d2a4cf3d32af1d08525cb582077e95acb84edf2a0ef6f3c986bde855ba9d0578

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.9MB
Sample260803-r74c3abb84
SHA256 d2a4cf3d32af1d08525cb582077e95acb84edf2a0ef6f3c986bde855ba9d0578
MD5 39048b0dc0cb76fd6ed193327c819a60
SHA1 9fbaf122a42fae068b6153b7dd10d23de1150c70
SHA512 a7170cb92c07ed44648eb284943af2bee0dc83ed0755720eed428e3b6cde3d162d4a1ab1de1f101acbd4521c0f0ec1807d1060c1d24b0ce07247799968327062
SSDEEP 49152:/rt6hFYkW8qmlouFSPLNiXicJFFRGNzj3:D+W8qkSP7wRGpj3
TLSH
T14F95383672F20199C45EA072DF464731A6D27CB58FF0D3DB8141721A1BB2AD47A3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2260	elevation_service.exe
2316	elevation_service.exe
2424	maintenanceservice.exe
1440	OSE.EXE
2268	PerceptionSimulationService.exe
5280	perfhost.exe
2008	ReFsDedupSvc.exe
5972	SensorDataService.exe
6072	ssh-agent.exe
5400	AgentService.exe
2952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\14a39e6c23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007be2dcb35723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005b2a9db35723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb15acb25723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f09cf9b25723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c933fb45723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e4783b45723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b4296b35723dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2260	elevation_service.exe
2260	elevation_service.exe
2260	elevation_service.exe
2260	elevation_service.exe
2260	elevation_service.exe
2260	elevation_service.exe
2260	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4156	2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2260	elevation_service.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5400	AgentService.exe
Token: 33	2952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeDebugPrivilege	2260	elevation_service.exe
Token: SeDebugPrivilege	2316	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3412	2952	SearchIndexer.exe	103
PID 2952 wrote to memory of 4824	2952	SearchIndexer.exe	104
PID 2952 wrote to memory of 2576	2952	SearchIndexer.exe	105
PID 2952 wrote to memory of 3472	2952	SearchIndexer.exe	106
PID 2952 wrote to memory of 4844	2952	SearchIndexer.exe	114
PID 2952 wrote to memory of 4176	2952	SearchIndexer.exe	115
PID 2952 wrote to memory of 4204	2952	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_39048b0dc0cb76fd6ed193327c819a60_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1440

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6072

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 3028 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 3028 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ae940eb46417f2e5c87d644ecfa6f5dce21da7979691fd32e6ed315059412f08
MD5 b036ec6043ceb4cfc44ef9aaa4d82540
SHA1 7e1c56167ca5d1c3af5b46b7dad356273c186a79
SHA512 dc3adfe72bae20de2fa571c4297f879417ba707e686aea4db654c6a0f10ca029e414f11a8f2e1ab1b1b1f05e9529e9da16655932aaa28fa849b001fa009ca099
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxntLNiXicJFFRGNzj3:N3q6mjBW7wRGpj3
TLSH
T19FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ad7e768aab2280a9b66418cda8aa6c4e21844532dcbe32c601d80402a1a7b925
MD5 b337c4ba47461033d80b8a0b96a3140b
SHA1 5c01307c56a5ac6159a2896b275f6c1ff98b52c1
SHA512 2778bab275e9e00ca7d762ffb58c07e5c067d36618b5762119102460661ac5f291ee1c35c3d59c6e0866066864a1bd4e3da02fff5d1b6c2d4cbca509b7671f3c
SSDEEP 24576:wXYfDtczAS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HtcrLNiXicJFFRGNzj3
TLSH
T1F675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b6f416d117ff24267f0f97c5fc7fbc848b7c5e1ceed91071698bccae323e91f6
MD5 d67a0e551b2f5c5507d0db5bdc9c8fe7
SHA1 7cd93c7ff10247c4ccd57f3d97364dfffe60f171
SHA512 398604c0f228af39c3852c9621d46f2d118669b36d2415b724d5d09cd8886b8e9dde1228d14bc35ccf1605c20fdef80f11dcb49b448f936a326857261ff637fc
SSDEEP 24576:00Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Pji0AzzLNiXicJFFRGNzj3
TLSH
T144859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dbcbd981a012315533a35346f77cbedf4a9a3367223d1cf3be9f375bfb742a18
MD5 51527c18c56a442e96d5ec9d2a5e2fd4
SHA1 73c761c8d098ed52261d4a7544a0c68ab08b3250
SHA512 9ddc0221e20a37a176319bb252dbc6c5d2edc56b7428af00f51ef99499a79f076071b224d9ffdaf9e91e40e48dcb3acb559765661513db192cdd2449a019caff
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWj6q8wyug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h/ezSC6vUzPv+HjynLNiXicJFFRGNzj3
TLSH
T1DF756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e55d5968f6f5d0a38e4c5c3c68ed729afc790a82d6396397a3b6c61075bbffbf
MD5 a96c99c35d8710da129638180277a81f
SHA1 8bbe0418af9d288d937c4a6c60c5cd875509e23d
SHA512 0e0e64815720ceea44c047346f9b5d5b00287456e6fd5acd553692829ec83504cd549329167930eb16fb43530c60b36a5541b72b2085fe85858c3bf4173c7ada
SSDEEP 24576:lVbqPb88hv/l+BR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVO88hXl+TLNiXicJFFRGNzj3
TLSH
T10B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c09da2c2cf6575c7e263da962f4f51b114ca4b4ba2d5fbb6ef63f4d9ff358dd1
MD5 5ab26b1a4084698bc3523366189bfb37
SHA1 b3aef1e471ba91d66d6cc1b291bfc32d770a4e26
SHA512 12ab86119bf5868c5e3b8e32074a95757990a4da1a2f4799402a85fba544b5da409146c59a0cb48f63792b0104b60c70c128d8afbd0594c37b4cfcdc9cc9bc41
SSDEEP 24576:aGy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T1015523D3468855B1FBFD0039867A5828B5845E2CCA595DE2D2503E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f56103c5a0b77408c1793a03bd6d0717f57915af6a3896336ac97f0e473e6843
MD5 23481860e8fc31ed372114fbb25ffcaf
SHA1 f6b10e0cb12fd982992d0ceec602bfef073e97f9
SHA512 10f19f5dfda32f7ab801fa0a586dfdfbc1dafea11eec9d03b60a1fdaab7d53ce5c8c00a2b7e2f31190d32ec59cf0322f1d5339d41e193334758e768627d50d0e
SSDEEP 24576:cJIUZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cJIUZLNiXicJFFRGNzj3
TLSH
T14575CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0afa4c0c0dd745077d16b7e073ca3ce40ecff0118ab0245f5aa0cde7319847a0
MD5 5988f0ffc9feaf1bd2d5b1447b0a9c04
SHA1 f1c4505e8660ab6a8de4bb3f1b330a80a4af73f4
SHA512 da1f9e5a08fb90ce299909e1d2b55d89f3e4ef89d6cb2a009aaf1a6619ba81286e63089ceb5ab9e42c22bc26fc82b13989a59469d72e37f85ebd6adcd2dc4fec
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THJ:+QvGAdlCEL8c/WRNw5Cw7wRGpj3
TLSH
T1D0266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7276729d354ac5f4e966e4b446bfbae31b2a6265871fd35e5cbe37c93f162450
MD5 b53553f81c55a88ca6abdd16e1af0654
SHA1 961a1141adb1b9eaa8fb8389cd149ec97a2fef56
SHA512 44a20ae967dcff0f28654c03e896ec669d54676eadc3327fc196d04f0d14214e9b922d83fed7330eeaaaa0429134863aba2ce814ca3cbbbba989b08238c88a2b
SSDEEP 24576:GfewsAjD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ljDLNiXicJFFRGNzj3
TLSH
T16F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 65afd8bcb949011cd31f6a639818de92ebca14b3308300317d026dc49e5ce132
MD5 974881ac45233ec4e0786950ed98d4bc
SHA1 e048852e0b0cb5c5f45f17f7371dfb6d133fa15a
SHA512 4f97e1127895145fcf9805e70bf3142f946e016e04819329f220e8f13ca6a2eaff2f0ea47e5b948f4eab8601cc71a53da9eccb4ab208f58c9dd1b5acf354fefb
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHfF9:2UEtQevvqc2W1cpV20I32t9
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2299e2b668d8cf8708227f507cf933c7dd9d723048adb687aef373f78bb5a0ea
MD5 800993cc58f919c760789c7e204e34a9
SHA1 a6e5e3138e9ebba0f96998cbf5e5c697f49aa0d0
SHA512 1dd1eba9227b7cf393fce4171088b2dd6017bf8e7420ab3f2d9efc714da2df59d1f81d4eecd0ca07476f84c7f352bbbf77f971eaf08dcfa26c5a2be6f05102ec
SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/zjLNiXicJFFRGNzj3:Uoq2Vjnmk7wRGpj3
TLSH
T11FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 08c9b44c5dabec444ad7b62bca755540226c1e2bb587f83ea148dd81ca82012c
MD5 a3fd40a8132698bb798f375c259a1cdb
SHA1 31092f0638d3d4625a6de4eea7b2c91517fe8680
SHA512 429f9c658eb68dd4b35e7ca0a99ddeb590929b373ee8026527579b92cce33339ec5840831f9321540c7c601ede0ef28cfe36fcf64e94ef2137411cf670b0f141
SSDEEP 24576:BAhGL6IFoiwtA5l7S53E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BAM5Foiq50LNiXicJFFRGNzj3
TLSH
T159359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fe07c8aaeafdd9af663f4e1d9cbacfc55815f71552cf4c9100ae5ac7a7233dab
MD5 c1c4dcbfea6c8bb73dce1c517723b10e
SHA1 990c335520adec6b926996c4f3b20820d1e6c732
SHA512 b1212ff0258428d9400b13ccabbe2e37f49ce5012b3f2b1243744569d560028afdaa004fdea25ce6ac857cda589ed3c2f6fce9c63203552ee73abb8123d296df
SSDEEP 24576:2wuROWH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2wSOoLNiXicJFFRGNzj3
TLSH
T19765F18632940CF9EAB641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3f44e5e0e906166fbb80192328925098c69d1fdc2f3166dbfa83d79ab5aaf390
MD5 9bb5d11da5126c75a1fa852639e7e71c
SHA1 e9ddf678c050c0ad3b4c64b9a1b3b7d24fe131e9
SHA512 068ae47cbfb1f7f2d3091e5ff80d93e845eaefa04c5e22db17055e2f8229f976a64342393214e23155fa6b1a73be82872690d9d7aed3d05263b01f74fe4bf111
SSDEEP 24576:zZue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T1AA55129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0206a86635d4225b799e2b495862ba486f284a1e41df39d93915ee4a3db330bb
MD5 100e6d7352450066dd7a28fa02ee5cce
SHA1 994fbff623fd391681623d369d7292bb42732222
SHA512 efdcdd10987edac44d1d67bf1e8da786fb977a879fce829674a29073dc048b2427522c09ecf73d5c09749a25b21551f915a9ba9238b484c38c0eaf31ef17058f
SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:YQyiKanX+PNhF9
TLSH
T19F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 78a687b5bf4f3df6e412a2214ee7c07ce0688a2e6913d610cc9a9d6d342cc537
MD5 8e8d44aefa538913378c9b568fb5bc10
SHA1 e477760bcd1429b7f468395da5e571c8cea93078
SHA512 8fd75fd4f41e133b8fbf8ac3ec880575a878b063ea4673afd66d1b905caabfe84c79403b2df66cb479c75cc2b33f0be31921365e7033d516bd9944b3417448a8
SSDEEP 98304:PQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:+QyiKanX+PNhF9
TLSH
T174667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 942160c152e5825e0cfa5042eb31d42fad39066bef821f7b7e2c98505676dd45
MD5 6276fc9a415fa41e6e5329bcb8dd0254
SHA1 e1f4819b248a95017fb88ece2fab57da146f689e
SHA512 e3e79495eaae4d5598b1020e591fdb50e30e5d8c184d8384ec73a594e66f8ddd64557679b1ddfa7ca239b363dd5a01126304b69fef70e244dabc1751db69a62d
SSDEEP 49152:L68Qg55nhkeWu7PNU3/zLNiXicJFFRGNzj3:VthTRc/z7wRGpj3
TLSH
T149B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9b59f98705855affe2b10631ee742c2f83be7769b104f854ea6ef83eb4d7d713
MD5 2a11a3f2945fd9fe15649226c743afed
SHA1 2a7dfc3150c001a902fac3aba168b1fb0f141182
SHA512 3bb9b9d2b7f1eb7d755acfdce57b7f8fd8e1700a65f13ddd92fc6af7c8f3b6e49c1c2f4da387f3254e6f1d977a378a73f442066dfdc0416aae84e50a4a75cfb8
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZy7wRGpj3:/LIHRWh4F9
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 20893f6f9b2483f5498549e96145817453bbe3a533c41947f74fd2039060a3c8
MD5 8892b751b0eaf22ae16901d9dbe18d2d
SHA1 8dd0d8877149cb94599ea982b0348afee687fa09
SHA512 71393501cdfd6d7dfb529ef3ab06fdaeb1c7a000b2840cfe28685c82847598ef062f9650aa724fc446f6789cf1527000ed31cab87562683dfa4b831a3d4ccbe8
SSDEEP 49152:IB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCLNiXicJFFRGNzj3:Cu6JmIxd2dC7wRGpj3
TLSH
T1B2D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b31c78e3d2ad0fa30a9cf1c5fadeba3507d5a0776ed045a5367e02385a1abb61
MD5 45c973aac762f704944f31ba002fcfdb
SHA1 f35168995f0fdfaa52b6f60f76e59bd1698e5b70
SHA512 24d8d986b9044730899c62d602477f888030f31d1d73355a1b00eea77b075827f9104063057b2b81d4bbd93de6233ca7ccffb9fba9bb3a4b979108f83559d3c4
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4x5LNiXicJFFRGNzj3:wmifPqRk7wRGpj3
TLSH
T176B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f3efebec68292d3f4e33bed08882716aaf48bff99953074cbafbfd8e7eb625c4
MD5 4f4c832cb76c2c88896a4f59bf35bd1f
SHA1 a5002fde46a184aa16c9a89e543077ae977305c0
SHA512 97825c22a5ab7c4eb6b2d05c82717fe976ad4f79a44729200da0f4fc5a062acae71a12bb16747d1645b12d0f1a791699ba1f44a8766da2b5e82f082c0ee44410
SSDEEP 49152:4SuZQIY0Be2KkRVtOnks6NMHqeLNiXicJFFRGNzj3:i5dKqi61e7wRGpj3
TLSH
T1B2C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f92829d074691a82b56a30d3cf7ffbf4476243ce75f433a260a490b0ab37eca0
MD5 e79b6db355b6254f9b22420fdca2096a
SHA1 2ed6d35663754cbbce47fb70afc873db1d8bf64a
SHA512 cc792c5a8f87a36b5a1a5319f9d8928c5efc0e0550f3d9873e409144cf54d34b10848f21f6240e65138ceae6c4b23ea24e8cc972497a6a91982bca2f92440cc8
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wFLNiXicJFFRGNzj3:dX2iWphI7wRGpj3
TLSH
T1DF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2c29c34d982a87f70e3e07f9fd6e97e8fbde12bdd7f06e905f6e700aba638157
MD5 50495d64e95d5b7418eef5a5c6cb219b
SHA1 4ba799c7960534012dfde5aa795ecb1b815f8a17
SHA512 ca832f3bcf8f0be8ed775cfe842cf06c4b76022de4b7313d54def931f54d8d9bcc9e0ff933d62e4a229ee25d1ba5c75d8c8f4f83c049362b09228c20e533214a
SSDEEP 12288:zoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:za/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1FAFC0039C6755428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b78d5ccdf0c8c75efb8ca11efb0ab99cb87673c03a03f7e5d71412a41414d82c
MD5 f3dc5298f49b2f02551cff2ff11ba972
SHA1 b2b1aeacfba78addbf96d410c4f1b2cdc0a8afeb
SHA512 1c9bea5f284257680af8044a58f736d63b7c076e8934208ece7f3429a4dad1ed95871379f5976a69f347709c23c2f89e6d1f6f574d298ed30e135ebfb09bbc14
SSDEEP 12288:MriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A95523D3548955B1EABC0039C6755428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1a245717a41948da3c996bc1852180a7615590319924b2918d9dc979b0b88fc9
MD5 fb460188542319575fb42c74fd094a5c
SHA1 4f7c5afebcd568adc66288328414fbdc981db895
SHA512 21de097728d6b90087a9d30786263df13f6556762787d1935cd5e4cfa957195197293ae2728ac3b3887ce3046694b4605dd1ec61614b04eea97ae2cfb41bc621
SSDEEP 12288:ddiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 689e5589ac71ab482a140f347bd32b282a8af6a838a3738906428ef04236fedb
MD5 a8bc8e89a37bdd0e34d792fe7461dd36
SHA1 12242fe7d27d0fb9202d4e80bea38e490b7d25c7
SHA512 b4f5dc843e770841e034a93a3655c7a29953b2e1667ddc9e9884a413790719906de60f8ecce7f7f00fdeb7ea61d51fcfd8a0685b966a890b42c9b1c0adc9972b
SSDEEP 12288:uViiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T127552393168900E1E9FD8039C6764428F2A47D6CD7325AEBD3003D1E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d8ad2b052ea669ccef285d4f495a79632b4dc026a46b32a3ae3e2a57aac69dc4
MD5 caeeac88e9b397d4331b6c6aa9e93fec
SHA1 ff01050f29573a9627223f2a2487d8ecd182aff2
SHA512 ca6ec0d83d0dc8bc6e60d3ce14d535641a2e2ed985788963a522fad83425376ffb6a2b6d1cd45c5f32b8d525b34766ca15e680eefe7dfa586326019b38fe438e
SSDEEP 12288:LaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1035523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d4747710f9eee1a3b76dfe633ce3e21bdef33412a610b8bb0c086d8d084c3e08
MD5 b75515e1b447f230b8f92826be0d2821
SHA1 31ef692389801d5e74efcf0d8af829c9570f4f66
SHA512 4ca2b6e2e3ab71a1b954994acd1d1969fa163efd026f8eb2aa3f38e30db96aad7f0cb5fa61b93f74c170fe7ab31cd0cc853a7cbf3a480050a00f72d6873fc529
SSDEEP 12288:lfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3548955B2E6BC0039C6755428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fad74408828eb4b5132338cc32c289010793fb3e5be9a028e5519160f2d3d346
MD5 78b375d28d4126dd5ba4ab1e9436e94f
SHA1 2a14c26aa753bc1c5a7ba632e0798e54bd9ae063
SHA512 86ec663d33eb95ba4fac050b04e2f451d20b01c31d1e3a1e7555823da25459297be4135d10886622012ae6f1de4149630bd8e3e6fd66f928c853bcbde40f652a
SSDEEP 12288:9DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:93/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d6c7aaa8334874e1f4f90e407373a9f11c0b5758b0a3764e9693b094e945585a
MD5 c60774925f7ac3597ea7094478bdaa5b
SHA1 f46affda0a57079e80db8c17fb2b909b140de978
SHA512 0b987939077a9c8035362b3e8637f62c24333d79f8fee9313ded230eff0b6a5207be856d07d593f10480e51356999d8795d38a1afe2ad875f558817c5e3c7ee6
SSDEEP 24576:rZM3zFVSOf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rZM3zf7LNiXicJFFRGNzj3
TLSH
T1D2750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 056bfea967d0ac7918f3a844c7069a2f2580a2cd0a8f3bf9fff2d6a011c57d0d
MD5 84922d3fe7ec149c4dae7df898f3f482
SHA1 8807e3273506ce075b40de505c862559152c45e2
SHA512 7f364b2a38ef9507163c3a53c62f31f5d96eafc54a06b2972a77c996f5c86e671e43433e99eca958c2808dcf709b0448ace5480043a18ecae865dc03a771c9f4
SSDEEP 12288:KkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ku/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1015523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ada3d83fe3af9b3e5b4b7c559e68e05a52a965f4bf966533fb3502ea5afea72f
MD5 13dee38d5716120f9c199d08fe8d7943
SHA1 76c85f84227c0d77c80f443642d08668f9973985
SHA512 c60205cfdb19e5ae2df46b59d96e7f7e8c9d8e661ae46b9ac7b0925e3f4b2cc901ac3e183bdd6370918a04eaae80bb546cc0ad581f6f57b50158b30a8e6d97fc
SSDEEP 12288:/QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1FABC003986754428F5882E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e56d40eca75242d2e798bb4a6a615babdec65c7472dfa09945ef42370d2b401e
MD5 44d0c046878cb6158fe203bb3602777d
SHA1 57904b0ffbb20e291698a734fd6541356d545573
SHA512 beb340b780e899370ed3d387b8765451f0c45b8895cb670553f64bcbb9d9f198bead5f05336e3218264fba36b22cdee340a910434e5af3e827afd548eaf72466
SSDEEP 24576:wzyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wILNiXicJFFRGNzj3
TLSH
T1A3650247629530F9E17A4139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 35bd0649c28275ddaa8cf6578280672812a1ce5acf1b5c22909a8126372f5075
MD5 8fddc9cd1527126cf89bf76df63b78a6
SHA1 88040240a7404ceaf1e65fd3cadbbb6560c8c424
SHA512 7fa3c5df8951e5a9c156d658ad5daef205dd93eda68e4b3cb8d1771bea5f242312bb48890e669294a53e43ca55de7fca3a7225d796a7bf6e701ffaecf3d38804
SSDEEP 12288:JkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19E5523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA238FEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 334f9fe31ee84b64585b95d3d83c30360e27c45dcd9c14b76d5960ac382d250f
MD5 5e77ce61b09ca130044832a0bef2dad8
SHA1 ffc8d961e6a7b45e424b12e828951a7dee8bebfa
SHA512 e14991085e0360e0ca880c41fb92b14c43f7d62b5edc31de67ba92ad35d11d112be9c910e9d92cd1fdf14a0cff592e58115a73a0e56fb0d0e18bce835a31449f
SSDEEP 12288:UkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1085523D3558955B1EAFC003986754428F5882E2DEB5658E3E2483D1EA238FEFCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 19d2ae7e8134bc0848fe24cef204a006f6ccad74c18d01b9271f1fa820b7c741
MD5 fcf3b7237ea5bb03c6dda1993856ed21
SHA1 f0f265efd94dac764a6b77a3f363a07974fc5cea
SHA512 644f11ecd4eda6f9f4b1ac15ac2ccf5ff89b6dc8b29b1770fe70190c68423572ecf2684482f54c1483ab902827c646330a56a6bd270a5197556adc6bfabdde37
SSDEEP 24576:9zyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9ILNiXicJFFRGNzj3
TLSH
T155650247629530F9E17A4138C9621915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ebb16eefc9d6a61ac9d8526dfa452e7712ed7dfc8ee0e7b2f7277485a947b99f
MD5 0ba685144054df78754934d148583151
SHA1 32374ee0337815b0d0254149035cbe47a8d382a0
SHA512 66de61ee55009394465ec8a4c15afdc04ceb903155e150a330d3b298b58aa73473ddf420c7386446446ab029de7da5b87fc2f8b5a90b00434546ef1c79da995d
SSDEEP 24576:JT8aLl3z0zDx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JT7LljgLNiXicJFFRGNzj3
TLSH
T12C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a369f951a32725872158eaaff7a5af79f5790228d0355c2fc303b9172a5bdb84
MD5 be07c5df0cdb956a108ce9bebffd7f66
SHA1 8410d93f7c60d70a8dd97406f87826bcbfa9a88b
SHA512 9ad97973c4467fd849aa095e357767c733e9e15b9705f68039aa78d49c74105029b6318c519748b6375f45e0dfe608c6eb327a65144cf18121e39dec42c049ef
SSDEEP 24576:T3rd9CHKy7GZN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zrd9CHKya7LNiXicJFFRGNzj3
TLSH
T18A85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 985034e2c4021aeb5aa245d9b8cd77da5416fe8f5ebeb7e4883f3140503bd738
MD5 28c61ab8a475f63b6e68c29967cbcf25
SHA1 3a581c3eec5cf361569e6e2039495fec15df3021
SHA512 89a7bed50f2e680d55eb3523d1bdd093dbc70e1a68c05b4aadd5dc068978eac51a148509adbdd3ea2ded24197fb456d30e93eb67e196bb1d6639c23579bcd4e2
SSDEEP 12288:39iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F15523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 efcdd7461e94390b8cdf89520b1aab0a12f3a906f082c41c14f50f4e6e4ef826
MD5 6b895fc0b3de7a0dd1620c7ca462c697
SHA1 b7a9e26270b0c9e4e1de8381d636dbd92cd83cf4
SHA512 f6eeb2100780eb1ca54c3012662a2773d72ecacca2b6ff781b82a6338f47bd78e677af4f2d457e3e5cfdd776a76ccd206e1907ce530efa3a5166cfc5e43fecea
SSDEEP 12288:bHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D2558955F1F6BC0039867A4428F5882E2DDB5619E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d399da06dcdda6d6c3b090d4c35bf8096301ef0d9901afc97e9946c874a536cb
MD5 5af279fc41619d54aaedc4f0c097e48d
SHA1 a20f19640e73949a393694ef4d2438fe0f796bb9
SHA512 bee79e024ca7875b28d2955eab80343d2ca5a26c203870360f8f32c19837f358ec45a4e1c034f0cc86e303f7f15747b42671db4c8f46ef0893932ecccad798e3
SSDEEP 12288:QuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA27CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 22b3f62ef7016f728b640bacf5c7ee2a9440b33c9b9a207c7a2e66315fbdd510
MD5 7ab9164cafdcd570469d2fad2505152f
SHA1 b1f4f155e5218f075de185766943dfe19ef66783
SHA512 1f850c74be16acf6b0ed88d5851a60c9210528746144fb803eb08d9bf8a5efc1016ac78293c3385f2f2ecf8758fc784227e037f5b8b67c80b4c2dead3372df6c
SSDEEP 12288:vkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3548955B1EBFC003986754428F5881E2DEB5659E3E2483D1EA238FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ca38827fe3588cfde0099a3e60ec675928ec7ce5a5ae49621477ddc2dd5e3b74
MD5 16627362b74db37d0444f5aaa6d07a04
SHA1 0b71cf469898a252ee3259962377be04e92a0ca3
SHA512 8d8fe9ceeb60e2044749efc948667156c80d13d867ab69c5a16df6e9384ff7f5c2c8e96cfca161a15a81a45b72be266be22e5d874d07c8307a95df60b647ba20
SSDEEP 12288:Y9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C15523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0cfe61ba41a0927b6c6d72ac13226cffa61fba3dd8c5444e58d2d903417c83b9
MD5 c8d3d2f9f16848c87416aaf094500d12
SHA1 3fae8921517d187924148d8e8d7c8b4e6be9aadc
SHA512 71c7249f6d623a9f6ee0403098afe88486bd31f70b3a2e85afc1d6cf122bb15babd9613358a74ad6741ebeef0dcdc18a50264a67cab0bdbf2830ba6ba894e6c7
SSDEEP 12288:L8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D2548955B1EABC0039C6764428F5881E2DEB5659E3E2483D1EA238FEFCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0fc403cc90f0df9215c9967531c6c01f7e498b10c6e74e6aca22d31cb631e693
MD5 384e4b68140793f51fb1cdc7da2570bb
SHA1 70aa74498f6e4c18a6fd734de6e655d2af64137e
SHA512 d844bcb49a1482cf417df28bfeccf12301e2b8e956965dc1e6693ed294bcf208cebfbd6b8eb38212cdf8b302b17e83a013089ff8c092963f4b053b63757bbcaa
SSDEEP 12288:taiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1a18284fbd9505984a040112f3eb751575b3b2eaef05b77697e0b102f8d3212a
MD5 fd9c1e43423f0c14d01bbce5beb836a2
SHA1 fa3e0706c9a4197f5e21b3ba3f279565c89e2150
SHA512 7138a2e0a7a01527550bee2bdf563849541c390d8ebfa5768c339ffd7d9543d0350b0944d90345df41511b6cfed0cd26bdcf67f2128a3f8c6de5df04519c7c56
SSDEEP 24576:ofwvzk9RX6wkyAIS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bMnYISLNiXicJFFRGNzj3
TLSH
T1B385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3d588aacb11415da99fcf744e47218913cfbefb58422d61b6d64c0c08c88ea0c
MD5 d13f00125bec660d922de590ef8182a5
SHA1 b7499e35282cc967233e98a83e5f064b049e0c42
SHA512 1cc1ddf7bd9987bf36b2ef607c7b68bbb5cdaabe25039e4b4a242e8e28a85e826cafcac19450ae67f844b6277e0f8d0d816c988dc8c8b9c823b6382dfb5db1dd
SSDEEP 49152:rYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lLNiXicJFFRGN:2ySzPN7wRGpj3
TLSH
T1C3066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b7a98e89608792842a0c894e02ab2a11e165f406da9ab3ca94608093e73cd61c
MD5 3d259c8beb987e81dd3f5b54818a418d
SHA1 cd9c338166bf44504f8fae980a0232f2c475108f
SHA512 af0da3d98ab1281a708740f9a8554718b794a90f31e565e2ef3952f8bf500ed2ee7f4d8e556ce3325280f0e540752b854f2d34f7fc194a2376f3c1df0ffad2a9
SSDEEP 24576:e47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e47JUQjqirIhCnDHUPfF/1LNiXicJFFS
TLSH
T1CD65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e5af381ce9d11d4d05bc82c95b2d1795b948db99c6b226c35f7560f2edbc81b3
MD5 fab8a88b1792e50de833beb3d3834ab6
SHA1 6f09108b2b9c6ed4d4b7a7dff3b3358049858a07
SHA512 748742300efb40e6b16581657e9208ff8d272b914a51b0cd40f98dd9031bb6057dc49b2983268cef0b71323828dc423c1e325fb5936ae3e3d17f11e59eb840da
SSDEEP 12288:Ypsf0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ze/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 982304eb84ce29bcfec8e1016ff734513bc1e3fbb5ca4b418e004c208fcdb83f
MD5 a2d0957435f5148b61f55410961b6718
SHA1 55c01037bfeef1bd37fabf942e993fb8a5e422ae
SHA512 ee0f5f5f7d5007b121a60eeee54b125d7b3de0c5523dedc8df180eccce09a02d458dd50d23eb1052a96b95db8f0b64a38588299776ac34f477c0041ea141fb41
SSDEEP 12288:zkkeU3fIl5h9AIPQnb8wD5WupuivkqohOC+:zkvUPw9Af4wD5WuYykbE
TLSH
T14C2517017626CB4FC6AD40365E32D5CCAB707D41EE449B0772C99B3FC5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 31a52f7ce06c21b25c4c32e9dca79d512684a86cb39ae2dbfa5fd71a4882d8c5
MD5 069beb7577c8ee652a28675c5ec6e0dc
SHA1 ede0372063ad77ffede9fb0442f7c5cb48234e97
SHA512 4898dbbbc5a2b3b7c0348672fdd16d2ef1d2f5c7dd6dd9ff29946127b8745a1b9bf524a7e91cdce5064d754ce64c917339584e9fb1a114047d475bbd54acf021
SSDEEP 6144:Cwzzvdmiy5D9Abha63Q8XAzFmjt+PLwAD9tMxdD9tMxcDYS2C+j7jYpQHETH0suo:VR3Q8XATPLwea+ETUsuo
TLSH
T1C465D9405536A38FD1BB6032072A9B8C7BB4DC06B3495F2773C8493AD86BB55A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3023a7630c1e5e47f10f0cced1d53fad6d94ecae8e60d6e290be592da4c23844
MD5 f10d1f358df12bd719b4cd3e8b26ccf4
SHA1 e57d8499085ebfa6424554c59b62187b049401f4
SHA512 79d51484deb70c7cf4573d2b0fba8738c4dd26077a10ed977b1906a6b3c6e4b451607337441c3433e1bf85d21c079e812546ecfdf95dff90c0d429b6d16decc5
SSDEEP 12288:6F7MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:22/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1565523A3568859A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 20d3ad2e51d6f726b0688e2da14ff3907f6a773b5b4ae4f821757daa142d5883
MD5 a0b6c3c3b456ad3c20de5b2474d26a5e
SHA1 64a2a296680ec1fe78c98c1a3aed064b0f7e89da
SHA512 2651b3de869cb5786de53b65ff8ef4630cb5c3a9f20a2b38b5e03a34572eb4c878e2b2a0dbefdf770604bd5186275585840b5f92b00595145b5c77d51c0c9a46
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+gb4mBIBhGFvLNiXicJFFRGNzj3
TLSH
T1C665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5201720537959234e966f6f9686f516f14474bf7a5e8da1accc6083ae7130de0
MD5 7524500bbcc288702848db3801edc0d4
SHA1 d15e70eac0c3ec0ab85dceba5e53754e83592db3
SHA512 aa84d09c4e9cb970be4b40e0f7cff1c85c15c37da77022f83f75edba66a97ab0efda462fc92e0a0d10a267f744dad8400f189a5289a9097486e8ba99e83352f3
SSDEEP 24576:JG88u8FpJqH1vzria7/mf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c7ZFPqVya7/4LNiXicJFFRGNzj3
TLSH
T12985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a8d7d9701c3dd9eab958d6253b5854b87ff9a2ab70590bff5c97d6e9eb5bc5ef
MD5 84873f938e81e60243e8905224fef7e3
SHA1 def3e711e06cf2920ae77f5692219898b937c4d9
SHA512 a3440f0cc53bd7c65a4aa7c5e01b470ac3425d2321d209107046a57b7054ba856e9aa969baca3751fc8c1caf97f5def70a52d9fcfaae73408d215fbee58e71cc
SSDEEP 24576:tPUr+NQ7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tJQ7LNiXicJFFRGNzj3
TLSH
T10565F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c00b4b91169a03085ec5f49f810e12b82f8f8785e617b2c88d0e075e42c09aa5
MD5 c7374d7236ce901b36f56c5d7f621239
SHA1 03ee1dd2503a5bf53d2249d3ed9670abae210975
SHA512 a3afae3d6cfa6b154c58bdae286ee9877d0b281e3bb2b9be2118d327b7be0101ff052a779e88b8b3136ef6c7c4f6f53bd97a488ffd58b139c6956fe337d1ff62
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrLNiXicJFFRGNzj3:bG05lO43bq7wRGpj3
TLSH
T1DDD5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75c7bde037d2ad73b555a04fe469f01406e5677034a034bbc590ca9fe1c018e2
MD5 353d677cba4693c9a3f56c0edd2d380d
SHA1 3481d315252cc593acb9e4597206226594951b1c
SHA512 6299d85556dddec0b95c77f1a99707e877dc43bbd059b7163378a2a420d32eff525b4ddbca4a97aeb407a8c5be5f01319ee7b73a386ca7cff01dbc0f6ad651a7
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnl/TwSfVcYG3K/cJHlnFR+IGNe8jg:ea5POZ3lJt2pasx2+mzLNiXicJFFRGNf
TLSH
T1AD65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9270462ca4a430729a63f6a89108bbe71fc9bea078248a8dcb70fd13a21074e7
MD5 05b6dd4ede454512bed6b5da7dd59029
SHA1 be21a3867aac57236bec476b1548075408d2e182
SHA512 90ab3a319e054873270046ab1c33c48b5962c2c0ec12d4d00b06ca10ab5a6e26395746394650a9feed5e8e3acd1e574cc8388f7c15989eb4ece798fa419e73a6
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7Fkn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qNc/zEOVHFYLNiXicJFFRGNzj3
TLSH
T15A858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ea17a931b002ef7bdfca88ebbf90f2475e0395caefa162131ed672af4d52fdeb
MD5 5b0b45f7d079934b0c3d680fdd9dec1b
SHA1 59445efb90a8aee909db39f4500767fc76968e0f
SHA512 62a9d25f65f6b6f91069047af68116304289f10200e45a500bddcae49d48e18c626efc8f916801a08e2ac4d0a5072ceccee3f64599832ff4e0ca6f63fbd1d9fc
SSDEEP 24576:vzkNvNnaFeYhJNtmZBmu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vzMwBtOmuLNiXicJFFRGNzj3
TLSH
T1E955AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ec10826286198b4689d8e8280f566067c112af2fef8f226fc99bb71959cbd2d6
MD5 5d111bdeb1e8045e838b1dcbf5ebb837
SHA1 42dc5636b70e9778061307dc5ea836995928a253
SHA512 c745b34238dd5edc2ee9a1a265d64a0f7b2a0b6a3c3ce52a238053678491d8801adb5fc448a9d86f534e41f60f4d595436c90510eba0b68a7bb3d8bbdb3c6280
SSDEEP 24576:GD3FHshBIYQgA6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GDVHeBIAA6LNiXicJFFRGNzj3
TLSH
T1BA75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-217-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1440-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1440-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1440-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2008-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2008-331-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2008-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2008-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2260-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2260-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2260-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2260-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2260-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2268-72-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2268-298-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2268-78-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2268-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2316-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2316-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2316-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2316-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2316-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-57-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2424-52-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2424-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2424-55-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2424-43-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2952-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4156-8-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4156-51-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4156-7-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4156-1-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4156-0-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5280-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5280-88-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5280-86-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5280-82-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5400-140-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5400-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5400-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5400-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5400-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5972-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5972-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-317-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5972-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6072-127-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6072-121-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6072-119-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6072-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download