c4c2969f7eeea317a4d2c9c6a199cdddd3919d15aa9c3f117e6c630f7f8d348c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
Size 2.7MB
Sample260730-vy1glach67
SHA256 c4c2969f7eeea317a4d2c9c6a199cdddd3919d15aa9c3f117e6c630f7f8d348c
MD5 824282b1996f10328316463f1de42e11
SHA1 c3faeed3c5b2d969f76c273114af33c8a9c16c39
SHA512 d55d3e46823e6ecdd86e384e1b9f70ade340581c374e5e42337e36e6534fad23f804ebbd2497e6250bfa2566553af39e641dc195362f5ab714c8c8ec6e003d55
SSDEEP 49152:Wq4Vu+QDK2tDkyHJ8v9ltjNXBVofhZTTSm6mGvKVO+n1:WMDJtK6SmXeN+1
TLSH
T152D5AE4BF25611ECD06AD0B8C75A5222FA717C490B25BAEF0790B6252F37EE05B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2408	elevation_service.exe
5076	elevation_service.exe
3180	maintenanceservice.exe
3784	OSE.EXE
5540	PerceptionSimulationService.exe
4776	perfhost.exe
5700	ReFsDedupSvc.exe
1496	SensorDataService.exe
3548	ssh-agent.exe
1676	AgentService.exe
2664	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\61df16e123e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fdf5015c4820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1dbfb5b4820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5b22b5b4820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3872	2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	1676	AgentService.exe
Token: 33	2664	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2664	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2664	SearchIndexer.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2408	elevation_service.exe
Token: SeDebugPrivilege	5076	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4208	2664	SearchIndexer.exe	103
PID 2664 wrote to memory of 5928	2664	SearchIndexer.exe	104
PID 2664 wrote to memory of 3180	2664	SearchIndexer.exe	106
PID 2664 wrote to memory of 2320	2664	SearchIndexer.exe	107
PID 2664 wrote to memory of 5192	2664	SearchIndexer.exe	111
PID 2664 wrote to memory of 3340	2664	SearchIndexer.exe	112
PID 2664 wrote to memory of 2964	2664	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_824282b1996f10328316463f1de42e11_cobalt-strike_icedid_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c636af015ea39723b6a1d34010e157ba7678a2bef957041cd9ed1965b01ef0da
MD5 0d28bd44c1b0bc6b8d09a4c3f541c9bb
SHA1 ba80cca86295198a52ed310bb2250e98cbdac49a
SHA512 321ac486758b0e4a4776bb9be8efd9f9a9b68be0f67348694d665ddc80738e47f7ba3897b4db93cc5ab7868254c5e0456f5eb3d4a4e5cc142e2999cbe041b5a7
SSDEEP 49152:7b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnq6mGvKVO+n1:J3q60jB9XeN+1
TLSH
T159D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 56eb08ade133ab6418321e44f4eba3289ece5ee9b586f6e9b3249d7cf87d6373
MD5 a8f10fc340166b125eff4725c68cb5c6
SHA1 a2cf29cf9f06ac34dd69854ec0778af901187a10
SHA512 949bbe691c143436ef3d7323281ddffe9c2177215825f55713671bff2903a50df5b3b5919739d61042ef42806cb5483df7259aa096c52cd96ab33c5348b35b1f
SSDEEP 12288:S1XLsswWkxy2lRq2czA5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4XYfDtczA56mctvE/BT76+1NCE
TLSH
T1F2750224779504F9ED6B4278C9A2C112EA337C9547A4E7CB03E4892A5F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 255002f9e22f6724728cc8b27d4928a987b0574b2830d434c5bd6289b7b5b470
MD5 5c03db6b81b1d5ddebb51d2402db0a02
SHA1 aad8fc873e06fefe6b4e71b6bb7912040f0944dc
SHA512 cf22b0a2a6a08686dacea984d0c3adbf514e0871c23ee279973d7c108733b4845c42635d6fd91c8e4f2024c8deceb6d8da2699303f624908d41a7cd9aa3090be
SSDEEP 12288:pXZNYVLeyUji0h90ZD0wxpGZIVuDrHsitM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:/0Le5ji0hmxkrMi6mctvE/BT76+1NCE
TLSH
T1F5859E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ae67a48c7fa356561e158c7ca43f09b8fd19511d5c021a73852779aabe1e141b
MD5 a55e54324f3f5c2e4b2fe736fa0f3e7b
SHA1 604e077b5635f7c7a6c97e186f3528e773825f2e
SHA512 e2eb6b31c443f433da9c764e544f26776228eec386eb9bb566ab9ec9bd21e3a56f341a9f9eb7a9087f218992e789d8b39cc973629cbbc5833e3b98497177dbbb
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWr6q8wyus6mctvE/BT76+1NCE:R/ezSC6vUzPviHjyj6mGvKVO+n1
TLSH
T15C755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bf75a3963c72676670de12af4ea5516919b23c9ef6a5447a24ec1a47c59f582a
MD5 b5b82e98b0944fe48aefbdfd49cac139
SHA1 4add1539872385d0beaf32d588b01cf75b7e5a1c
SHA512 5a8b129d6577ca2531fa1b07e34300c2796eff4accf7dca247eb269cfa09443f6220a81e434c406be8b2ebc8006307c72d09378dd73f146e768be9b121bb5c42
SSDEEP 12288:hVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98ttM6hct28uP18WR/FW2Gb8JTCMx:hVbqPb88hv/l+bt6mctvE/BT76+1NCE
TLSH
T18855AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 7142fc03330fab954daa225858809bca2a122e85e8a28838e17366c289426d2f
MD5 3db45d2de02333b32525f6238bfd7944
SHA1 1408748410dccb3d8b76d23ea6ee3d0318974d1c
SHA512 d29785a7cd96b97e043558a558778f73ec35d1614c2dea81c8944e80e8169c7550ca3cecc6b0ae5e6691e6da6978f0971e12c7ea169814d21d826e913bcfd8c1
SSDEEP 12288:iimtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iim6mctvE/BT76+1NCE
TLSH
T1E9552382881B11D0EFFF07F06395E296E8516EF974DA1C81D322991F9D30162FD4BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d0e678965c4786f0d4e33e55f4a458c070431b845546cea6f1c7a2df7a69daca
MD5 d51696d66a662d3f800ef79e0bdf93e4
SHA1 f66cdec3dc2e675c4dab7a43561833a25a856480
SHA512 82002137b1f6c5cf6fbf51d3faa65d6db40494c8ef1ac88e94369407a1a1fa3b1cd775dc29df50c86a8aa4705472f0fe11be526bf8cf69ec1b0dfe9d6373a2be
SSDEEP 12288:GeBNUbTVO86UFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:GJIUF6mctvE/BT76+1NCE
TLSH
T12C75CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f3be8a9946517c6f8d1b3bca32292e0a83c1d15cac714d9dd31cce72f0dfeb4b
MD5 b8486daf5a16b8ed66c8966edf9f37f9
SHA1 6797d2e05e8ee50d78d8ac38524fe9ca0e18a494
SHA512 78b1658494722fe8716096810ce5e25081a79c9ec57a8624a6bebaca214cbd4636e31c74e317789fa66a52ae37200eb0d90495a5e561e52f4a4262d481fabe7b
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH3:nQvGAdlCEL8c/RRNw5CcXeN+1
TLSH
T141267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0b4ba93bda1ed0383ce4e0c8b6b46a398d7f79d565773e18dac33e75c1f42a38
MD5 5922fa48e15fdff4cce09f46b5228a03
SHA1 8b034f756bd57214c90580e27407715921ef7150
SHA512 5c2e7367e468f4c6d2802b394ae71ab2eab0dd0c28785ccd29ba079cb4182e165a884ae95864f2ce2b699f0b0e1feb8032d143b5ef72bb0c5b99ba2a30ec251f
SSDEEP 12288:ZAwSfxL/2Dc3ADLLmt0LDQewsAj3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:KBewsAj36mctvE/BT76+1NCE
TLSH
T17275E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48564c7c12fcb902a8cd489114fa5260bc401bf8548946439f23ef3a6329af41
MD5 674b45f8f1b928f9106adba9d8522b7a
SHA1 1df2b58162e0038725cb539f3826c55b7f1d571e
SHA512 94790de663370c07cca579079550240a26399e9246ebb43ebb913f5331f49c0760b5bd57cf12e09ec4b0328be34d1c8e0d9850e7e0cb6388248a26396f2145f3
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHfXeN:qUEtQevvqc2W1cpV2RI32Pe
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6091fde2771eaf149f8c563addf42d93143fcb7adcb86b733a472dd15771cfa1
MD5 1d803929f5b3b6e584376af378eba7a5
SHA1 ce1f90142d97155f8ac3a35819ace53c452e7704
SHA512 867a19c6d7690b342bd34b3b792176f8b7f6c14a29987c21e3f4f13795f5a85ef9b6bf32e791342a1cb7caeecbf2b3884c926df0b4b340e021172bd00e7cd919
SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zX6mGvKVO+n1:2oqtVjnmIXeN+1
TLSH
T114D58D0976B8C1E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3edee4f78392f02c4d1eae8f93c9cd1a074961869f3826dfceefe24019c85e32
MD5 a03fb5595909ea1dc4caf1a1d0c76ef1
SHA1 9498c5e1527ed8591febf33444f47da55bf252a1
SHA512 47bc3cf4e6231dedbc37389eaa8ba68ed0f366680044b949db62c5c237ffe64e4182fd9adb63077f091a1221c68c95402f36905117e5549a4175accf2f2df26b
SSDEEP 24576:uAhGL2IFoiwtA5l7S53/6mctvE/BT76+1NCE:uAM1Foiq5v6mGvKVO+n1
TLSH
T1BD359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1c1d041557b50cc7e4854548eaf1b6b9690791c36d57790565ccad96088b208c
MD5 9062ea0a3ae3dec30eaf5083336171f4
SHA1 f22eccad474ae55d980973136d8e2c117eff8e29
SHA512 c5e67af4a06992f3611d3e542f666c553bbf50dc1369a084cc9116b4b3087564581a39b517d342bb27330a222002d318f3e843fa0dbfbe36d5496fac5ce2fd72
SSDEEP 12288:hmw5HEjsChNNBFgl0WDm+CMtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:8wuUOWD6mctvE/BT76+1NCE
TLSH
T10765F14676A508F8E9A742788657C136F7F2BC513A25DB1F1360C61B5F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c8cf0bfad0a5135b8968be0641d2d1cd179455c895302c85eb6ac21b927cf63f
MD5 83b76ec983ad8872535ed1d3f0fdc42d
SHA1 f86037ce6044221dd438d99dca252c27d96b7cf0
SHA512 0ba55b0cdebf5fb4c3d9a92a34a46e2c3b3e7294f46449b2677a74662b4d93fc062796f19691ad2c5413355320cf3eda431fc6f603d34dcd0fe65d938782cc27
SSDEEP 12288:n+Z1IyEtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+Zu16mctvE/BT76+1NCE
TLSH
T1A6551286226520F4E5E702B8C9E19245E77178E6377603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4c5ab08f63f3ba03fba2ba03a1e28d33e26baa96ea9d6c04c3fd0bd832f8c913
MD5 f8d0f0cfc873ee95bc2d25c9bec5e0c8
SHA1 4d2dd7d45f162acb6fbf87e6834355d0a050d939
SHA512 914b791e84d897e6cab75b0d87fcaa5dfe7b647eb64224d2fd618097449a5c842823d8937f18e7543d3e5dc0c33ab254e8f06f430ae3fc96ca8703a399443ffd
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UE:gQRQyi36YOcPhLvw2gAf+PN3KXeN+1
TLSH
T18F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 02ff473e22126abac0e64e63825932cff2d90a7593feb9ac47adc5ea5e99bfc7
MD5 e00e60d441d80d08854518cfec2316c5
SHA1 2a9908d7bfd1c713131dc0d16ce150ae90141f65
SHA512 4231b7ae7d104a8a0632cf1bc9f5b5afb82c3acf2f083cefb8f15e859a2e6ba6c82eb149492088e88cdf8394e120dea2b610b09af5d3b7eea5b8c709a5fd62ca
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UE:9QRQyi36YOcPhLvw2gAf+PN3KXeN+1
TLSH
T17C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a264d86064a87843f0ade84538c920261d7bc51f8fb3f510851905f9a73699a4
MD5 17c427f9a7727de2af80afa552385ceb
SHA1 7940d449a2cc520dc67738bdbb8c703013941408
SHA512 9cea2dd509633fc76a24be16d5af5c6e75ff956e66abfb7a0f8893b7f5f4bd27175f85c9472bfeddfd2368067a48a5f98661790e4b4dea497a2e2e839e9c8d51
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0l6mctvE/BT76+13:968Qg55nhceWu7PNU3/k6mGvKVO+n1
TLSH
T125B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1cf4ffa050b47330401d5e0253929434bb41f8a77f3626f74f3cdfa639487150
MD5 deddfef68665b302982fb11adb939991
SHA1 8dd9f0c0cdb1cbcb38dfa5e014ccb7866e8e7610
SHA512 09b0ab7507901c0f30b56680a2c94c5b6ada5049a7ae7c0999708b9568325a35e947254b4714acc3381562c08f9e164216ca7e9d0549fb2000a7defab011820c
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99e:qy5112gYy5azzVva69nLKnhZpXeN+1
TLSH
T156167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 acec48c8afd5b944f69980d715ae1874901057d9ee6f1b71012421b75f858f3e
MD5 5b30f7020c4bc86ea32e0ee4d0b3dd6a
SHA1 2ce025d67d77996729464e075b1c9d81d63269ac
SHA512 82d16916e6f895642244d3e15c0066caffcfa617138c65976aeb12dbeb1a1f24b9881d60a68708ca7032870a8349c4d232873b24b64e8c81e19bc51b307204ce
SSDEEP 49152:iB+taZ3usBWOBr4tEG20bqx0z+n217aau1glJ6mGvKVO+n1:Qu6JmUxd2dJXeN+1
TLSH
T108D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 59a32719c415ff8ec3ca69563314748eed6c703589c90760597ff108de6e47fe
MD5 d739ddb4bae7f49551db9b62ed59b3d1
SHA1 2ebf8cac35ca8d07f44baff91f9ee9611e6770ac
SHA512 11d1eea5528b2870fe51bf8724d0644cdf6552374bdc6d33645b3991348f41d29840fa4e43bfe259cf2b27edd89315d55bf1a911a96e060fe127730b21ac0c78
SSDEEP 49152:91hpsNoJpF1A6BU44CwH7R4x26mGvKVO+n1:9mifPkRfXeN+1
TLSH
T1B0B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bb7638eb5ad8b19a6a3b3900f85983bb4354fb49d9cff758add056450549d8df
MD5 f6f2e51700301d11f3b42065e073cfe5
SHA1 f3b2f9f357085fbba1c6a42c28748894dfd66b16
SHA512 83838ad51bc0d7ac0a9297234eea95c24bb4f377c51cecc769b4d15c3ff17ad0fd500c0d286768027f8eaeb668df9028e0a504831d4fe151182fb17a05016225
SSDEEP 49152:nSuZQIY0Be2KNRVtOnks6NMHq16mGvKVO+n1:95dKvi611XeN+1
TLSH
T1E5C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 81f5d6d525655950ae58119ecb137bc214094f9991f066eb57ea92cfaa665117
MD5 517868c15f175a68e21a6a754fcf9a0a
SHA1 f3876f9e9796870a16a1626f41f1cff5645b2751
SHA512 a758b2f81302ab80a6dbec5000be6575af848265c24f3f68cd65cb6a7fae67a81716a5624afa5ca08f1daa9d364c93509bb8cd6d22b686ec8d1e9de55432ac2a
SSDEEP 49152:LhtSn8EApI0figXgiDn0AP5wi6mGvKVO+n1:KX2iyphjXeN+1
TLSH
T1CA95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 28fb5222167de29ca4eb96961ec04d2ab96ff717ed5d1c2c98a41543b88a6b57
MD5 2cd9b6caf4c2a67f05227e4a4e498f39
SHA1 0a670878509c0b34d932e0ae8180d0f5e48b5937
SHA512 40c83631da8d31b7a8865f3bdd1b4111450d2a500883b4b568822013a97ff687e4f9838d461872949c25087e2d6596e031642e846ff7862af9241bd6ad64dd17
SSDEEP 12288:DRtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:DR6mctvE/BT76+1NCE
TLSH
T104552381981B01D5E9DF07F19395E29AE8502EFE74DB1881F326841FAE701627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 fa10c5567a4bfb47bb4a3c616ad3790b3cd015cce3aa885e5e7db028c106f2ac
MD5 73159093d4c7c4f3770936386c74d114
SHA1 9af08f6ed59713da132799196a9d2e099bd6c259
SHA512 e77a22edd91ccae562af6500e55ecba0b7fa49f29085c2f4bae4aa762cfb4acfeeae7fcf428c64b96cf58cf8cdb8ec7cafd828f8767b735b98f73b8a3210f51b
SSDEEP 12288:7AtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7A6mctvE/BT76+1NCE
TLSH
T1C5552381981B01D5E9DF06F09395E29AE8502EFE74DB1881F326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 5669b5015fb17577375d6d4d853b4954f9478845f4bdc2e2c1c5c1a658917707
MD5 4ba6780cd273ea688b0612274de22f95
SHA1 5c231a81b8e14d0133fe0dcbc88c52a985e27b6b
SHA512 80ce0ffa47f53c40f07dc673b8a66ac8eefeaac14fdbe6e6ee7dd82947868a0c1f6c70af591442c5966bd40ba2b7e6a7535988bb7bd1fd3009427f85c469bb22
SSDEEP 12288:N+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:N+6mctvE/BT76+1NCE
TLSH
T175552381981B01C5E9DF06F19355E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9088cc88b385bc059ad08769f81051823beaa88d6a242ed7d1f55d1baa13be8a
MD5 4c231f0850a234fef1411c1dfc524088
SHA1 a66abe84a2ca109de6393bede06793ac35e022c3
SHA512 a95c66c73126578c1a02ea76975533c5bb853112c930366dff2fae18df8040e8e76d189086f2fa659fc89ab99c3d96a55b1215526702681855d0ffae429556b6
SSDEEP 12288:oVftM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+6mctvE/BT76+1NCE
TLSH
T108552382692B01C0D8EB43F0C2A2D256E5B07DE975A719CBE311481F5E703A17D2BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 81ba6f9ee3513e90fed1a0989ac6c05c7dbfbb32906d553c9d8dd468e0cf2ec4
MD5 ad6c34488b4e85b83dde899c31240fac
SHA1 634820c1ee85d9091332653c8f90eac925f8abdd
SHA512 263f50eda9f265f93642fdc0ff15f36df52aeffe5a47081522bd389c6ab7aadd51cb63bc5da7bb2b090329f9c63ab0f33e7b39b4dd82bd5e68c5058b662e2a31
SSDEEP 12288:I3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:I36mctvE/BT76+1NCE
TLSH
T1E4552381981B01D4E9DF06F19395E29AE8502EFE74DB1881F326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 00a84963f6721dd145e0e4e787d5d2b6b91bc215f8d39acb9daa8f81ce3838b1
MD5 dad480bdf20b53ca8ee7a3280188bc4a
SHA1 49c9681cf502438ac14bfca5949dd4cd0a3681d2
SHA512 ee22323fcec4173e0128dd298e5d736b13487e6a46e6975fe80aec66088a74da0765de5a835fa712cd7956cbc665f579306f71ed538425e3a85260affeb372f6
SSDEEP 12288:s8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:s86mctvE/BT76+1NCE
TLSH
T1A3552381981B01D5E9DF06F09395E29AE8502EFE74DB1881F326841FAE705627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 914ea36c3347094f7ff0cf9730dbdfc3438042a6ef2fbd5b684c3fec53fd493d
MD5 20a5ffc6d4c6a4baec84ae4c01d16fc2
SHA1 1c43ef1a9744c6cadf4ca31a2793c584d6841d26
SHA512 38d9a4615da9737d66b6eb76eec7f50fc471eee4b4fc21e5ad79ddfb5db0aac101a394fee713e617f175a28f2ef8348a96fdfe91ecf4d4875af9e35b3025c3f6
SSDEEP 12288:A4tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:A46mctvE/BT76+1NCE
TLSH
T18D552381981B01D5E9EF06F19355E29AE8502EFE74DB1881F326841FAE701627D0BDFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 edd15c4fab5534c1c16047640fbf3bf919160f19ab20b8e5ce68f506b5cc4068
MD5 26e545559c31609c29b316e3646062b0
SHA1 723113225f02da21c2afde284d4f8edc362f2f41
SHA512 b5b3c90dab83a9ecacc3c3250dfa8e80fdb2773f723cb91a0dfb9059f417e245ff15d824b5bc221a7989df847cfbe6081611a219bf1b6f6a5640158d6ed613fe
SSDEEP 12288:viZwbNzzFEoS2cPvygtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:KZMJzFVSOg6mctvE/BT76+1NCE
TLSH
T176750295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 e51efb57f245976b9d93da83f55ca3f18e82b553bb44bef131bcfa0f7fef1545
MD5 27b8612210a8f79020d7d78fa8d17538
SHA1 e78795f1946f1f02d5494bd2fa2db2bf5823a02d
SHA512 850a6e56251a5aab363bb6cb856755e0e8487ea10617d7ca6748b0ae4cc41dd31c904518c639ef1b35040e4d5ee11207122762d543d7462221b13108e3286002
SSDEEP 12288:mFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:mF6mctvE/BT76+1NCE
TLSH
T1DB552381981B01D4E9DF07F19355E29AE8502EFE74DB1881F326841FAE705627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 4c73a461918e87780615f8d00780c6952710a6503e106eeee52008a76c8e5fa7
MD5 449cf5124863ce4eef921529d79b8efc
SHA1 3063f8fa9c64785095914af547af58502d82a024
SHA512 9f58252054e10b357fa5d86e6a3c5914b805759cba0e831ad65c394582974449d974736275d50106bbbee7440aa035abf3858cde66acf3b4c0a829569a37150d
SSDEEP 12288:E5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:E56mctvE/BT76+1NCE
TLSH
T1B5552382981B01D4E99F06F09395E29AE8502FFE74DB1481F326851FAE705627D0FDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 67ae9673de4b0fe2e8aab943ad3b4abbcb0427aef3cf1dfc8a38ad9b34797369
MD5 42378fa1253728f27d8c9f408e6d3ba3
SHA1 011d2cf9a8307e245dbc737519ba214202b3c973
SHA512 3c7e76251ea0399d44bcfbf246ef33b7c01cf324b3a621081b3e1908ebf69c6bcfe3d75f576b3590ad3f722b071cc10fd2ccedc6654da884470b13d1a3597ea4
SSDEEP 12288:JyPz5L8EtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ozyE6mctvE/BT76+1NCE
TLSH
T175651143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 0fb711422ccea6f6e2b6fc65c3709df29daf1f11222708290d5aa556f2dc9887
MD5 91de1b31539639e206b971ab76b77886
SHA1 ecdd460026f0864d31986439bf6cf70f1e42cc6a
SHA512 18ed3a67dbd27b60173b836411f702bdd8d687d45b09d7239fd2318d98e72b85690362704630205090312dd949cf53b8ac5b237c52c26c16c54d2f59c2b057de
SSDEEP 12288:dFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dF6mctvE/BT76+1NCE
TLSH
T1BE552382981B01D4E9DF06F19355E29AE8502EFE74DB1881F326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 6bdbe520508ba535862415576c5ec394fa8ae79ccd152b5e9ae117eff66ade7e
MD5 eb369eadf776aa918018b2e57aed8cbe
SHA1 3fc441974cb92a25a03bb1e138e149d53a2339b9
SHA512 c0be8ba4c7d34256047d2be2b64860a2d6bcc094bd1b1f768894e1c0fd211701ebef79eb8c96c8c9eeac98ae08f3e14142d86129d05544c2e51bfd9025769759
SSDEEP 12288:DFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:DF6mctvE/BT76+1NCE
TLSH
T145552381981B01D4E9EF06F19355E29AE8502EFE74DB1881F326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4ea7e790c3254f9043b28dcc5f3883e8292931d1cf5ddaf63111296bdc17340c
MD5 8eee4e59826d2461238ddb62c3eb0412
SHA1 1cc602daeb26b3d69a79fd9bd287cff70d33953d
SHA512 715a4c05cd133236d5da0012d5b312c8b33d0bd355360b18736f23ca0f26a2119c7e492b76319f11cd842e90a67e0a77af8063605ab1064b3214d3f315d86334
SSDEEP 12288:gyPz5L8EtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:RzyE6mctvE/BT76+1NCE
TLSH
T14D651143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7dbf6d01144aa63e82834d529c5ae8ba0a3fd922551b67dd7e192c3ccc092285
MD5 b0fe234a13a11a5c55ed317d8afa04cc
SHA1 c6290268aff93487da4612aeac0b816d2c3cf4cc
SHA512 ec67731838dc2302c3139eb8ec77284b11549b2a55356fb252f9065d6da396404964e1342de668ae07074e7bd27950d78e64ee49ed8fb6238603c276372645c7
SSDEEP 12288:/Cd9PWYoaLHF3z0z04PDvhutM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:qTmaLl3z0zDu6mctvE/BT76+1NCE
TLSH
T116750295B35118F8EC67427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ffe31c23ef517a531c7303f299b9c3420cecedb842f16beac49f5cf4b480ec34
MD5 6514c5e68b907873db6faa6886952b25
SHA1 f3de72c007b37a345ca6e914bcd18efdeac5c105
SHA512 5f24cacd35adf50c48b9ef50638c1902db3c6ce8cee125a7e04f5b509a5ac05ee5f259642129101005c8ef4eb92bca7bdb6f377e38cd8b62936bcc362066b267
SSDEEP 12288:1i4e75RdTfgwCHKy7GLbbdIvztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:13md9CHKy7GZq6mctvE/BT76+1NCE
TLSH
T10B85CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 e223444381bfe03890a4ad5dc3162966ebbe92ea122e3127179397f328b21300
MD5 7c0817b6f621ff974e3e609987de7c3c
SHA1 9090992880bfa846c7ac73fdb3b167122401d05b
SHA512 f6030328a8f598cd2e1c42663c72fe622482a4d41fa8507e7a22556e786f3f332c6623a800d00d9975eee1762138f58fefad15f48af7b655fb47e78c08443891
SSDEEP 12288:cetM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ce6mctvE/BT76+1NCE
TLSH
T107552381981B01C4E9DF06F19355E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 d921267131c1844373ecc0370767b7f2e057aba8098fc08dc07676a25efadb17
MD5 2584139855267779b87f8a277b71e019
SHA1 f08fddc3aef05bbedbba1de2f1bcd4733a7b3053
SHA512 bd54237aa2187d3f122854b93c7b857e8689d297e75010a49b0f4e98d473af29e9672727633cd02fc5b3d338ecb2396190762975816b51fc56e75d9ac1ad9bd6
SSDEEP 12288:pktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:pk6mctvE/BT76+1NCE
TLSH
T106552381981B01D4E9EF06F19395E296E8502FFE74DB1881F326841FAE705627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 17f267ec974d5c1ef33f8372d2a1f630574e86947f80147074d95258543425e2
MD5 56f5adf9baf57bb9d561c1b8cfaf4df1
SHA1 3109ce00898f18facc1d154ac27ef61db86d7872
SHA512 89696a2654f05e2a1d28bcb8f79c6e422a5c51be76d266ac8ff728f87e82d41c68c61e49911ad6eed31dc85c9554894d3145be602a826944db8513e9eeed3ab8
SSDEEP 12288:iztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iz6mctvE/BT76+1NCE
TLSH
T1F4552381981B01D4E9EF06F09355E29AE8502EFE74DB1881F326851FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 b893a97e51c6effbd0bf52efb1338018c0d4d5a17a555954364c6ae73cd7ef44
MD5 690160072dc1e33bdfdd09cd87725465
SHA1 8c5f196e2190bc94a5f49e8a6b8ff3701cc2b9b0
SHA512 5918930882cc345245424fbd78484391c95eaefc4697e92085950c5d826554890e69ef2d1e38b07118bd73558b8434b3183846f4f9598647c654182bd57ef5a5
SSDEEP 12288:0FtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0F6mctvE/BT76+1NCE
TLSH
T169552381981B01D4E9EF06F19355E29AE8502EFE74DB1881F326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 55ce8ab59e3857497f4a29e6d02f1e21e334effe8355b4200faebef8d5521a3e
MD5 e7c9449e74706a6fbe601f93d7c08f31
SHA1 d02b2bbbe4ca5cd66fd4bb2f8111eb5cf6628872
SHA512 c303987148eb6a9051733d8f4b1b2f0748c33467c1921911ab8870da2c329a42a2d43c2330bcaaa84396f852c1e4536b33b87ce32876f3049870eae7eea244ae
SSDEEP 12288:GetM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ge6mctvE/BT76+1NCE
TLSH
T1B6552381981B01D5E9DF06F19355E29AE8502EFE74DB1881F326841FAE701A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 df443d85e801244547bb391930c76c2d42eb6e8d12b5bcf3ad9830b033ef5d36
MD5 410e70b6e951bb70b3acd1031864a6ac
SHA1 3c1e9c50b024ff83ef202c12be05017fa24b7196
SHA512 28d2f159939097757b8475b2056b293827165475df5dac5cb4cf68d62021baafc9c356f76bdb98599f8806655fa55396ffb448cba39cafd9bcca23e762f53e4b
SSDEEP 12288:cdtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:cd6mctvE/BT76+1NCE
TLSH
T1E6552381981B01D4E9EF07F19395E296E8502FFE74DB1881F326851FAE701627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 0627b1e82a5016f508df40063498db931233b40d2b12e9a34a180eb18ed86066
MD5 9eb36849072bbf8f43491f27206132cf
SHA1 a98ee117e992adf6a368d4ce6e92b1cd81281bb5
SHA512 727515cade4d394cb7168d54a7b5f50e00d92ac7aaa46eb1b832fb69c01b02e79ff7961e824c80980f9b11837297185eb3095ef080fa13b0c0b2502a5760fb17
SSDEEP 12288:03tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:036mctvE/BT76+1NCE
TLSH
T138552381981B01D4E9DF06F19395E29AE8502EFE74DB1881F326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 48a93394cd980ed9426630513173bf0b97901d1a50694e421d29a633396b3051
MD5 1e5f5e177b9807875e05c7cca14d4a57
SHA1 efde219b5622973c36dd3bd24f894816962bdc89
SHA512 f11c9ca1dbc54fdaa3f9b1a7f7e86f26ae11524e5b4f3a6f737616616d01f5d84be063ae2507954d9be4f35a7009518d4fd6010de275b72b2fb00530e345579a
SSDEEP 24576:Mfwvfk9RX6wkyAIG6mctvE/BT76+1NCE:bMnYIG6mGvKVO+n1
TLSH
T17685D129EBDC04E5E1B7927C89B3460AF6B178691B31C6CF125A536E0E33ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0f3744eede5d1e4862cf52b1e919855378bc802152be52dc58f1a5f8c28dea6b
MD5 e8a59a313eac8a032c226437d088f0d1
SHA1 2292ce0d6d46dafaf3945cf78f35f28704527f3d
SHA512 32675fbc1c921657eac6ac975949b1d64f971d33fe8db99f21bc7d6994bcb681b46f256c9f99e9533cbc4153640c528fbc5319172fa100f9b9f26999456cf6ce
SSDEEP 49152:AYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Z6mGvKVO+n1:YySzPRXeN+1
TLSH
T12B067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 26ced5da09f4cedafaa38c248fd870a01c68ffb7179d43ba073ad46ffc6ca8bd
MD5 ffadd8c3b02353c6bbb561320d97b9f9
SHA1 bab6fd3c569d33492b2a457edb8c5d2c70eb6361
SHA512 223d2d5461f313fba1bae07c018d485bd68d505735a6d766ac31ff3bd4a897d0682fb074dffa520269d3035c1684a6071325c7e8cad8c5e320f32a80c3f80b03
SSDEEP 24576:G47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYb6mctvE/BT76+1NCE:G47JUQj4irIhCnDHUPfF/J6mGvKVO+n1
TLSH
T18065AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b5946aa2aae5d386ddc4f21291907a2dbfb3eda118527b681870289f4f36f471
MD5 65f679f75c1fbad3e8ba40a651c2f666
SHA1 013ac3b494cf7182ee378a6e6c2cb0e49b2f9d8c
SHA512 7222454ae68614bab37e739a0296d7ca16fe6260809da3b59b5d024d1b4a2f5baadfcc3afaa6e1f103370232cc9ad45e9f440aeb5c2bf4fbfc02db9ed5ca91af
SSDEEP 12288:+Xsf1tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:R16mctvE/BT76+1NCE
TLSH
T1F565F14AD25902D8C0AE12B5C7569241F7333CA597E293CB63D0F53E1F326906DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f2662bc1fffd761136552d5bfb6e5ceefe7280fbd018d3455bd01cb3178da5ee
MD5 3b8871c3fc4328e12f6d70144e4e449e
SHA1 9a1d1f8dafcde0aa6192ac950ce0c067c755e2db
SHA512 9ee37ecc4b1e9908bb1434f3d10bcf9948f5032a6437b0a525cf0a859154021e9f1d8f1b207bef9b91371ffea48386734d314b0b40749b56073c6586707f24f8
SSDEEP 12288:GukTU3fGDdfdfMs4pojFyg9bu1b9fqRL+orktot8BqqK8f/:GuOUPYf74poRyMu1b9fqRqXt2oXK8
TLSH
T1503518407666C78FC66D40361E32D5CCAB707C01EE44AF0773C99B3F95B6659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4423f98657f0f48debb94b1c941daebc7c3ff3718b7b97ec583ad39172d4deef
MD5 671dc3140243a5e0e71d0ee37a6f2a9b
SHA1 571832e80f909d77256ad7985a5d1b6f06b190b2
SHA512 b7b24b6abcb9a580e93948b6b395475021149932839863e125ae323a68bd1f7981d2b319869f2cfa7f33c3c07af3767837130c7b6df0ad9db5bc3ffe5bffb954
SSDEEP 6144:CzKR/mZ0EQXYFMJBMJZaJFDhzg9yfBvf/zPYkqLI0WvYggHTPgZMOLD9tMx0D9tO:1LoZSFDhzg9AFc2cVtdX
TLSH
T19A75FA815137938FC1BB603203295B4C7BB4EC07B7496F26B7C8453AD4AAB55A1FA3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 c237ea48d5c7347758965db4fe8ad138adb2245dbb2001a5edcfa52e00d4b29b
MD5 724206cf32cb9d0cec37f1659a8cf7bc
SHA1 bd7e09f353af8f7678472c1c33d8910c864f6ad5
SHA512 1ba2352af66829026e68590d6c406dc2c6a4c1800bcf87c32a657a1cc0f539d8979d061bfe02fc3c1bee178486ef0efb244ac41bb8abf11cd7b28788bea32ef3
SSDEEP 12288:Bp7CtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:fC6mctvE/BT76+1NCE
TLSH
T1ED552382951B1184E9FF06F0529AD265E8157EF93B8A08C3F212851FAD305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 32c6c7c3e83f7f8d1a97b7a894c06e0e55321b14a9d692c5d1e398e01e0c5867
MD5 8800a164ead6653c7469780707955c42
SHA1 b4ad62917cf7acecd0d3443eab1e6b8e7a63e38e
SHA512 7a870ee81005818598c5ce16add25a2b7b724b1b36b94d7f880b7111112ed5d1bb55c9ece3c35c2d14b4113c86186b60f3a8c30568bc1ccfcbf9b582c4f1d239
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYs6mctvE/BT76+1NCE:igb4mBIBhGFb6mGvKVO+n1
TLSH
T1CB659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9f619931b8bf431abc22e4033960a09088eb557869a7a215714171af56393233
MD5 4c15a31c2d06f3d6337a00cabd49a778
SHA1 10091a9429938ef151e9ad06531d896cc6c2575d
SHA512 62fd42c2d8c67b45693de6c437c224867636fd7004e4495a77ceb3a4caa4c69e55ea53014468a92098b1a257afbf8009ef2c92054689434a2b21c5b963f8904a
SSDEEP 24576:zG88u8FpJqH1hzria7/mr6mctvE/BT76+1NCE:C7ZFPqVoa7/U6mGvKVO+n1
TLSH
T1A585F16576E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8ead9911d1ef135792e4acbb17f0c10a6f467de0f43d8c427493afb95904c61e
MD5 3445979a5c87e1b49b6ceb32aa77ebd3
SHA1 f36cd566be4dd0b0865f0536394e5afe398fe3cd
SHA512 d0f03a7eeea84836b99ba75de197f9c2c6cd09a9d07c860da57413cb404a757fa2f1aee69ed31ed18a2b8b7ba9aaaa1cd06b30493a01e166066b6ddf81c111c3
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjP6mGvKVO+n1:nG05lO43bOXeN+1
TLSH
T187D5C06A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fe34ab9920d79889d621f1696c95533b92b85d753e4f1144b69d9f8a2a5cbc21
MD5 c435e7e9377ffa6b815b46be9aaf67eb
SHA1 a765dd758650fef9f59d76b2704a5c8ea36901be
SHA512 8ddc8dffa89c7fd98250d65beec0f50a1f0ad1c0e233c59dc78eb30844591058444e26b5f7f7bc11429d0129c58b83a3b0d79ab4a726c0b5b48d0bf0d031b51b
SSDEEP 24576:xfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnZ6mctvE/BT76+1NCE:Ra5POZ39Jt2pasx2+mH6mGvKVO+n1
TLSH
T1C165BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 df5dcf56008641d1a9e6f664a377f98c4d0dfb78f57541535bfd0d0b9eff1c94
MD5 feffd923305fae1d17d1e5aa7afd96e6
SHA1 1f787ea7160c8a4da044f793de149ddc32694a00
SHA512 1c3f51975a782bd7c4c80e501157d921bd157a1160774850d40ad5e1d83ed2ea7e6abf3990437e5577b356fc917fe9dce8d7aab4f401e3e4e2139caa69d24e85
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fkj6mctvE/BT76+1NCE:VNc/zEOVHF06mGvKVO+n1
TLSH
T1C9858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2291d7d1c081f3787d59c395185e0308d0b27dcfefe555c34af4526009b62f07
MD5 2b1b787bbf68a6cb0750799e74a5976e
SHA1 9c9b70e97f7b49883d446e34e8870507c5711213
SHA512 ff077137eaa298c74655e2a739e74bce1cd496103a41c0bbccfbcef695baf6f8ffbf52282f1a6aa1c6c1cc4add8da50ea519144e6fbd31bb6a59acf059ab4a56
SSDEEP 24576:2tkNvNnaFeYhJNtmZBm16mctvE/BT76+1NCE:2tMwBtOm16mGvKVO+n1
TLSH
T15255AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 bf10cf4e5faf24f59f4b2c8811d2af8deeddfc4330f83001c52e7a0fe065f252
MD5 59bab13d8ade12dd85c3ef31f215261a
SHA1 63a32496a0cdac218a13b0eb8e9d58ac89f190d0
SHA512 9a6135cfe9112fa8428e3665bf3045e2d67263995bc27868b915748cd2967a200e3c33d8586dde81b31e0e3478a694f84679d41560a65be724a02f748ff1a037
SSDEEP 12288:AHvUrBFrEjwaQ/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:APUr+NQ/6mctvE/BT76+1NCE
TLSH
T1D265F21F61AD18E5E67AA17C85828319F77178A2175292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b6af6dc569e9db5dcab6868fcd67e30517a117e7fecf7d39a2ce81a50037bcbc
MD5 f8b490bfe196f38d63df7d0685d1e83c
SHA1 aad24a35ae0713f40b7b31f4f75c3202f26a9204
SHA512 95a2f6ab25ccb9d0e4a538cdc59c69483c7772c4998b1f5525d6bc1e97ebe0afff2c8d6c470ab1d6d90db60253c28509c182fcd48f02af4530c948a5cea1b876
SSDEEP 12288:iQcMxWDXN1Dp/fshBItT1IQgA+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:gD3FHshBIYQgA+6mctvE/BT76+1NCE
TLSH
T18185E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-103-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1496-109-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1496-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1496-328-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1496-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1676-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1676-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1676-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1676-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1676-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2320-343-0x000001C201D40000-0x000001C201EC3000-memory.dmp

Download

memory/2320-398-0x000001C201D40000-0x000001C201EC3000-memory.dmp

Download

memory/2408-15-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2408-24-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2408-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2408-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2664-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2664-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2664-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2664-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3180-40-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3180-46-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3180-51-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3180-39-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3180-47-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3180-53-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3548-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3548-331-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/3548-115-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/3548-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3784-62-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3784-56-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3784-277-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/3784-55-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/3872-1-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3872-9-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3872-78-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/3872-0-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/4776-79-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4776-313-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4776-80-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/4776-85-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/5076-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5076-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5076-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5540-66-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5540-298-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5540-68-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5540-74-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5700-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5700-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5700-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-344-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5700-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download