5ec2fe5fc280aaabf9bcebdeb211d94550a5d83e1b90ffb345d265573d6df978

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.9MB
Sample260808-vmcamavxdw
SHA256 5ec2fe5fc280aaabf9bcebdeb211d94550a5d83e1b90ffb345d265573d6df978
MD5 eb787927f78141e33a76bdbe9252e3df
SHA1 e31627e94b90fd7b1a90cb0652e45a7558d6db30
SHA512 b273a13fdf8146bcab253d67dff43ca38019ff72fb3cfd4b46a974b8dc3ccf833b1d08e3dcf7ea0eead3e19bb65a9e56044d9bfec2e1de3e3a7d828a2ac1aab3
SSDEEP 49152:sFv/Fgg8tv0LNT3uLa2hcA8VV5B9dj18Y5NUm511PJPqtw:Q8tq5+m511PQ
TLSH
T1CDE58E07F3E951E8F1FBD2B497655232A972BC464B34A9DF028076251E72EE05B3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5356	elevation_service.exe
5076	elevation_service.exe
3368	maintenanceservice.exe
2472	OSE.EXE
5444	PerceptionSimulationService.exe
2104	perfhost.exe
6088	ReFsDedupSvc.exe
1420	SensorDataService.exe
1520	ssh-agent.exe
4800	AgentService.exe
2828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25e80f7ed744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a290243b5827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010a7d53a5827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022f3193c5827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b27313c5827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027bbb43a5827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4348	2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5356	elevation_service.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4800	AgentService.exe
Token: 33	2828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2828	SearchIndexer.exe
Token: SeDebugPrivilege	5356	elevation_service.exe
Token: SeDebugPrivilege	5076	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3868	2828	SearchIndexer.exe	100
PID 2828 wrote to memory of 2956	2828	SearchIndexer.exe	101
PID 2828 wrote to memory of 4456	2828	SearchIndexer.exe	102
PID 2828 wrote to memory of 2384	2828	SearchIndexer.exe	103
PID 2828 wrote to memory of 3576	2828	SearchIndexer.exe	107
PID 2828 wrote to memory of 2220	2828	SearchIndexer.exe	108
PID 2828 wrote to memory of 4128	2828	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_eb787927f78141e33a76bdbe9252e3df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4bc3dd1cdd005658b3e3a4241726cb58c2237e0fe467ddaba5b155089854d78a
MD5 e19166ab1cd23ec2b406fff1e84c5264
SHA1 2a82b7dbaa7c9311af58d01481846c1db6dbb0e2
SHA512 df465a8db093072f09ff3f3553d1279758212b261ced91fad085d630fed237b2dfdb1688cf95a6af8d8e2e8352b2db95ec76548a5f7f24a8cf5ef0ad143c32fc
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYY5NUm511PJPqtw:Z3q6HjBw5+m511PQ
TLSH
T1C5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 39f392ac23600467f31a8011f71742f49f47a977155ccc4694fd1ea5cb8787a6
MD5 25057d3e21dac0e50c490a6eba1f47e6
SHA1 f1600bf51c02eaa68925d1f3307fbfb90a670846
SHA512 0738f8137d09a41c5bd9136fe45a5a96e6f1962e64236056dfecfa8a183d117b957b9970e42df5b6236c22280702793b4ef781510858dda032ca66cb9f1384f1
SSDEEP 24576:/XYfDtczAQKLzqYkY5Nk1NbUQO1GONZJQWhqbJwI:KtcRY5NUm511PJPqtw
TLSH
T13205022973D408F9DDA78279C9A18612EA32BC5447A0F79B03F095660F337D45E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4ce41470f9a4fa2cb1eed907a46b8a08d271e604e1f5d98a5c5ad09a61fb0a0b
MD5 bf84d3f27ae73e733862723f80a10695
SHA1 56dae4780e9bcf88650be27c35a0266f5c7cd537
SHA512 8d2328e88998c2eca3e8e49aa37260d8f0cce617789fa59fab6a76235507d90488c5908ca1bd912a9306c6010015dd2ecae4edda561e8afe29d137abbdc1a015
SSDEEP 24576:+0Le5ji0hmxirMRKLzqYkY5Nk1NbUQO1GONZJQWhqbJww:+Pji0AcWY5NUm511PJPqtw
TLSH
T14235AE16F6788331D073C0B9C5D2A68EE97130855B308ACB4296D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d2cb0aa4356ec627efc8397a042ce6451adea63575cad57521619a099e4873f3
MD5 c637406f5270d993a99f80fed485a9e2
SHA1 fd1a9715c7aa41a09f87a75f67e72691c7d73233
SHA512 e8577b373e58bd4f894dc670cea353faf14adb1439fd7a9eba7c09096d53b3b32927a5a2b9fe100396337995fe8b29f2fad53e7c811627f29094497ae2a5ba01
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyufKLzqYkY5Nk1NbUQO1GONZJQWhqbJwx:9/ezSC6vUzPvxHjySY5NUm511PJPqtw
TLSH
T1F7755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14c556dc7bde98b4422589b47ab92b8d8f51c6a24cf893e055160a886ed52012
MD5 f30a47c55d74ded82da9dfbcc0d70331
SHA1 8677ecdb92b3548ab8ef21c00734812a7ac39221
SHA512 c0b574dfb4aa370fc53f9f60e0d017344fc5a5302dd0a5c6effdf5604178e6d76146a2e8161fd2cc9a6e77d4c141ab25e0ec62e403185b9ec8802ef183adf7b9
SSDEEP 24576:tVbqPb88hv/l+6UKLzqYkY5Nk1NbUQO1GONZJQWhqbJwZ:tVO88hXl+nY5NUm511PJPqtw
TLSH
T1DF559E66F5B48331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 dc2461b0501bfb9cab4390f9bd65bc0a5c334b593d329d71b77bb1cc19db986b
MD5 9477fa48ea06072904e8d8cc426d27c8
SHA1 52f6896dae5cf7881daef2e91715a469f6891177
SHA512 8f525044db9270f10728c07e268307581d61e1ec6c190d2f830accc667b65fca9c2fdd669a6db2777659e35961547492ce062ab5012ee8ce0d93ed57098a28e6
SSDEEP 12288:5R1KioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwc:5R1KLzqYkY5Nk1NbUQO1GONZJQWhqbJV
TLSH
T11DC4232B268C04D9C3DF1B72B6F033979544AC9C8CD6EB2663B0B59B8B34752D9D6483
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f8e600be78c37f60c8e351a4f7fe5da4e48e6234ecf75bf86a4b8a9a4eb491cf
MD5 2ca9c15c95f6c4758c08b5588fc89ee4
SHA1 7bcf81e86da2fb99300b570a46835fe72383dfd8
SHA512 5ed191cf1b00ae5c6d8691c0ab0e41881cbcef413d4b0c62c169e2a724790d5ae05a2345de6017dbc8baddc9711a7c156d3a45cb80a070e9b280f5f7cc56d163
SSDEEP 24576:oJIUsKLzqYkY5Nk1NbUQO1GONZJQWhqbJwj:oJIU4Y5NUm511PJPqtw
TLSH
T16605CF3BAE28ECD2C27E4DB95B918340D76278704F52A3CBD175820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 df62fd751edfe4b6f7f9bd765c9be5134c40621a80f6e114c29b2e942639f241
MD5 c1e5ef68948d31d2267203e5d99ac8d7
SHA1 e31e5cdc846a04576eb1086d9eefca823a3be6e6
SHA512 f88e0e15a7a0b914813b40c451f9b5b12ef58f705c533cc29179ff640bccff1eb272d62ce2e8513a102a0396b1569adcf53640860ba3750936a7e6712eeba046
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:7QvGAdlCEL8c/yRNw5CG5+m511PQ
TLSH
T1DB267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5cc12307c241218f4cb9c19e3d23a803a3dde595fa2705087769e7387c84e98a
MD5 c17cdf32b087a7019380e783da56d362
SHA1 aa7303ae3c065240f9c741288169885bb29d785d
SHA512 63dd4c9cbaac0234a08d1fe6fbe326862437fc4afc46b0046ab62e9c17ab5829a5e6c0cc484da0f593a0b410007086e61505f7b3942e3218f6153c5a5730d0c9
SSDEEP 24576:1dewsAjyKLzqYkY5Nk1NbUQO1GONZJQWhqbJwR:7ljmY5NUm511PJPqtw
TLSH
T19315E031FA74D436C3BF0DB21B71D716542CB9604F921AC3E3B89A9E4A302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f208ff21527b859142d346d981c85a41886d4a6894819e74feabec6d053f76ee
MD5 4e9809f1064c674f633d1afd4926f715
SHA1 b91aa605d3ce4e36bdac8d94d808d62ba88154df
SHA512 eb028cb935cc03480e5ebc70fc235d422742f5138da100aeb6866a92b608cbbc57158b496cd61d39bce0fac38a8734111426bf53399330e73164cc7d63e68c25
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJ+C:RUEtQevvqc2W1cpV2EI32JJ
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 37c9ab17ffd4c76ecd00dd429e2414bfe6ecfdf41fec3369e84a78a534f9a90b
MD5 a096fb0dd8f83af3289fbfdb22357812
SHA1 4f4a340706ed2135186ff2ea3fbb633e3b084f8d
SHA512 72c4e6d171ce8f5897d3e735c7731d9689b27eb45bb7c436069d99ac79f840dc48b89610f6087e06e205e96573e7c8b620f6ba20832c6fc8754ac9bda595ffdf
SSDEEP 49152:HCbRquA/m2yL5zLfFiV+XenmE3/zGY5NUm511PJPqtw:Qoq2Vjnmq5+m511PQ
TLSH
T100D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e6c03b8686c23b73e8e23a4ca0b7e31af77f2dc8ef7da4f4134fbf79f041fb16
MD5 bd4ba762cc16d24388a3174f3807bb96
SHA1 5ade4d18f6bc6e2dbc92293e43ded18e21858885
SHA512 2db20a19e76e4d3fa0b3ce0e68c9191b18176a0c94d01e5daed0f97688de3292d089c73ee79ceb00878418dbd0195da431211d929c6806a274a6e06bd265f323
SSDEEP 24576:FAhGLJIFoiwtA5l7S537KLzqYkY5Nk1NbUQO1GONZJQWhqbJw2:FAMyFoiq5dY5NUm511PJPqtw
TLSH
T1CE359D81E7F945D4F5F3AAB899B69171EA76BCA95E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 71610a4d1f0e0e7b8a282f39f3b9224b218b444addc3c217fb8a147facaa4f18
MD5 f52046c9c64b0341e7cc4ed39fd6f860
SHA1 edb01795a88d5e21dad9bea05ec6532c0d15b2de
SHA512 92b77886fe565515ac45ea7d89c182f5738632a1ec826f4cf42cc19a6a69a7ae85953136f246534129e847c0ad0dd4010df29993f02c711ccc3d99dba9efabbf
SSDEEP 24576:BwuoOWOKLzqYkY5Nk1NbUQO1GONZJQWhqbJwl:BwDO5Y5NUm511PJPqtw
TLSH
T16205F10A36E80CF9E5A7463985939236F7B2BC052A61DB1F1370C65B5F33361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9aa1bf1c2378f143d57b325fd36aeffc09a944b0ebb1be9cd60cdce29a7c41a6
MD5 139e08fc570b92a3fad8be931ffdc04d
SHA1 cf381a15f0ef7208391739865489f91e9951c2b6
SHA512 111174c48bb96e1b3172b38b7b091c7594d84f98cd007ab2e9fa8981aa0eaa85c796ffd05b2eabd997668b6af787498e1eebce496bdbee68ae4a7ac91ef122a9
SSDEEP 12288:9BZ1IyiKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwg:bZupKLzqYkY5Nk1NbUQO1GONZJQWhqbz
TLSH
T17DE4121B32D810F9D2D74679D9F01346D76178995BB693CF1370A2AA0F32BC29D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c23445a3ba570293c4c6ca76a10a7d9796feb5b18fb3c3a1dd871168b1c343ee
MD5 ffe5bfc2b9c3a8cb9a4c0c6a7f6c2988
SHA1 e7a7ad91e20ace5b5eff3834e2eae4ed5a59085f
SHA512 4bfbdfbc1b40bc071d9cd35631b83cc36445b7e48e06c43773ed543d370483bb81564ac7b5b7981528252e8b676808db09c6b5742ec9e30fa36e93db3926bf7c
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3J5+m511PQ:dQyiKayX+PNz+C
TLSH
T164667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d391ca7ef3712097e5a71793ea296461e127df0e2181325a15aad3aae322f73
MD5 a5bfc4634cfb92ee334b7afa8d2fed3d
SHA1 9792b83799614b2db49b4ee1d7614f398976e9f9
SHA512 64e9c2009a4f5a4c76374691e86eed91bad6f87666c717db4d30506fd0f98985ddd843b6462f27b5fb72cfd1ad722b8710b5b1ded3f94e251ced87e3b3a386e3
SSDEEP 98304:aQRQyi36YOcPQLvw2gAf+PN3J5+m511PQ:RQyiKayX+PNz+C
TLSH
T1D6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba66cb7a45681f29717a1508727767b9d92884db28b5f61e02928c055230fdb8
MD5 f483f4abc87c28b2e522589f92750104
SHA1 0cb1dbb0aedd6e9770fdae199477ad98cdbfd3c3
SHA512 deb9fc01e31c3f639cb1c572974cca25216f2c00e85039257397cf2a98dbcac675c76cbe8e3ebccba3d0bebc87c92aa1bd2771c40aa527df17deb1647c173a5a
SSDEEP 49152:d68Qg55nhheWu7PNU3/WY5NUm511PJPqtw:bthWRc/P5+m511PQ
TLSH
T12FB55933B2F600A9C04DE1769F46973196D17C758FE1E3DB8611720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7835341ffc79e48fd4e9e341d6d25a8096d2372dba5dcfb668cfb718ae755176
MD5 5517484d89e40fec4132ecc6359bc416
SHA1 1d39b64ecaec99f6cca0104686b63bda0b19b47a
SHA512 0c669dc298a6529459fa2574b9b6ffdc4effb07104447e1115434f52130a520b1701e329553dd4bc5c0dada30ee75ace94617c4bc32aca308d8dca3f4c519943
SSDEEP 98304:Sy5112gYy5azzVvL69nLKnhZQ5+m511PQ:bLIHmWhq+C
TLSH
T126167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cdd2da7285e280d3314c2070a495db434800f70d2d4746209089f467e429dc9f
MD5 b7af719cbce61d5088cff642eff0b9fd
SHA1 339d4c59697d613da8020c877bbd44714d0f759a
SHA512 70364e63227ce45b2d26a830d539752b6709647e0f2d9d7eda12dabeaf7f6aebdf638bf55f19f32321ecf9f05189e7ae66211b5ff4a21ecdf4063286032eaaf9
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glrY5NUm511PJPqtw:Ju6JmVxd2d05+m511PQ
TLSH
T1B5D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 94858d7b626f8c2b6125da5093913075b8ef403433f737c143338e1855cd3c62
MD5 ae273ab3be32fd739c27883607b5790a
SHA1 960caa4c35c29ff02077e942410e091e8f00fdee
SHA512 50bc7a06be39c133c69883a3e69ccd7fd4a1af94777cee30f8e0432bed95aa6b489ba3d5ab4a47b6eff5a5686a4806fc3497e1b78cb0bf28ea1251c15be37eb9
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4xYY5NUm511PJPqtw:zmifPbRq5+m511PQ
TLSH
T1FAB5BE13F2D800E8D06ED17887569232EA62BC450B35B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 12f87c51b0e7e85c79663a2217914fe8b0e3399b51c2f4c7f98dddb66cf68a45
MD5 7593eea215b0fdf8438b5cd546dc577b
SHA1 55df49b5776ccd110a3314afc9ef2fd40fb0f428
SHA512 112be29392465e0a14e9ff71de165311d9f7d108dc5b5dccd86c781f7cb8f8437a0b69b9c7a793aa423d1e2d39a7f0003266a8b77fce29a80a22c3160fddf9ce
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqjY5NUm511PJPqtw:c5dKTi61c5+m511PQ
TLSH
T1D2C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0cb6ebbc0ec993d631a4303cfc58c6a7eae2f63be472e71064be88e8bfc66448
MD5 430d5520337572645b3b16a50cdc838c
SHA1 ac714d43260ad824331f99c27ae5160b3dd3c592
SHA512 bdb4aadf0315adfa0f4ca91f4e32622e0f3e300ad317f69b2bb334ddf2603c5502f7d84f14ff2d36888d78971ad1c1396ce6d1028d65e9921113ffed643ef93b
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wcY5NUm511PJPqtw:MX2iyphe5+m511PQ
TLSH
T1A395BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b70e87be65614feacfd905d2f6625e993b35fb41dec9789181a22cca0e21703f
MD5 8fe4bcd796eb3159fe3323925e893824
SHA1 eebd8be96e5f76a29992406f7d505e730c8e9bc9
SHA512 914be57d487464c967ebd1b00a0213b067ee162f03fcfac91d9561e789f085946f072fc15493dd23a4e5726182049f8b0ed84c8391968b77cda2613a8047a68e
SSDEEP 12288:7tKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJw8:7tKLzqYkY5Nk1NbUQO1GONZJQWhqbJw8
TLSH
T1AFC4231B358C04DAC3CB4BB2A6F0339795086C8C9DC7E76A73B1B15B8B31B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b31cf9ca0b479daabeb86fc26dde811cba12cbb7ed47cb6218e844ebb6e354ef
MD5 f72c4aca4ea5ab4991c3560a777ef1f2
SHA1 5a5e3207b3665f26d4fd475d2caddbb365b7a45c
SHA512 a76fb614749c851d69a3a0c3acfbbcf8c78f0fe6b28f822c51e8e49d3639274d8a346941f7a1265d708c4e053935160e3a2cecf4a13e36d0ab982196e0cd17e2
SSDEEP 12288:w2KioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJw9:w2KLzqYkY5Nk1NbUQO1GONZJQWhqbJw9
TLSH
T172C4232B358C04DAC3CB4BB2A6F033978508AC8C9DC7E76A73B1B05B4B3575295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4395ff20a8afcd6de85412055265f4f6d55d9a090bea87288b1c6d7c5857c3a4
MD5 1ba21834024834a95913617944f991b9
SHA1 dd2fc5c0e0a5574b8bc7c15431daa36136efeb9d
SHA512 4c61d8aa62eddfaa6fa461c34a4c5fa1cf6f2309df903aa9e0a3dda42dc4b1f6cf12034dc798088c08eb1ca1724a0a90d29fdd472e362e907e8fed8f1b8f6d07
SSDEEP 12288:AkKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwA:AkKLzqYkY5Nk1NbUQO1GONZJQWhqbJw
TLSH
T1CBC4231B358C04DAC3CB4BB2A6E03397D5486C8C9DC7E76A73B1B05B4B31B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e373ec0456739b79da983a23f6364a8d4b2299c1cbd29058222d3c30f0344e5c
MD5 7b848a57cab8f6041d88f35cc4abe026
SHA1 6220c8349bc02b841deed9bf147b137677241628
SHA512 6bcc11fd294afdf88ce77a7b0329b3a99112bce6e2d42b2f02fe752d72684b3fd87969644546e22f40a58105b9cd4cf21d42743e6275963f3ddbd327cfd9a3fb
SSDEEP 12288:2VbKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwF:aKLzqYkY5Nk1NbUQO1GONZJQWhqbJwF
TLSH
T187D4231B369C00D9C2DB87B1EAB02357D654BC8CDAA3E7AF6360754B0F3179198B5D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f87777c0ba49f0d030c86f9faf82d5ab98f8e65792887e3f8c56b9db664a8a5c
MD5 00c79bffe90440051f9febac003b7c8e
SHA1 fce638299678f3b667a2a43334d56c020f563b16
SHA512 772fcffe1c1b04bd9bead60503764d3dc7e4e0f1a1fbb6ca7d0b6d3cf30c9a490e7b0837e3becd30fc7b21c4551d8fc4d8b4360f1028e1aa48050d7d28449eab
SSDEEP 12288:1DKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwe:1DKLzqYkY5Nk1NbUQO1GONZJQWhqbJwe
TLSH
T1D6C4232B358C04DAC3CB4BB2A6E0339795086C8C9DC7E76A73B1B05B4B31B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6254ae07c946d9c9868369bf1088a6627019b4541db39a1948542ec43564292e
MD5 3d6bccb8e18876597ce128308b0df4a9
SHA1 dc0d51d7a50740403bd1d18a4c9aef54a8bc426e
SHA512 800cb60af61663f92558b56a8c137492cef729fe73f361828fe212c372f1b27ea2a40d0a88438a9497ea531572c8e1298025844593b8a816accaac21c041ceb9
SSDEEP 12288:NqKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwe:NqKLzqYkY5Nk1NbUQO1GONZJQWhqbJwe
TLSH
T1D3C4232B358C04DAC3CB4BB2A6F033978508AC8C9DC7E76A73B1B15B4B31B5295D58D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 349ea7da657f7d4ce383cd555f6d7d11ace3ae6e3a1c7cb575edbddcb9cce02e
MD5 1dcc3589c3f368b0872c816a0244d868
SHA1 d5ebd69a294da7cbee07fc3bb4fe1380cb57d265
SHA512 e430f7c3b0531848228247e85487829d2bfc0f05f66eed25c7f0fffb5676ddc36aab0da31301f9f964854bb65a17822d3b18e826803b2a94c58b97c4a8fc742c
SSDEEP 12288:IeKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJw/:IeKLzqYkY5Nk1NbUQO1GONZJQWhqbJw/
TLSH
T1CBC4232B358C04DAC3CB4BB2A6E0339785086C8CDDC7E76A73B1B05B4B3176299D58D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e5979ee41b10ac9433fe8c91a9c408a41dfe41d714482fccfbccb57aebfeedc6
MD5 d17488c6cca8c7ee2ff531ff2057e603
SHA1 66e3d93c9207523fd4700b3e705108dc2fc9520c
SHA512 581b4ceae454a61066e884e0179c2c24e05a66b3dab4fc4ef04c718205542cbfb9fbc279d897bfa241f5580bfa6f8215384b3f9bd8c52d6a4c2ed0cfca0ccb58
SSDEEP 24576:SZMSzFVSOWKLzqYkY5Nk1NbUQO1GONZJQWhqbJw0:SZMSzfOY5NUm511PJPqtw
TLSH
T1A3050169739408F8DDA7823EC9615A06D6B27C594BA0C61F13F4366B4F333A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 94b2a5fd65d262cd64fcd1643f435be7137af304638921a2aca907ce0e04dc2d
MD5 7fa79c264f9bed4986da25ed768a8ede
SHA1 263148b88099676c1ea8881a488e09fc40d8d0f4
SHA512 0d659817f5a9b345394b98eaea97a2a1209cd795718df92e34d666b6438a4e497478fa3597b666ec8990904a90ce5cf65252f0b660cbd7820ae206e638adbf60
SSDEEP 12288:mZKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwO:mZKLzqYkY5Nk1NbUQO1GONZJQWhqbJwO
TLSH
T1E1C4231F358C04DAC3CB0BB2A6E033978548AC8C9DC7F76A73B1B15A4B35B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 138e444a4880266d97a4802514f496616d61588bf673a48a0eeff30b9274c065
MD5 90de4b93f9458ad775f9701f616129bf
SHA1 a659015d29e4f18cd29f4a47f4604e5619937d0f
SHA512 9b8da9f362282b4141c7a311799db87a62cacfa1ccd8b564bd807db3c97077e6381b28d23c6dcf0515793b32dfdffcdcae91883eb4efd93bd99994716c021c9c
SSDEEP 12288:ylKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwg:ylKLzqYkY5Nk1NbUQO1GONZJQWhqbJwg
TLSH
T110C4232F358C04DAC3CB0BB2A6E033978508AC8C9DC7E76A73B1B15B4B3575295D68D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4b854061aef7505519e5e30ba42c47edeff8ed4c5e2049208fd8a90ec341078f
MD5 2069190e3fb6d203de4f8836cd8acd48
SHA1 7b2d123687f2d74fbb69269ecf7fd3175eff03e1
SHA512 7b895e6b75a7159aef67029e7444835ae6c6eed82c3216ffe5dbbb38613d59ea8933c91df435df13d4ae5fa6dae60864970c16858aafb49af658590e3ac768ee
SSDEEP 12288:CyPz5L8iKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJww:fzyiKLzqYkY5Nk1NbUQO1GONZJQWhqbz
TLSH
T1E9F4021B32A820F9C26B8235C9A11702F771B8754B61DBAF13B0527B1F337919D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fb78f6eeb22581295c9cebc5834aef4d77de5269b40812c386129a0a662a7f1d
MD5 600f3d21e14bcae50806c8c27beb046d
SHA1 8b80b240df99da0c8b7557e2a52135b67623608e
SHA512 becd1b26c9bb03ceb1b81214fc2cadfa6043d145045b0e2ec71c643940d0639385740d02a60a9c99de9a69c6b0e7b6f82934c2735a816f012e069a42269f34a6
SSDEEP 12288:1ZKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwe:1ZKLzqYkY5Nk1NbUQO1GONZJQWhqbJwe
TLSH
T1E0C4231F358C04DAC3CB0BB2A6E033978548AC8C9DC7F76A73B1B15A4B35B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e384a211bded6763fac95aa15c821c096b628bb39bbe9180fa8ae2d8d74dcbfc
MD5 88e29107a9755e7ed924cfd8e1793ba2
SHA1 3667fcf16ed0ed2cb334cc1fe63c2f4875df738d
SHA512 491e964a532a555e35badcf6dbd23c44a953c706b7de7476b237706c38adb36ba141a905a71eabcab622887fcb42d66dacd716dbcfeca997e60d49b1503e2212
SSDEEP 12288:WZKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwH:WZKLzqYkY5Nk1NbUQO1GONZJQWhqbJwH
TLSH
T10EC4231F358C04DAC3CB0BB2A6E033978548AC8C9DC7F76A73B1B15A4B35B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 276b1d8b1f7ddf9e930f88970cc2a32b2fad373981d64bc80d8138ed769f0854
MD5 6b758967e120f845973ec665575033a2
SHA1 725fc3d27fe0afb93fab2a00cf647d8c36d4c0aa
SHA512 96df2d401ba2995780c2968a0b348923e16a0eac8f6d62907de2bfa7fdc28fd18e085ff57c1c6214b82436165887fd611cbc3afed74e66c358b647c722d9fe37
SSDEEP 12288:byPz5L8iKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJw3:WzyiKLzqYkY5Nk1NbUQO1GONZJQWhqbs
TLSH
T18AF4021B33A820F9C26B8235C9A11702F771B8754B61DBAF13A0527B1F337919D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 18ef4066aa60a8cb1259a67936e2fe2d36814c7be22ed3861c37abc6ea2a4347
MD5 3ecf3281aadf1b2321f9343fb17d3cf9
SHA1 b641e64b73b46296492911b2675d5bb3ecd210a0
SHA512 3f766113485e317f1dfb73db97ed7dd4b20707db99a4519f60469f4c4eaa0e7c71c6cf02361fb044f07ee5864d5ca1feadb84187afbbc1734cb1f69288be9be0
SSDEEP 24576:LTHaLl3z0zD0KLzqYkY5Nk1NbUQO1GONZJQWhqbJwc:LT6LljhY5NUm511PJPqtw
TLSH
T1AB050169739408F8DDA7823EC9615A06D6B27C590BA0C71F13F4366B4F333A15C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7022a44be51225b4669eed4ecbb9fe9911ecc8a2627da2582687c80b42e40b52
MD5 22634e0648bd94ef084d0a910b7492d8
SHA1 c4c12f18b52117911b5eb8123f11cc56d7e2e5f2
SHA512 9663c675b77133c4b91be3aef5a1a304e313d1b52ab0db42ccf4e75dd08f77e8b40df36a039d793e1fa55c0c8100a10260860500c1568e8fbecc1545b1fe124c
SSDEEP 24576:e37d9CHKy7GZIKLzqYkY5Nk1NbUQO1GONZJQWhqbJwS:g7d9CHKyaOY5NUm511PJPqtw
TLSH
T18E25CF91F3E810E8F1B78A3589725612DA767C991B71DE8F03A4251A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d2e6da54c32b35d1340176a94b0e25219ed679bf89da705c7db79199348f738f
MD5 d5033f0c34c47c4b6fbcbe39a405bfdd
SHA1 b619e55d102ea6eb140f5366268c89c4ee7301c9
SHA512 1118290d1a2a921968d0c0b25a0a17625096a6e895501b49743cf901d6d89906573659cb6cfc5d477ee2af521df9083d1dbf08487163c7f924886fdf02fda72f
SSDEEP 12288:IEKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwD:IEKLzqYkY5Nk1NbUQO1GONZJQWhqbJwD
TLSH
T1F8C4232B358C04DAC3CB4BB2A6E03397D5086C8C9DC7E76A73B1B05B4B35B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7a79dca147607617ea449eba9dafd56344c813688b94e1fd5174c13b77974b53
MD5 122ab6e9ba44f310fffff15534b3196f
SHA1 f4d389cb44ae7c9952d36b5b4ee1749d6d4e16c6
SHA512 8468a9196cbda96ef2ec1e41779b2f4ca3c46cfd2654dce7c70918e941551c6964a5ea5a7298ebbfe7e6042da8c61691a40f894bece279f9d3ca68855ca1d3ef
SSDEEP 12288:mCKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwu:mCKLzqYkY5Nk1NbUQO1GONZJQWhqbJwu
TLSH
T198C4232B358C04DAC3CB4BB2B6F0239795086C8C9DD7E76A73B1B05B4B35B5285D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ce58520c34ff72a6ceec3b63cc79774939048935e0b4f994f53bab74e904c877
MD5 4913d46a6e9a90f71a02e5ec9d31ada5
SHA1 131069462608337f561f6a3902f6e76b47fccb43
SHA512 c003dbfa794fa2e67873e6659674dc08a13f07d65cce22ed88030b775bacd9b4a9923b356a2ebb58d62289fecb8779f0f55d5fe5a90483c7519d198193b449d5
SSDEEP 12288:UHKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwK:UHKLzqYkY5Nk1NbUQO1GONZJQWhqbJwK
TLSH
T12BC4231B358C04DAC3CB4BB2A6E03397C5086C8C9DC7F76A73B1B15A4B35B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 7f6751e925f97e155253fef59bab49ac72feef9cb6f6bcfea4b676335101cc23
MD5 2082d10df119e7ede0eebf76c5f2e3dc
SHA1 b68e06519ec005eaaabff73f0eb187d979c79299
SHA512 418f060fdd317421055f7fce8539cec2664c3fd002ce408c17ef732a097217bacc108fc65aa96d68d7f67321c30c128ef624ee05ed793b93a30403904a2ab8fb
SSDEEP 12288:wZKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwr:wZKLzqYkY5Nk1NbUQO1GONZJQWhqbJwr
TLSH
T1F0C4232F358C04DAC3CB0BB2A6E033978548AC8C9DC7F76A73B1B15A4B3575295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 85988a563968a3001733005360b49a59482ba5ecc8118bcdacbef0ad168f9621
MD5 f73279b3def7f8f9ad53dc9a43273163
SHA1 356d157d16ccf80596b911cc99929239006419f9
SHA512 60e3765f8a657304bd23ba656e91aad421420c8f180ae9bbdcceb294432c7ddb8a8bb1578abd963041743520743d7b7632a311cba77890c19388524cefd397a7
SSDEEP 12288:tEKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJw/:tEKLzqYkY5Nk1NbUQO1GONZJQWhqbJw/
TLSH
T1B1C4232B358C04DAC3CB4BB2A6E0339795486C8C9DC7E76A73B1B05B4B31B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 5886648318776d093a905dbb67922bf379b31fe4ea92f2dfa3641a1a0f405f05
MD5 6e3d74e9daac9a8071cbad4743a4364d
SHA1 1d09aaddaebb369854327d88ec62ab25492c3b6e
SHA512 409ad51a28919ffe3e5bcce4531834f912c47e553a51cccda2f1cc18dcaa11edaaa9059c17adbc5bf4bf03c7d087e3e118299ececdb2cc806e3e92c08c077a27
SSDEEP 12288:lhKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwa:lhKLzqYkY5Nk1NbUQO1GONZJQWhqbJwa
TLSH
T1C1C4232F358C04D9C3CB4BB2A6E023978948AC8CDDC7E76A73B1B14B4B3575295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d93a202032633c9b2df3f6911119591b452a75a8bba211250555e6f15855364e
MD5 9d37533527f85fc930851583d2246e39
SHA1 a4b874c309c7d31b55f41fb2220b88fd8a4fa76f
SHA512 d38646eec75c021b853d9da41777ff1fe2add02ecc41c6e171e677274cd58cf19541d4f1376e3f7e10d6f6761b8772b1918d04550084ef043b61e42318813435
SSDEEP 12288:kDKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwW:kDKLzqYkY5Nk1NbUQO1GONZJQWhqbJwW
TLSH
T116C4232B358C04DAC3CB4BB2A6E03397D5086C8C9DC7E76A73B1B05B4B35B5295D68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 07debdf3e9ad093571b75ce83ca59eef70a9c13fedad9eed41f8bd35ff46b8b9
MD5 95094c57d73af2945dd1cb8a0f1b71c5
SHA1 246b56bd025b04a8bf11e52c508faa1cbafa143b
SHA512 cbcbdbd8daae796c4dda90ac3817f7988bdf5919905ce1b13ca02d643d68c5c5df21d1cb271447ba75c4414c33f314c0a0c4ccf2ecf7acb6e90d42d6af504f54
SSDEEP 24576:qfwvok9RX6wkyAIVKLzqYkY5Nk1NbUQO1GONZJQWhqbJwS:2MnYIPY5NUm511PJPqtw
TLSH
T17C35D029EBDC04E5E1B7923C99B3460AF6B178581B71C6CF129A53AE0E33ED05D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 66a30c4666467b2477592e116fac8ba209aad9e39e85412652d725a83e49a365
MD5 aa27681344fc6f5a1d4253cb2c279563
SHA1 8df8333535bf910d48c0db5b5dbb23df9c112e21
SHA512 db021ad379aee2c11ef1d75815a1e415d12b6c7d1957b87834875f949bb66addab405aebe9f5b559a232396237405868b5ec93b077639d02e6b502c7e071ea74
SSDEEP 49152:uYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08Y5NUm511PJPt:gySzPp5+m511PQ
TLSH
T13F066C57A1A801D5C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 93d82151a1c0049e4c8d5675ccb254e68c76f9b101634c6329fd72a7df9f2a5f
MD5 5442220e9d05c7bf866b8f6d42c29b89
SHA1 9d8ec22cb470413555501ac90bb86da710b70081
SHA512 9ffe2457416fca58078ef2160d035d3ba744f809248bb70cc518d54821066f83bc3e11b61aca42e2cb986d7704ce829c115a10ac44b14608c428096418393d09
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGKLzqYkY5Nk1NbUQO1GONZJQWhqbJc:v47JUQj1irIhCnDHUPfF/MY5NUm511PD
TLSH
T1FF65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7cacb72e39262c2ded6ca264b3e1bb8279b1ddf912471e23b6b40ddcf3e06f4b
MD5 5d0b125fca7540180f6c60bdc3908d15
SHA1 92c5c942dfdade149c60669f1d72a480a668e368
SHA512 b38cdcdacbcf0cf80d42303624d78b748152449dac85664775ce9d65c4a783645d13d5e7c3959fd6f5b87a2359d978c651c61c7550929c7145fe08c9481acd66
SSDEEP 12288:uNsfpKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwn:XpKLzqYkY5Nk1NbUQO1GONZJQWhqbJwn
TLSH
T1CEE4F11AD29801E8C1AE5275C7915642F3237C6887E2E3CB53E0F57E0F366919DEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 71378a2d8c5012978aee9353ddefcd6a2394cd305c71ef76d98bd55e4d8665af
MD5 e3d47690542ff776ca7b3788a552ab6b
SHA1 abff4232f57e9a3139749e504c59f1a73f3bd744
SHA512 37bbc6f93084eec20d6f62e4c6182d98cb23c913921a1f7783d13d8b7fe3b107965d49210148d80bb2a9499d905ba8e30b34e660d70308a3a50fe07b2dbe7bd7
SSDEEP 24576:agAYxUPSNzyRvz+TR4EKV4b/H/LaRRjkgbb:LxUFRvz+TR4EKV4LH/LaRRjkg
TLSH
T171351841766BC75FC6A940321E33D6CCAB707D45EE056F0773C8873F8576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 36038cf742c459e6f96394a2f378bc993adbfd30586533f83d1b414b0e005039
MD5 4694e0fa8e0ccc137527fbf6eeea68d7
SHA1 faaa47c837ef2fe275758550b6bbcd35d4ffc478
SHA512 003107bb2f8620f181fd55ff9ad2fc4e32bacad26a788fa5da7f24b2994baa3db3203babbb550d2f52618f5349e66564a748bbe15c7208e5f141a20e2f3f645b
SSDEEP 24576:ZeNGBUTsz+TR4EK6z+TR4EKyNjNdNFWNJviAFg74O:NUTsz+TR4EK6z+TR4EKjNJviAFgZ
TLSH
T11965EA815137E38FD1F76032032A5F4CA7A4DC56B7096F26B388453ED86AB65A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8248135d4ae6c2148883f3c1bf76f04ba34adad00deb73838f0bb386ae5e1df7
MD5 4dc2c1cbf3d16d1ad091d361538f1799
SHA1 d500f01ff764086a81d274c81a6ffac6c8c65e13
SHA512 4f33561301153a002cfe6adbfb320d2aa31a1ad9216dd82d3f9f27292c3a20e4f08d03308c999b53915c946aa374bef827762171ec1ba515f98d8ee7598dfb7a
SSDEEP 12288:MF7xKioxzqVemPGYu5NvxOioNbos0fQv2EQvu7Ce1RLCZt/QWhqDvJwe:gxKLzqYkY5Nk1NbUQO1GONZJQWhqbJwe
TLSH
T108D4232B268C0899D2EF1B7165B063265508BC9C8FC5E7E7B360719A4B30BD2CDF5987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 89e33daa2a5fc0b394198ca7257684636f68f69aeceaa6bf3c0a70ef746a4b56
MD5 860f0ee55d439ded014e2913a47e2e3c
SHA1 d088012f9d037bb6b856fea46ac1fec18180b81b
SHA512 f49dff481f064d9c1a8f73bd5cc9b240ee3957aba68a974de7dd3ddc3cbec4312cb32faaf2bca22d898e62e08aa52c980fc19465be645ab5c2ca34d18f94bb17
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYfKLzqYkY5Nk1NbUQO1GONZJQWhqbJwk:mgb4mBIBhGFqY5NUm511PJPqtw
TLSH
T10A65AE1E22EC02F5E0FAD2B8DDA64417D6B278160732D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 cf4329aed7f3bad9f96ee23f972e4a095dcd45189e44e6bd8eab8d1334d399dc
MD5 d536f3281ef38ddc8770498846cf0211
SHA1 7f8cddc361f5336e1fa72adfa73d511e571ecc3c
SHA512 555e86fa4bb97fc61124ec794c5e184a75cb625afa1d75a9534f581e72ec135b8b88c7eaa9cc8c0f32e2d4b5735f54614859941c4774ac1ae1bce56dabd9d535
SSDEEP 24576:lG88u8FpJqH1bzria7/mWKLzqYkY5Nk1NbUQO1GONZJQWhqbJwh:I7ZFPqVea7/JY5NUm511PJPqtw
TLSH
T17135F12576E401F1D47BD1388A924663F6B1B8250364EFDF07A88A551F33BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9c2e167aed48eb2489a754bc670ff1f435fcde26514d7f52e7c8b298f1d04837
MD5 6f0715c60594f7eab56f296b618ddaf7
SHA1 46fe295b21ed010bf87e9361888b150cc365ab53
SHA512 b43833cacbf0778a13d50b5d05bd00467a25ca04b7f9bf8c015c0d9d639b714983bdd483e18ad65bcccafd1496599ea71323f75594627023999e97d54f59fff7
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+Y5NUm511PJPqtw:4G05lO43bo5+m511PQ
TLSH
T167D5CF6E62EC01F9D1BBD17CDAC6460BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b4c0486c96f907eaf115e4f6e18bb41055e5727f1c730e7dadb7f9ef8ff89a0b
MD5 f114ab3e28f5fee7e2f499e43b56686e
SHA1 c383186f747de30f4d3e32df50db0a5adc3abd1b
SHA512 622286ca02f0d8e7e818e43c98419a4b2adac59328c8c3d88d6b568180f923ea9a1171d9341206afc0386b00a48ccd34fd6a9ad6640e9d7aad8eb46a6cca51a4
SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwKLzqYkY5Nk1NbUQO1GONZJQWhq5:xa5POZ3+Jt2pasx2+mWY5NUm511PJPq+
TLSH
T17265AF5EA6FC00D5D1BAD17DC583461AE5B1342553329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 91b83ca104ef653569dd3c9d58838103e812f015529de5c55cc2629a7abc7aa7
MD5 8d6a833f28a7131c735ace84325e4e6b
SHA1 bea703ad4f910d49ccdff54e8381ad4376ad6af9
SHA512 3df842abd0244214a38da821df0407942887f0fce56249ae524df797ad5dfe6f1fd729b88eca6929a781d8cce5c7b299640ca8c747af89e6ae1b0e99d95b7ca3
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkuKLzqYkY5Nk1NbUQO1GONZJQWhqbJwo:7Nc/zEOVHFpY5NUm511PJPqtw
TLSH
T1E9857C1623E901E4E1BBE1BE89779646FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f21702cf74a865776633775da20f8cc85038dea21b1a7c1798c0e605d26dec6a
MD5 0664a101d33ee7f488ce6398087bd81b
SHA1 5ffec4c80712e815dd308c44d58ba0e0d569387b
SHA512 4e1f205e37ee2529eda5f6d8d0ab7ff6110fd1f5883b883a1157f3fafc73e8f7f843b80fc66269100e61d3f571c96301bf676dd69f3321bed6604e590c4e7322
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmoLzqYkY5Nk1NbUQO1GONZJQWhqbJwJ:H8MwBtOmXY5NUm511PJPqtw
TLSH
T12055AF2EB6B805E4D1FEC6B59D238512EA727861073293CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 95d3d37cfc62b0ab714d91501cb0a0a5cde334b0c1552a482ccc7e7cc6fbfe25
MD5 65dd2c6dda8444b045473821e2e10646
SHA1 1f62b0aff13771ce7e94c75e51e9a503e47c322d
SHA512 6374d8a5c9d0a0c81c6772121f52c83c5beab13a4fbc8e49ff2e589bd025d41c7a5cc9bec77318de6642785c4b0dc40687a64672745856a5aa7f2c9acd6ec61e
SSDEEP 24576:aPUr+NQaKLzqYkY5Nk1NbUQO1GONZJQWhqbJwp:aJQOY5NUm511PJPqtw
TLSH
T1CC05E12F22EC08E5E67AA17D85824719E771B8650752E2DF02E0917E4F33EE4BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 fcaa7090338f8be8f021a1bbfd027ad05f19408c399855296316619cfccb456a
MD5 7caba7e34280ddbd6b3909371d012b61
SHA1 da40eaf9eb715c0c433badc5b005ff4e25f3a501
SHA512 7a487a51d36cf52bacfdf8cca86283ebeeb5ab93bb4a54bf87fa068eb938bf46d69b3936648720f925e6b1b89d17c2d7fe408e9e13dd4c1e96e47f797059f571
SSDEEP 24576:sD3FHshBIYQgANKLzqYkY5Nk1NbUQO1GONZJQWhqbJw+:sDVHeBIAAHY5NUm511PJPqtw
TLSH
T17725E13EE69C04E4D57BC2BCD6634606E77138AC072266DB12D091BA5F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1420-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1420-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1420-316-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1420-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1420-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1420-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1520-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1520-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1520-118-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1520-124-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2104-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2104-87-0x00000000005D0000-0x0000000000637000-memory.dmp

Download

memory/2104-82-0x00000000005D0000-0x0000000000637000-memory.dmp

Download

memory/2104-298-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2472-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2472-281-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2472-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2472-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2828-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2828-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2828-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2828-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3368-50-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3368-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3368-46-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3368-54-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3368-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4348-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4348-26-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4348-31-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4348-0-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4348-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4800-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4800-135-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4800-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4800-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4800-129-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5076-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5076-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5356-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5356-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5356-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5356-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5356-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5444-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5444-297-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5444-77-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5444-71-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6088-330-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6088-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6088-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download