14fb48b7aeb239c730d8877be9931c1381e0408737684636444348e9dba96955

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.1MB
Sample260723-sd3p4sep4v
SHA256 14fb48b7aeb239c730d8877be9931c1381e0408737684636444348e9dba96955
MD5 e3934c40f15bdc0cb54e7f271cc5ca4c
SHA1 39ff12666d17f064b565e75856c78cf49f79b373
SHA512 55d08288395409e74af5491c4954afe34d9f7fc34d9df3a2e9883294f45f9106990a0de19cd19103226ca304e604d057f1acf8b49e48319cfd19d99375abacf6
SSDEEP 24576:KyGICkmaTEbaQ/aN4mGIkXxbjIPsHAnrsRwYIQk3mhUVi:KZICkmaTEb1CN4JZdk/YIQkJV
TLSH
T1E2A505237152D8D5C65D90B0CF168AF153617CBCC7F297AB31C9BEE4BB325903AA6209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
700	elevation_service.exe
6032	elevation_service.exe
248	maintenanceservice.exe
1060	OSE.EXE
2328	PerceptionSimulationService.exe
3680	perfhost.exe
3844	ReFsDedupSvc.exe
5708	SensorDataService.exe
2256	ssh-agent.exe
5640	AgentService.exe
3428	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4a003a7238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfeda36eb41add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000711d2a2cb41add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9481e6eb41add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d09f872bb41add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d804c62bb41add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005b8c312cb41add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e67ad62bb41add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4668	2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	700	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5640	AgentService.exe
Token: SeBackupPrivilege	3844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3844	ReFsDedupSvc.exe
Token: 33	3428	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3428	SearchIndexer.exe
Token: SeDebugPrivilege	700	elevation_service.exe
Token: SeDebugPrivilege	6032	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 716	3428	SearchIndexer.exe	103
PID 3428 wrote to memory of 1920	3428	SearchIndexer.exe	104
PID 3428 wrote to memory of 1852	3428	SearchIndexer.exe	105
PID 3428 wrote to memory of 3800	3428	SearchIndexer.exe	106
PID 3428 wrote to memory of 6008	3428	SearchIndexer.exe	110
PID 3428 wrote to memory of 3256	3428	SearchIndexer.exe	111
PID 3428 wrote to memory of 4880	3428	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_e3934c40f15bdc0cb54e7f271cc5ca4c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2632 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2632 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9626786af3e2947071352e15c07151bdfd8f8f7bf4a48dffdacacc2c3e6833d1
MD5 9af3bef1462aee19f4ec32073c80dba3
SHA1 587d383659464685dd4bb323fbb00e8c59d1107d
SHA512 507755926c66d92a4efa7dc8099fd53b4593a3a2cd322b4d9a79884b261de515e20cdfbde31884dbed28d35e5313642e2fa649bb7711dc37ec96584755fee985
SSDEEP 49152:rb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnv/YIQkJV:53q6tjBADJ
TLSH
T180D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f91edce5829cbd53badf713adc3393d2b7611563fdb0e0b90924a07bed473afd
MD5 c94d0149dd12e17f2662ff1409a12677
SHA1 73d79ffc43ba343d58c9b5e2ba6ba37e6405e038
SHA512 bffe6fd19d4294477a84e25ad17d7bae73606b7522169ae07caab7d2d00661ead8e692f94a77baeb59bcf07a66d9e077a36672013c984f6cabe20d7f8f95610b
SSDEEP 12288:D1XLsswWkxy2lRq2czA4PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:ZXYfDtczA4PsHAnrsRwYIQk3mhUVi
TLSH
T14C65F12963E409F9ED67823CCCA18515E6337C9187A0E79B03E499261F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 141007e3d9aa702fcdd70162775049d135477a31b28700a834d02bd3686df8d2
MD5 d57dbd6ae9ce1299bace9d9251e7d2ec
SHA1 5a68a478081dcdd9d9df8ed231ca399e913ba77d
SHA512 e60678e52f4ed045832981e8d10408c4ff13588ddb3c80b2cf5e014b714825c6dbf19739acb342ce303376e7a880f71078395d23ea6fdb10374807e2484d9a61
SSDEEP 24576:90Le5ji0hmxnrMvPsHAnrsRwYIQk3mhUVi:9Pji0AxW/YIQkJV
TLSH
T163859E56F6788331D073C0B9C5D2A69EE93230815B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed5b3d1110d314cc3eb364590b291d4a4563d5cbdacc40d22a54928e23df26ac
MD5 35787d2e4b98c62157dfb98d83db6939
SHA1 a13a90a852e55f1140ffebb43c28fe49dfedb132
SHA512 f241f8baf62c7c524c2f85ea7c1affe91f3ba4019d1b8913e30034684a3b77f7f460939bb946cb7f73fc1de882162fa120def28fa85f5354ed647a0c8dd61537
SSDEEP 24576:da7/ezSC6vUyDZaqgrvWx6q8wyu9PsHAnrsRwYIQk3mhUVi:U/ezSC6vURPvMHjyK/YIQkJV
TLSH
T1B6755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 79e06816f47cd9f2061f7afded214336ba8a0f2431a349887b1b730b834d3916
MD5 97904041651e869d0d8297fd6f1d1ef7
SHA1 99b03e2b499885c3687015e0456d1e734e8f0103
SHA512 a54d1b6baf1425d75d018ed3e36948dffa156f8d096974b5a2a1a6b5236d2090a544a124a754f22a69ff02a34f193a4cfabe2661d8d7739f6c0b3c0a4694dd07
SSDEEP 24576:bVbqPb88hv/lV7APsHAnrsRwYIQk3mhUVi:bVO88hXlVY/YIQkJV
TLSH
T13B559F66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b1075f03db8377fec9ac3930eee16dfee667b219adc9b73e861cb434a8365c46
MD5 ec8984203f02009ee5592fb2cc590804
SHA1 1cd7215ec3b0e95268f71a7faf79ce39f0b32035
SHA512 ed090bbbb99b9d57673aa0abca3f391b026c3068440002743aed4329dc789d51caebc4fe0023a98bcb8fd92d2a9077bb6b5b0f71aea8bc3d472cd37d1b867757
SSDEEP 12288:oGbPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:oGbPsHAnrsRwYIQk3mhUVi
TLSH
T16E4523A6C3AD89B0E3BB06343CA1E929D5377EE0FDD1033581F0761F6C35E01A566A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 260935ca6888a1a28f03c955d699a1237359108129f298bd5cb4245315d38fce
MD5 5ce0c133c048aca9f8105b2bb9b1eb80
SHA1 b398638d5c31f407dc66f5540dd84eb4cd742bb5
SHA512 c833a9ff33ea283779362a450812dd66b0a3678b8bf27ed4fa4d1ac29ac811d0e9f16aa70c194b7a235b08347ddc7c7d3049b08c6712ada46a7a12870cb92c35
SSDEEP 12288:/eBNUbTVO86UYPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:/JIUYPsHAnrsRwYIQk3mhUVi
TLSH
T1EA65BF7BEE28ECE2C27A4D785A91C600D77278704F62A3CBD174820EDE239D15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 df91f5e4ab7a20464e06feb5281f5a39ca87c1c3fb8f1a43fdd48523fc0e77fe
MD5 19062258bf5b603fc5b76f1a75c03776
SHA1 4ad1d9e38f059c217934694a29b8fce01049933f
SHA512 932d1f0b1040e35923f2448a8e7e827ed2e4ea86d6fbfdf4d57eabcee194f3b80d3e1b84396f351373f957b31487cf0990907cf87782d2df77f9bf9337d29f7f
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THU:pQvGAdlCEL8c/pRNw5C1DJ
TLSH
T1D0266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 859707e238dc26e55debc9125ea20e7d7fb3e6c0a5eb52cd344a59097604cccd
MD5 e2f71aecdb6d38d842ec5465443be7e6
SHA1 2476903509e57fa5aa93cc2c6e817c34c86b1650
SHA512 abcd54684faadbe1ff7b4236b8f79511ee80c5a752faeedf2da282ca27926b4226f5cf2be03d499818cc8e6b19c402dd4a35a8db6f9d4267f04605ea6d4a876a
SSDEEP 12288:iAwSfxL/2Dc3xDLLmt0LDQewsAj2PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:nwewsAj2PsHAnrsRwYIQk3mhUVi
TLSH
T17775E031FA78D432C3BF0DB62B21D716543D79604FA11AC3E3E89A9E59306D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d434aa851bb08c4140c0899aaae9277deb10c6d78478ed2f64ef90bd32188a54
MD5 3c7d3157925945f1c1702fa397cab8b3
SHA1 c0a46784d566555a6792aac028d40127f0527b0b
SHA512 ab030d776555d13485c2f30703e117ca7c6b206f0ceb62b726b72858bc1ceed199d99eb5e0c24092e5ce7c80178126d677456c5bab78adfb6e31742897923ef9
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH0:cUEtQevvqc2W1cpV29I32
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8bac5f468ad8546378e593df87ce0921ec9bd7b79f26809420dddf7850aa3c4e
MD5 a207e0267aa9ce5968ce30b8f9fb0878
SHA1 3750c05641e1717342fe60e4328cc428cbc608fd
SHA512 481329cf6b31408be091bcf68da7cff9c0d81771b05680574ac856a26e91d406e9d105e6030d9a0984d33cf9236d29c72706689318f0390c7dc648d771f44148
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zm/YIQkJV:xoq2VjnmZDJ
TLSH
T10AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d44a43930374ec1f3ac2d0871b8288b69b55216283b9565c7b8301e239ef8c2
MD5 a951bcafebe9a01383882b3fd1b84464
SHA1 7b3cfcf7ae44f17ecca5711287fcaff38f92d4ef
SHA512 a6c0306692f8a829de19f62529b08c02a005fdba514654ea94d930b0f8a85d4b1e31ecfaa5bfba0fc7a843728b8309ab70abbe36120c3da0611681cd2ca0e265
SSDEEP 24576:5AhGLmIFoiwtA5l7S53xPsHAnrsRwYIQk3mhUVi:5AM1Foiq5J/YIQkJV
TLSH
T1CA35AD81E7F945D4F5B3AA78A9B69171EA76BCA65E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f3c06133bee10f23d577e214065015e90f339a7267a9ba2b8dd9ff6a864b24dc
MD5 8e14999cfbe59342b1a05f64c34797f9
SHA1 054ab65a9596d6a2e29364efdbb0b06b5f3db1c5
SHA512 3d6e56ea9188abfb53edda82929ab6e13dc7371e5ac088f154b783e5dfc469365984ac4196d61a20f50679305fd4000781d4f89dc2faa60926187036a42bab7c
SSDEEP 12288:Zmw5HEjsChNOBFgl0WDm+CdPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:0wuXOWaPsHAnrsRwYIQk3mhUVi
TLSH
T18265F14A73E80CF9E5A742388953C536E7B2BC512A61D71F03A0C65B6F37721AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 618e081a1b788936802e8686c12840e2e1947ea1a74edebd6d7e074d132b2b62
MD5 538dd79e78ab88d31fa797b3d5bf1b87
SHA1 65e8843f8c560e5427f602cb96df9117d3870c94
SHA512 1696b8c4e49b7258ba62d41d2f5554a8ee82bafbad1bfb0aefd223e36af5bdcec3b64bdffb49334d2c5e47f120e0b939d8289b35ae45698c2dd28ddcdf9ad0b8
SSDEEP 12288:QbZ1IymPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:YZuHPsHAnrsRwYIQk3mhUVi
TLSH
T12A55129A23EC61F5D2A7423C9CE19609D7327CA1A7B203DF5260526A2F33EC15D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 796160c738e46948cc2c4c069d1e6e40af5ba09d446658111c2292c95a3b4ce1
MD5 a8fdf22e625b06511d44fa345327c13e
SHA1 f175e43beb4168025165e1630e9f24c8089c3be0
SHA512 6a6f3cc3d6502afb5b9b4a98b61811d688ef8e2e841733026ab0e1d05f5922cf3ad21b12efb130e2f0e284df903d6c9c046739169e3d68988b838bf195cf0cf2
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ug:aQRQyi36YOcPuLvw2gAf+PN3oDJ
TLSH
T162666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5e5ad55cb3cb9080ad5bc5c651ec6738910ac16f21fac2c06613490dcac2b784
MD5 990445c0086ade0560e2457cdfddff08
SHA1 0a98825f34e71989380944e458111dc17ed9e29c
SHA512 9055b45f5125ddeef96f752b1b291ec54baa13ca108901aa39b2b95d5de38885b5c7de37853ce7363b157846997ceae485725feb19713df531c700a882020280
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ug:CQRQyi36YOcPuLvw2gAf+PN3oDJ
TLSH
T183666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9c772d0b7200e5680d95d45934a3f303efe330ee1cb02846d71d4b4fbb914ea5
MD5 b600a731947b7f9aeeb66f9a9c18f4e1
SHA1 8753d4094fe79a8459b2b0069a63e06ab7a3057d
SHA512 bc3c48a32669bf1e13519342fe59547f5f57fa3169855272a3a689bcfe9e32ab9ed32d5e35f3efebe3829a7a0432eaef13430869240f7c18db44bb40979ba09c
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0XPsHAnrsRwYIQky:w68Qg55nhxeWu7PNU3/W/YIQkJV
TLSH
T1A2B54933B2F600A9C44DE1769F46873196D27C718FE1E3DB8151721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f83d2972918e6ce10b68de32c39f9310289a14dd9803c2f0414c4346aff62e4c
MD5 53f390760ab39e637666b6c84b2f1d68
SHA1 af779010216de4752f66072ac46b62416fae88d3
SHA512 0b979f328c442246186f00e94d7a14d37df305e26de4ff3de939437a49e21dca2a7cdbf3d2904b323b756b7ede6915fb9225eaeca31f3c8dd787aa84446f77fb
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:+y5112gYy5azzVvD69nLKnhZXDJ
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0bd8e39859c87a6bf068effd1b4108d5796f60d314e0d172ff49cfa824cf8b1b
MD5 93bb6355f2d787844ff0730fe79babb4
SHA1 3b9e0cb158ee944cc0da64ea12b4c78c78027d42
SHA512 288ca206e735564ed6b74b79d518b54ca343229ecf1f6d7c117d648dc39fc50232835be5e43c59e61b75abde670a419b055f48960413b0dadfcf0fd34f0cb877
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glk/YIQkJV:Fu6JmQxd2dkDJ
TLSH
T144D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b60708009e30d671110bffc5e0c7d7dd840feb24eaf0cf56fd8b8505e0549111
MD5 672b7c4e1e898cc5aa4a35b53c3f041e
SHA1 dbc7e5ee38e3904b702c63f995fcbdd2cf6c42d6
SHA512 7127e42e6816afd91f22053a32c8656b2f89fec5f805667278d82355e5aa4441c43f05309a33a15dad34b4632ebb35b6e573cef158e48f15b71c05b329532014
SSDEEP 49152:b1hpsNoJpF1A6yU44CwH7R4xU/YIQkJV:bmifPVRZDJ
TLSH
T125B5AE13F2D901E8D06ED17887569232EA62BC450B31B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b691f11b4a0c5bd16fffb4d9012f0fbf65f1992506908a09bfddd0a526a0f57b
MD5 2c3de0edcaf504ad141aecae38b70728
SHA1 7dd63c5b0ce35e59cf4543c9acf8b504fcb19c3f
SHA512 e320e9d1d70bd8d192376b00d36b033c9003a1f898e2ed9cd383962673f3b09cb69b2265bffdf8bcba1f317135d00274135ac6e8e4b37b2f4c07571093776c95
SSDEEP 49152:iSuZQIY0Be2KIRVtOnks6NMHqj/YIQkJV:85dKOi61jDJ
TLSH
T1A5C5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fa13ec1942cd84f20e7c06c15eda8d58afcec647ad0c975d633e1f0e1159cd0d
MD5 932483e74ee8f9a042be90b773088ced
SHA1 7c48611a4262209d4a052249e63b33cba277c459
SHA512 c5bff3ce7ec76838922dec0c19d85886c44704d0514ff89e0457c74590abab297b6c117d0a1026c306a6c847c17a469f08eb5322ba06ef279fbb81c3cafd287c
SSDEEP 49152:hhtSn8EApI0figGgiDn0AP5wQ/YIQkJV:wX2i/phdDJ
TLSH
T19C95BE13F2D900E8D06ED178C7468632EA62BC150B35A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8b74c05588c42abb8d642d7e476fcdf265f4adf549a108cd5380c0df74a0460e
MD5 ca6a44b5d714a9029eafd19d2d3a01f0
SHA1 acb9736c8ed202c548763f8fd8d8b85ab5fa2752
SHA512 3851512c37868107e18f7afde8682431b24cb13776044553cdd69209a767d827722f29dce369f659f1224ae5fb0bccdde39f226c962147a07aab8ae014bf8d18
SSDEEP 12288:rTPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:rTPsHAnrsRwYIQk3mhUVi
TLSH
T1D34523AAD3FE8AB0D27B47347C60E629C53A3EE1FDD2037592F0621B6C31E012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4afeb37e0619b88984cc2b74caec27b2a4871043d245fd1930fd268ba88d229c
MD5 fd566f72c6e1486d42431f2934d96462
SHA1 71987983af32d31103bb40a95e7ce972b695548d
SHA512 fe23ffd247bf3a1680060a7c59b09e1eeb071ae057bf3ec654d71612ae1e13e91885760cbf55eeac4be38a73f07f30346beec4f4362a5b7a1030aa6a65610e96
SSDEEP 12288:4iPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:4iPsHAnrsRwYIQk3mhUVi
TLSH
T1F54523AAD3FE8AB0D27B46347C60E229C53A3EE1FDD2037592F0A11B6C31F012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5c9ff442cde3c7675c15207121281069550f54a6168eea8602f078a3e1e8932b
MD5 fceb3d8d86760495cb54a4a3164ab087
SHA1 745bbed48271879cc9b3c704636b596d7d2f6dfa
SHA512 323f841bb0e48f94be52e06354dc9a014a36eb8eb11fa3ca73b1090f10f6d2557eb18157dddd7345f2406ba92a2fa7548f3ae8d4a5006b52b2ad4e879b7a174e
SSDEEP 12288:BQPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:BQPsHAnrsRwYIQk3mhUVi
TLSH
T1B04523AAD3BE8AB0D27B46347C61E229C53A3EE1FDD20375D2F0611B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d2005c0dd5f29ee9c038337428fa1899b3e72634467cad82ddfb8921268e05cd
MD5 c10077ec148cd63c9753f08e8257fd55
SHA1 e057f205a382b50c34dc68270e94cfae3b9a6098
SHA512 d2c8c710fc1f1a4191aedff332be0d21ac3acdd751e980f6f3a02ccd03d474d95f5e4829135ac2bd80d3be50a97c50d48b7399671e4b0a20909054953632e4e2
SSDEEP 12288:cVRPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:kPsHAnrsRwYIQk3mhUVi
TLSH
T1D74522A693BE45F0D5B78238AC61D229D2367DE0FBF213AF82A0161B1D31F406935F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 29598aa0283d6cf7d0740cd556469a0f8d8416040364e61583b6e7d09339ed3b
MD5 4d2179f7890911a8ae14868d3af37f1e
SHA1 36e6fc90d0d3a69f4b6f8a0d23612620f087dcfe
SHA512 704096fcb17b14edecad33769ca66825ff81fc1acf54e9e7af13948ca94a632361b263d24e458a5ded6e1a88fc5870373db134b5cdbf2a0928ec40e1abb78ced
SSDEEP 12288:b5PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:b5PsHAnrsRwYIQk3mhUVi
TLSH
T1C84523AAD3BE86B0D27B06347C61E26DC43A3EE1FDD2037592E0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bcc6efe934dec6264a8aabe65b19c8b7470ef130cfa9f61f66e0e3db94fa9dc0
MD5 45fe3cc28819f45d58933d72e293b164
SHA1 3715623ee88d429769d421a2e03f6e107e92f1ce
SHA512 01fb7b12246c06f5383fd14563de2cb55d6044d09193bc4b5b934a56885de861f58803be2cca54348565ed7a1ee8bfde9c7bd8ed63c263a5c063a9aa63ee93ae
SSDEEP 12288:wuPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:wuPsHAnrsRwYIQk3mhUVi
TLSH
T1E44523AAD3BE8AB0D27B47347C60E62DC53A3EE1FDD2037592E0611B6C31F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5a0160deb79b8cb9cbb0065c57ea8d38bf337846195a446d84274633864edd56
MD5 1f51d86b21391c8fd753124f2a15c694
SHA1 d28cfcfc6e54c7cda581ecc85dc8852deca56e94
SHA512 14f13b24780c87e2b879df762cf5e68e55e547b2248a909b51a63345dde43acc12f84fc7b25c8e2a286c6a3bfb599488ba0811b43b82284a06ba40cf63bd4c29
SSDEEP 12288:pqPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:pqPsHAnrsRwYIQk3mhUVi
TLSH
T1314523AAD3BE8AB0D27B47347C60E62DC5363EE1FDE20335D2F0A11B6835E112515AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5c9ed236d8828ffc38d72bb9f29b44293060cd380114a70d8c520e93cd7bb660
MD5 9881ff99c8e7d61728959f241f3921f8
SHA1 858636e9288150c7dbfa11f128bac7e3d2bb022f
SHA512 1adf6029720e9f30365236de477db6bbb84138566d26e31be9e08c062e999b636dd1575c295bfb90d41ab3f4473d0663ab0c0fbb3d5277ea5d1f4258afc93f67
SSDEEP 12288:viZwbNzzFEoS2cPvyCPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:KZMJzFVSOCPsHAnrsRwYIQk3mhUVi
TLSH
T10965F1A5B3A408F4EC67823ECD619916D6727C655BA0C31F03E4362B5F337A11C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 23619a5959febe340a054267064e1abe7ecd0bcb41a1889fa8db629847d95b4b
MD5 35e3cb1e588ef7868102fceb7cda1fdf
SHA1 91d3a5804319e7c57ec77a2779706532e6577520
SHA512 dbbe98247c615ac9ae5f238531b3f8195355689e462aa55dc5ed548b5af5731566a7a6440a7ea200346226b9dbe6b00b7bb2e867a1ed3880ffefc54aabc78d47
SSDEEP 12288:l3PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:l3PsHAnrsRwYIQk3mhUVi
TLSH
T1E14523AAD3BE8AB0D27B06347C60E62DC53A7EE1FDD20375D2F0611B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f08fc9023592529b259dc502e4fe451eeb44e059686c056e8f2109b33645fb2a
MD5 e3da77319e1c48553f7cabe23841ba0e
SHA1 71f47e5f7d79198bf1b6ff55f4045a1a95e72596
SHA512 01e8f488067db99ad29362bbf445d1711b2fda8e7683725967178f9e37242284a21ee4e542b45ad5c9fdac2e8d5be95b17184136da571d7e191ccadc388b1bb0
SSDEEP 12288:tLPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:tLPsHAnrsRwYIQk3mhUVi
TLSH
T1354523AAD3BE8AB0D27B06343C60E62DC53A7EE1FDD2037592F0621B6C35F012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e0c33b052b0392138c729e2ea74c33c9288055e2ac1a4f1f4c7eeffb6f3db0c1
MD5 e93d636e9b54c30fd6c6bd4cebb998b9
SHA1 5747bf6410c128574a2f1873884785e0b4a2f3da
SHA512 36b44d761baed71eaee273cc22024f3fdf25cadee21ea959fd01c3cd9f0b1cbc52727de4266fb4531ecf04351b7bcddf354b8a7fb432835491b41a8b7fec41cb
SSDEEP 12288:HyPz5L8mPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:qzymPsHAnrsRwYIQk3mhUVi
TLSH
T1EE55025773A920F8D17782388CA15A16F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 47fd316425f4e5ee7494bfd400ef615abd1044b15ef8941406d06f83201bbe5a
MD5 edac5537c6cb99570291538da76dda40
SHA1 af33d19b5eb285b2ee97244e61f23ac222c64df2
SHA512 7c33814fd003222f2e0d6f0688557cf212347d9103a7d1784428dde6c27094719000c7ef33687aa4b10cf991a980d0220d831a531e019cc8d9d5b6f8a56237d4
SSDEEP 12288:83PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:83PsHAnrsRwYIQk3mhUVi
TLSH
T1B84523AAD3BE8AB0D27B06347C60E62DC53A7EE1FDD20375D1F0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9dbd2ab3fdc08b4d7aaf5d4c5d3a2a20904a1523677c532940a8616b6ca97a7f
MD5 67aa89078db5c1c8ebf778b4b5fe0f89
SHA1 37ecb5c0f2d1e30a5067eb0e2f2dd0f928c72ed0
SHA512 6d5c92c06a5a99f91c92f77e5c641484a7eea7b4d9c6650e72a6ff338b8b0d82f92c5238a94ef41b942a77e796d1fdb13ad53a24cd09e423829a2be842928470
SSDEEP 12288:M3PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:M3PsHAnrsRwYIQk3mhUVi
TLSH
T16C4523AAD3BE8AB0D27B06347C60E62DC53A7EE1FDD20375D1F0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e8cd0f6afe5995770be3275ceb69f79bc8c13143286996fa24c987e11c71d919
MD5 b9470c98d6dcaaf121e520ca880aa58b
SHA1 0fff911c335fcfa6cf13c468f6b2c87aa7fbc7bf
SHA512 9d28bddd63d536d60ad8535affc5eb4ea0b1e7ce0043d52d82b27a4bc2eecc1b9addc9ec5d456de8752c5748ebaf060957403da7102b1047e1632aa1500b28e4
SSDEEP 12288:myPz5L8mPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:bzymPsHAnrsRwYIQk3mhUVi
TLSH
T11A55025773A920F8D17782388CA15A15F7327C725BA047AF53A0477B2E33B915D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 64d996bd5455940885db98c795e814f4fe906b75ddd92f5864ec416f32d7c2ec
MD5 9d5f1f8daf340f931e21df1267534d3a
SHA1 c23e27d340b0a5d0329f2da53b5933f3ee833423
SHA512 b4f0c9035f3d0781ba772489783474738ba2d4cf3de8b48e0266ce466593224473203eaeb043caf030eade49325c66c9664c40571804f454dde19c24b23ebe99
SSDEEP 12288:hCd9XWYoaLHF3z0z04PDvhgPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:cTuaLl3z0zDgPsHAnrsRwYIQk3mhUVi
TLSH
T1AA65F1A5B3A418F8EC67823ECC618916D6727C665BA0C71F03E4362B5F337511C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 fd96e9effffba2b2f7492be5ceea589a37f3e7a0d3630bd835818259bd6440d4
MD5 086f0f2792fed710df813e9486c296e8
SHA1 46efb6d2abd816a79ef8c015cba560907777e770
SHA512 3dfedf7efb53d40c02e8a7671462e0109d81bc2c8c43e4da10cc44b3774e042846d5326a1ddea251a180179af18e44f83822ce392f37abd6580ee6c5ff5ca51b
SSDEEP 24576:13xd9CHKy7GZ8PsHAnrsRwYIQk3mhUVi:Vxd9CHKyaO/YIQkJV
TLSH
T15D75CF90F3E814E4F1B78A358D729511DA767C995B71CA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d516c7a8714665fdb537d28b517c9b9ce340cceb6395dd8af9c25fa91471883c
MD5 4b17b398efa9855ba2c6d17eefdf02f9
SHA1 980388f4d1f71e030831d2ec8a239072d6ca61a0
SHA512 65d43a56a38b7d05c5a3caeae4aaa80dac6f401962b57a8a7406d3ac1470eaacaa08ddcd0b043a79acb6645b971638ce2f451a7587cbe07df0bc885d0c97296a
SSDEEP 12288:8wPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:8wPsHAnrsRwYIQk3mhUVi
TLSH
T1064523AAD3BE8AB0D27B07347C60E229C53A3EE1FDE20375D2F0611B6C35E012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a9df924bdd8652961fbee8659cea1c7326d624f27972f604a76668ff3b445736
MD5 ff784e52abff5d1208cd5276a673199f
SHA1 e7b6b8e1d9d102fe155b3b14967147f2c089b4af
SHA512 a288e3f3440dac9fe0ce1944b7c5354216678106ece3d37f1199cc815802c8eec5a78960cb6b80d3b684325f5c5b1335702b8c722cb8b15d15db9387b960a189
SSDEEP 12288:PGPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:PGPsHAnrsRwYIQk3mhUVi
TLSH
T1894523AAD3FE8AB0E27B47343C61D629C53A3EE1FDE2037592F0611B6C35E012515AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 90760acbb23cbe2ce72f794496b181287fcc487591dc45ac309a0292cf90822d
MD5 58ee2c96af23b33a7a415d1d33cb1e58
SHA1 138bc8002a1230272207684bef59e78cdae7114f
SHA512 e6073a80e3cdbf86bfe71ed14fafe384c76acc6ac75a9f07d74e0e30cfa9ab53446271630f35aa06cb4bc14e10d6719de249686373846c33437260a59d556b6b
SSDEEP 12288:HFPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:HFPsHAnrsRwYIQk3mhUVi
TLSH
T1194523AAD3BE8AB0D27B46347C60E62DC53A3EE1FDD20375D1F0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0222291747bbb03ece24fee730901f59c906c8b16c49402e58f01ac70af919ad
MD5 cc0a9c1d795b4a5adcfbaa5937d2cd95
SHA1 3fb77028a35afbe06e1865c1d9a0edd9085ee193
SHA512 46a624048bea1b342591aa622adefe5b2ba5b67e8c09e9f1661b93c9c13afa2b3d183c519026f06e2f8afa47e9976bb551c0b7426f8ae5cdfb26512fa20560b5
SSDEEP 12288:03PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:03PsHAnrsRwYIQk3mhUVi
TLSH
T1844523AAD3BE8AB0D27B06347C60E62DC53A7EE1FDD20375D1F0621B6C35E012519AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d919f7460a803ea91f7f670d2a986add93aba8a1e5d6ea6fdff0b9ce05bc595e
MD5 9766dcad4c4994435e17bef066466a27
SHA1 d2fa65942a63e8acc3593878b3b3bd6b46b5994a
SHA512 a318ab522a0b2fce88cefa764ba819eed6141ec3bb16f11b1d4b529903b7a62709f6a7be57cf37cafdd633069fdef41895c482c81864fd1f2d57a3feaa766f1d
SSDEEP 12288:MwPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:MwPsHAnrsRwYIQk3mhUVi
TLSH
T19A4523AAD3BE8AB0D27B07347C60E629C53A3EE1FDE2037592F0611B6C31F012555AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9741e08b54a2e5b04c6d7498991b4bc8148fa917bbe1378fb918190a22bf67bc
MD5 3051f5541a180acfa0b75456a25e1cda
SHA1 951d0721d0594733a682f81bf10b0a06dd10374a
SHA512 1db5809717e95da5e63172700d7695cbeff6eb4470ac224aabde83f9a75a48e352b364bdf28658a2d118916f0ce7855172c4fff18ba4fb893a291c3863cc1d19
SSDEEP 12288:m/PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:m/PsHAnrsRwYIQk3mhUVi
TLSH
T18C4523AAD3BE8AB0D27B47347CA0D629C53A3EE1FDD2037592F0621B6C35F012455AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7ae2d5273786d0393f70da86215bf5f53ce4f0acd967d52ffd03a7fca58df8cf
MD5 b31856f5ba37c434640d7380f7e3133f
SHA1 7fe549bfbe4e0dd5cc22c0eaf985dda24570f249
SHA512 00b70071049c67a3a4231edf8f8c266ae0583f8995c62f7b23669cac817af5910f6df29e862cc74049201b97a369f998c5d766ead3c44a06c858162726305a67
SSDEEP 12288:95PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:95PsHAnrsRwYIQk3mhUVi
TLSH
T1BB4523AAD3BE86B0D27B06347C61E22DC43A3EE1FDD2037592F0611B6C35F012559AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 80219e691710b7a61d45b4c3c98acf456d15ea9f6c18b80ff6bb71b5e304c718
MD5 4d933e0c2adb2750e236691c44987499
SHA1 2c47147ad84e8cbafbfbdce1eaab10f25a202f8b
SHA512 86e264d3dc7bb10f264fb3a5e939951db7dca98df96c72a988cc329ada2b74788fdcbc4fadb71e2ef84dd47602d01b72a63e619638d9e4452bafe35cccef60e9
SSDEEP 24576:+fwvOk9RX6wkyAI7PsHAnrsRwYIQk3mhUVi:oMnYI3/YIQkJV
TLSH
T1EF85DF29EBDC44E5E1B7923C99B3460AF6B178691B71C2CF0299536E0E33ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2ae6070b740759cc25d3568ba2cddd8fb50fb624249a451787e99a1be8bac80d
MD5 211f524243458887cd5f82a779ddb672
SHA1 7b2c84787c99d38f188ac9c927b0862ff6d628da
SHA512 374b257eb5e5b1dd52947bd8b83bf40a0c60741673c0e623f386b037404bc31ec497b3aac870022252c697447ca2f5ecf042b94bc3ff86c80987cefd115d5c5f
SSDEEP 49152:+YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0w/YIQkJV:2ySzPIDJ
TLSH
T16E067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aaed76d926f717a9ddcb1fde6163324dc610b4c33ed359af7c068656c294f6cb
MD5 970db3991767bc4948f15ee231552436
SHA1 00afc5e42909ffb576274bff09be3ab651cf2ede
SHA512 2195fc8b0d1fed49c99140fbfe0c909ce17453a91fad97e83fe35016ac158292ae07f57c576e84492569831aca8006c64a837edb23c8725c5c55c90d3747d10b
SSDEEP 24576:o47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYyPsHAnrsRwYIQk3mhUVi:o47JUQjairIhCnDHUPfF/g/YIQkJV
TLSH
T1E665AE1EA3EC01E5E1BA827885158A1AEA71782D5F31C6CF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4c0ca19b044a95f3ad6b9a6daa71b49a782d80672b95fa3f8f2f59348f5867a7
MD5 d39330738cf927075df4a78f64f801cf
SHA1 52e130a3551996b58675b2569e0eca7b1a54fbb2
SHA512 a3757acc090ec11380110ae0f68a1e844f64344707f8acc93a92fb06fddcf1deb5a6470ee28233091b38b58c984a956c03b91e8dac7882d501e265a77b1ffdd5
SSDEEP 12288:BksfHPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:xHPsHAnrsRwYIQk3mhUVi
TLSH
T1D355F15AD2A802E8C06F5239CB519A45F3337CA197E193CB52D0F53E1F36A905DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1920fcf17be10c81c521927ebf3a1a54d736b5c77020315d4d90bb673078c3f5
MD5 19604b4b1a971241a0a04d07a2e03c05
SHA1 d70b9874fb2b6935ecde4aaeca6cdf501ae7e221
SHA512 680f0205ca4d43a4983a1006d0fece3c6bb60d9d334978651172049822e3dd33df0fcd423d45c04bc6ab0cf2ffce84d0614373e61e716c22bf8a74c2caedd8cb
SSDEEP 6144:4sBC2na2wiAlrER3fKDexHc4py5GPTPMEcjIvKy4578akeI9pJ4I5E1YfeG0mYUJ:5jjaCy5CTPMry45Jk74I56YfeG0mYC/
TLSH
T109351711B66BD75FC5A940325E32D1CCAB707D01EE05AB0772C8873FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 622a53329cbdc9ef87c31a2d9525b7c2f69274b5ea8d41dc407da8c35c653b5e
MD5 c4bfe8627b2e97b2fc85e867cab86341
SHA1 be41eecca659ce3dcfe0978a03f1f12a1b0dd039
SHA512 9d21de1d75dc117e852c3b8f914aed432182d2fa0aa86086befe67ae58d11a4562b422389697307670a2e82fb1eba6f7d9429e342f2b6f2a7ed642d83341ba47
SSDEEP 6144:eLdPuPz8SIJIP/yfZhnS8LZWKDexHSYtWKDexHAieYN9tlkZ6NRiBKM:CPuPz85vS05elit9FM
TLSH
T16F65F841A537A39FD1F76072037A5B8DEB74EC02B7056F2663C8443AD86A725A0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9db86fce4722215cc58fe61dc143384f8fe06cf568a3c2da68d7972b886ed3c3
MD5 a4bf66a230132755959fee2e282b64be
SHA1 70148d295ce318f98dfa9624605365081660dfc9
SHA512 80e5aff112925d3f1cc7f7b117ae46ce6ec363220c77eab8f1a9c61fa720476a1133a3d21e4f2182899a7ecd9a05f31170ec384e0cd6f552fc003492c4e22a90
SSDEEP 12288:bF7PPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:xPPsHAnrsRwYIQk3mhUVi
TLSH
T1174523A6C3AD8971E17B07342861D538952B7EF0FFD103F7E1A0621B6831E816D75B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b09efba7311b405f9b43bc9886c6bf1de3887267665f144c8362909617542ae0
MD5 e757754449e790eb558bf2e9bbd1710a
SHA1 b827d5ac86232bf73a61ba543a7fa275c7f1d171
SHA512 e92d06fb8e2c0e04ed25a2f6af5d887699daf6c79bdbd7611b6f8ba1646de2a2569ead743154fababb18a51dced2b1b16b729e50bbd50930ce16cb0ec5e4b8b8
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY9PsHAnrsRwYIQk3mhUVi:egb4mBIBhGFC/YIQkJV
TLSH
T11665AE1E22EC02F5E0FAD2B89DA64417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f37c4542fd699b68597497b9a3c8bca283a7c9c7f4335ca6c9ce4d353fd733ef
MD5 d2560bc41bc9830986f954d130fd53fb
SHA1 b9e9bd5b66f3c8f01194fa0fee1b4ae6039f8122
SHA512 6a5746dbbc8484ed61c4241d6167e9612eca483e408d683590e14d721a49d452df2308518f9fefa7dd427e00f46d84c3f5000b5d2d1193ef25ef07f609c252f0
SSDEEP 24576:sG88u8FpJqH1nzria7/mCPsHAnrsRwYIQk3mhUVi:P7ZFPqV6a7/t/YIQkJV
TLSH
T1C185F165A3E501F0D47BD13889824667F672B8211360EBEF07A88B561F33AD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 db709edf33093621b81f2adc7e0355b1b0b2ed0fa80c65a75be2ecafdb1eac97
MD5 0a31e71027f8d0d532fe59f0a1c6e7f7
SHA1 98f11928cebfec8deb4d10b85d72a3b425480453
SHA512 b5e737eff253ce92f4ab1ce3d3e2c1707a79e98d236c23183bceaed7720f8ebaff679e77d9ed9d5907364c3897ee82d4c1abf28e4a005a77cf6cbf8f04151ae6
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAje/YIQkJV:kG05lO43b/DJ
TLSH
T1B5D5CF6E62EC11F9D1BBC17CD9C6860BEBB23825033556CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 afef6bf94391b99ecc7cd4e8f83c3371a9ef8fe7497b2a90669d07539c1f6491
MD5 5632a104ebe95fcff2d1224c1db4fe21
SHA1 6769b6a9b4eefc5208df73558acba09950a999b8
SHA512 93be9bf4429a570c1c2c4392b6e16dd823cdbb3a82840e3e911449d52116998a12e240c05423d01d03f8752240c563da4cba652909782b034a22b105b98779b5
SSDEEP 24576:Hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnkPsHAnrsRwYIQk3mhUVi:/a5POZ3hJt2pasx2+mW/YIQkJV
TLSH
T1D965AF5EA7FC01D5D1B9D17DC583861AE5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3d82e3171146f792336684a8bd93368c5acd537020d185150568b09c6b5f5280
MD5 68724f228428cfec8ef22030b907208a
SHA1 88ef062bf52601277d4ff63f8b2fade8abca64eb
SHA512 049a13c791bea557518c51e26fca86f1ddc8209fb89132abe7595072230198ca5c12b76940a0f6d63076526fcd8176599f3b81fff8f9ba48c17eb650f3aea1af
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7Fk6PsHAnrsRwYIQk3mhUVi:5Nc/zEOVHFN/YIQkJV
TLSH
T100857B2623E901E4E1BBE1BE89779546FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9cc9c1530cad837d0a3e7f1da15c3c09487347881fba4599129bca0c4336cbfc
MD5 397cb0f78cf12170855084b522dd8319
SHA1 ed0f422e87bf9fcc1093992cee2dbed4078756ed
SHA512 0ff452e4f16811e4c77cc670547ad30a52fab51c7ebc309b09e5389ddb13e476a32ade371098099e446c771f19c15042530074c4fb18ba845a5feb10c299dff4
SSDEEP 24576:/3kNvNnaFeYhJNtmZBmMPsHAnrsRwYIQk3mhUVi:/3MwBtOmY/YIQkJV
TLSH
T11D55AF6EB6F846E4D1FEC6B48D238512E6727861173253CB9290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 50179d5dafa65015e24a90b21dbc4d7ce6231cafafe7e03e59a831068132a433
MD5 afe291cc83cae320a3e405c8cfdb40e1
SHA1 847c69e7f85a8be97d105db9149058207a9c683d
SHA512 4511917d24492845ef565f10d4989e290963bd44d6ac0b4a204108726a82c0af081f12576776a3d23a62ce89a64712e7faedfa7b7b576900b46cd2d283db4bfb
SSDEEP 12288:5HvUrBFrEjwaQePsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:5PUr+NQePsHAnrsRwYIQk3mhUVi
TLSH
T19B65E12F62ED18E4E677A17C89828719E7327862575292DF02E0817E5E33ED87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 733a039533f5fd9edf2e85436427f44b39c023135b9ae68d84dd46b230e8f7f2
MD5 b14b1544f093b125700e3088c16303db
SHA1 a1ea0dfaf8afb01cad31f412ae75839df45cd091
SHA512 032dd1d07c1f5cca614405ac18cf2c2c87d4e4c1a52bd1dd5e90fab7cb6976d009208dd47c44489a2e0ef54b342de76f527ce3e1b92ae552e9da960a329c3fcf
SSDEEP 24576:JD3FHshBIYQgAzPsHAnrsRwYIQk3mhUVi:JDVHeBIAAv/YIQkJV
TLSH
T1FD75E17EE79C04E4D57BC17C9A638A06E77138A9036256DB02D081BA1F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/248-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/248-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/248-63-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/248-133-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/700-16-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/700-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/700-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/700-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1060-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1060-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1060-282-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1060-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1852-399-0x00000149C9560000-0x00000149C9BE0000-memory.dmp

Download

memory/1852-330-0x00000149C9560000-0x00000149C9BE0000-memory.dmp

Download

memory/2256-122-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2256-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2256-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2256-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2328-297-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2328-69-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2328-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2328-75-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3428-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3428-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3428-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3428-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3680-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3680-85-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/3680-80-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/3844-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3844-334-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3844-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3844-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3844-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4668-40-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4668-2-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4668-9-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4668-7-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4668-0-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5640-127-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5640-134-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5640-137-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5640-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5640-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5708-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5708-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5708-316-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5708-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5708-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5708-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6032-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6032-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6032-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6032-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6032-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download