- TLSH T11AC4236A1E494192F1078173E16EEA04BB70BDC21909D24C2349B81FE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 e5f7d617daa3fcb31398523b916258d55a71e82b794823f412dfe015e67ac2e8
- MD5 2da6cf5572d8839b73ae7e2f8c97eb16
- SHA1 9b109838107e3a125f344754d585bde62444cac2
- SHA512 a679bc9fd536dce0d186e0d68ec8d9aa79c9d96e41a75a361440a67b0f37dff73492498c66a756ca944328678db4f4bd0022790b416635d040d9e9e89a017bed
- SSDEEP 12288:+VqK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rY:/KY8fMCBTFKJo4IPpZThwS8c
- TLSH T19BD423662F5901D2F017C172D16AEA04FBB0BDD11A29E38F2304681F9DB92D9FEB6741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 fb61002f9603d236211ba97b9ec89be830036dda578f46898c77b5b4055115b3
- MD5 869f5f5dbb98f7cb6262d7ca6377aa65
- SHA1 a56323a582f0d8854394dfd2f191bd13893b2300
- SHA512 c4e98ca6c39ab508f95979f8d7f6868208d40d3a2ce9510caa6cbd6714b077e17129e88533364be6872e53132adc85e72611bdddf543cf4849ce1ff05c78fd4d
- SSDEEP 12288:SyK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ru:SyKY8fMCBTFKJo4IPpZThwS8S
- TLSH T121C4236A1E494192F1078173D16EEA08BB707DD21908D24C2349B81FE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 038a873404b586be64130bfd81e31c4fdbf1de9c6f354e25b26feddaa65a9c02
- MD5 9119b985fcb9aa7e36886f3ed165c2e3
- SHA1 404858ab8e13dd22bb7c0c171bc6ee79257de203
- SHA512 1d5c80723e5b434b10698057b3049969d92a4e9edaa45b0be4e8c2a295b5a56c95e705d1a48a336ffcf412d28f45576c28f2ffdba6471b060ed5598724e4e236
- SSDEEP 12288:OnK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ru:OnKY8fMCBTFKJo4IPpZThwS8S
- TLSH T172C4236A1E494192F1078173D16EEA08BB70BD921909D34C3348B81BE9BD5DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 188021b93b22abd6fac1f3d28f078065c8f79c7018a884c8c05c023afd9cb00c
- MD5 ce3cf3f799ceb95b6d8d45ffc1efc0ce
- SHA1 0cd3003f475ad19f294b542a88a8e18a7144a74a
- SHA512 cc708cffb43d14dc619474f12efd7f5af8af154270936af578f98afc45213203b905f18c3e876551eabb2887206cb2ce41f6519a52faba6f7cd50b736a30e6ea
- SSDEEP 12288:VrK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ro:VrKY8fMCBTFKJo4IPpZThwS80
- TLSH T1E1C4236A1E494192F1078173E26DEA08BB707E92190CD34C3348B81BE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 12e3ce4eeeb9409ab0cae7940b17b8a5a538ce3d1bb637ed49670e269ddb67f0
- MD5 d464dde292aebd825bf102065aad64ac
- SHA1 5c12dd836bd5d38754eb95911beaf31563718937
- SHA512 d3f1cddcc541e51916504159d8222f21b86e8cc02dbf84ae1d4da7dcf9d6171e05fc391948b077129418e1b121b41b4e2cfd1b0d942621bc59d7495f6e0866f2
- SSDEEP 24576:cZMSzFVSOjKY8fMCBTFKJo4IPpZThwS8u:cZMSzf3sZBAqvpZlw
- TLSH T1BD0501A5739008F4FC67813EC9259D05E6B1BC5A0B60C60F13A8362B5F773A16D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 53b838771368c294f080417829375a0fe0dc88472e10e2478bb9cec00f8e6128
- MD5 aaab092f38c1928c35286c18947941c7
- SHA1 87546aebc71db47701e215d4e542293963bc2bdf
- SHA512 37a395ad880bda7fdea962714681caa890012276cb50e24a3cc8c145fd07449d20f71c1ab7ccaff94ce133592d10b45124eeb1d96fd437cd8ba2167c49fea691
- SSDEEP 12288:1AK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rr:1AKY8fMCBTFKJo4IPpZThwS8P
- TLSH T15FC423AA1D494192F1078173D16EEA08BF70BDC21909D24C2349B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 d600f07477be3883bc4cb51e9923624cea5c1d1ddc6e13a59930377d8ba06168
- MD5 0eed9f95c227b9a8ad3710373d6ea605
- SHA1 5e11db7bf8e4a3159dbfe3a91483e237ebb9d2d4
- SHA512 a4b7b4fc56536f58ae2a3e5f0ac04acd68d522cfcfa2fa82f717fa07712992cfa13d9b4d20e5a562cfd67aebf7e5532cfedf0b4fb59afabc4889366934571c10
- SSDEEP 12288:xMK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rW:xMKY8fMCBTFKJo4IPpZThwS8y
- TLSH T1CDC4236A1E494192F1078173D26DEA08BB70BE821909D34C2349B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 72b38e08e3a987f2d9fe9bdaeead914af30de7ba4fc779b61797c3e5b31b2fe6
- MD5 4b687742146ce77e1b0ea22bfdae53e2
- SHA1 33772e31e178f846f4099311414bc9ba7d626578
- SHA512 7f2dedb4ac4c18bc585908eacccde1bda94b4426bc1f9a0876435cfe89cb6afc0917edc016710d486f619f882667903823281c639d423882cdc7f55aeadd132c
- SSDEEP 12288:iyPz5L8/K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rk:/zy/KY8fMCBTFKJo4IPpZThwS84
- TLSH T11CF4125737A530F5E1278235C8665A01F770B8720B24CB9F13A4563B6E3B2D1AE7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 ad5f48cec920795032a4466db1daae839c45c0e3bbba01bd08225b47a89862c2
- MD5 e92eef417f4411f4931c6ed78358a78e
- SHA1 4e8da221d17a5f20e3aaa65f9c511a9542d20804
- SHA512 854028d583770f5cdca6d454510c2ee9a8c475262b44f2c14e9369f135bca76022f0e9a4e34b37f2112af36bb5569e1f81c61b094e1f074f2328ff81b9b40559
- SSDEEP 12288:bAK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rI:bAKY8fMCBTFKJo4IPpZThwS8M
- TLSH T1F8C423AA1D494192F1078172E16EEA08BF70BDC21909D34C2349B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 54686df9ef15c62ee0b0a02902636744b357809f698372e19311b82675ee08b2
- MD5 83eabd2c43ecb9d2f6729617248c032e
- SHA1 995df2376fb923a10e1570cef980ee6701b4a9d8
- SHA512 b8f2e2047c9ae6ee0e657e3e945d50ea20153b635bd9a7c781bf7a057497cb3897b3391fe4a9168a74e77612a81a950d0941226e6e9737533e6713262907c3b3
- SSDEEP 12288:tAK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rF:tAKY8fMCBTFKJo4IPpZThwS8x
- TLSH T12CC423AA1D494192F1078173D16EEA08BF70BDD21908E24C2349B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 86f1fa106921942dec1324f3299a9d617203428fe992949f82bebc7ed3949695
- MD5 bdeb9c800234fb5e4671a786bb109d22
- SHA1 a961e7a3bafd7ec93a77db48ced22ab117660709
- SHA512 6ae63f3df00f9c3a283714bd3ea3cf3518a28510cdd16efa1e9dbaa2fefe37f8411427a3553371e4986534b3ac114a5f94338a4b01a27773cdbab4ecf3d377c8
- SSDEEP 12288:GyPz5L8/K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rz:7zy/KY8fMCBTFKJo4IPpZThwS8n
- TLSH T1AEF4125737A530F5E1278235C8665A01F770B8720B24CB9F13A4563B6E3B2D1AE7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 99229762765c058d9a16c3c7ef7c8c3d08f2ce82871e2fa19bcd87c636782922
- MD5 152a1f18f37944300d367f60a05585ea
- SHA1 4ec3b10a0718aaa82c2c518ad5251173532e425c
- SHA512 d70400be91d9cdd14c611209463b085381d8fdbebffa47a96752751ffdc1f6c14b35e902c3cf3da0e9e53a9e2d83bd20594d42fff1a7dfe6e8b4a6178c1f0a07
- SSDEEP 24576:hTHaLl3z0zDxKY8fMCBTFKJo4IPpZThwS8o:hT6LljesZBAqvpZlw
- TLSH T1AC0502A5735018F4FC67813EC9268906E6B17C5A0B60C71F13A8362B5F373A16D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 3fa7e2c6fc3997741a803d0ba05489fd8b644130ac661f5f70f319a32b238b9f
- MD5 8085012773579f93a187804af44af739
- SHA1 f2bc888ca77244d80e81b87e49c482a7c5323f8a
- SHA512 7d9bc96d97af9eee3d7781a794e71337c28e7b37ecd83496c8a90fdf6a6b0e49d0a0c335084387594a5624eadf692af4b02c36bd14f311a2d4cf9bea9b9780e4
- SSDEEP 24576:937d9CHKy7GZlKY8fMCBTFKJo4IPpZThwS8m:d7d9CHKya3sZBAqvpZlw
- TLSH T1EB25CF90F3E410E4F0B7CA35C9769511DAB67C9A1B31DA8F03A8651A1F336D19E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 5c50dd2318fa3e0e18f3beaa096aadc34cca5c4d7db21dd3378a6ceea4b6ecaf
- MD5 4853c08abc2d943cf09c38f0f9d4d832
- SHA1 2b0d51560228d75665b5b89e6be853cff1c98bce
- SHA512 6441d310cdac497bee413080dcfe13e089656f3853fd0872dab5949d0ba154855f7219bfbdd2ba0e78d122e4700f7760a9d7b6ea11f27530ca91643b907a4604
- SSDEEP 12288:GhK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rq:GhKY8fMCBTFKJo4IPpZThwS82
- TLSH T1A7C423AA1E494192F1078173E16EEA04BB707DD21908D24C2349B81FE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 90d3b293adccac1898b76880a61b1ca28c2ad82674835a33d19ff94977230f21
- MD5 45e23f635bea7660dd5188b649975343
- SHA1 c011137886cb2d4f677cd1b3550002a9e590c4ab
- SHA512 dd3fc836e91f82e6d3a437e0258b00504528b0b288ce1d9efa773d698be530efe8949d5e688b423abdb095e7af9023efea06a3e3c42b7e04a2a602faead2c029
- SSDEEP 12288:ifK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ri:ifKY8fMCBTFKJo4IPpZThwS8O
- TLSH T16CC423AA1E494192F1078173A16EEA04BB70BE921909D34C3349B81BD9BD4DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 dc91a1a145562d2315da4b07dbee7978e2ea9e9080da70b7cc261b66b6225671
- MD5 78a886ec57e84dd34c9ee1e4fed15caf
- SHA1 82287d1f5310b84480cc8724fc145ed6634bdbd2
- SHA512 af477c3358c9358fe73c6014591f3531c24c23ac60545e11949249da412d10bc370a4a4e62b5d60f335f5b976cd80ea974055c662f84d844f92d6c2d109f91f5
- SSDEEP 12288:3GK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r2:3GKY8fMCBTFKJo4IPpZThwS8q
- TLSH T1F5C423AA1D494192F1078172D26EEA08BF707DC21909D24C2349B81FE9BD5DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 14c5590778cded0fa233040972ac3aa17732039948bfc2f90fa659bbc64ced78
- MD5 0fb9bc4909ea6957c04f246d1e91e0b0
- SHA1 63dbb955cfed16ab50ddb75b7a2ba3a8ae065c72
- SHA512 0ecc957642cde22bd66db512ab6ad4408394125c4536267931ecce9706e62bb5a2f5524a787516ad25e672b12bc844214bd252c9d7b5a7a718f80da96c0aa63d
- SSDEEP 12288:TAK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rW:TAKY8fMCBTFKJo4IPpZThwS8a
- TLSH T137C423AA1D494192F1078173D16EEA08BF70BD821909D34C2349B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 879fc85ae0dc5baf8aaafaacf1ccbf8c7f2f36f19737e756ebe3d3683d8db121
- MD5 0f01a46359202af40d242748ef98fee1
- SHA1 060e2d1bf411d122d0530818023f23e70419b4a8
- SHA512 7a8cff51b91be35dc8589f4cb1ac7ed2de1be3e1a816856860d64722a6bd83d767446d121f4292ca51240bac1d85c13475440a1490f330478da2fc50ce0ea8fb
- SSDEEP 12288:mhK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rq:mhKY8fMCBTFKJo4IPpZThwS8G
- TLSH T1BBC423AA1D494192F1078173E16EEA08BB707DD21908D24C2349B81FE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 38eea72f9cd42c51ef340080194c69e2924a13371fa1dbbc8ef54be6e64c3799
- MD5 ee4760b23746dacf437f1a10ca148c5f
- SHA1 bdcc4734c18b89049ae3bd744e5f114a4387876a
- SHA512 369bbf0f02fe48da5efaa4844ebe69745f822f841d95b400d35e5ce94d780cecaba3a18f7975f3d2c5436d01b54bb8a28ba3197b7f4833c6eb1d1a2669747a96
- SSDEEP 12288:CoK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rW:CoKY8fMCBTFKJo4IPpZThwS8a
- TLSH T1C4C4236A1D454192F1078173E26EEA04BF70BEC21909D34C2349B81FE9BD5DAFAE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 d36c09b1d80c337631de76ebd7d432c7c1a85d2a4fce761011603abc071a2c0a
- MD5 3e4c2cb0743d07b45fa1c86ea9a15442
- SHA1 884d54007ed577816e636d2b9bfdf2fea2c503c6
- SHA512 04ad722a9d45779c5c635c479e10865a1729e8c02af47d1a2bd6f1a4788c96c101ae188f9071f4f8e9eea47ab7c90f9f633d21f0abea86899bf8897772b5b81a
- SSDEEP 12288:VyK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r3:VyKY8fMCBTFKJo4IPpZThwS8T
- TLSH T186C423AA1D494192F1078173E16EEA08BB707DD21908D24C2349B81FE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 88cad8f1850504ef0df3c1d4c6e969833627429b52189d13746a540c325cfb78
- MD5 99a2c11f77ecca5e586d529b9adeb1eb
- SHA1 f712ef0ef5afaeebecfc3da9d86eee9294da3e54
- SHA512 b0e84adbcf2af840f4e721d3cba0bde4eaff7487edf9dd1126c185ded2ad73ad0c2551557a0c1ca311c9599363280cc7f13a45d1e0513d4fa6d92bbcb6c0a55b
- SSDEEP 24576:1fwvok9RX6wkyAIcKY8fMCBTFKJo4IPpZThwS8J:zMnYIcsZBAqvpZlw
- TLSH T1B335DF29EBDC04E1E177913C99B7460AF6B178591B31C2CF129A536E0E37ED4AE3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 80921059a6658d69d7fd74331456b95996766962d813a14321767ba762bb8e5e
- MD5 bb3a3c1a2d10212b83e1977cb47ace35
- SHA1 04453da6fdf491ec719925ffd378d1118ad7a1a7
- SHA512 d58bc9bfa5598ca405c8c36721c38ee2040ee76a5f527a6fa2856764d877a204ec668bbe1ccffc4a3002c65b356dc853c4678433b7889eec0138cc8b69a69054
- SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tsZBAqvpZlw:bySzP0tA
- TLSH T1E0067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 d4f356c064db410c4e27f710852c34bd77d2fe2c2963e70cd07f67b8676f033f
- MD5 667d544d40cdcd9926aff1edab5f8ed0
- SHA1 28e21cb9572654c5e20087a9f3f9d4051dc76356
- SHA512 75a7c968b0b243c7ef23b5b7e80ec8e00960a9d4dde2cd1fca76585d526ff59469ef15401ae390576b74e1b051061e1210f0f37f1a217418bdd38da22546f5dc
- SSDEEP 24576:I47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYzKY8fMCBTFKJo4IPpZThwS8u:I47JUQj1irIhCnDHUPfF/9sZBAqvpZlw
- TLSH T1DA65AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270837D6F67ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 a96545e76a111d41d7010b44273ee3a7a12bda8152eda38db16dabe0297ad1f7
- MD5 8707b926117f368961c2683297c0784d
- SHA1 1c9dc9f17d0b80f5ecde4a3efd1138cbe7b34a40
- SHA512 44d75d28fe9cb2b65b8adbd3ef03806ed253555cce406a3af57fb8eacfac5f1d8ecd04eb5fa9d928b77c9383a3511e6f6c869d1d259870b18cd3356c27c6ee9b
- SSDEEP 12288:DNsfwK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r0:AwKY8fMCBTFKJo4IPpZThwS8I
- TLSH T1CCE4F05AD29802E5E06E9176C7569A00B7337C6147E1D3CB23C0F43E1F7A695AEEA703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 bd144ac01885546390381bfb66ceeb9cad01c6f4254ccfcfb5d16736d479c0c1
- MD5 c2ebad57a3fb46c5243191599abf7a0a
- SHA1 ed32809c609f8546dfd16ef89d8a82c0fed72675
- SHA512 a5eef75bd853a3f9c55582acf7c1a0fae2f0fa39738f621ba62d96dd278b0fc5c13cbfcc6b856ab8a9d58b36bf0b0ee62b0571c75b7109f49bc449a873a2ee6c
- SSDEEP 24576:hiCy1DUPPapjcJC3gsGwk1lonUYu6VbnLvQyzVBjM1:A1DU3AjcJC3gsGwk1l05nUyzVBjM1
- TLSH T109452840762AC75BC6A950321E36D6CCAB707D01FE049F0773C9873FD476669BAB6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 7700d293ca5fa1fc3d75ce9cb499d699a9270507619cf6ddefbd22eeaa3526d9
- MD5 3a475e80b0f03f8c9f65fc75e960e490
- SHA1 935c2f206da3976a293a3aa7fcb02d94930f082a
- SHA512 c83521e647b4ab48fab1d2f8410b074f94ac7b1840114ff9c6dba0290f54ebb0754219fa4bf1dfcd7711e90f13bda6aa42db660318f3ad98b131f2f5b60170de
- SSDEEP 24576:EfwGEM+f0DaLfI28iO65H4SgsG2gsGuk1lMk1lojc4weV0QQT:qif0DaLg28iO6gsG2gsGuk1lMk1lojcz
- TLSH T1AA55294065BBE35FC9BA90370332C68EAB745C07B7493F0573448E3C986697EB5E6292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 ca129c3d373096eb71124617d505ff8b89e749e757ba1b2a2f418aa3d667704e
- MD5 b4a432edad63fd441477573d2edac9d9
- SHA1 2ec8265f1fd757c8125c6e6f8aae3edbf9ec91f5
- SHA512 b02c90ab061b982d6ed22568d47c97bacaaab5c3ab0c8086f669614f37af0912a99d887e52beadbf5a8bfea792e36e08a6c466b649dace531a30befae9d22186
- SSDEEP 12288:S07YK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rs:DYKY8fMCBTFKJo4IPpZThwS8w
- TLSH T180D423661B495592F02B8572916EEA147B30BE910F08D2CB7208745FE8BC5DAFEF6306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 564492c77a14e2c076ce2a2b619b10981f674d124937fca64a04e2e5ca762e0c
- MD5 ab928d79ab8f122c73670a7dcaa81cb0
- SHA1 89e5df35460ad39318ab0ffe60002fce5e3c7b14
- SHA512 0edfc7c36a5f1cfc2a30807d090a07e055de1cafbd90679c4a017f144920fe919761b44754833ee87df7c1a50a09f9464cdcad2578786050ee77001eef321bfb
- SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYeKY8fMCBTFKJo4IPpZThwS8I:sgb4mBIBhGFzsZBAqvpZlw
- TLSH T1F8659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 46179dc5cc639264615ddd0a22ced25fe98df26b86936e8829062dc8a364408f
- MD5 9d2f7f9b6325463d5928c6e5ec59c1d7
- SHA1 73300e110ca27a4e57c6b93342b818b7662e698d
- SHA512 c26e8969567dac121e2e1b374e78809538642853f9e9fc89305b24465c539565bec75d9c2f484a2e5d3fef2f10d60beadd95636610ccc266d5f09ec1a5795c2b
- SSDEEP 24576:AG88u8FpJqH1bzria7/mjKY8fMCBTFKJo4IPpZThwS8D:T7ZFPqVea7/msZBAqvpZlw
- TLSH T10235F16577E101F1E07BD13889864663F6B1B8210364EBDF07A88A561F33AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c4dc8cd50c438ba738101e1646c5f27ffe1856ef9e73dc717e9cff35ee51396a
- MD5 02db5306553a290978fcbe75bb00095c
- SHA1 9f2d8484586fb75bfcabba2ab750fb775c8fa54a
- SHA512 3b668c1102c56f05b214065d9e2e2fe6cf8dae24ef7bacb6df2eff6271105ceba4d4162c9c985ad59779d176f6dfa8afff5d6948f6f91de54604cde838a2433d
- SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnsZBAqvpZlw:zG05lO43bvtA
- TLSH T1F3D5CF6E62EC11F5D1BBC17CD9C68A0BEBB23415032556CF02A486A91F27FF4A97E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9395d5b522701f02bafcd9099eade423b3b1df708a32b5a123628f404096d11f
- MD5 0b24f4f67ed1d533a399318ff454a4d0
- SHA1 fe8c01e2006f1a1a77be00d5c42505c40b823b41
- SHA512 ee9d5e73661fd30d7b31175f2024b2db2f285647de7d774ebbc391ca2ac64ab8f800928898d6eea0b8e329a35557d86afa5808a564f0737d0698da1cca4e7610
- SSDEEP 24576:ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidntKY8fMCBTFKJo4IPpZThwS8d:2a5POZ3+Jt2pasx2+mfsZBAqvpZlw
- TLSH T14C65AF5EA6EC01D5E179D17DC583861AF5B1346213319BCF122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 fc8a206579d56643f137902d735b429254d19a90c179752f2674259c167bd87d
- MD5 3575c1f7c5e5e19f941a822b1965ef03
- SHA1 855c259d6d5b930f3fa5f0d91269de604f5bfbab
- SHA512 162fc0d324c6b6c8109923e1969ebd0c35cdc4b68659b4531586880301772de630b34acdc81a4f92bf2163114da6a9c39197434e96de8ed8b0f79c6b9ed916b0
- SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkbKY8fMCBTFKJo4IPpZThwS8K:uNc/zEOVHFGsZBAqvpZlw
- TLSH T1FB857B2623E901E4F1BBE1BE89679546FA717865133486CF0291851F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5d1a558c8eb666e29ec573a27ee6e2dedc5c37599517b656663f910e825a71fd
- MD5 ef937592fc12c156fc87f546703ba403
- SHA1 97ccc54704b6da85fcbda2cb4a5b64d3146668bd
- SHA512 2fe20875c2e2940217a02b99aab5b676276d3ffbbbbb14044ffe2bdacd61b676c0a39f806ac6256831bace45e8ec0e764da6c1e6782f3bc8c04e2c2c17f2ff67
- SSDEEP 24576:X8kNvNnaFeYhJNtmZBmKKY8fMCBTFKJo4IPpZThwS8H:X8MwBtOmKsZBAqvpZlw
- TLSH T18455AF6E7AB806E0E1FAC675CD238512F6727461073293CB5290C13F4E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 fe0c6171068b47e7df81013332f301e71c5e9a067ec8ca2bdb6ca1adc0cbdd54
- MD5 4e64fdc9443f1c35306497f5fb7936c7
- SHA1 b4d5f463111ae0b2f75afa2b8da3a45b6556abb9
- SHA512 691384c33ec73cbbfcf5f7b71510899abae8c43874e66f78afa1e9eba13f704e03b05edce50283cc64900ac9a0ae3aa1435d18837de77a7b19ca987694c9eb6e
- SSDEEP 12288:fHvUrBFrEjwaQ3K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ru:fPUr+NQ3KY8fMCBTFKJo4IPpZThwS8C
- TLSH T1F805E12F26AC18E5F676E17D85868709F771B8620711D2CF02D0817E5E77AE8BD3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 21251cecb372e001d7bf4afe1c4f0af81f55c8edcdc8fda9f42f542c6a662b82
- MD5 d01b8b7e9b7be2ef0865bc2273fb0e16
- SHA1 8fc820b3306d63ce6b02489a058f3fa8f968f128
- SHA512 a4c23ad0a9badcc37400664edf11624d7abf98cbae3e35e4b2019e45555b3111523932d03a1f55d9f68fc10352cc3d74a6caeaa9eb4e47834425326d9464f2bd
- SSDEEP 24576:DD3FHshBIYQgAUKY8fMCBTFKJo4IPpZThwS8G:DDVHeBIAAUsZBAqvpZlw
- TLSH T1C625E17DEA5C04E0E57BC1BCD6638A06E77138A9032156CB12D491BA5F6BEE47D3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH