f7c2c27ebf3fc0c5e43ca98a44bbe7d1fdba1fc755e5be3edc66b8685f2794bb

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 2.0MB
Sample260814-rkca3avhpf
SHA256 f7c2c27ebf3fc0c5e43ca98a44bbe7d1fdba1fc755e5be3edc66b8685f2794bb
MD5 1956fc2bcf98ed9df81a6279ad451259
SHA1 5126a6e9d3e803d6c8b422983b4d02b18095b9d5
SHA512 e1d7e16eb253adc60d7b326335a3ddecc4f81b20cf4bd3ea2fa8bf2b696e8be6b356bc4276fe289a612d6e0b481d780a0a27b1237206558d632c0c15de9fc7f7
SSDEEP 24576:jcTyYv0FteQUd5I2kjgD6iQacAlVg9N9JMlDlfjRiVuVsWt5MJMs:juXv0FtpU5606zO/gFIDRRAubt5M
TLSH
T14AA5383672F201A9C45EA072DF46473196D27CB18FF0D3DB8152725A1FB29D07A3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2968	elevation_service.exe
916	elevation_service.exe
2684	maintenanceservice.exe
3300	OSE.EXE
5572	PerceptionSimulationService.exe
5472	perfhost.exe
3172	ReFsDedupSvc.exe
2292	SensorDataService.exe
4640	ssh-agent.exe
5092	AgentService.exe
4304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\83ef257ee05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efe3864ef72bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5c5ce8ef72bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005c2858ef72bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da40ac8ef72bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004714988ef72bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b62294ff72bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8ca814ff72bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038dadf4cf72bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2968	elevation_service.exe
2968	elevation_service.exe
2968	elevation_service.exe
2968	elevation_service.exe
2968	elevation_service.exe
2968	elevation_service.exe
2968	elevation_service.exe
916	elevation_service.exe
916	elevation_service.exe
916	elevation_service.exe
916	elevation_service.exe
916	elevation_service.exe
916	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1160	2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2968	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5092	AgentService.exe
Token: 33	4304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4304	SearchIndexer.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2968	elevation_service.exe
Token: SeDebugPrivilege	916	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2200	4304	SearchIndexer.exe	103
PID 4304 wrote to memory of 5468	4304	SearchIndexer.exe	104
PID 4304 wrote to memory of 3904	4304	SearchIndexer.exe	105
PID 4304 wrote to memory of 3712	4304	SearchIndexer.exe	106
PID 4304 wrote to memory of 4728	4304	SearchIndexer.exe	108
PID 4304 wrote to memory of 2356	4304	SearchIndexer.exe	109
PID 4304 wrote to memory of 1332	4304	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_1956fc2bcf98ed9df81a6279ad451259_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5472

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 712a96e3ea2b6c9b62e683f2fc6e2d674f1ff254928faccebc3fc03c8c289146
MD5 67855714c4341f64b9b18bddaeeb2871
SHA1 09e13fef39dd1658b280f7f77202dd940569fab1
SHA512 8b4603d98d413748ce42727ea5eb8e6c1664aa98a92905efda2496ced34ed8c98725a2efab0c6fcbc6d017497eec17d0291d1e6c65a036c7c6f8bbaad6b30008
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnzgFIDRRAubt5M:h3q6sjB/Uf
TLSH
T13BD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b041006112df315f36284a34abe20642198f41288d674740e74c9cf20fb5797c
MD5 0a1ca7cfb001358a9e004f4f4c65d60c
SHA1 d6b8c535b0bbad1e8a4f8e78a1ab313d2b855e2b
SHA512 4f2d985adafaab8202cc982bf97587d4acc5767b6f9bb3045e6790e5824ac4e3bea02476409a0229f3e5ceda21a0e0f73a547de0d322ddc58ad9d21769aa9459
SSDEEP 24576:4XYfDtczA+Vg9N9JMlDlfjRiVuVsWt5MJMs:vtc5gFIDRRAubt5M
TLSH
T1A585F12873D409F9EC678279C9B28502DB33785547A0E78B03F489665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 17e42230d8ebf4b6b9fe5e4d8339a1bb1df1ac097b78b9ddb03441a27f8730c9
MD5 aa0c5fa61aff081c8780f3b52af297be
SHA1 1d112b965c25dffcf5258ec46c78e28eeff3d393
SHA512 066040a75531a6ff5e91c47653fbce51ec8ab9c84f393edf08d45bcbc102b50675c76762183ba66b9227b78223abaf45c942c42ed5147153dd71f81794eaafda
SSDEEP 24576:70Le5ji0hmx7rMgVg9N9JMlDlfjRiVuVsWt5MJMs:7Pji0A5bgFIDRRAubt5M
TLSH
T1E9959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f38ba1d0a7c23699e825582bf357e6d2eed490cc5f9b0bf6d442eb4e6b7b4b5
MD5 287162821ae9e0ea2008ac3b6361a67b
SHA1 516199f012a43cea56b4a23015f8f6162f029fc2
SHA512 15683de35399675746ab3cca443885e14c0182462c2d5f7d680d8ab738d52ea91abd4272b9f6d6f1a05face06137827136de8bbeac413b5401e25f404788742d
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyuiVg9N9JMlDlfjRiVuVsWt5MJMs:a/ezSC6vUzPveHjy/gFIDRRAubt5M
TLSH
T198755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 07725564a60c42bd4572f41c29fbaebb31a1ba9ba61ed889d849963c5054a9ea
MD5 82e6870348fce489364f5ccfeae7b2c1
SHA1 4410446b9d32433aea32ef70180cfd3d6e187ea6
SHA512 e8f4febf6d6eeaffe3881e1eca3029c1e46f97099fde0272859b9e08b53a186b7d3d92a7e928591363253d792fb25773b43ff4a0d8a87f72c1e93b65f912da9e
SSDEEP 24576:dVbqPb88hv/l+YXVg9N9JMlDlfjRiVuVsWt5MJMs:dVO88hXl+WgFIDRRAubt5M
TLSH
T1D2559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 db239362c87ef197837d9b5536d9f10a49b88c8f048772ce6e50433c65e1cf6c
MD5 9b5b75caaaeff957613323303c66e9fc
SHA1 e89c88c34c0230a0a1dfc3372910d09afb308836
SHA512 26c8937e39d3544b19bb79e708922bd372b66b5fa4d63b506ff2eb54ff7f5a9539047e14c7b487f31edb7cb24bd95755c267a475b3500e757c9eee9d77aac978
SSDEEP 12288:19AV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:19sVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11D6523AA7645A5F6C65B82B1CA73538ACF225E5835C58547C2B01AD1CDFC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a68f5556f8ee590ea840bf7d0c1eda7fa2677cebc256cef16333680ccb78f9ba
MD5 14aa91f5d4521e4d36b31f6f86b60fea
SHA1 bf9ec0b16ea40f75711ee6063ee1183a55dae296
SHA512 bd9e5d4f8eb523876f9e8d40af76394acad679b75b4cc1437374f1a2dba653c3f63d4d33d46b678837ec2a9af3b468bff03fa4622c40b4d9278c9276c493ff21
SSDEEP 12288:ieBNUbTVO86U9V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:iJIUPVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B685CF7BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5638c104f623e6ce99042e0294c862af2584a89e6768e30b8b0de6dfcee0dfac
MD5 972457b1658d9b4a0f98090f5961093e
SHA1 2e45213e08a68801a06dc4914340e79f47940557
SHA512 8b5a86d267868d9b7e2d53be6e032fc930e72bed84de889bf4d15096a00126af6808e1c03f5e734528abd5536d534ab60edc4541a9ee08023e5401ebc872fd80
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:CQvGAdlCEL8c/DRNw5C/Uf
TLSH
T13C267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 17b30c0990086d9e04a60ccb2891658ad22c4176443b132be8065e4458ee8b0a
MD5 8faafa7dcb98da5f22b0cb755891e230
SHA1 fadcf9558b79f504c08fb989a722a417ab3a4531
SHA512 72fc51d0d9753c46340f72abf557c257b72c6307825f3369a812aa76f79f08e3de30a1a7a11c7caa3057c31c8f060dcca2ec19d49f2a146ed12dff63e5623dbb
SSDEEP 24576:SSewsAjBVg9N9JMlDlfjRiVuVsWt5MJMs:ZljLgFIDRRAubt5M
TLSH
T15485E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 91d583f41870ad671daf5ef1156e33282f09851927ab2da8c9d689ab3ebcf7aa
MD5 cf9894b37026228190957c6b9fd9927a
SHA1 5829188aaf929d1576b21d1b7d271d85c9478480
SHA512 83670d944395a3a029c3535c685f255095c1c1b2fa7de9c713f3ff25ed9684cdda95c2b454d4e2eae64e1379acfc59851842cf1ee2c4a3eec84e9711e734b638
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkUf:gUEtQevvqc2W1cpV2tI32kUf
TLSH
T136474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 79ccf11c07414b973c9f58615fab4e875067c162c484d16a17c4261922b4b067
MD5 f8895c46305551d7b9cdc68096adcf82
SHA1 5ce829f07afba359e13cda3eb27ef52b7f8d75e3
SHA512 c04ecca992808079339f01fe0f20a661725eea6f24874e8a5b9410044d098d981fe4ae1ae8b30a71d5440870f8f1bdfb4c6ac5d7631338c9f1e667b21481d34f
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zrgFIDRRAubt5M:FoqtVjnm7Uf
TLSH
T18DD58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d3a34bd99091857d1ac2626da7640cb6eb7683128f13c7ccb5edf792fadbae8a
MD5 0b81c6ad854e25dedc405ced9e95e869
SHA1 cdaf8318fb516593bd3c1036823dd21d616cfc8a
SHA512 e5d79d36ffeafcda688c43ff90bef214bc11fdaef990b6562d550b29586d734b5e35d100390ad6a4503df92efa44c8314bcbfab40fc268be2dbaba94cb3a86fe
SSDEEP 24576:JAhGL3IFoiwtA5l7S532Vg9N9JMlDlfjRiVuVsWt5MJMs:JAMUFoiq5CgFIDRRAubt5M
TLSH
T16F35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f908810df18e26de4684c76bd1f7dbe5047b1776c00d8dadc10938fbb3beb70d
MD5 54ea20c2007246cd480d1fec2a4a9964
SHA1 64a221229b9b6e1439947cf621e26a7a1c3e9903
SHA512 b4c635c4624475f3b7dbc3dafc7301a363385e8dc18e5645ed608a1fa32d08863f667cc84ef65b992608eaea146ff47da113035a68e3a2399dea51feb685ab95
SSDEEP 24576:1wuWOWFVg9N9JMlDlfjRiVuVsWt5MJMs:1wZOmgFIDRRAubt5M
TLSH
T13E85F14A32A40CF9E9678239C553C236EBB2BC053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 240f991ff25b2d69b7a212ad198b72859453b9b97ad35de8c1f5b6252fc9892b
MD5 4a4b7db71668a1911d87f552bb160ee3
SHA1 829c8dcc846c8f35523e06009cb6629f59ad3952
SHA512 477c959eb841729934db35ca5d23a4882de73bdc3d296d151d3c29ed64fe363d63b53db4258743ebc38f3cc921f046d61e41adb0ab1e7c84572f26b5db562f64
SSDEEP 12288:+0Z1IybV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:JZu4Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15775129A32D460FAD1A78278C9F24345CB72785633B283CF427006A65FB66D25D3E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3f0c96ad999a2ff4da92ee2792eab619c4d957e8f85c178c2482447e9b0419ba
MD5 640f81bfec1c028085e68ebf56452cb0
SHA1 02e1475535ed6b94d99d56b73fbebdb43c197087
SHA512 8d3166205d5c31444cd3464cb0b116fcd2654920ea89aaa4bff270cc37e583b28860771f37c7f3c59e23667d63b6fba612c111bcbd4d2826f843232c4816fcc8
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:2QRQyi36YOcPbLvw2gAf+PN3mUf
TLSH
T10A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5fad9e26c90e2c06250ed4d619ccf90dd12e69dea63fd4e2138a4181d9aeddce
MD5 7b554ac9a69a8cbb013f74d05308ce7e
SHA1 21d9adcb74ddd137bf30b9cfbef79244eec01485
SHA512 68c5baaf2274180719b185f1f6d2f30ac019524a6a8600d9342ed244172a4132cd7abcc4444ccfc041d8cf534a945840ee09d04b68e39c7112e35efd732f7ed0
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:WQRQyi36YOcPbLvw2gAf+PN3mUf
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 37983926227283690cd0f1aa275826e8eb74ed33c0f71bbaabecde618b3bd390
MD5 25ce4521520393c485665b054df626a5
SHA1 3cc9717bf8902d05cdb99854d41ce61f819d0c50
SHA512 95da3b3e297c1f4e8b86fdad03c60dabecf38c1d697a1f768024542587042c33b8033f8f9fa9d56f73dac11296de3d8534734534bbe736c696e36455880df51c
SSDEEP 49152:A68Qg55nhceWu7PNU3/bgFIDRRAubt5M:6thLRc/sUf
TLSH
T1BDB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4c66849d4ceec465c4fcffdb27a89f0cdddd5028378829d6067e440b7a625f7e
MD5 f416a81b21c11adc4218b3dd36d8a220
SHA1 ebdba66852c116f808dfb2f2f7f3fc7f64b17aed
SHA512 563d5d6098fe6792faf0ba60be2fe146b405fa4d914dd851fea8254f1b9122136b6534bf44ea4c59eca5a5d49d7063b7685fb9cff8656f4e74cf6b4208ec252a
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Y:ry5112gYy5azzVvt69nLKnhZBUf
TLSH
T1DD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 09cdcb7acee04289707521d430968fc99fb3e548890191b0154a5bfceb22c9bd
MD5 58737dd1eb9ac7323db0beb21eddee3a
SHA1 40f5673e4d71ef87b0d5e126af56dcf29b10688c
SHA512 8ae78e53283a407a2c3ca7c9f5f94ed426696a7186be2ee36b704571aa31ba9f9b34dd56a4ebe5b901cea516ab2dde155c31215e18a67a023ab85b97dcf75de3
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glKgFIDRRAubt5M:/u6Jmdxd2dzUf
TLSH
T169D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a6d20a99f5ddc85745227e875d277d15f3513a56253c65b55fe0b0cd325a943d
MD5 2f8eca6cdbc02d9a6e5892cd2d9ac19f
SHA1 d68cd66fc7160d5e3fb9706a632721479e84df58
SHA512 710949d6cf2c003e4cf42bce3c91e347bffd827398ebf3be707b97f5ec1587bd9409b6afec4c47b9bfcecd929ff814d8e52bd0d3655ebbe57cfa31a7c2562c3c
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4xdgFIDRRAubt5M:EmifPWR7Uf
TLSH
T1DAB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5a05a66912328fa4357c113678216f4d63037d5778a3e59247b7815ceee2d3f
MD5 30f292b2030cf0ed3e670e189f6231bf
SHA1 e8a880b97af9d4ef2768c5f95dd282d3d9be9c05
SHA512 56ecdea638ad45adf220e28aa13e39ab73934b81899379181c9045ace0f567d21f9d1ed96aff8b7407b5d5882068430b5658718bf446846224dcd1f6ffce0664
SSDEEP 49152:ESuZQIY0Be2KcRVtOnks6NMHqIgFIDRRAubt5M:W5dKii61VUf
TLSH
T1FBC5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3a7fca4408e0565cb4b78b56bf661d5c401d12426db512b309078ca1bc1bf7cb
MD5 a905b19ffb66abf73aec9438cfe0d408
SHA1 4685d0c8fce39b89ee0e70557a9d13f91a1b75e7
SHA512 5ec7802c39efabf7059ba3596a9ed10cb3067884734d7ab6409d587151613a5e6777d7da1e38ef1d55a4450205e3bb9242c9dc27df1e63524f90bafdd0685130
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wJgFIDRRAubt5M:BX2imphnUf
TLSH
T19C95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 8714085eee4a1f1b12f4adbbcf405ee039b401d29dd4b9a1c031d8767b1e643a
MD5 36035e25aca9fccf666ef18e2e6c45a8
SHA1 2eeead6c9000c18191ca4618d5ba8fdd19300257
SHA512 0e97e835fd084d1159779f4fd38a5749162768dbc8c5f30ba032edd8990d6c2976ddb17054e0c87968cb4c8037ffe35508d4917fa81538adfbd394b0cf195dcb
SSDEEP 12288:fIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:fkVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C46523AE758695F7C50BC2B1C9735389CF262B5E72D68147D2B005919EF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ccf3e5f644a1ab90f266a8d258ee6a17df1b55ee93717eb79af079830f695fb6
MD5 d274f737fb3ffaf0f3eded5567aa0c55
SHA1 4a6d8b65fdbf4cc626c097d517e26d12cf1d6cca
SHA512 d16b60fb21dd518d8b4dd5f74382c1a209de80cbd588a56122cbff2b3cc5b3185e38655e777d19613c9f5524a99f4311a0d38a7641f55b856ec02ce381153c73
SSDEEP 12288:6fV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:6tVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1656523AA758655F7C50BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9032f11e56ca5b479fd991cc9fece6bd5c65a58a3727223c0db47433197fc734
MD5 649b98e5bd6fb19b346018c40bb86df9
SHA1 f2a772aaaf9ad311642d369e47d636a22a188b5d
SHA512 e0673f8f251e36eaa3422df4ff1a90f2e0301d44e2c70bb16bc96c4751e9fe6605f8d2e7da7859e8fd137155154e89ea99c424ff0bd03c4728f0f1537747ab90
SSDEEP 12288:/FV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:/nVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19F6523AE758695F7C50BC2B1CA735389CF221B5E76D68147D2B00491DEF81A2A81FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 69f7b1418d74121ef4d4b10927cb12444fd54a7b6462f050387af3409ddeb7e3
MD5 d849b22bef5f88f7847769c5bcd53d94
SHA1 44c12d9016c1479d21797117df50ca120320c892
SHA512 8ac98a1272a454815ac021f629a2e101da9e9328991f087737f616561788ec1b482ed95a3f666f2d9a87587196a2269d2710b74e6400adb4b6e9061dec67cf93
SSDEEP 12288:+VGV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:xVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19665236A369651F6C457C2B1C9734345CB727E5973A2828FD27009964EF43A1AC2AFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 6c092ae73161a933271e94f6b7a794a98baf13a14d57fd8809a533c33acf5b9b
MD5 8d490db83defa2051cd667824288e1fb
SHA1 433973a5c3cee5598aacd8c9e8e7d3f9264a636f
SHA512 889e4008698bc58ab696aae97399b493508d91e6ccf580799147be8aca3904d59449d4a84a248b8577c811f6e576969d73b507f2b2d3ac94b90447529580d5b8
SSDEEP 12288:deV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:deVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1326523AE758695F7C50BC2B1CA735389CF221B5E76D68147D2B004919EF81A2AC1FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e4409652f5768287166d49effbefc7df8ddfe9e3f0de729bb3ca4e8078986e6e
MD5 e705392dd22b367c012b213f0c098df4
SHA1 568a888b1b6cbac8f6016bdd841da9c537ba932a
SHA512 97549754dcf1662ac7e4ccfdf30feff6faf4e79a82a234ef837d124923d543512f984974aef86ac0937f23443b914e736e8ce627eefa0164458107a67e614194
SSDEEP 12288:xzV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:x5Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CC6523AE758655F7C50BC2B1CA735389CF222B5E76D68147D2B005919AF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d95d34ea774d3a995847b8e4c7ca9e3ae8075c51975c4c65687dd1ff800ae99b
MD5 ef69edc44866cd18e7032115f6b81bf7
SHA1 103f3eb6b177ff64db65dc6bd009e51981824599
SHA512 abe931f9193fa713af6e50c7f65158be92ce70d7902f27247e904cb7cfa9beb7dd76282179cb443e5efabcbd360bd60f189fc9af17aec13b450729bcdb289c41
SSDEEP 12288:2XV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2VVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19A6523AE758655F7C50BC2B1CA725389CF222B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b161e845ff1c82c4999507cce8d29d07844b2c990ed2456d4f9e80abf42b1019
MD5 08ed5af56599b121f44ccf5cc90c8b92
SHA1 0b50b8f99b0bbc9da2c8b0201b083aae539b51b0
SHA512 49b678c596481ea78c025ec2ccdb066d906587b691d7a2489ce5fd15a3faf628d5af4d795b1fd6b2d1e01a4b581ada2290de88cb24f82b55ff7fe4099fd534d2
SSDEEP 24576:3ZMrzFVSONVg9N9JMlDlfjRiVuVsWt5MJMs:3ZMrzfzgFIDRRAubt5M
TLSH
T1A68501A9739018F9DC67823EC9228906C7B27C5A17A0C61F03F436665F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 199103af0cfd534126d36bb6274bcf9792ac23057f5f1f57fb7687a5b3c75d62
MD5 e35a08f5470532ee3ebb8e508ed5caea
SHA1 e740178f532e5427738d4d6a28b40220e4a2cbed
SHA512 039476fb2fccfc65f52e8b930330e4bbe9aaa1b303109119c8f5d4b0250ffc386368490e823bb242de3669a7349bd5c6890f1d59eb5ba96f117dd790a9b3c3f3
SSDEEP 12288:xUV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:xoVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1BE6523AE754655F7C50B82B1CA735389CF266B5E76C68147D2B00891DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 eef4a14f3045ea1650a36aedd2b829efbc49af974898d5ba62048d9801039fcb
MD5 b64198107cb645e893b1c3366929e4d2
SHA1 1240fa28da277662c48ecee66445cbca203903d7
SHA512 d717b413b116b53d21e4de40cca195592fa58387e9a6c110fbb7286860e1342e4dd5616364a7979203f6e5170d96096cd13e47842067edd983efd1ce6aacb2e0
SSDEEP 12288:bQV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:bcVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DC6523AE754655F7C50BC2B1CA735389CF266B5E72C68147D2B009919AF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 38c158dac6ed12d3731822868ccc227c303f2c366405823b9a0311750f12a80a
MD5 1ea2514f8c4cdb988989d1f18a74c675
SHA1 7e97a3059028ba48778b77096e0263195e8aee0a
SHA512 16eec0fe59a2144816a7ca055cf401cd4a5845d97adf9cd997baf39d381d5540dd994a5cb2afa3ec732839fbee932c3eb4a1423ccc12e204f59ca2e468012ba0
SSDEEP 12288:1yPz5L8bV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:czyxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15F75125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 fdbea2446fd2149bce0ac681e80188c896276776c90e6be01326e3ed8f38e446
MD5 c8427846be8009db131ddef6b6ef604d
SHA1 590a6db26e2713a701f4f858cded7ceb75e1917d
SHA512 d088a47f091077ea257eb7aca778fc6f4cfd9212d47d5d067f4fb49949db10ac2bbdb76299020f3b77e5e4b0003189ee6d5296425c613480b41d36a709e545aa
SSDEEP 12288:bUV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:boVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1956523AE754655F7C50B82B1CA735389CF262B5E72C68147D2B00991DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4f96850a30a4013709c8fe21fd5bc0090fb8d09806787ddfdf1e694decec5f26
MD5 54ec0a8cbd73f0428f22d9230dc33972
SHA1 ff6615e67148254c9dc448c3d066b9499ebb286f
SHA512 3d069ecb0756a17469a47bb5b4f6b6c0736eb69baadb572201e6a82dbe42d501a72c3dc2500b0b0ab66628b9b9ffc50f87c3afb53685f0c8dd4e09ce241d83ca
SSDEEP 12288:UUV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UoVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1326523AE754655F7C50B82B1CA735389CF262B5E76D68147D2B00891DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 98db4358dee746048faa633789f1a7e659eb69df12ce10a453a483cce174de4f
MD5 55687e5946aae18d1ed943ad5b62b301
SHA1 474a2ab3c31061cd7084a18427d4c296b1d257ff
SHA512 fb9625487ff466b73bb7eee5c06a0e37be1283a3223ca4f3e6c714becb993aadca04215968e46e9f10f8ba474e2cbdbc9a5ea3779f7a87b40ae8e6bc00233103
SSDEEP 12288:pyPz5L8bV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:IzyxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A275125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 bc5658fb552da31e4d1e129c875557ec3f681fc016389efaf5d50505b4b24541
MD5 ec980db98071f7eb503baaa2fd3ca33e
SHA1 1b11abf3f4bb3791df8ba190544d26f29c09bac9
SHA512 2dea81f8aba1ae88afdc87c675d4adc43f410579e231588ad8137df28e9f2d723119689cb7be55c16149b2a9c21c7c8f1406829eb76fa79c5d64698d3a2242e5
SSDEEP 24576:/TxaLl3z0zD3Vg9N9JMlDlfjRiVuVsWt5MJMs:/TsLljOgFIDRRAubt5M
TLSH
T17B8501A9B39018F9DC67823ACD624906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 0f977e9a157671dafc9ebd4cb696a1d2d882ab2b0f1db250e7b0c2aa0280848a
MD5 95aadc1102b0810a78f253e7dd165116
SHA1 6c25a91e93342f8c6264af42cbae6634d885f47c
SHA512 bc32f5e689af182d23a6cd9cf0c3f9327b3837121e7fd2135516af6d565b0279d08a1f5f3979592a26ee9032828b92e2a8d122c455f258593dcdd498e3548b04
SSDEEP 24576:h3Zd9CHKy7GZTVg9N9JMlDlfjRiVuVsWt5MJMs:RZd9CHKyazgFIDRRAubt5M
TLSH
T13C95CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 966043248487537e1080a7cef4f4109f390063a5c07d497827f60934559200e2
MD5 a649d1784ad694f91f336c7a2cb34e2d
SHA1 41c5ece960b91ab6b09f595bf050aeb900f66aa8
SHA512 60027d4a85e7a5c18bd43745314927a2d32050adb74152e4f08ed373e7fa091589eb0275e6641abf4120fb9e7e01100a534bc2a59de5b8dd78569c6cbef4a33e
SSDEEP 12288:hlV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1ED6523AE758695F7C50BC2B1CA735389CF221B5E76D68147D2B004919EF81A2AC1FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 1422afc49bc60d8adc9310a1e80f3030370dd0b190cfc8442623ac72f10c9e50
MD5 e94aaf89e91fca9f8f9c9c417cb11174
SHA1 0b5fd09a6fe2225159d97758e6c77b9e96ceb0ad
SHA512 144b94553d32cc595ed0ea210f04e0ad4eb898b7665945371973c31589540f779da92425c54d73690f70787284056818b2fef18538fc2783e9adcfd06044d8a2
SSDEEP 12288:W7V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WRVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EA6523AE759695F7C51BC2B1CA735385CF222B5D72D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 1ed09c2e450772a8e8c6128133b1ca00ca4bc6ecebbb608d911e9ebdc8a95885
MD5 c8711deceed3897ccadd20c83e3ae3dd
SHA1 ac76a9dd8a79b483bced6c2168e9f0eba796c797
SHA512 3dcc72230f1ef99a3191515652163526006179fbb19ebca6e982c1de915a7c141a6dab42403c4eb883a9dd868f472b386a09e3aecbef6e506522901103cc7212
SSDEEP 12288:nyV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:nqVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E26523AE758655F7C50BC2B1CA735389CF262B5E72C68147D2B005919EF81A2A81FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0c035f19a3922e3db532a0801b51545ce534ad1f15ef5d7125494f32c4b386ff
MD5 a47a02fe344068d968e5a50fdd3e5b57
SHA1 7f7a8110f69dfb0b89107d7c68a8e416cb206a8c
SHA512 4b6d44eedf154879de67600f5a8ff32880bc6d1302e5453ca4d659d98a2e196429da213a880305e59427f515c201e447123cd6b0ab7f3bcdfb812aec9f7d8959
SSDEEP 12288:yUV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:yoVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D46523AE754655F7C50BC2B1CA735389CF262B5E72D68147D2B00891DEF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 40d8c1fed20de6fd0989769913cbb90d05d8b1408f13bff8adbeac293c579c14
MD5 67f9bb307874d30f7938170306c97910
SHA1 17ba22a4103e402a02f266753448f10d906f8bf0
SHA512 cc590edcaeabf5f434b98970bc1cae846ed5d65989b60512b50dbf32823f31078d8a8d8ce61c1e7e3f8b82b94a8314b1b5c3e437ef2ac2910398db026bd03293
SSDEEP 12288:glV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:gHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1366523AE754695F7C50BC2B1CA735389CF222B5E76D68147D2B004919EF81A2A81FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 f4278dd8607244e1ff0835cc06c5b887c017e5c1d680f04d2deb9c65d0caf735
MD5 242fb746b083e727b57b2ad05376d856
SHA1 8cad1984044febfda9ba5df62174ef91ea411236
SHA512 72aa5e356b26ad38ca5b64a0d540de33d3d136405411d68a64f6fc5af698fc3e3c973880ab6ea27d2b8eb1953d7152c7f0e6649f7af8c261e904517e0a103a9f
SSDEEP 12288:WMV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WwVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1256523AE758655F7C50BC2B1CA735385CF262B5E72D68147D2B009919EF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 de7e1a9749d5aa81c582e9ebaeef0d56156d7aa1b17e25ab08004745159ae3fd
MD5 2a40777c65081d641f7081cba9cb1b58
SHA1 edbf469f0cd557b77d8bac97607cebc3e1148373
SHA512 1235fad44a5ad1b7b61b7c98551a4d134d1c578c10738cc29a74f57c152f3ed8c3fba24ad91e0efa8a69d3fc81c7db92a66a0e00582c5ad7f966dc37605db9e5
SSDEEP 12288:ZeV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ZeVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1946523AE754695F7C50BC2B1CA735389CF222B5E76D68147D2B004919EF81A2AC1FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 dee78574ec1ef310d04c0df4d87f42ec234a6869616a947e34887697bcf9c367
MD5 dca0fc3451679a989adc216110c70d46
SHA1 bf31ca701a5c6fa73555f9fa1994dd225d294dc7
SHA512 58255fdb5b9d9afa953a62c277ffb0557f5367175c0962b592c1142b2ffe4b7469a32f71a356b3cf5de5a713727d1d5e725a619adaf0a9b3d1a7dfbea29be59e
SSDEEP 24576:+fwv2k9RX6wkyAIMVg9N9JMlDlfjRiVuVsWt5MJMs:kMnYIsgFIDRRAubt5M
TLSH
T19295DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 44c9c475b6a9c601a2fe760fb8e6e1e3b064635c4ca5f585c9466461ea93cd89
MD5 f7f80c87e0f233a7792c309393b36900
SHA1 a193ea7fb0c86cfb4e03b32cd6f0eb8d8f77b2e0
SHA512 c50ef4c3caa9dbf5f1f5dc6928a4d09160473082b934baefd76d8c6650f57a2749aef089a8c6f3095122e68822f6fed1f51258cf1f8cd64bf2b271e285b7dda1
SSDEEP 49152:wYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pgFIDRRAubt5M:XySzPGUf
TLSH
T15C066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f253058c1faf0870ec03c0b059c7c5379c276a5e06929759614134a7a5c48fe7
MD5 1d77d5974bfe42675a5efb4d1efe8fb4
SHA1 01797d78b7d6911a4d4de107b8a90b5b81dfa150
SHA512 13f9922bda2a613fe5db30317693fa809eeb0ba39cfa112ef01ab9c0cf380dcb922e4b01291a5cdaf42b4eb9cc0f372a330d8b65f8540e4d574bdb065878920f
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY9Vg9N9JMlDlfjRiVuVsWt5MJMs:D47JUQjTirIhCnDHUPfF/ZgFIDRRAubE
TLSH
T16E65AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 023c4e3c07221c6185a722f8a22c59ac85279f2fc98e0ea5616a741a9802eae5
MD5 abc264d77dde66feb93f48f1150b6e59
SHA1 b191a7194da4cb66012641808ca7b7858290d03e
SHA512 1e34fc31d0a94f5c9cbccc0516110bdc72e5c64332d3e9ea3acfccdc1b346e5647d49b1271f369f341ffe6603afeca555f7f676641cd4f0dad8e45d2d9c3efde
SSDEEP 12288:PVsfEV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:E4Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12775F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8e4b28f262522c52894a6f8488acdf09088dcfb046c75831901e164fe7b55348
MD5 0e6cb138a69f81aa8f6c171f3c26311b
SHA1 d32cc7ed9ed3b73c0a9ff63d522691aa669c650e
SHA512 fca2fd228f0eefee4d3700227d514b2e65dfc7fcc9c2668b138973a8da24ed57f8f5743b6482bee9b8523a073d0c1f1fac296918dedb22f15426919e89951991
SSDEEP 12288:D4Hm+PU3fbY1V1sZo/Tz5HEH5dWfZB2D7qcR+vvTUf2ShTZS:D4GMUPYXsZ+z5HG5Ufn47nmTMD4
TLSH
T1BC351850766BD75FC6AD40321E32C2CCA7707D41EE05AB0372C8873FD576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5ebbb0ed70713427bb9dc05408bf0023bf51884b566180fa511dcca99c436fe2
MD5 215a32c18de1fdfb537f357d9f5707fc
SHA1 97490591562ab25cc5dc0cce0a1ed87a215b7176
SHA512 50ce3e03013b58d582106a03cca9e65326d35fe0ff8e093cffa60b5b4d40edd84de27de8a7483b4f2a0386d9f14f843136f22830e9c51b57451833102d01955d
SSDEEP 6144:r6F9DJPx24uO1+VPsVvz2P7fdG/THWlpVMHKUzTPzOHG+4BYrv9AflQuoMBwnYBj:S2AYP20fOqVE+Y08cuLdwd4p
TLSH
T1DE65E8815437E3DFD1F62032076A6B4CAB64DC4677096F26B388453AD82AB25B0F83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f671bd158c1f607ff886dd4c2faa2c817386c989d7f32ac2e3a71cc0db6d304f
MD5 745a9d5f559a29857d30f9ee8a92584e
SHA1 7e82bdf7341d72d8d0c15723718d90d1cf482bdb
SHA512 39ea20f7a7200a8915f940f34abe8ab8be607007d01435f13d72726a1f06ce807507a7b52deca2418203f5b8976f197e174c96afbac0feed5a89362ccca01dfa
SSDEEP 12288:++78V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:dAVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14065237A768999E6D46B92B0C97383058B2B7B693BC181C7E17005D199F81D1AC3BFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 679e6cde37ef4dee3a8eb086fccd36906b1a1f114d2d95ea843c43c487ce7837
MD5 cc73efc116ce81c93711eb604193ab7b
SHA1 1fe189efaf77a532447365de2094c3224a2265b5
SHA512 e88a391053dd47b0dfe8d8906f5a49d86e2098bfc1b180c5468ff701a5f72b86934f7f25cc7c517971390b50f792c4ed01d8d8e914a7ea59422c4d3a1542e2f2
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYiVg9N9JMlDlfjRiVuVsWt5MJMs:Bgb4mBIBhGFXgFIDRRAubt5M
TLSH
T1D6659E1E22EC02F5E0FAD2B8CDA64417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 02fe26d082c577c2fa2d169cfb79517deb09a3b5dd9a0fd1276889677d8f976d
MD5 bc69a7f1585864739de1ff0af9fe5332
SHA1 8d21712aa6b52efa1eb82861b90931ae6b4ea1d9
SHA512 e0ebd58452f210c3394624c151beb05dd2c1d6e9b3eb54a862e045ac3845a5421146c52e84ce40a9baded07116944b34776818a850f6ebd827aeb8e56dadb494
SSDEEP 24576:mG88u8FpJqH19zria7/mNVg9N9JMlDlfjRiVuVsWt5MJMs:t7ZFPqVka7/WgFIDRRAubt5M
TLSH
T1ED95F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 bb626b682f6bb90718b6803dc50a5bf56c9429974934a55fc8bb93d952a4f94e
MD5 fabf0a532a2ed88449bd293f14c2be78
SHA1 1af3ad19cf56806288acffd21a9a1419a9cb5b4d
SHA512 88e17a9be4abc7973d22c058abe17db090135522ab802d2a977f7032c27cf715bea06b63b413ef4a419876b2ca0e012b34b7eb7f4c291ae8f29ade416200e6fc
SSDEEP 24576:2PUr+NQpVg9N9JMlDlfjRiVuVsWt5MJMs:2JQzgFIDRRAubt5M
TLSH
T17385F12F32A918E5E67AE17DC9824709E77274621352D2CF02E0417E4F67AE4BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cbaba9f834d3864e360dc7c0ccbfe787beb3a1258687005002c2a584bc71ad6d
MD5 eb984c12a5cd9dabb3c901a2e665c71c
SHA1 08d3c050a1def45973d2a58ed75e9bdd68151eb1
SHA512 f12cbf2aef00ef4542b10cc3ae266ef3525b9f870f033bcda67ed6f3ca051aee1c5dea9ad2a991b7ea74ba82d62563bd3ded8c5c1c48852bd6a562e7d7736aa0
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDgFIDRRAubt5M:wG05lO43bpUf
TLSH
T1E5D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e50dd8ba452c1e4c8f40ae12a1abb16393b4ace795ea63807ec0dbe1e31bb6ea
MD5 d3f4fe7f6238d6a3d50489cc80b4b3f2
SHA1 f9657ea695042eff026e051230dae1743f6ccf02
SHA512 66cceba71023009eb08b1dd5bb5a9367ccdc43441c47d007f1648aa487f29b4e6b81cb46abab3b92df0804a154a49562a6a2177cc3a679ce6237250019d87e34
SSDEEP 24576:Zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7Vg9N9JMlDlfjRiVuVsWt5MJMs:Ja5POZ3BJt2pasx2+mbgFIDRRAubt5M
TLSH
T14665BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dfcfd7883148d0818558d271be584a1cd274a5a036d7935d8e51c3374f2edf8d
MD5 f9e681b0e7db649704bb6cbea30c98fb
SHA1 c82a625d4f2d8fb7ba7ef969a0d25f5b27a9d12c
SHA512 6a0996ad017a63b3f737121a17736f307b1b31a8ebeb3abc691d538a258850d03f85b48d51c731ebb10fda011a5bc97257226702faf6c3f6d1155380b0ec1cc7
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FklVg9N9JMlDlfjRiVuVsWt5MJMs:ONc/zEOVHF2gFIDRRAubt5M
TLSH
T1E7858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1052d8b54439c9218466290a9b5d6899c49708aad52dfe04b2880343c3e93807
MD5 66c019d2e30dd4226d7abdacc363d089
SHA1 622f33176f475468ec699b0df69fb2a185372028
SHA512 d6d54537b5e47f27794313c0b10e7803da417f69331c1b1b687601e16cb2ea03061745032d8192b1ac571303d595accbeaabdb64558f419fe61dd0990676a609
SSDEEP 24576:2TkNvNnaFeYhJNtmZBm6Vg9N9JMlDlfjRiVuVsWt5MJMs:2TMwBtOmGgFIDRRAubt5M
TLSH
T18055AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7d161433e739c861e6b6bc14361e1a886c93adfe6e2cab97c0572f86b5e5a927
MD5 ce62fdb9f08b3a26689a6f9fb66662a1
SHA1 1340ddcae041cb1c6e96965d8689ddd2f138c3cc
SHA512 f3216a31a1ce69002b646c012af7788300e097677f5f7af950103715b9bfa992a1195ad796b88a1f819e6db39c5139e17bec7c44efe752c9cd7a115e26c1182a
SSDEEP 24576:5D3FHshBIYQgAEVg9N9JMlDlfjRiVuVsWt5MJMs:5DVHeBIAAEgFIDRRAubt5M
TLSH
T10E95E07EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/916-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/916-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/916-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/916-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1160-41-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/1160-4-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/1160-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1160-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1160-8-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/2292-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2292-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2292-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2292-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2292-317-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2292-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2684-44-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2684-59-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2684-45-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2684-52-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2684-51-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2684-57-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2968-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2968-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2968-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2968-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3172-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-335-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3172-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3172-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3172-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3300-282-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3300-66-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3300-55-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4304-320-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/4304-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4304-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4640-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4640-316-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4640-118-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4640-125-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5092-139-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5092-131-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5092-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5092-137-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5092-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5472-313-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5472-88-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5472-83-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5472-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5572-298-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5572-78-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5572-72-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5572-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download