edf14c871e0933c5ebe05030b50c528f80dba2cfba3b41f46e646f3f8dc34899

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.9MB
Sample260723-ajjkbabl31
SHA256 edf14c871e0933c5ebe05030b50c528f80dba2cfba3b41f46e646f3f8dc34899
MD5 296d37ba89b670a1416d40840b338415
SHA1 63a224344c4f548058cdc931fe02123f3f4b34f4
SHA512 23155cf5defbeafc7d05a2f67ec084185a29d10c623d35d42d41089626b2adeab3e31ea4edd5de492ef791227231af7b9be615416d9e17f16b4ef025c9161967
SSDEEP 24576:BWr/IyQUAj2GnKDemW9ngi4V2o3u3rPsHAnrsRwYIQk3mhUVi:BWr/I5jNn6emWgZu3n/YIQkJV
TLSH
T14C9517337297D4D4C41DA0B0CF260BF195A17CBDCAE5979B01C9BE24BB325907ABA21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6796	elevation_service.exe
6776	maintenanceservice.exe
1812	elevation_service.exe
6008	OSE.EXE
4848	PerceptionSimulationService.exe
6488	perfhost.exe
6204	ReFsDedupSvc.exe
3104	SensorDataService.exe
3312	ssh-agent.exe
6924	AgentService.exe
4704	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c4a27473957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f226d46381add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd497846381add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034438087381add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005250ce46381add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f481b048381add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074e9e587381add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6796	elevation_service.exe
6796	elevation_service.exe
6796	elevation_service.exe
6796	elevation_service.exe
6796	elevation_service.exe
6796	elevation_service.exe
6796	elevation_service.exe
1812	elevation_service.exe
1812	elevation_service.exe
1812	elevation_service.exe
1812	elevation_service.exe
1812	elevation_service.exe
1812	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4868	2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	6796	elevation_service.exe
Token: SeBackupPrivilege	6204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6204	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6924	AgentService.exe
Token: 33	4704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeDebugPrivilege	6796	elevation_service.exe
Token: SeDebugPrivilege	1812	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4904	4704	SearchIndexer.exe	104
PID 4704 wrote to memory of 3680	4704	SearchIndexer.exe	105
PID 4704 wrote to memory of 7132	4704	SearchIndexer.exe	106
PID 4704 wrote to memory of 1412	4704	SearchIndexer.exe	107
PID 4704 wrote to memory of 2732	4704	SearchIndexer.exe	109
PID 4704 wrote to memory of 1008	4704	SearchIndexer.exe	110
PID 4704 wrote to memory of 1592	4704	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_296d37ba89b670a1416d40840b338415_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6924

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3060 3016 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3028 2912 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3028 2912 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3060 3016 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0b3558f19317a5a3234a3c9ed8ed0273fce0091bbaee96c585ecd7864a87aa3e
MD5 bad1d4d7b1e170c0e2d39b22bd7d9751
SHA1 a2c524b8b4fadf7b9777b7f77204e3cd9555aab0
SHA512 226512d7280fb9d9891a8dce7ec2d8800c5166de2f3e97e90c4da50c63e4130df9fecf76302507fbf23b518bd2d7f0b6db79218583994b8cca6c248af0d9c169
SSDEEP 49152:wb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnB/YIQkJV:a3q6tjBGDJ
TLSH
T188D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 848b13c39976caed63e8eadd29be5186aa4d7f0d71e122a5ba01d1a4dbba4578
MD5 eb462f9e9605f637d7431e8471cb223f
SHA1 45e96012b75febea02543b15f6388573b9c27042
SHA512 301a9e12fcb122347550793724bc44f9cfbe56e021d7cdbfc61b798dd301651559c15368573e11417359918596d07ddbd5060d369559c7ed8a18c64823988e95
SSDEEP 12288:n1XLsswWkxy2lRq2czAYPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:1XYfDtczAYPsHAnrsRwYIQk3mhUVi
TLSH
T12265F129A3E409F9ED67823CCCA18515E6337C9187A0E79B03E495261F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c250d9feefdaa334f3d1cc9c6995e0b531d04a3addb39c06ecf15d35299a61be
MD5 43af5b5400dd1c096dabcc3e69852766
SHA1 e2a91c0ad0dfe6d84d42bfddd46b227f8aef4f18
SHA512 11f04ee35084d947e12f149a67a9cb8247c11e1f4da86f1d007c0b1f0b6ebdd3c35c778b63aaa23453f7e8b90b98738f0d1effc2926f8d32b0bacbf7b20f92e6
SSDEEP 24576:R0Le5ji0hmxnrMzPsHAnrsRwYIQk3mhUVi:RPji0Ax2/YIQkJV
TLSH
T1E6859E16F6788331D073C0B9C5D2A69EE97230815B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fa60bae853e2ef513e2028131319eda961d856cd76b615c7bd023a97684b749e
MD5 8e549149c0c8612f3c34fdc70e240b55
SHA1 b818c102e43d4ca45a20fe124ec9e658b24b044a
SHA512 befe3585f7459cb486a2716c400ff564dd58cbe69d981515c8f1a4b89892e064a3febe156cee7deeed412d9ddb587c2476dcd40b31e64b005c755beb04066d60
SSDEEP 24576:ha7/ezSC6vUyDZaqgrvWx6q8wyulPsHAnrsRwYIQk3mhUVi:g/ezSC6vURPvMHjyS/YIQkJV
TLSH
T12F755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 779544e891a50769bdebb449847c74f974cf02d5547ab67d6c52e706c32e0fbb
MD5 e3a8d0e6003e9413526f8e02b2961e40
SHA1 67735453e922cf621ed5ea9deb1fe29e10886d5a
SHA512 d0c4886294d16632f22c37d1519fee9c54484fe8e5d65d52373dc1cd96b5918a950600b4b467052e379605890847d615fb68a50013eb5607dcc0dcca692fd1dc
SSDEEP 24576:PVbqPb88hv/lV7sPsHAnrsRwYIQk3mhUVi:PVO88hXlVs/YIQkJV
TLSH
T1DD559F66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cb9d7d02eaeb5478c868384a4203527f243018095f079c8e9aa3684912872ad8
MD5 1e687788fe4ab6fea630d629a343be90
SHA1 b54dfc211957971a25b6e560f331722d64716d74
SHA512 e2689296e969f0471eac8d4cc9ed6f52ed949f2d09f2014dbb85bbf1413c4888524dd7cd9e018de6b3997225e5b8a8a3c0edaf7f69aff1834386783a86e20493
SSDEEP 12288:TG3PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:TG3PsHAnrsRwYIQk3mhUVi
TLSH
T10A4523A6C3AD85B0E3BB06343CA1E929D5377EE0FDD1033581F0761F6835E01E556A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2c43fce80e634341b83c6db3a864ff66b66db2e60cc0329c122e35995239bffd
MD5 e18d5282aa35c65d4f9881064baa8133
SHA1 475799f584c76147795fd3d6e7ea12f9cc618c69
SHA512 b17368ac5283b3f7763bb1a47fa24c591ef22e8cadb1d25a8d61632e57fbbb8677a2ff49fcf6e20ac0ed43912c8b61ff1dae823be1ee73380ea82b9a18329ae8
SSDEEP 12288:WeBNUbTVO86UUPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:WJIUUPsHAnrsRwYIQk3mhUVi
TLSH
T10A65BF7BEE28ECE2C27A4D785A91C600D77278708F6293CBD174820EDE239D15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7118507c9d2691ca6606a113351528c8e157ef36fb4741364c949775f7a91d81
MD5 7a9db3fe9d97c4d39f88bb9bf8fe2924
SHA1 66251256c862c8b09c0886a5d74f73b423aec69b
SHA512 9f420d761c79a79eec37503502affcc53e530bf40aeb62a3851f66a92cba93a4b520137d899005bba0e5c95de597057f2515ab5d47f0f2880f6f62c1106c2e13
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH4:uQvGAdlCEL8c/pRNw5C9DJ
TLSH
T18F266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9ee25fd5a5325c23fc60d0a0666e10e8dea2b9c8f50a2eb7d39390af24b73de3
MD5 3beb97ea0ca0d573e7ce4ac0286b4dec
SHA1 2444686e5adb9e7639f036a637fbcf43748bae93
SHA512 290220958215d6158fa8562cafe6012d60829b8a0a9df7b4967ddcff90144f6392c8dc21604598b98823b329d85962e6509af756e882e403b9e562b908b66300
SSDEEP 12288:QAwSfxL/2Dc3xDLLmt0LDQewsAj2PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:lwewsAj2PsHAnrsRwYIQk3mhUVi
TLSH
T16475E031FA78D432C3BB0DB62B31D716543D79604FA11AC3E3E89A9E59306D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 12b5960439aeb11912d8f16bf79d4029591963dd23cdb6765947c429a3e096cb
MD5 53647b12e1d0b97a56c693b7919ec5b3
SHA1 013e5a7da4cf87e32da97359ce5397f04f266f88
SHA512 c41640cdc2954cd30510765ba599ea250c9a06ebe6cb7f9eed2bcf0d16acbdf14e737c654cbe760333b972f4bf82e772d5ddc2ce802e1180725f27a53cf452b8
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHk:JUEtQevvqc2W1cpV29I32
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a606c73d207e3633585c839ab20f235c8ac412db41f87e62a03839a34c7b89ad
MD5 12f794366d53b8ab38450de7d8ed4811
SHA1 7742df320cd60d4264fe968aa312947588db7f71
SHA512 ed8205aa62dd79f099d2261f932a94a83b6dfae37fe500a799c7a94da8f80745752ca68764b978f9576b13c4ab79dc32b8925972b479e795ac04054f9068a06f
SSDEEP 49152:zCbRquA/m2yL5zLfFiV+XenmE3/zm/YIQkJV:Moq2VjnmpDJ
TLSH
T120D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 67f3a9ae50ae54a4028b1779e5e97e86568f65263c6208de265deb94a7798dd9
MD5 3e5f95cf51bc58c8e9157cd203cd0fcb
SHA1 ab8d38481ed805ae685015e0fc58aa19daa1671a
SHA512 45780968fbe894c7a4f2e08b8b4ec8919a5dafe7be85cfccf031470722ed750d3c42a354ce5b281744aa75f8f13e8ab582200f04bfd54390a6bde0daebd067f9
SSDEEP 24576:IAhGLmIFoiwtA5l7S53BPsHAnrsRwYIQk3mhUVi:IAM1Foiq55/YIQkJV
TLSH
T1E635AD81E7F945D4F5B3AA78A9B69171EA76BCA65E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a5950e026caf26aa556443b5702fb5f6a5634d721e20cc9d79ca63e3abc52582
MD5 c3a3a31f36446bfc6bcfe429bbe5f171
SHA1 90d928be50049de63995201f58c27458e182ef55
SHA512 bccc612144ea0785b1869b1f8de4cd1fe4a097b14f2b5419b8af7cca690e84a5a7b415755ff07673b27826b7a3985d7eb05b358ee16eadf7529a8a18487281bc
SSDEEP 12288:hmw5HEjsChNOBFgl0WDm+CFPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:8wuXOWiPsHAnrsRwYIQk3mhUVi
TLSH
T13E65F14A73E80CF9E5A742388953C536E7B2BC512A61D71F03A0C65B6F37711AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 915e0790aae140f5e08f6e59aaddf5203ff02061f1ffe345f2f7480eaae50346
MD5 5307f8efb99d8be432413ffddbd7a50b
SHA1 27e5e1b7aa257871bd39e87b90a3c125ef2423b2
SHA512 cb2aa7ceb04f65822dbcfa97a45b1e6b6d62e59405348484e4597730305f5aa2ba7be5ac6d1bd0c4c4c4caf2380553e1dd60ce05f1418a936f69f538c9cbaa3f
SSDEEP 12288:xbZ1IyGPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:9ZubPsHAnrsRwYIQk3mhUVi
TLSH
T13755129A23EC61F5D2A7423C9CE19605D7327CA1B7B203DF52A0526A2F33EC15D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1c474ee83bc6b9bed5c0544ec9683e20c242c868cb91acd78390f354ebec7dc6
MD5 2c3a1db2f404cbc3ee2d14ad42234af9
SHA1 779dda508d4ffa4b590d951525cd05c6466b2af5
SHA512 4bc4f445f26c423a7983e5c33958e2b9fb92d76ce391343c5a74e38a8beda5e75318c5da2f849c28d45ddf3d579a88210fd855cc8798169a75905f884c4b6af9
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U8:xQRQyi36YOcPuLvw2gAf+PN3cDJ
TLSH
T194666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d911143743e5513b4c9be81a41e1867b7982abd17f68ecfa92241d73d2cbe92f
MD5 069e005ea1d1f0a427c5adcdfe50827f
SHA1 071f72b5321407dbb0eefdf41053aafda880b6cb
SHA512 981ea73af29484f314a741bc332d03c4e6d333e5456cbff008e2601a207c5eb3194703903ff2be2ba02eb5d1796b1193731a93d522c41189245aff981cdb6bb1
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U8:EQRQyi36YOcPuLvw2gAf+PN3cDJ
TLSH
T14B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 46db5f8cd2bd22e6346d4830da758db310769f996d5800ce159e8484aea9637f
MD5 fae8789c2669321983548200c7531a57
SHA1 65e5b3d5f80a418558ee9d799473be1de5f5b9dc
SHA512 761b2cfc46088faa3cb2aeacec8408421fa6af4ad4bf132e0c0a7b6d34cb18bd5bb7c61e13cbb93d2fdd6052bc0eed7eeb1f682fcb2974dbb6d0c6b3197b467a
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0LPsHAnrsRwYIQky:q68Qg55nhxeWu7PNU3/2/YIQkJV
TLSH
T111B54933B2F600A9C44DE1769F46873196D27C718FE1E3DB8151721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 99adeeea276efa1ab4547cbf11021aa55e054877fb1d5b9a35b07c6dd719891c
MD5 f0477627acd26a06dcb284dccaf3152d
SHA1 0c43b1ad21c6c98438e070489579223957d875a6
SHA512 74a52de0c9815ff222214cbb85be0474ca7d0566fb28f8d9ee2ae4c61a05fbf4704a4942cd15572a5791ab393e99a6bdb0dda30e2e195fa96bd5c76af123d5a0
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:fy5112gYy5azzVvD69nLKnhZTDJ
TLSH
T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1111bb84ddd24fddb938d6afef0c9f5906527c35d8c8737587028cc2c6da3d1c
MD5 c0c83a3e4ba4cc32f192618952249080
SHA1 1b80bf2abb3e60b0f86e1b9db194263fc4e7011e
SHA512 6bc5309e41c56d9cb74f32647b1ee4ec445ced75846b6be242304bb9042a5dc5198c264c21ae41b7d6cce4e833c31b4d1124269a330e32dc7f0c4a277a296ea7
SSDEEP 49152:PB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gly/YIQkJV:xu6JmQxd2dyDJ
TLSH
T19CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a9ea068e5d8407199bd16936edaba4c28b9b9f6e3b577c9671a7955ee15259bc
MD5 24b35d095330728d445705e7a5471061
SHA1 9545f122b6e9e7dc7462553831063f7f92687edb
SHA512 ae77f35586b58f3a411b303177e9bcee4d7459ffc36ec9b5496b4e9e33faa1014e5fb9ad3cc7f53eba02b1617e2c561f05acc9be837011ba29dbae97a5fee538
SSDEEP 49152:/1hpsNoJpF1A6yU44CwH7R4xA/YIQkJV:/mifPVRpDJ
TLSH
T150B5AE13F2D901E8D06ED17887569232EA62BC450B31B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b77be5993bbb4386e8767c27eaddf8536865675fffe34d9d0a3b7fe681a73896
MD5 18281b7bdcece779ef19342fc09e2541
SHA1 c2361fff38497e2c357b50b7a053b705742dc149
SHA512 0250f97bbd26d73190ba018e883586d899f5349cf300d4616dcfb14d613cd7f54e941106c536882bb81524d2c440592c1e1cabfba1f5baca9892a0d516947d55
SSDEEP 49152:oSuZQIY0Be2KIRVtOnks6NMHqX/YIQkJV:y5dKOi61XDJ
TLSH
T16FC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 80212df56fb7764dfa1eb11c3f6ec3be25d427c193c05575a3007a1bd239b8e3
MD5 98b2f6f9d68d01ace662c785d9387c61
SHA1 28cc7492993db73e2cc5e8271d4178348988eeab
SHA512 2262b96f01641a50e3d866610e71b7521bd89997cda1d362409072c7516498b1dc5f30a5b5d1d9eb20cfb139420c7c67a0cf16120511a36997c839b304e491c2
SSDEEP 49152:fhtSn8EApI0figGgiDn0AP5w0/YIQkJV:OX2i/phVDJ
TLSH
T1F095BE13F2D900E8D06ED178C7468632EA62BC150B35A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0a7b367bbe35401b66dbf62f99d59e820e5be09ebfbaf99bc189d8ab471b1201
MD5 643de0f76fc01f9ba55060ece6b4d53e
SHA1 ca29bbe1c8af92c4f441b72444ef5b7dff65ca27
SHA512 8c62c0cba2333a78cc18eb99531a7ff9228d2e677cd16a75c339654e71fa2b1a8731c58eb8e95c60b46d0663948bf0e5d12408eddc1d5c4d8638ca511db519cd
SSDEEP 12288:+/PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:+/PsHAnrsRwYIQk3mhUVi
TLSH
T1C64523AAD3FE86B1D27B47347C60E629C43A3EE1FDE2037592E0621B6C35F012455AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6c2a9f4347a32ee06436fc3e66c681c18820088fbc3ca7e1dcf33e664b222445
MD5 09956e8ef86dd8c29d5772f02305b29a
SHA1 cdb7de657777d8e910eeee9f8cf22f75c99a881e
SHA512 53cf6b8dc2bfce47f6b6affffe936b44d9fcc0fe226d5d3529affc045ce33efb2cbc5ba21f5cfe40d002af34a5776933441dfbf4984f7b88b5746ec4e9e5a91a
SSDEEP 12288:Q6PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:Q6PsHAnrsRwYIQk3mhUVi
TLSH
T16B4523AAD3BE86B0D27B46347C60E629C43A7EE1FDE2037592F0611B6C35F012455ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aed55e114327b1144c8f4c8431eddefa6cf32954ec2fd3a0d3cb1716a1e69ecd
MD5 b164642cbee21e0131d3bad3054af406
SHA1 4021bfef43d2378ed4c2f917c9ff9ae21c35d699
SHA512 09b22f7bcbd2fd68d9689cc36ab0984f0d553ca03fc8aef5a65737e73009e0907f80f5620b5460c9dea47a2538cf1627614379e10d03bda5e0d93cb14db7a3b3
SSDEEP 12288:1cPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:1cPsHAnrsRwYIQk3mhUVi
TLSH
T14A4523AAD3BE86B0D27B07347C60E669C43A3EE1FDE20375D2E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a2fb2255f7a9e4960f954e1ac136d32c6ef9a0406f9b646bf59dd856a94e54bf
MD5 a2cd62be563b45a6af83a571f0d92311
SHA1 2103568e2506738a0a484ddb96232d3441eb23e0
SHA512 9bae87e581a0a832ee629cbc2a1aafef503baa4b319d1f55bea7f6995b389556d5adf0b7114edfdb9ac89917a677d03e87efb1433872fe0ea26905ac4e670104
SSDEEP 12288:jVhPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:zPsHAnrsRwYIQk3mhUVi
TLSH
T15F4522A693BE41F0D5B78238AC61D229D2367DE0FBF213AF92A0161B1D31F406835F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cb20a7f411aaea0600898045ada86dfc0244ac62c05e50c449fb7611d52ebc0f
MD5 b218494a013b683063f23029ff15e93f
SHA1 8b635906986c8da1295d177be81c92111984951e
SHA512 4872e7f21239675c84b010a0c2a78a4d1ded5575407f8f92e9ce87c0c993a5239e30005961f7a85a6075de14a723306e5912c61370e3ed398316c8fc052f2aac
SSDEEP 12288:a5PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:a5PsHAnrsRwYIQk3mhUVi
TLSH
T1AC4523AAD3BE86B0D27B07347C60E669C43A3EE1FDE20375D2E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fd81d326a2bd38a497231559cf60bb9fdb4f96ba5554b909c573811c385b09c1
MD5 430fd9c7665da13fac05a9555df15a01
SHA1 39d0a8c182b8bed77c0910701219424f253fb4b4
SHA512 39c271e7a7040ecdd0479faf01088398b08d7ee6ca3eeb329c91053a9811765c0879232e9fec77a85d1f9940eacd78ce98c5ba959b4259d1373444cc2514dd15
SSDEEP 12288:qePsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:qePsHAnrsRwYIQk3mhUVi
TLSH
T1214523AAD3BE86B0D27B47347C60E629C43A3EF1FDE2037592E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6bbe9906480476d644654c77ab4e3e6c942f1ced5a67513caf5a9b0de0a19ea7
MD5 5232bbccaadd32812f57d298fdc5e34b
SHA1 7ac78481163715c337c9d6f55136cf67eefdf737
SHA512 8e6a9880e0aadd8543c1362e5ee7e2ef7d97a3a60125e4a122ee3803beffa3331d5652265466c136a68c967a5a02aab68369983d607582b477217ec1cc06e43e
SSDEEP 12288:GSPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:GSPsHAnrsRwYIQk3mhUVi
TLSH
T19E4523AAD3BE86B0D27B07347D60E629C53A3EE1FDE20375D2E0A11B6835E112415ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2dc3a6ef8ddb0e63288174494af5434ebf60c87fca98e5286454286e1d8c9327
MD5 6d2f2246cda9a751efb1252f85375502
SHA1 716313b7e9a2bc61adac95b59ab1b3f8430f9844
SHA512 d1d4422c0961a10cc10356919be3af98cb3feb3b961468055cd8b12f2f75ee5d697fbe1418bfe9da46f9ffdf2af5722ceb9e00d61e8f49c78abc39d02858fb4f
SSDEEP 12288:iiZwbNzzFEoS2cPvyaPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:FZMJzFVSOaPsHAnrsRwYIQk3mhUVi
TLSH
T1B565F1A5B3A408F4EC67823E8D619916D6727C655BA0C31F03E4362B5F337911C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ae4274afbda6d187e9d4f65891a0284b7ae2a952e75747ec5fb0642d221b85de
MD5 5bfefdb3649e23c710cdd1d5db2f46f9
SHA1 9de277f39de972f25b2cad1cb5ba320fc6e370b9
SHA512 cd0d7637cb160fc7180f596fc3cf687db00046a4b1e7922a08b481a7997a3503fd587cb9315c3fc2a3cfe5b9ae838e5f394ff68125df7e8029013c15c6ed34f9
SSDEEP 12288:4rPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:4rPsHAnrsRwYIQk3mhUVi
TLSH
T1824523AAD3BE86B0D27B07347C60E629C43A7EE1FDE20375D2E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b8101d5c66749cb277c84b4f858bb3a859730d2bdc51bfe7a002c079b21ee87b
MD5 fecb29c4380254fc31b295b35ea6784e
SHA1 dd9b7eb09e65442dc2490e6ac2e1e6ba3528065e
SHA512 3ce2340bd64f5c54022c1d5a80714ec08c4dfcfd1f5cc0983fcfb5bf0f9f230aaf9e6595a6587106d455e9cbad9e6cb40caf1e44976ebd3286e14941bc681047
SSDEEP 12288:tHPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Zh:tHPsHAnrsRwYIQk3mhUVi
TLSH
T15D4523AAD3BE86B0D27B06347D60E62DC43A7EE1FDD20375D2E0621B7835F012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2e1a758c765db6d29e3072b9fffcce6e78ca0666ed29e904beca4ef83f224dc6
MD5 f1b4df5ad7c94e653b89836f6c30f8cf
SHA1 c56514969b23e42e346f78034c3b37b9723adca1
SHA512 83ee6b35e161852f44866ba242c265698041c37aa604183e0639cff6ede519519f69bf50b397dbe4b6fa854d85fa1e9c5d9c9913c6f1ff51d8d787bb387c3209
SSDEEP 12288:fyPz5L8GPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:SzyGPsHAnrsRwYIQk3mhUVi
TLSH
T1D655025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ecfb87f10bf393dc8f4251fd4c8c92edc25dfc3998924b8f33db0697c55ef10
MD5 66457fb219fc331af4ffb10201e65261
SHA1 adff4ae2eaf5d7fc90147896f268bfca6f0ba120
SHA512 9e51a6ccf79cda0d1a3de760dc85cc2900938165dfed9a8a25f62383a3c7e6f284248cabacb3724cd8d5ccfe80d340fb6da9915d4c3bb34ae61c2312237469f4
SSDEEP 12288:/rPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:/rPsHAnrsRwYIQk3mhUVi
TLSH
T11F4523AAD3BE86B0D27B07347C60E669C43A7EE1FDE20375D1E0621B6C35F012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 af0f7158a1dba746343babc0f3c90ee4dac672809be4159e6e5bc8512efc6a4e
MD5 dc7924871dd84a8933d73d3a4c35ebb8
SHA1 bc8468d2e1d53f34bb5ded9cca3e62a0d7f72c2c
SHA512 97e0d921fefeba6e3372847e86e1dd89ab8f8bdbf3edf14fe5f1495ad64056a28050b5c3be3f5670f055a5cd734153d8c868f14f5ae602ab65b37610d31c093e
SSDEEP 12288:ArPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:ArPsHAnrsRwYIQk3mhUVi
TLSH
T13A4523AAD3BE86B0D27B07347C60E669C43A7EF1FDE20375D1E0621B6C35E012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e8315453e4819b4cd841a09e1a3f44866b8882e80b6473c9d57b21625aa79125
MD5 1fee562044d522e0718409e8fb5fd128
SHA1 e6b1c56a67f77b6335bc55bb0b2d70b30b2f0661
SHA512 43a87904002a3d3f5daf0af85638c4c8668fb52c52d5402095576bd1a11c421c9b6a4e4f83fe3aab5eeba3e688ec796c973ce1340ffc5cd59bca154d6951f4a3
SSDEEP 12288:dyPz5L8GPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:UzyGPsHAnrsRwYIQk3mhUVi
TLSH
T1A355025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b3223d00c65a5c5d3c33e620cfb58e35e0a1c0ad7595a3a31eec56f4035b5c7f
MD5 540cb77b66aca351eb2d372e56e0a9f4
SHA1 b97629f6245a6f4a3e4764a7b866091f0f693bb6
SHA512 d563a51f51a93061902f1524de3ef5a55919dec3c03d2e88f4c5186e92dbb4bd85b4cee6a25ae83c4ecd1b1b2b7d9b68b0de68ce1d3868efd0dd8c43a88d1699
SSDEEP 12288:uCd9XWYoaLHF3z0z04PDvhMPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:/TuaLl3z0zDMPsHAnrsRwYIQk3mhUVi
TLSH
T10265F1A5B3A418F8DC67823ECC618916D6B27C665BA0C71F03E4362B5F337511C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 890d6753d764522d59aa79b4d73c9bf11a1460cf355eb46763078e5ab44abee0
MD5 7503ac07f247d4d055b90cc9ba1c7367
SHA1 d0dbc886d2856becd3ca7110fff8a0371de04c5f
SHA512 a0f4f65ac1b00a6da3597d57dccfabf1f3bfac8e1cb83bb003ba41a42528341ff53807d2cc95127e381f2820a24dc2445ed6a44f35d6b347277f63d746cfdccd
SSDEEP 24576:e3xd9CHKy7GZAPsHAnrsRwYIQk3mhUVi:gxd9CHKyae/YIQkJV
TLSH
T1BE75CF90F3E814E4F1B78A358D729511DA767C995B71CA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 af9adbeb76901237913924881fd5f32108c3782ff516af1142b5d39ecd5d18fe
MD5 31c027cab76141557df061fd580fa2c4
SHA1 fb316c68f396c5b361264f80d436c75151d82e62
SHA512 d347b3a23445ec6adb051cff46a4f10bfcdedc05b8f6b9d753f029ca3dc1d873ffa19d01273afd06357516d82af7632aee089b786e96f8bf59f7a50ef27ac617
SSDEEP 12288:k8PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:k8PsHAnrsRwYIQk3mhUVi
TLSH
T1464523AAD3BE86B0D27B06347C60E669C43A3EE1FDE20375D2E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6048acbc442202db7eb2be134b2cd91e1415cecca9ef2a3359b2e7a011af5748
MD5 280233914e17a1f7e51bd136e2b71644
SHA1 948bf83003eafca2513713f26ca5b82c9db53277
SHA512 8d23812f3f179a739a81b5f3cd88a699087ecd5f54d2e5131058371734ff8a4e4f756a65dbf3e7ef86f07fda2de814cff1dee8d283cdb3dffb2acd7926576937
SSDEEP 12288:LmPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:LmPsHAnrsRwYIQk3mhUVi
TLSH
T1014523AAD3BE86B1E27B47343CA0D629C53A3EE1FDE20375D2F0611B6C35E012455AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 169c6fa502228ef2c43319ada3bd686f66f77858274bed292f6f46e7b8c6ea6b
MD5 0554d3a45727b720a329360d696b5e98
SHA1 e16c75f59f8584f1b42e7501bd7cc4cbd98d7c44
SHA512 b002a36c26ce6afe079941253bd2b70566c01e706936c836fa6396c5f19e771a3bb9e433db04e169b73c5103fabbe8b6d783696375320eb07f1264d41f433dcc
SSDEEP 12288:LdPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:LdPsHAnrsRwYIQk3mhUVi
TLSH
T1C24523EAD3BE86B0D27B07347D60E669C43A3EE1FDD20375D2E0621B6C35E012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 697126fe63d0b3889821ee388b96ac287c2de6b27bda07f84ccf633b73586b58
MD5 d1f4990358a8bf5901d9dbde256a73d4
SHA1 d7fa0589549066662d168a33b82e394421d22658
SHA512 2b1b4ea741f75639168da9649c65837c3eb90b4b7175d6f3bd8475c025020281cf4b1c7c6e111a863d0266f7158360e51f481e8c7d9b757078fd893f09b504a2
SSDEEP 12288:IrPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:IrPsHAnrsRwYIQk3mhUVi
TLSH
T1F64523AAD3BE86B0D27B07347C60E62DC43A7EE1FDE20375D1E0621B6C35E012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 64b64f15bdb9e61d48fcdd633a7289a1956d8554744d881b490ea49378c53e3d
MD5 c9ab510965eeb6380bd35c7f4f3f7430
SHA1 36240a804574dab9484b337aef66a268c53ed670
SHA512 2c11c0f2aa91212588fb3a637484d8c60eaaa007c028a8bc6737c2898dfb1d5cb4bd58875c761bc30bbb134ef2caa38f8b6e17f6674d8ce7c9b32ea9e45906ac
SSDEEP 12288:88PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:88PsHAnrsRwYIQk3mhUVi
TLSH
T1354523AAD3BE86B0D27B07347C60E669C43A3EE1FDE20375D2E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 237038a81e21d566c848c5e3e2c9936abcc28d8f0defc11cf4d7f7beca52985c
MD5 ea5393e0fe70fd519b10631733146615
SHA1 405ee26f5dab00ed30f83957712e78db90d97d9e
SHA512 9480f20a4bdca1b08dcf3a3aac18ed6640bc03eeb647fc378c7a97947812acf7a95192d635254826b04f6e47d7cd6ffe565d738cc908bfc972eb76f49fcb5122
SSDEEP 12288:ejPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:ejPsHAnrsRwYIQk3mhUVi
TLSH
T19A4523AAD3BE86B0D27B46347CA0D629C43A7EF1FDE20375D2E0621B6C35F012455AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9414d8120990ea5a623df336c41ef87bb749c2e991e46a0f4b7fcacabbba50be
MD5 f5f14e20bfe05781439afdcbf9ba961c
SHA1 3dc9e576c8a38755dba23d62e2a17a1965041879
SHA512 0f89e46ad39713f0e4b333970228488bd46bc964f9b65e1d3c973d3f9da3d8b0e7a1ffbec9f9ff102bff87ec63d280b9dd7e3314f928225b9c42e23d720598ff
SSDEEP 12288:q5PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:q5PsHAnrsRwYIQk3mhUVi
TLSH
T1514523AAD3BE86B0D27B06347C60E669C43A3EF1FDE20375D2E0611B6C35F012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 efed789e92945d273f849b713adc81dd8cec7f693d41388c734b04ace47ef4d0
MD5 9ca1915cb3f1a94a2df44d7cf88b238d
SHA1 612723c37e35963b8a5bd8182573bf3b37b87d14
SHA512 7672ab69189defd2f2049acb2d077c67ef5a9fe85ec72adb03d9a8d89ac24b05c300427ea7339a0004ca34d337f98bb0612a9ba57ede38cb60440c60ca53e068
SSDEEP 24576:lfwvOk9RX6wkyAIXPsHAnrsRwYIQk3mhUVi:JMnYIz/YIQkJV
TLSH
T12485DF29EBDC44E5E1B7923C99B3460AF6B178691B71C2CF0299536E0E33ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 98e6773c20fa5ded0f552009accf80a9815afd37c57ab91cd00e2654bb413e1f
MD5 ae8a3c93008d25e51d15335b392200ba
SHA1 6fc23901710cb9cd6bd6502ebaf352a425af51b4
SHA512 a60af7367190e6ec1cd06019a33334a681ab425bd0148a93fed1272a5852a74288db968848fa89f559c2285726b0acc77681e2030314b903a6e27231de6f674b
SSDEEP 49152:5YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0U/YIQkJV:3ySzP8DJ
TLSH
T189067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 48efbea707f6cb891365963f26610f4805585d9931b974069242554bb73d02d1
MD5 6c449d2ca01dececf3cc0c7dc80325d5
SHA1 38c42fbf0efc32f2f8f8270bc7e224315c7accd9
SHA512 b0a75ae01c343dbfc766891ec3158f9059db81bf377b43dc75f3d6b2d46229c72b5c759144f9f4e73915cdc18027eced6e2ec98e15db8609ca4966ffe820d92f
SSDEEP 24576:/47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYqPsHAnrsRwYIQk3mhUVi:/47JUQjairIhCnDHUPfF/k/YIQkJV
TLSH
T18F65AE1EA3EC01E5E1BA827885158A5AEA71782D5F31C6CF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 258e30c9f1d9be52d47b451a37a9faa532a356cf31f0fafc007e96de04215123
MD5 1ddddbd441abc55160c34532ec9df1cc
SHA1 3ae370ef834241ea23096f2ec83d8e6d79d6609a
SHA512 4ac8bda56de156fe8fd82926c3c31a362408c5efde528301d727e807c89348b4642ff5fce810a95ac48f6b313ac57e8c1b08d96dfcfbe69c401b0e40ada3a29c
SSDEEP 12288:zksfbPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:fbPsHAnrsRwYIQk3mhUVi
TLSH
T13E55F15AD2A802E8C06F5239CB519A45F3337CA197E193CB52D0F53E1F36A905DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5c6f65ffb3357c66827ecb6d60f24fcbbc231473093a1b081bbc28023bfdb628
MD5 07c3e901ee1907f953c5a4189937fbb2
SHA1 9975393ed91fb1342e3222f731455e2bec504c35
SHA512 6234a6e7380b94becc8e691826ffe199603add85d5dbe1802f6f92ac63c478427e787b5ee77f4cec0ffc8e2bebd5088976d1eb1d0e8e68748c48e90af7cf7ca4
SSDEEP 12288:ERSBmgU3fE8bluEToS1lXgMRg9UI/YnQ5yKNvmQu8FxaRMe+:E0wgUPZl7lHRbI/YQ5yKNuQ3FxaRMe+
TLSH
T1A4352841766AC75FC6A940321E32D1CCA7707D01EE45AF0372C89B3FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4f843f950476621ce537c7208c06f7481bc5d26ea10ed41ed7374e560196a823
MD5 21b1e998228c7502e8d8825752c0ce17
SHA1 989617e13e253989b3ef6bc18702c4dbc8a715f8
SHA512 dd75af4175722be22971b6ab0794be2309b77ba9d33648947ea495a6d0e6c2472fc0179041174378255ea2c82cf4984c370036cd1cc4fcf6d552a3f3c0739c99
SSDEEP 6144:swCe+RxhKWSINHswFkOBPptMxv5CPptMxKHdMU8C7jvZD:sXf9FkOiYjF
TLSH
T1C555D7815137E38FD1F76032072A5B4CA764EC06B7096F26B3C8453AD86AB25A4F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0495460edffcbbbd21dd32187fd23bd81d2ad64eeaf5ed219c308a655936c8b3
MD5 48866ea837a4c5a5d1437a990548cd62
SHA1 0d3f98966b32ae7cd08e11e231f832557ced5a0f
SHA512 d7979ca8f0ce89f69595f2930f52e4c8f85633ee1f55719ea9ac96c0f105a234d082a46c0f1c39600bb4a7ed270cbf597522d4992ee84c674093ccd22a547426
SSDEEP 12288:UF7TPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:oTPsHAnrsRwYIQk3mhUVi
TLSH
T1DE4523A6C3AD8971E17B07342861D538952B7EF0FFD103F7E1A0621B6831E816D75B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6c22b7fb555d1521fc78815e39c0691501e0601e20df65ccb0ae84ec8e5fa80f
MD5 54006f365c7800ec1a3a9fbe9ffee562
SHA1 87280557234a21517d3ae838918716b68a43a55d
SHA512 d73d74fc289b23ab2b0d87c2c65af65059e7da01299d89c8fc5e929e898e6326238b70802877ba1aca3f57071a1d11cbfe01ee9488e8884bb890152c32090311
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYlPsHAnrsRwYIQk3mhUVi:Igb4mBIBhGF6/YIQkJV
TLSH
T1A065AE1E22EC02F5E0FAD2B89DA64417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2c9b8b1c371498521bbcfccb2c4627003f417ca762262475bcfeed663c181a2e
MD5 e72b8b3f20ecc186aca8b5e246b95f59
SHA1 b3036ee2e7f67a6202c2f6ee1326c52820f929c6
SHA512 a881de7539428b3e64865637b2d3f11c883afc26d9dd5c00d9af63f8ca4d0874ab08c53faaf5937d280b746f1b280e75bde96f64774248a5968a3497ff98e6c5
SSDEEP 24576:HG88u8FpJqH1nzria7/maPsHAnrsRwYIQk3mhUVi:m7ZFPqV6a7/F/YIQkJV
TLSH
T1EF85F165A3E501F0D47BD13889824667F672B8211360EBEF07A88B561F33AD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4f793fb19db2f943b8ede7b4fc67016ee4fe7884883865aba26762d264ede00c
MD5 2fd98ab87b53b62671d8b68123870d18
SHA1 98e1c5676eeb2bdb1b7b61f2023e82004a02ceef
SHA512 10356bc9b1ff38eb31112027c5bff7d65bc4e46568901d63ce972fad2b046b5a1c1ae2a4e6b5947df10ea06827fd1b648de65695d454ce7db6b8e41560ddf52d
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjO/YIQkJV:oG05lO43bLDJ
TLSH
T18BD5CF6E62EC11F9D1BBC17CD9C6860BEBB23825033556CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3955494e6e90c6e8a831ce82d7bb7ceec889cc99d82654c731a77e6c56bfb96
MD5 35c7f6babcc593a32cd5a100edb727b2
SHA1 b6dc41ff6d158248880a369d4f89288f7712aa52
SHA512 15f1be76a3b820612b26004b6f15fb05be06d71d621b89efbdd571234b47be6a507f0e7ce8ece251b1bd77f24c58febf7e13f64e40849f0c198a8a394e7dc80e
SSDEEP 24576:Cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4PsHAnrsRwYIQk3mhUVi:Ka5POZ3hJt2pasx2+m2/YIQkJV
TLSH
T19665AF5EA7FC01D5D1B9D17DC583861AE5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bc7f7564bf51151d32b4e350e801ef7d62bafdb21c4c1810cb08aabb40caa2fe
MD5 6960b935ccaa48ac2fb30ef702ab27c4
SHA1 154e3d03778d66c2465ec4cd37faf36b2c1b6524
SHA512 7d6634dd70c987898b3d0e0a1587771e992de4c66517539b53747281db66ed1fd5405f1802d6caca9235e5a8c289f440f363d863b47a2f1d0fded69b60aafc11
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkCPsHAnrsRwYIQk3mhUVi:eNc/zEOVHFl/YIQkJV
TLSH
T129857B2623E901E4E1BBE1BE89779546FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3523522970ea01c4003435104bf5746babbebb68716d79df9b57ba8039f50454
MD5 83c7a4ae49ef2a98f328bd3c04260d7b
SHA1 9b3b644f04491d81111ce0e16e029e5e70c10863
SHA512 a62edd8aedbbfb0b81827879c675b9745391e7d48749f2e67ab8fa397fb2544f21ad61cd7745fc0fd685c849c115fe39b4a02ecadd58aaf36436d3085f295fb4
SSDEEP 24576:w3kNvNnaFeYhJNtmZBm+PsHAnrsRwYIQk3mhUVi:w3MwBtOmu/YIQkJV
TLSH
T1FA55AF6EB6F846E4D1FEC6B48D238512E6727861173253CB9290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7eb7b9c36bcf34d18daff5f81055b5bbf21b12178d94a7a040d3adb7a22153d4
MD5 c6dd97655aa4527ad47f8aa64d32b015
SHA1 f0143df792a2b4da6b32261d9a768e1bc68bd0f7
SHA512 3de360ae788b47bf400918702b5892f429b84c54718c2f87f81eb7d50cc833884dc42b1219a9c8babf2521940a07a0a74aa9ecc2b592afff2e97f0c5a454be0d
SSDEEP 12288:yHvUrBFrEjwaQuPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:yPUr+NQuPsHAnrsRwYIQk3mhUVi
TLSH
T11865E12F62ED18E5E677A17C89828619E7327862575293DF02E0817E5E33ED87C3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2f29bed1a62a8b8933099e5a022844370a8050a4ce2332ae3a430f5cd9dff2f8
MD5 d48faf0b1da796ee6a2dfabdf193e9a2
SHA1 181e8d8fc705b6fe25b5eb91ebb4d8c955269fed
SHA512 e889ff51169b0ce865beac15df8e4b74bae9b24eaff320e5104f584209c66529f7324428bc8e09238fbeda4998307c39b8933de703097786baa5d36249be470b
SSDEEP 24576:vD3FHshBIYQgAfPsHAnrsRwYIQk3mhUVi:vDVHeBIAAb/YIQkJV
TLSH
T16375E17EE79C04E4D57BC17C9A638A06E77138A9036256DB02D081BA1F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1812-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1812-50-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1812-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3104-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3104-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3104-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3104-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3104-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3104-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3312-118-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/3312-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3312-124-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/3312-318-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4704-319-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/4704-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4704-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4704-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4704-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4848-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4848-73-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4848-67-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4848-283-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4868-0-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4868-29-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4868-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4868-1-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/6008-251-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6008-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6008-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6008-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6204-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6204-332-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6204-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6204-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6204-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6204-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6488-78-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/6488-83-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/6488-298-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6488-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6776-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6776-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6776-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6776-117-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6776-115-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6776-33-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6796-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6796-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6796-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6796-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6796-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6924-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6924-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6924-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6924-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6924-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download