966f4c4a23d6f582b57aace261adc6af8916d428f032e9df34151d954939d969

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.0MB
Sample260723-ashpdayakb
SHA256 966f4c4a23d6f582b57aace261adc6af8916d428f032e9df34151d954939d969
MD5 0799842980c7860481ea2814fc7773e6
SHA1 caf4636a076aae87b8d80fe4853035c832794f3e
SHA512 036e12a42f53665efe24df24e802ea04184e45bd7e0442b9bd7a43534517b3326ed00c95983e435a1800d0ed75c3a07c745b8dd9cf8198933e6e38d974063181
SSDEEP 24576:vjzs91554IGaq3pljhZNAoYWXypSbX+mmPsHAnrsRwYIQk3mhUVi:vjo91b4Ie9ZjY0y4by/YIQkJV
TLSH
T1BAA505337197D0E5C41D90B0CF160BF195A17CBDCBE597DB01C9BE24BB32A903AAA619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5680	elevation_service.exe
1320	elevation_service.exe
5012	maintenanceservice.exe
4752	OSE.EXE
1140	PerceptionSimulationService.exe
2452	perfhost.exe
4808	ReFsDedupSvc.exe
5384	SensorDataService.exe
5632	ssh-agent.exe
4184	AgentService.exe
1068	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\95be814fe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000460b33b3a1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000646de23a3a1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9f51e863a1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000000998863a1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe
1320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4608	2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5680	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4184	AgentService.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: 33	1068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeDebugPrivilege	5680	elevation_service.exe
Token: SeDebugPrivilege	1320	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1480	1068	SearchIndexer.exe	103
PID 1068 wrote to memory of 5760	1068	SearchIndexer.exe	104
PID 1068 wrote to memory of 4872	1068	SearchIndexer.exe	105
PID 1068 wrote to memory of 4916	1068	SearchIndexer.exe	106
PID 1068 wrote to memory of 768	1068	SearchIndexer.exe	110
PID 1068 wrote to memory of 2572	1068	SearchIndexer.exe	111
PID 1068 wrote to memory of 3828	1068	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0799842980c7860481ea2814fc7773e6_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5384

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5d776f12ba60622ff59937c27a9611ec078cb0dc17493a27bb68a1a09b8f9b89
MD5 09e4f4cbede8c98cdfe2d2db0f361e93
SHA1 8fe1933340f032e4254b4ebab38a5c5f059eb34b
SHA512 3a9cf84fb89420f38ba9265520ceb72e5d3cc6b33ba51c52a1f3d29073283f74439ee247699248085a93429a2f2561cd4edbb58603351f019ef8a2cf267f8f8f
SSDEEP 49152:xb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnZ/YIQkJV:33q6tjBuDJ
TLSH
T1FCD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d5efbabef46c6c51092a7dce08d03254e86d75a764619cc7d38a317bc43fd42f
MD5 389d66f86073b4a6e7697259b6cfc69f
SHA1 49889225cd359281e009f091796d982ce68a6974
SHA512 85939ae35e2ba374a229486a3b0ad913283765d5be7f7cb6efc0b6afe046bd1ec2f6e4838e4bc2e90e8205eb43aa0a7fe7ee06e0c95b29e3711d430dd11afc78
SSDEEP 12288:u1XLsswWkxy2lRq2czATPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:cXYfDtczATPsHAnrsRwYIQk3mhUVi
TLSH
T1B165F12963E509F9ED67823CCCA18515E6337C9187A0E39B03E499261F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e6f73aeecf8559677822cbbcfd5397a485c808bbc9c911555758ff4ab25efd42
MD5 1d0f124286124e411a911bad86f8e1d0
SHA1 3a9c9a174d5303b1c5859e2ff31b0c4b1fa34d5d
SHA512 0acbdabc8cbc4f130b2cd8e215a3cdc4287699c3ce98655d751e5f99b37a6a2f39b3e72d9e6b4de30513fe9edfc5e64f55c0ac2538cf4973b2bb8a14b75c17db
SSDEEP 24576:l0Le5ji0hmxnrMgPsHAnrsRwYIQk3mhUVi:lPji0AxB/YIQkJV
TLSH
T18D859E16F6788331D073C0B9C5D2A69EE97230815B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3cce37e78305a72bb2f5a4ed5bc3cd4fe88bcb5c193e2219f48080e845fd5aac
MD5 daadc5fad12a339fe65bdaa9c3989d26
SHA1 3647e26134eced4523962c20ee3eb12900ccda20
SHA512 3de3e7aa30438e06b1bb514ba3f6cedcaf832bb4d8f961a694c6dd2173c9b1686e365ee1b45db1f00631d6e8812f2dc95377ee0739592a775cdbbed64009707c
SSDEEP 24576:Va7/ezSC6vUyDZaqgrvWx6q8wyu6PsHAnrsRwYIQk3mhUVi:c/ezSC6vURPvMHjyd/YIQkJV
TLSH
T1C0755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a0c2777dc004de73665a0c0975d130b4143a82e281110f93ea0d9e5bed121be9
MD5 f66fc76484bfdca2327d06db917c2729
SHA1 25a40c4fb4a2e3b162f933b6082c4a8c5ec818f2
SHA512 cb77844e2ae5a66749650cb7c87cea63c21c289ec3771de5525bb0c6b87a78ea83475c556a578d06684364ab1a73a016c645145a29862208a0277fa658b0c331
SSDEEP 24576:DVbqPb88hv/lV73PsHAnrsRwYIQk3mhUVi:DVO88hXlV3/YIQkJV
TLSH
T17E559F66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 093eee9650808fc18c5257ac78270a7af48501a051a12de0c6a6fc52091cf3bb
MD5 f0797529230e3fa63f06b5551d4cef30
SHA1 138a54f74c6520535f74246731421cb0a3a095e0
SHA512 3c68176be2caa21a29bf2359788f8b713e4997771bba412bdb0c5d49a4d8157b21649faf66200db1e23d1f1cdffc9214c365ffc893342a4b1b2266babbe29dcb
SSDEEP 12288:DG0PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:DG0PsHAnrsRwYIQk3mhUVi
TLSH
T1534523A6C3AD85B0E3BB06343CA1E929C5377EE0FDD1033581F0761F6C35E11A566A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b54ce888fa75aa2c8480a23d753e02a28a3f795aa7d98fc9bd9db8913a0a6df9
MD5 23f379f8c22b64554eeaf439bd4060de
SHA1 6102b1fd9e33d6128c10672ee859a281f784b04c
SHA512 9e1fea6f96c453311526ecbea16791f12929dcd3d2f189f64d5c47ee44a5bb513370b088a771e59c01a7402dd0e03aee1e14ddce3bef849a29999d9e117a089d
SSDEEP 12288:TeBNUbTVO86UPPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:TJIUPPsHAnrsRwYIQk3mhUVi
TLSH
T10465CF7BEE28ECE2C27A4D785A91C600D77278704F6293CBD174820EDE239E15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ed1c45e6e7344082a5db6f17bc652d3f9f5660697804263ff4e0539730ab6234
MD5 710f00a327f73d72c635e0f62f5b3971
SHA1 651c8227899c21fb7b47bcf11ca4a510746ca65a
SHA512 54e1a93111de4148bbc5a93098f6c68a59d35f8c8aab40f3f903d3ee51e8ccda13966654809cede229b1e7ac1afd6ca632185476643a08a6f1a3d86ee734ae39
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH/:nQvGAdlCEL8c/pRNw5CaDJ
TLSH
T1C1266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4886a5b53f8e2c6430b53355a2f2466bf24cec6ca293b8261b582ae436b575bd
MD5 cab86a774f1f23206caaed21fc40b14f
SHA1 1383d9beec7611ef8fa95d28d6f7e0d3ffbe8c60
SHA512 3832492936af35b58d9015fd8312d145541a4cdead7c1b39a095f720950c4dfbe34e4e0be15c577c70a45a76efb6fbd6312a42347e630bc1a369b891da8b5090
SSDEEP 12288:OAwSfxL/2Dc3xDLLmt0LDQewsAjpPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:zwewsAjpPsHAnrsRwYIQk3mhUVi
TLSH
T17D75E031FA78D432C3BB0DB62B31D716543D79604FA11AC3E3E89A9E59306D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5789385f06dfb2c6483a2b030b2f7db98ae57983ace6fd3d3ef0429c81b08479
MD5 bcd9308ae39a241e84987d4c81161d26
SHA1 133dbbf6b8914618b81705f7499d4a8b5aae2eea
SHA512 33fdabe46c3ec30cb160745452d06be2955def58dca8eee933115852055cfda428d7db72123d07be2a355d32b81cd626de3326aa9399361204af982c04ea33f8
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHD:FUEtQevvqc2W1cpV29I32
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 66414418e583aa99ea560a8f96eda4fbeb47b36261c698cd9a4dc0899851acdd
MD5 2f978113f7bb839e8d1c348b459c1859
SHA1 0a6d14fd28f35a0b310534c5b61ea92852eef8c2
SHA512 664fccfbbeb88c49937eae3160f9c16f905a44985af9f1613bdbf36ba7c79f3c24b4ebc98cf4705c7cdf998bb377dc03572ae73b1a111956081902c189acdfea
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zx/YIQkJV:xoq2VjnmGDJ
TLSH
T16BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 481e47520237f67df34695f49172833338f16139f59c77b991c0bc4bee72abce
MD5 0833e882444c780f6ebffb7e0abd3892
SHA1 2db1c72beb1adad8ea0c252b46744170113c5c8e
SHA512 6b4f690984d0aaa3dcd290c44e2933c0f9b9beb108f484adacc3f2c3793b79c07370a89b97e977c1d44a6bb29bf486cc1b4a3a44ab7548d94dcb561114b26eb4
SSDEEP 24576:RAhGLmIFoiwtA5l7S53WPsHAnrsRwYIQk3mhUVi:RAM1Foiq5W/YIQkJV
TLSH
T1CF35AD81E7F945D4F5B3AA7899B69171EA76BCA65E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 076128f798aa1c6c3d77a2aa005753ac9c3198b34a05a8f3380d5dae84c0b218
MD5 a249894d43777adbc18e99d5b67c29ef
SHA1 5703ba0058d28fce1803db6c1b4ac255cb9c5324
SHA512 5011689479f9c2de0ca08fd47f92dcda6030cde9fd6c86dd294f6c22773ef54b6ec51b2b7262a29fed00fc1cf7e6623c707c38093aaaaec1923bbd80240d1120
SSDEEP 12288:Nmw5HEjsChNOBFgl0WDm+CaPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:owuXOW1PsHAnrsRwYIQk3mhUVi
TLSH
T1D865F14A73E80CF9E5A742388953C536E7B2BC512A61D71F03A0C65B6F37721AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fec8905d71d21aa107aa51c078ad55d83c86f58cbf38daf7e7c5748bbaa32eb2
MD5 57b9f0a60e20308d35b1c8c0ba23ff0a
SHA1 d79bd5d4cf953972d59b81bd76b916191c116f50
SHA512 c0dfdeade750b311eea1b20932ad27355c8c85dd50abfdbe124ee6c468d39ba5572b286bd5b839c543ac92e91c986d5a6f54fc3ef61783aac47121a8abd598ee
SSDEEP 12288:fbZ1Iy5PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:zZuYPsHAnrsRwYIQk3mhUVi
TLSH
T1E155129A23EC61F5D2A7423C9CE19609D7327CA1B7B203DF1160526A2F33EC15D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 91ad9c9feb03dde860fa07a9862a77ff01ab9892b7cc2860483b6b31ab7d7366
MD5 698c557944fc95627d8e2e520d972c73
SHA1 0d6b4275a2f07abfb0f75a427ec889dc456a4944
SHA512 5dff3837385dcd3bd9cb7a044a7615a0004cb7ed461451459483589f8a64469ca66b6701b0f3b6cd485e68cf611dc60b30a4522dabb671526f922100d6da783b
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UD:JQRQyi36YOcPuLvw2gAf+PN3nDJ
TLSH
T18E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c9ec43a2712e14da49022d22dcf42afb8c76cd5762e526adf79140b1aff1be1
MD5 3c492c0853bf407b6056bc5a3a122fb5
SHA1 35a808ccccb8dc3b3fc4e6afea925c79163ee07a
SHA512 866e687c98653db175935569b4766ef7129a4268cb441d55d5f38ddc37e151c5f11cd70b6b404ea1ac5d158d4539c5b4b4225b38c48ff3bd14000c2ab746da86
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UD:eQRQyi36YOcPuLvw2gAf+PN3nDJ
TLSH
T14B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b164e0ed46b5686e84825de04f14b39c34524d3c83eb7bc5f4f400614d4456d0
MD5 83d7464ccc9682c769252c75468e4c54
SHA1 6de1434b6ece9529f377601e62c4b4397f9e8a98
SHA512 1949b5b33304d8e275ec385c6e890d0eb696785be0cbb96c8299bc009c75cb1053bad875dc39859dccf941f15f7567e06493bacda62b0cb8ad0d81218d6b909f
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0IPsHAnrsRwYIQky:O68Qg55nhxeWu7PNU3/B/YIQkJV
TLSH
T198B54933B2F600A9C44DE1769F46873196D27C718FE1E3DB8151721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 958452443b07c00fee3634fedf8a07303b86031a7b1815823f22e4031fce5bf9
MD5 428c1cca64ef58d3c8e8f845202e9172
SHA1 88c947ec28a2c71bfa3b25f56aaf85042a5c8561
SHA512 af16177f5af92db3f9368eb6b9b6bddec1ef4bebb05fde4eef4e021895e6b2f0542ce5b2617595e53cc0c4ce0ed2f08140cd699bf0fc02c077eed608e1dae341
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:jy5112gYy5azzVvD69nLKnhZADJ
TLSH
T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3755a82a3d253dac70328efe04fc07c289f45f476d8c5b01c05d448890530ec9
MD5 f19ad416ab1a90030e6e868c6f02bed9
SHA1 92ef6ac14c0e736aab16b03e4b341858af2f4ab2
SHA512 cbc29271ccd84936f140776a26252e2c00b25877703bd13c000683044efa5357979c138f3808fb1b920e504b87946591433ba4026b35a7da30c38594464bf500
SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glK/YIQkJV:cu6JmQxd2dKDJ
TLSH
T1CED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0a347d750d18989dad602fe6070aafb8ba5ebeb4801b3c5f14a11ee13b1b3b2c
MD5 71b8328968289438f467dc215661e7d7
SHA1 5657c98461656312f1b0c882df6abbc9ab577da8
SHA512 13ba899e5eaff11c3c9ece44852c147f87e0f75786cf4dd63f50f997308b224fad2f43de6e653ad324d2bdb8887835debc864d659a191988132b19a4bf075766
SSDEEP 49152:f1hpsNoJpF1A6yU44CwH7R4xr/YIQkJV:fmifPVRGDJ
TLSH
T143B5AE13F2D901E8D06ED17887569232EA62BC450B31B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d50368fd1dd2d92459bb30ddceeb578ffbd058cad055d5f87ce198ee348c4356
MD5 a5469f7766ba2dadf8de92abbc6e86e1
SHA1 ceaded57938a0eeb7b540a14eae5e5f9d179af59
SHA512 c03af6ba08a178b2dc777d69b991d69c3ac9566475bf5b56bfd04d541bc9bac78a917bd9687bae15c1e11b81b2593f9ed5e47eb0e8348e57e73638bcd62906e1
SSDEEP 49152:MSuZQIY0Be2KIRVtOnks6NMHq0/YIQkJV:u5dKOi610DJ
TLSH
T1CFC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3b2a5ac58aa6ecafdf56bc23e8562221168da3eecfd258bc229573124dcaaf0e
MD5 eae9c7495f473128253ec8a0aa389f63
SHA1 524dae8f4c79b0af97e6b5350110df908d5e63ce
SHA512 98405f093b478b74af91e8705221fb814a30b088711473ee25534ea558611d2b889190356b175c7ab68374f7845cdc97f99d3ae2b27884b4f08b058a4f9050db
SSDEEP 49152:jhtSn8EApI0figGgiDn0AP5wP/YIQkJV:CX2i/phCDJ
TLSH
T17095BE13F2D900E8D06ED178C7568632EA62BC150B35A6EF0A90B7561E7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3154d6bb7d579dff802772d7a6e2b910a7587690de3e0ab56ef5c72e5a0daadf
MD5 cc3277e0d6b1dab8d926a0faf2613b47
SHA1 ce030ca05dac1081cfa9743af856de296da7c82d
SHA512 efea7af77a14879b2736d394e508bbb8b331a9878bc84ad2253dbd3395690e8f94949bd728ddb2ee7788ac3fdea420d570a0204137c92bf58c5c402f8aae163f
SSDEEP 12288:AMPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:AMPsHAnrsRwYIQk3mhUVi
TLSH
T16C4523AAD3BE86B0D27B47347CA0E62DC53A3EE1FDD2037592E0621B6C31F012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eb12af453ec2f37360069b8147899ad19a92097953e8ab60783575115fb7461f
MD5 88afc47d3351da4d41f37ea64b9d426f
SHA1 afaa797963c327a80718555efb6c9ee99fc4d43d
SHA512 7cccde1619b9188d2e1ce195bff25ccecc4a555f21e8ab917b267c24915a2d186ae5002db1ea8da4e38a74442f83446e9eed0f5eaa50625012b07a665fb6eb97
SSDEEP 12288:x9PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:x9PsHAnrsRwYIQk3mhUVi
TLSH
T1AB4523AAD3BE86B0D27B47347C60E62DC43A3EE1FDD2037592E0A11B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1a998f7eaf3b116f4274994ce4b84021fae2052ae3f7bda51d5e19eda467204a
MD5 803285c084bfbbfd672c5b0d15b1ab8c
SHA1 3996503e210974f8f15cfcd23f2e2dc49b4346c8
SHA512 93ad8407a2942ebf42ee1acbbf0482308ffa7eb53f56eb16efc74248e27c01597efb1edd0735d5d4629956e35828b0fc85f555e053f795ef4871139d4655c65e
SSDEEP 12288:MnPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:MnPsHAnrsRwYIQk3mhUVi
TLSH
T19F4523AAD3BE86B0D27B47347C60E629C43A3EE1FDD2037592E0B11B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a717f0e9793d8cb3786aec7fde95f2129fb5ef7b3619be851f44efcf19c8d048
MD5 9dba018f2a9cd6a22700fc11d93c013f
SHA1 8bb89a630f6ecf9bc8ff9161374243bb15ed93c7
SHA512 5800095ed44596f1da428006a6cd7b6d82f670f13b8b07b21bae0992253b87ef35e151e769ea812f9ea3b3678fcf246c6d1b7df8398a0661ab4e1820af569537
SSDEEP 12288:BV2PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:KPsHAnrsRwYIQk3mhUVi
TLSH
T18C4523A693BE41F0D1B78238ACA19529D2367DE0FBF213BF92A0161B1D31F406935F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a8f1be3245dee5600be152eecf23a983f1e8915a9f2e536100c01710a883e77f
MD5 c53a14bfd0a7ff3b918207ed01923c2e
SHA1 b41de85c29515555e12adc8775689f8b7588cfe1
SHA512 96eb1d7ec9b0b683f12a3e4a2bfa8be265c9ca7b9831acaae52e725ec63d5b9375e39d646ae974ed4b400e99f6ce90e1f5d89962d75c21432518d60c5f8f0be7
SSDEEP 12288:0ePsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:0ePsHAnrsRwYIQk3mhUVi
TLSH
T1CB4523AAD3BE86B0D27B06347C60E66DC43A3EE1FDD2037592E0721B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c189b7858de9318b46c663c3bea05249b16935966e5760fd166b960971cf1202
MD5 dee0a1b4af9dfc6264dbaff77f20fd92
SHA1 8a2181ed04c71ffb7d142398ef2e894376d1c5f4
SHA512 6a92e1d3ebe71cd8cf691c5f129c3c366aca799517371aa742111c97ba7b5c5100c1da76ef9d383bdcc4fcb2d93301af016433f32d6ffc1bad64cb05fea5cb35
SSDEEP 12288:phPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:phPsHAnrsRwYIQk3mhUVi
TLSH
T1114523AAD3BE86B0D27B47347C60E62DC43A3EE1FDD2037592E0A11B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8729421166ccf115fe5fc820414153c991fc20f326c48f25cfc7ab8e58d7c35c
MD5 983b1ba5711841e0b89e37202d64ac00
SHA1 aa6511aa6ba521f623aed75d3d99b241119aff78
SHA512 f83df15857dc61bbd26eaf5fe5e0b6cc30a7edc774189901c9fc506c08291d21cdf7771c8b464e3e4ce7bee7689a6a767e597b57eb82c0aa5eb2d50a412a7054
SSDEEP 12288:HlPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:HlPsHAnrsRwYIQk3mhUVi
TLSH
T1D94523AAD3BE86B0D27B46347C60E62DC53A3EE1FDE2037592F0A11B7835E112415ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8a887eafbb256a9d22917d3ab1358d3e6b2768db40c8a839be41c40351a00c61
MD5 b542d9df560178f4fe543ef5187eb073
SHA1 3919afc7bec08ea57d9fcc9c01e73295931c5756
SHA512 1ed4b29d2a58ae9754c6f74635919f8ec61d6c7084703b2070e0e51c86463c1c3cc47e9b43a951725fe63c7ea09629bace575e14a8a459a41277fa4c9a1613d5
SSDEEP 12288:ZiZwbNzzFEoS2cPvydPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:cZMJzFVSOdPsHAnrsRwYIQk3mhUVi
TLSH
T16465F1A5B3A408F4EC67823ECD619916D6727C655BA0C31F03E4362B5F337A11C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f13389b34e9351809b4c9569bf0611d40387095c37c0a5920dcc3bff397ac06a
MD5 5305b25f1df4fff04f8bd820ca1ccadc
SHA1 5865da6f84428b9685e8393a3eee8daad1278964
SHA512 0aa3bc5a9fbd2e73c0a10db1c72d00bb4f532bf60db87267e16b8529c2b5b072ce30e06b1df319ad6e49a345673481a2f7f1d20bebcf2b8b1943c6107c829df0
SSDEEP 12288:joPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:joPsHAnrsRwYIQk3mhUVi
TLSH
T1104523AAD3BE86B0D27B07347C60E62DC53A3EE1FDD2037592E0621B6C35E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 866e3d818d4fbcf5b52c722420e848f88d88a7ec6b3f45199adcf82c365dddab
MD5 0e63a4098dd63c0013f09bd3cec594b0
SHA1 48d32097282fef36d1bddd59620d530fe82f27ae
SHA512 2bf93abeeabd8e70f08fbfdd2d5427d754c1583cd49b75f77f4ad335d7bbd5721d2e8a63a96caed3c59ed448fbca15c47afb4a94b7cab10028f7a7ee9415f303
SSDEEP 12288:XEPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:XEPsHAnrsRwYIQk3mhUVi
TLSH
T1524523AAD3BE86B0D27B06343C60D62DC53A7EE1FDD2037591E0621B7C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f634506a0d637c0b76d4c34f963b4afa3acee8127c612b1771f4e0201c2c1a98
MD5 6f8272257e517313522b1e7981765e1d
SHA1 9c518ac9ad6708201ff4334d9a4feb1434a663f2
SHA512 333788392e87a9ede1d44e6c396050e8b381dbf4a3474f832d345ac192390ba682a53f49243e4641baa9e78fbd013a18a549c360824c4efe6bf72ec07a74593c
SSDEEP 12288:4yPz5L85PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:Zzy5PsHAnrsRwYIQk3mhUVi
TLSH
T1C055025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e7670fc21482d646eb0b25d4e50f066c971c82c05f2adf070bf7b4e64e8c9daa
MD5 3ac58841e95224b20aa2439148b24c18
SHA1 8ac514d9500d34b679b7e42923d67664df1cd521
SHA512 2bb710e88283419cb0df50e103f18140994ea42dece236ca2c2d34bc00c8263335c6754b213208d918883372fadb2a7211c27637d0770001f8b20d5a97801f2c
SSDEEP 12288:2oPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:2oPsHAnrsRwYIQk3mhUVi
TLSH
T1184523AAD3BE8AB0D27B07347C60E66DC43A7EE1FDD2037591E0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2b78558563706b716e80a541f5d3af86dccf65bbed04b861a920861d2cbb27c5
MD5 fb23132923797b2e084501af645e0c77
SHA1 f9605b0aea864029bac8025d5939d5cf92eca7f4
SHA512 b380251a3ad04b3635db80786d44fcc6fa0a8e758521d1f5d67c9b2a1bb555f59b293c7f37279b6118702ae7e16296b32df1efa775fabf20cc13eefb78adf474
SSDEEP 12288:9oPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:9oPsHAnrsRwYIQk3mhUVi
TLSH
T1BE4523AAD3BE86B0D27B07347C60E66DC43A7EE1FDD20375D2E0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a9836835baac2439a3df43fd2087f6edfd4596b16644ae2d417c6b810905a74c
MD5 3d9e34aef8e462a7cb78c3d5c562f918
SHA1 03b9bfc1bca9c05190f8c556b63332cff92e0281
SHA512 b310bf95108b7ebe7c8f4f16566a78315a7b4a63b2ba2b6884b4c11752d86f0ccbc572622c5ddf78e616b06e6f5b4f531dced103c15b799275a8082dc379d8c5
SSDEEP 12288:gyPz5L85PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:Rzy5PsHAnrsRwYIQk3mhUVi
TLSH
T1ED55025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c8649796c9a186029081bb251a582b8afb843b6e8dc31e24a40aa55bf67d30ec
MD5 3c8769b87b866cbfbcbe4d2508fcc158
SHA1 a66988dfb269b81a62a06f8052d951a12fb5bfce
SHA512 6fffea86612c24abc615297959cb75d3e78783fc168bf57fd97ba5bfad10b1b224a23d7e548371abccc35cbf9646d2b3f3ae4132ff1e15b601bde849f5516354
SSDEEP 12288:JCd9XWYoaLHF3z0z04PDvhXPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:UTuaLl3z0zDXPsHAnrsRwYIQk3mhUVi
TLSH
T1E065F1A5B3A418F8DC67823ECC618916D6727C665BA0C71F03E4362B5F337511C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d09185e202df46b51c19a00b7e5faad16ee4ee2c763d55cbf90ce59c86ca7fc8
MD5 2d5654c71b777fc9fc623dfef4063162
SHA1 2861235f21cc73892635d8526cb8ffab2b4a3511
SHA512 9e7aa39ead96d84c01e7900f57b1bcda6a2686ddd863fed8ff5aee9b508ec174e8f61a7cb1a88c82748aabe32e8ed495f0b40257522bd1f741a715f66966ec0f
SSDEEP 24576:I3xd9CHKy7GZLPsHAnrsRwYIQk3mhUVi:Sxd9CHKya5/YIQkJV
TLSH
T1B375CF90F3E814E8F1B78A358D729511DA767C995B71CA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f4b3b4ad29c1226a2ea15a2dd55c9ee2ee16f855cb2c078b4507993635a46b0b
MD5 acfefd45bc007925030ebb3187b7b0bc
SHA1 0ebeb0acfcbe67febfbc33ce3ffb6d9e2a392b44
SHA512 7c07b5b9ce8fba3ccf0b30fd0ada08053d835b8be8bed289181922bd930e7869eca4a5e8d0959cb2d360b7f57b35ca322c6b1696d38fc08d32ba5011673b557a
SSDEEP 12288:dHPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:dHPsHAnrsRwYIQk3mhUVi
TLSH
T1FB4523AAD3BE86B0D27B07347C60E66DC43A3EE1FDD2037592E0611B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cb63d41cacb8527447db32db193c6f0419e6fdd29dd31648d697c140d80be7cb
MD5 d3fb908285c205cad309ef908082a2ff
SHA1 33d56e07cfbeba21cd602f3132b1136909630b4b
SHA512 030bb343d96d0a3748da82e5af59eca69211e8d77b19a2adcaa9738e0cd16fa7aea9cfaf12552dc40e607d083d4c2395e369bd842c6fa0faf43d3996a41bd7e2
SSDEEP 12288:DZPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:DZPsHAnrsRwYIQk3mhUVi
TLSH
T1C44523EAD3BE86B0E27B47343CA0D629C53A3EE1FDE2037592F0651B6C35E012415AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fcce9885599f105ff6855c7178d6db1419887d060cfdb8f03438a7928111d61d
MD5 68bb2eff147f2520b0cf6499db5ae013
SHA1 0ce5a0ea0a4581eb4d9a7d29bc7ab1690120bbef
SHA512 c6b80314725c2c73878347018694c8414fe0fae123ee7779476c5b6061d9eb89a7705a2a1280c263fa402375af0bc5dd412eb9fa2618128d0f800c8c8ea800fd
SSDEEP 12288:ZCPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:ZCPsHAnrsRwYIQk3mhUVi
TLSH
T1C04523AAD3BE86B0D27B07347C60E66DC43A3EE1FDD20375D2E0621B6C35E012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c16ab64b8f61087e1bab143badbd20bd82f4e21088c7abc70d51e23f564da48c
MD5 b3031d3fbd02341ce820a5a6602af9b5
SHA1 6697e7cac5e9dfff3891aac66a5ffebe79eba293
SHA512 fd30b0d079b0c0f55892b605e15a6aab9eb0304efee7edf9b46de44ca4672ba2ea3dc78528decea50e5abf15181748df318aa68611c5d2e2a782f5dc34a9b059
SSDEEP 12288:UoPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:UoPsHAnrsRwYIQk3mhUVi
TLSH
T12A4523AAD3BE8AB0D27B07347C60E66DC43A3EE1FDD20375D1E0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9f8ea5e07451872403406d342623ccc6ca9cdc0685ac48957d042ea9ccdbede3
MD5 d1bb2c5d93a5cddb1edf3aec81640e67
SHA1 a5d85ca339f2c8e76ea3d55388dab7236d1fbd0a
SHA512 0095193f827dd5be94e300e7b3df309ffe7242d3f142518c1924d79978cf78aa26c19f118b5dc1cf00335fdaf0fc61f4821bdb4f3b33503a96e838328491c460
SSDEEP 12288:5HPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:5HPsHAnrsRwYIQk3mhUVi
TLSH
T1184523AAD3BE86B0D27B07347C60E66DC43A3EE1FDE2037592E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 58dd497aac181922ebbf2c61c17c3aeaf146e76da5ac81335a68f7545d61cfe2
MD5 2a19d32cb0c77e120b2dde39f1e05079
SHA1 91256d7f9dc3e6ae4e55702c790a41286e41ada9
SHA512 231d05cf5376920193f33588974d35bb366020c725c5c5ca35e652badec5f4b4f4e58ba743c686292aea021ac922409969f28d12435e979eaf8dac692e47129b
SSDEEP 12288:FQPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:FQPsHAnrsRwYIQk3mhUVi
TLSH
T1F34523AAD3BE86B0D27B47347CA0D629C43A3EE1FDD20375D2E0621B6D35F012459AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7ccffed308c9ad36a13c43b70e56c12a5a6c0d3ce73b97f65f6484fc7bdc5d66
MD5 789e1bb1ea9989ad488e1264dac9c282
SHA1 2b0f8a9ee5cb73d5400bcd48f8bd09b211fd36a4
SHA512 f7735cffff1ec909550222a70924f5b251e9899eebde6a6925c19b3f9c10d161f07728340162e50080e154185376aa2f7344e1e692989bf2ed2a6dcc2f17899a
SSDEEP 12288:TePsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:TePsHAnrsRwYIQk3mhUVi
TLSH
T11F4523AAD3BE86B0D27B07347C60E66DC43A3EE1FDD2037592E0621B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 257fab88fd4913c9722ce14875573e47fa16c5ad103efd51a51035cb0288351c
MD5 65336ad79055e4d6a147ce7aea0ff113
SHA1 d96c273299f8e657532a879de89955fe165eff4b
SHA512 6b9f7b955ba57ada9a7a816d13355b96d23060ef1f113650b5585afafb38dd15eb8e8c39fdf853e53dfd001fbb5e138e1661bc5aa362f8e937e4dca6fc3a0e34
SSDEEP 24576:wfwvOk9RX6wkyAIUPsHAnrsRwYIQk3mhUVi:+MnYIg/YIQkJV
TLSH
T1D885DF29EBDC44E5E1B7923C99B3460AF6B178691B71C2CF0299536E0E33ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4f9cace359cfca9597dc969a39a7b0ed2c95455c80385fddecbb68e455166afd
MD5 f7a985d7a947a7840d0781fc25200ec8
SHA1 a639bc84291afcc2b68830c7ddb799359dc3043c
SHA512 bce3fec3f3552b3847988ca0821896a34c804c08f496118ff013fbd37af62eacf36f6536fb84f4707f075952edda96f8fcb83c5559046ebf0fd08750d623d37b
SSDEEP 49152:FYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0v/YIQkJV:rySzPHDJ
TLSH
T1D6067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5ef5be27359f6ceba5b5a936d5065f2b338955398cd45fad6acddd66f1d34074
MD5 7af7fd5b490a4d28ce53e10272e98aa0
SHA1 0b33c6f804daa27dd87a04a41891d96bd56aea73
SHA512 cee3f6f63b41f83c71bd588e36be693b8ad455c381a19ba8a589276a19bdced6ad8f57762bfad988e464c1a7a45aa881d2f3f985485606f08b503f5101605845
SSDEEP 24576:W47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYtPsHAnrsRwYIQk3mhUVi:W47JUQjairIhCnDHUPfF///YIQkJV
TLSH
T14865AE1EA3EC01E5E1BA827885158A5AEA71782D5F31C6CF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bd7f74b82b803d0283af92469bf4f888f07d17a7dc74bca2e9790da9e4884ba0
MD5 fbe874ca0a3fc754a2847e6d35c5e777
SHA1 ed059908e3c24cbd2939e649e1861a1773098da6
SHA512 07608541adb92e57696e9c6542d609d3c5d39ce2409cffbd79e87e15db102c3319e9da3d93bad79bf20753f66a4752295f07e4a4e1c6e900a5e83651352251f3
SSDEEP 12288:JksfYPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:ZYPsHAnrsRwYIQk3mhUVi
TLSH
T13555F15AD2A802E8C06F5239CB519A45F3337CA197E193CB52D0F53E1F36A905DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 ff9fe10ec1a486c5af0df0da7e4de19fb25dcebc3d090457fc675a254df25924
MD5 8e5aa2f507dfa402223c53f69856ddb5
SHA1 f7c61a91e3d18aa3dcfd486a46a39adb11489156
SHA512 4498f650a64ac7e3474fad6cd0bba3ce7a9e6244c33a18bae0b3a98c34dee4c6497f6ad94273f9fa7f4833abe5731089cc98a873f2c9f6641c9134eea35b1c91
SSDEEP 24576:yEGeUPMOi1R7n/zXOoyLbrry6yEYgd4yHwEk8f:4eUERFjOoAzyEDdjwE
TLSH
T1ED553840B62BC69FC5A940325E36D6CCA7607D01FE056F0773C8873F9476668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 25e30b91e6d7cc47135205ebe876c742dec2e7bc403eae6e53eaa2e92d5022e5
MD5 5b8135452b09d7eddbfb842affbb0808
SHA1 178ee52821fda14a238e16ff2aeb6351a93b6da4
SHA512 b21a73658af96e787249e73aadca622050eeb16168cf085806ee9e0a8cfddfef0ac2eb08005c6833e7ed884a297500d8fc5a4c9d55dbc8600338b1624d924a7f
SSDEEP 12288:KKwNtM9pD592e2hrhzylmsRWoJAAbFRSihXwBDP4z8Uq2di15rmtA:KKwNWpzDQURpWfh2I2w1ZkA
TLSH
T19B453B41A5A7E35FC9FD50334232C6CDBBB46C16B7452B0173448A3C98779BEB6E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4f761ecd7c50c86c733888309d9d4de142d46bf694db8d6771c5d4ffd4994342
MD5 1e76376bdbc596182eb928565f424fef
SHA1 1c36a2d76e8ce1c8a92bff6e3a1c25546b1564ed
SHA512 35e12613dd52abe1d4b1b5ea02b02a9c6d5bfe96f36060746a158d066fad352a5320d52348e3a51de17b43ac66be541a53fea7ba480816408d6aacd57f473b64
SSDEEP 12288:HF7APsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:dAPsHAnrsRwYIQk3mhUVi
TLSH
T1AD4523A6C3AD8970E17B07342861D539952B7EF0FFD103F7E1A0621B6831E816D75B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f31cc5e95563cbc2fb0be2db7f17b25eac596233922aa9d2f7fb2df43f768231
MD5 969d069325a0703aa8f76b8d392087e1
SHA1 5571fe3988773c80711c59a715cc4fd0a52d50fa
SHA512 e2625af13415385e4783b50cb7e18d5c93c5170a5f19c54dd61b60f53af6f71fdacec37d0d4591bc31a41c3fd5227dc69712176ffe4d28c313732d97b3388a5a
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY6PsHAnrsRwYIQk3mhUVi:egb4mBIBhGF1/YIQkJV
TLSH
T12165AE1E22EC02F5E0FAD2B89DA64417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8539dafcbffb5515dc10342a9651703197d2def7d1f848648e5e8c5651967b97
MD5 f566427cc9a6264dbaf674f03a1861a0
SHA1 c71f92cb6696d27bb5d70d18f8f3e3ee62d25147
SHA512 c52a8c4974198b47267fce82cfdc41401e89fa4083d8374da10c751dbcdb9c5d9a6db266c5cd3110b1f589191d9b7c4e095cfd528afe11461aa95b43f7b714ea
SSDEEP 24576:6G88u8FpJqH1nzria7/mdPsHAnrsRwYIQk3mhUVi:B7ZFPqV6a7/y/YIQkJV
TLSH
T19D85F165A3E501F0D47BD13889824667F672B8211360EBEF07A88B561F33AD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 413b7d10836a6422bbf6236b3385902ba35a94cf30e75b4f4981ee49b37d9f53
MD5 dc17a8e5cb984adf5883c432af2a407e
SHA1 cb8864c2e50f2007fc77d323f067d6ae50a31f69
SHA512 7633296db74aede97f622e3f1665894708632119296a1ab1a2f16435db8aa08970aa4da064a904ab2efddea15dcb530b5271ac53115dd7921da3033a5cd843d0
SSDEEP 12288:sHvUrBFrEjwaQxPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:sPUr+NQxPsHAnrsRwYIQk3mhUVi
TLSH
T18E65E12F62ED18E5E677A17C89828719E7327862575292DF02E0817E5E33ED87C3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d64ff2fd6ba4ecfae892479ca4378a233f8d2cccf6a55563cbb31de51c0ba491
MD5 c9d593597708808093ba33fb936bacd6
SHA1 4632e8be1279713fcdc61bc80ec6fcfff55c4b06
SHA512 391c926a09e07c4fa378af728e8292af4e3a04dd27a4f306bc8ac410febab5c59928a83dd9724ad6be328eba5386c720b020b4afd72c3c6bb27050c904ee9c0b
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp/YIQkJV:yG05lO43boDJ
TLSH
T1D2D5CF6E62EC11F9D1BBC17CD9C6860BEBB23825033556CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d1ea34ac819a2399554088355c2acb5a6a5630d288fd7b30bc586366b48194cb
MD5 cee3a493fc0587bcf684296e2a179546
SHA1 c3f4e24bf36d713be8a0611e391f4bbdc74001c7
SHA512 6115103daad0ef9d59c79ae151023f8d4cfa633ea2e504290e5447781ccaea366d20d1c9fd11cad1fd3588f36493747e2b36d7e597cb649ab082594ca9527ad7
SSDEEP 24576:Lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnzPsHAnrsRwYIQk3mhUVi:Ta5POZ3hJt2pasx2+mB/YIQkJV
TLSH
T15865BF5EA3FC01D5D5B9D17DC583861AE5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55477e287bc6697f6df93a08f53e38909e2d0f94b55fbf69b219f888e0e9d6c6
MD5 af53fd2567f58747f61c60cd9f822214
SHA1 9adc2c9ae5bcf80b16ea31faf41b4fb30f4eb79c
SHA512 21adbb68c2eebae9412ae5834da573749efcfaa0327762251c462f597c2c53e7946d2e24f74ba2e12915f7b48ef94a4ee88f0121d2a9a6a728c2c9c392681e1b
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkVPsHAnrsRwYIQk3mhUVi:vNc/zEOVHFS/YIQkJV
TLSH
T1EE857B2623E901E4E1BBE1BE89779546FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b02092b2ad05471fc288f33220835d4431b67fef3567d2543643dd50f5a7107b
MD5 d663dedcc161bc401ff788a137de251d
SHA1 bf546c6aaa969663780ad5bd61d66d0ce40fe669
SHA512 a6daccc20ed8141f8ebe332d5322ab187211f1f98c70bdb238ddd9008cd385e927c70812a418f3788488c769a3b83a56b9467504c8f9189f07beb05e2308a14a
SSDEEP 24576:F3kNvNnaFeYhJNtmZBmGPsHAnrsRwYIQk3mhUVi:F3MwBtOmW/YIQkJV
TLSH
T14155AF6EB6F846E4D1FEC6B48D238512E6727861173253CB9290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ec8f0e0123fad8fc9558308f3a6ac5fdbaf3b0be676fe88f0ffad28aefa8865e
MD5 71a553e84203053ecb0dda5ebd51a9d8
SHA1 951e123da0e88dd4eed84f5b8fbccc39d6c14335
SHA512 f80f6e5c9cc4cafe5936f4d1a609a2aeae294d0b57a9add6543890b5150191081b1bdd3c9b381049e7bf4b81fccf536d673e425da3d8a2a440fbb38b52773356
SSDEEP 24576:3D3FHshBIYQgAsPsHAnrsRwYIQk3mhUVi:3DVHeBIAA4/YIQkJV
TLSH
T1B375E17EE79C04E4D57BC17C9A638A06E77138A9036256DB02D081BA1F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1068-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1068-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1068-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1140-71-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1140-77-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1140-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1140-292-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1320-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1320-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1320-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1320-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1320-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2452-87-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2452-83-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2452-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2452-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4184-136-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4184-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4184-138-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4184-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4184-130-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4608-0-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4608-29-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4608-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4608-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4608-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4752-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4752-59-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4752-65-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4752-186-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4808-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4808-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4808-333-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4916-331-0x00000131C9550000-0x00000131C9641000-memory.dmp

Download

memory/4916-400-0x00000131C9550000-0x00000131C9641000-memory.dmp

Download

memory/5012-50-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5012-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5012-44-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5012-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5012-54-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5384-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5384-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5384-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5384-111-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5384-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5384-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5632-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5632-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5632-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5632-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5680-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5680-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5680-15-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5680-22-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5680-21-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download