4d0bc4fae472a8d5bcafd2313131586ad37ebbef70a5e031c0192368d2b59dad

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260707-fxvsdsav5v
SHA256 4d0bc4fae472a8d5bcafd2313131586ad37ebbef70a5e031c0192368d2b59dad
MD5 14adbeb4521d8e8e38800b4fd0b7c774
SHA1 45ac53f6f7f90c395ae9c8021f95bd6328afaea5
SHA512 f63baccde95c03f453054de5a4e3feec2c74edceae74c6e26ac5293d05c944d15daa8d7fcd4d42cabf7223db3f9ef8b6f1cbca4fff9d8237521cb99db1680766
SSDEEP 49152:bjcHonJkXCXjMHaIbnCeGusRN/BEmjfzScB1QMTNVvn30TofuXTJLO83y:HXLfPrJoT0
TLSH
T19D167B07E7B941E5C0BBD13D8A569657FAB2784A877197CB43A0871A0F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6096	elevation_service.exe
1028	elevation_service.exe
5572	maintenanceservice.exe
2796	OSE.EXE
3832	PerceptionSimulationService.exe
5316	perfhost.exe
5588	ReFsDedupSvc.exe
4264	SensorDataService.exe
1832	ssh-agent.exe
1920	AgentService.exe
4792	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\246d70632468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9915eb0cf0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d2f324b0cf0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9171ff2cf0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe
1028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1976	2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	6096	elevation_service.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1920	AgentService.exe
Token: 33	4792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeDebugPrivilege	6096	elevation_service.exe
Token: SeDebugPrivilege	1028	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4520	4792	SearchIndexer.exe	98
PID 4792 wrote to memory of 2384	4792	SearchIndexer.exe	99
PID 4792 wrote to memory of 3176	4792	SearchIndexer.exe	100
PID 4792 wrote to memory of 2272	4792	SearchIndexer.exe	101
PID 4792 wrote to memory of 5296	4792	SearchIndexer.exe	102
PID 4792 wrote to memory of 4188	4792	SearchIndexer.exe	103
PID 4792 wrote to memory of 1768	4792	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_14adbeb4521d8e8e38800b4fd0b7c774_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5316

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eb2038d99900374a2523f8362fba4fd8e610887dcf144122434c0d4c5253fb0e
MD5 55d513e70bd03f13cedc2034b084d3bf
SHA1 68865cb2bd9e60c599c5547d0f347cf3c709b82d
SHA512 0047f6db6de803ab54340f77d4f3fbf3ce964017eb9f37b121d71971a8833b3ec24028e6084a9b9ef0595fba453a266b264d90539e0b23f49ecd560d7cf1f630
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnMTJLO83y:A3q6sjBHT0
TLSH
T175D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 0c80085be2214e6ce55aa3407c65f70e7d833b8892bf4f87552c0ec255845dc7
MD5 6d8678fcbe8c6a5f26ad451e5ec55450
SHA1 23fbee95bf1109c1808d4871874c068940186fac
SHA512 f31e3bcfa27520ec4572247be9b1f7d284750ee0520aaca5846e9314ee2c12d94fd0281782666161e01d0694a3b56fa65e207466c8f64a531e4ab5bde6923999
SSDEEP 12288:A1XLsswWkxy2lRq2czAfRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:WXYfDtczAf0TJkhwO8EigzknHy1W
TLSH
T1F475F12867D108F9EC67827CCDA1C116EA73BC954760E78B03A89A741F337985E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1dcdbb6f9919130311ed18ab869baf516632a8388cb4e280325f610d48dd9af8
MD5 b6dd406ec350535532e2c86a85765fe6
SHA1 060e6194f585275c51d01c90e8dc52254ef1ccfa
SHA512 70180875e82486daa882d1bd31bfff9e63fa8909c1a33ef10b57ba75040e2def9fd9172452c3c36d9f7b3816d944dad5629cc65a262ebaf2225b253f0ae758b8
SSDEEP 24576:o0Le5ji0hmxcrMg0TJkhwO8EigzknHy1W:oPji0A66TJLO83y
TLSH
T1D295AE16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d6b24765463853403e0e3b7b74594fd240155282a0399c9714a5a2e65a49ebc5
MD5 7149b607fee6ec3e8a526d47ae3d59f0
SHA1 9564b4d29955742754e92c9400ca65b367d2932c
SHA512 3d6345442942ba35b016795e8f5b533350372aa58ec735b8a075b19fcf23d20b5d8d3166fa628df3e9e08440e7718bb7cbd51ba6826aa365cd0ded05b06898b8
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWn6q8wyu+0TJkhwO8EigzknHy1W:P/ezSC6vUzPveHjyeTJLO83y
TLSH
T188755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f95736baf54dcdd0591679efd2eb2ae80a314fa95833fdb93a74fd8439150e06
MD5 39732c6457cec9f946eed715a39c8df8
SHA1 31601a38072c9d95a21163a951292bdf9a51ffa3
SHA512 6f1c470c8543ebb6d249cf249dbf09d18746db50ef1f6b47754d981e33525393c80963ccfe9719d8681958e00772b15360d661b83016091c29f09cbc7aed306a
SSDEEP 24576:jVbqPb88hv/l+YD0TJkhwO8EigzknHy1W:jVO88hXl+VTJLO83y
TLSH
T164559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2a1c5037ef78fa8e25c613c79959f73b7b6c7ea93a640c96952dfb0f402a4889
MD5 0036bb2b613531ac13019df09108c2e6
SHA1 844baeee9aa7eab2f994d9717e56d3195f5df2de
SHA512 a20509d7f094ea8d3d703699618eeb50290ece3f8f407d401dd67f029ec5f9d5853f65952ef8da5ea3c689ca8e915c93b8ff9334f5000c595f53d9c4ec9b89d5
SSDEEP 12288:zfkRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:zfk0TJkhwO8EigzknHy1W
TLSH
T1496523540F032659F2B72EB8ABB0D2DAD5F5FCD87844A64B4D297FF82CBCA19D601112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 fb9bda10d52a902d47d187e08ca9cfe2b996049afb322b7876bbb77649f733b2
MD5 85e4812863c2445ef4455a69856579c6
SHA1 6bf5c41056ef05cba160fc25a58cc5f055090a60
SHA512 1e0a354051edd358a8ddac91aa18f1829621309dc338625c06ac1e6fddb2a8272684d4b9b3bccc2dcf79dada74490ca7b5f810785a7b35911241783e05d04586
SSDEEP 12288:1eBNUbTVO86ULRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:1JIUL0TJkhwO8EigzknHy1W
TLSH
T1A375CF3BAE28FCD2C27A9DB85B91C240D7B2B8704F61A3CBD165830D9E235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d0b2232d98ce96ef0317ef48d97dcf455eba80ba71f06b805d1f8337a1691cf2
MD5 6cd0332d42b7c4f39e694b45b87bfafb
SHA1 3166fcea23d788078db38e5c5d85f54d056671b5
SHA512 459085b575741b5bfdbed5b13268b4c1df44a54e34523896ae1e9662f3ab469d8fd3e17c0e1090e0cff8e8b6a95c8b8ef661ca5f4584e1ddc4a1cfa98220b654
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THD:eQvGAdlCEL8c/DRNw5CtT0
TLSH
T135267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c5cb78cbaee98f765945ee2c8972aeafcda9c024e5e0d70098d5d4f11c8bdf85
MD5 287b831c8068a7bc543f7b97856e9da9
SHA1 007d95b7b8725dfd81cb3f1d6e8ef858669ecf40
SHA512 4fe336dcac7d6aad65b6d484a23284e15e57642c554b278a0f0172a0b988b1ce2dfcab2ce359401c753cb14fd14549cd8eb88de22a54edd21e097a54a2a1a98f
SSDEEP 12288:SAwSfxL/2Dc3qDLLmt0LDQewsAjpRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBH:XjewsAjp0TJkhwO8EigzknHy1W
TLSH
T13A85E030FE71E036D2BB0DB61B36C716547CB9604F611AC3E3A89EAD59342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5bf6b061cd9ebc6a49aa44e6373211c99a714b1cf8494482faf210244cf2bfa3
MD5 e6017bbc0d83be7b9524f540c398e387
SHA1 78a9047458a4f6544c2b54e34f5918149093a13f
SHA512 957bcecaa69d55423c000fa5194508b6c9363c4f936674993a2fd64d4129bf5b598de2675417e8c2b8212edc4a9db619c00d5d3249975cb83ed7d1944c1ff093
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7:KUEtQevvqc2W1cpV2tI32
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fcc5bdb9f93e38ec2d6c5086a12ea88d350c3f75aff9684058682a236ab7f996
MD5 4a859fbdacb9d91ae5ccd49726b06cee
SHA1 05f82e9d95811f2d82a772b7e724bd2d5744962b
SHA512 3f8059ce5e017861b5a38ed44743f5af17c497a0262c5e1ac3459646a36f6e9122b79c8fa9db5da8ea68b30690003200b6ea6402784b4445ec0b1dc3b44804c5
SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zqTJLO83y:ooquVjnmRT0
TLSH
T110D58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f889980f12a45ef60e44a95f7ea40132b7f5eec29a7e60e26f2e1bcdbf8a6b57
MD5 5daf404a230dd4a46689499d6baac40c
SHA1 1daf689437ae17908692e2788fdd0d395c709097
SHA512 6227046536d1acf3e08f836dd11e0cf04ca60a202c088b67bcdabfc159a82136a047b0516de04ff00ff2f75437956d8acee1df3f0d17a7376ec20a1642d3e4ed
SSDEEP 24576:7AhGL3IFoiwtA5l7S5360TJkhwO8EigzknHy1W:7AMUFoiq5hTJLO83y
TLSH
T11335AE80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 93a258bf5c57eb016c66b477d7dab262a1574482e005c6cf24d073216650b244
MD5 39b256b7bcf56cfec98bfc7d1ca77c04
SHA1 6f56c05ea0596a453d1dc9dfd1307c44c7bbcfc3
SHA512 e27a64384ef41bb981f2ab97ecb0ba2668d1e15127a0c33eb47b55559351fd86b9c3212a265171562c20f330d7e23d6542c3c4b9441f3943216c274ce9bba934
SSDEEP 12288:mmw5HEjsChNyBFgl0WDm+CeRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:/wu/OWV0TJkhwO8EigzknHy1W
TLSH
T1ED75F14527A51CF9E5A796388697C136F7F2FC013A21D71F0760C66A6F37321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 f4a6bf78f231175869b5f3debe2d52bb1385185fb5b9b032aa5bd7f9db34b02a
MD5 8070cf23cef4b95c8b9c4b30ca17190a
SHA1 72e479ab2175f1c298c08af6cb459f187967fa61
SHA512 14e70f9589b6761bf0efbcef224e54e9af15eaa0831580099048c7f5b13897c33a54eed1ca17b1abdec7a7214b2d902eb1b34ba11ca1b7fbfd3a0f8935cb3be4
SSDEEP 12288:fqZ1Iy5RlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:CZuI0TJkhwO8EigzknHy1W
TLSH
T18D651259279131F9E1B3567CCAF0828AD3B2FC95373143CF0A2956B82E76AC55E35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b37528a82e4fe2c421943a068a4def1d6ec157931fc349fed69759b664907e88
MD5 8b6e5d3938542a1539a75360914f553d
SHA1 5ccd3108f42170a537cadc4dc9d0b9af04092d97
SHA512 491c05314611ab6a6c54235598526a9fe486d57b2e561cd7f37e4ab312063721d25448955205cd2c079f583234327e47be13f0f55498c4368d3f73e6e0c46934
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uv:zQRQyi36YOcPbLvw2gAf+PN3UT0
TLSH
T101667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b0a434484b8de444649f7802544f733eade8b4ee778af1a2755bcf22cfe41741
MD5 ccbc3378ae07b3a751632138749ea861
SHA1 73e163b309192fb1191e8b91e198c1c873dcf6c2
SHA512 8a8da12bb5b7e81b236de369614d7df92d3856ffbf861d17a111bb774e705f2a15564c7eee7477e24e8f4e393ca7eb19629cc270e172108d61ac70397abf6e96
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uv:OQRQyi36YOcPbLvw2gAf+PN3UT0
TLSH
T130667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b9cc2520b4ffd40ca708d755686f71c209e533cb392b65a6478e61916d577a4e
MD5 7b49042fa9c67fad4b0a0a1ddeb8be31
SHA1 fb847be81f19ebbc3a172ce5234f5374f069308c
SHA512 444d6fbed2272ef051c096a26daa308eaea2ebdc70ed335af9fbdbe393cf5b84eca197a404fd70ca3c6dc0726f7b8e4ca06a806c3644da7308a3eb101fbed39e
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL040TJkhwO8Eigzkt:j68Qg55nhceWu7PNU3/6TJLO83y
TLSH
T17CB55933B2F200A9D04DE1769F4A872196D27C758FE0E3DB851572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ddc95f8cae61bf5546b52f4d1233a21da367b6ff7701109ff70e439cd57c19aa
MD5 f3a2b9ba1f458e937959ed2015a6a19b
SHA1 f99d2c3ee269526a97ba3c437dd29bbbc6b08508
SHA512 fb312dac6a7ad52aa78a5445c886c8b2dc1c829c64f660b773c2ea9e1f7bfcf66b7989cecf85d519b40b8e5cdde3cc681123cff6e3a2f2d16391b8d4d66e0b82
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99F:Ry5112gYy5azzVvt69nLKnhZfT0
TLSH
T1FD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f0aed3562950b79c9ee2de215b78f59ccb6a0ad3b87439e9929fd42da84176a
MD5 307990163ffcd05ec988b3ee051268e5
SHA1 8a62bca01ee939bf45de6c055a7e611d9a5b9fed
SHA512 0fbe4ca726fc67873f3cb75e179f317b4ccd5ad984208cdb25bd0c2305f2d5d84f36034f6b08460eb805e1783615f9688cc951f2265c031ac0704f6d8487e572
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glTTJLO83y:Fu6Jmdxd2dTT0
TLSH
T14BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 61df804accc4c189f8fbd3daf6abe3724b87bf611fbe92ea4049f91f9e9f5318
MD5 55c838655b1d4eedcc18d8d3ca88d68e
SHA1 9a4caa31729c04e47ed34a7dea94dd805da8b608
SHA512 39a6da00aec9bb9788c1e0357376281d2843a2f518d95e9857ba9ca850ee7094b3dbaa634977cfb74b0dac8af2e3b7233261a3070977a7c71bd99f72799703a1
SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xATJLO83y:2mifPWRRT0
TLSH
T153B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7952F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 57b7a2f3b5b7c60464a5473c8d8bb71e215a9fa357b49bcee12ab8ed052ba3e0
MD5 415cfac8f964fdca7bd3de623fe73ffd
SHA1 e0ef1a097cc261abba79003e18916d9eba4b9bef
SHA512 ad121dcb38085ab04c987df651011cb9bf1b60dfdb83f33f441e3df176ddfe694475e083c73c1638117f543d0e927cdadc4535523699df7f66fd730726d6baa8
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqrTJLO83y:u5dKii61rT0
TLSH
T1FFC5BE03F2E901E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3bd518de3f00cd40f2a147db1de288f0e662d7b9aad51256b64ebbacabc2301
MD5 4b85dfd4b2b37be419221ccf10a8f393
SHA1 5753475adc7f280ba89049cf87561b8ed1a1d1f7
SHA512 f74bc8f367ecc56b74157945126d62de9a222fb2222dc38f0abd666c7c28f1c400d324ee6c62c55ce0982a45faa49106d29be0eb2e1a18bba3e2c48d4216a320
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wsTJLO83y:iX2imphlT0
TLSH
T16395BE13F2D900E8D06ED178C7568632EA62BC150B39BAEF0A50B7551E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a174420b81cbb25c3e1d99f825ede7f27e26ef18352107a72cc21d12f57667bb
MD5 cd0b1f2c03be1d2296ccc1d13abb190a
SHA1 a2ad44fa553e1588b3f71e595f3c37ef43e58623
SHA512 0fe2c8513cacb4764a14668c9bf737769976aac4563cfeed8bcd79a10eb73128b02f222ea1d0a3b58a78199d79934b31c4f8980be8a25cc04aefb73349e666f7
SSDEEP 12288:csRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:cs0TJkhwO8EigzknHy1W
TLSH
T1296523540E43265EF1736EF88BB0D2DEE5F9FCC8B855A28B1E1E7AB43CBCA195601114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bbd322cd62777fc51d7a008451bb4360f0053fe1ce4b4f542a246f97ed109ff7
MD5 2cbf31ab932d07cf8254cce699761426
SHA1 0c5c21790247d42e171023f4a3627c44b0da73f6
SHA512 86a2b3c1c860d3804528ea7f19e7410225506ffa45d2c5ebea1d6b0be648fcfa67f018b07fa2a4b68454845b779d9b055a85481ffc72ca7ecb8ef4bc8633cf8a
SSDEEP 12288:tNRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:tN0TJkhwO8EigzknHy1W
TLSH
T17C6523540E432A5EF1726EF88B70D2DED4F9FCD87855A28B1E1E7EB43CBCA295A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ce9529821a55076f81f7fe2c6029c1a6b265353f129b6c77e49fb46857f6dbf0
MD5 6059ac415516a320e61acdf1a8ee0c3c
SHA1 e35021a4ca9f40c4c1c4555b15636ddbf4843a89
SHA512 cd6afc26a0bb5a5a3c038fdd60cf603578da92a7ed8cea5f858ea39c2b6efe8eed0156973c78cfd1571c90472970b10b30a8d5517607427671681a442c03f84b
SSDEEP 12288:5zRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:5z0TJkhwO8EigzknHy1W
TLSH
T1146523540E432A4EF1726EF88B70D2DAD4F9FCC97C45A28B5E1E7EB43CBCA195A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e17fee0ef30fa02974f1ddc3f9e4042532b296855e5bfb5f30375b4bcef96236
MD5 ce2167ed4fca35536cb7740075572499
SHA1 e1f3f601d5e840b612263bf2ade7b9571ba48ab8
SHA512 46e898640748b9ff9e111ef827b51301bcd722a80a36741a6be6050224e07578a513284578481a47ea26c24ff3dc76214652db3b0dfdc1d12c3a524904f4efcb
SSDEEP 12288:BVaRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:O0TJkhwO8EigzknHy1W
TLSH
T12D6523541F5311D9F073AEB8CB70D2DAE2F5FCD8BA21A38F4E192EB42DB5B149920614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 762f5526e3d1ac05fc1b569728218f827b40509f53dd51426060a3c3fc4f9bb9
MD5 e3f59b8155b19ca99bbb197a107a70b7
SHA1 6436894efaa9551db622315de51d82a96bc007ba
SHA512 bacf2b71b7994dde61021acc2a22cf7a27841f26595af697a6a7a099d30ec3ccceb7e760ea52490ffff8f4abb64b90c072e8f7c4c8a2cf397fb5306c1f830934
SSDEEP 12288:wSRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:wS0TJkhwO8EigzknHy1W
TLSH
T1FC6523540E43264EF1736EF88B70D2DEE4F9FCC97855A28B5E1E7AB43CBCA295A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f9b5e9ba3dc64fa29c3c4f9625b432b9feacaaf645de4c3c5fb0f1b249f75acf
MD5 babc8b73875e247d296c4772437ddd34
SHA1 0fe40bb20375f220e101edc12c837a1f61c5ba69
SHA512 049ceaadde8bb6df731b4993b12adc9c44ad3c82e9280ac85e719d9597994f57703d107cd568d446bd95bab3bb7ad02599727a5a0c1791f6e0f8bc728d8ef60b
SSDEEP 12288:hRRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:hR0TJkhwO8EigzknHy1W
TLSH
T1886523540E432A5EF1736EF88B70D2DED5B9FCD87855A28B1E1E7AB43CBCA295A00114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 58c6356a0ecf125df61893a21f14924da306e9f3355714b71fa70f942ea0cd15
MD5 94a679cd6c13bb2cf5b211787b103bac
SHA1 b6bc5a4813718b31663b7e6127b5e2a089852bc0
SHA512 7857cda2954bd9add332f2cc62038d1be1670a15e319b183944a69052dc0973b5a2de38bf5e80b7adcc0b8981d3f01f86a5253923172b156ff755b40beb735bb
SSDEEP 12288:iFRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:iF0TJkhwO8EigzknHy1W
TLSH
T1956523540E432A4EF1736EF88B70D2DED5F9FCD8B855A28B5E1E7AB43CBCA295600114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 301aa3c944b175e50dfd6d30d019a69f5abb9a7ea5125beddaee80f8eccac672
MD5 7ef4794343fea57001fad42e91c4dc85
SHA1 c3e066dff9674650336f78b09abece8bfb55298b
SHA512 f8429ea6774ffc335472cc8bb9b91a8cfe60a68984bef65e6f4a5316efed03649e95b2c9ec95556446df18b51cd2005b1667d17cfe6285c0b05c64e7d23db2fc
SSDEEP 12288:jiZwbKzzFEoS2cPvytRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:OZMizFVSOt0TJkhwO8EigzknHy1W
TLSH
T1D6750194739118F8EC73867ECD618946D2B2BC591B60C61F07A8367A2F333611D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a3eb09d7cb95f946eec1fcfd8c1ca5351cb6332e27e409ecf402525e38526a3a
MD5 a48544a9acf6db13167f5df4fbce8e9b
SHA1 d210917e4cbd8b053a6803dccb52628cc96bd146
SHA512 6539501c7560dac71564db8f62ab97eca7e5f10b083627dc7368d83522ee785eca72acc498a42c054b9fc7093cb2630ee37acfcf7661941e37fb40a5e254d47c
SSDEEP 12288:TYRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:TY0TJkhwO8EigzknHy1W
TLSH
T1EF6523580E432A4EF1726EF88B70D2DED5F9FCC87855A28B5E1E7EB43CBCA195A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 fab1e3a6bbc2fb6092dfd79f38aaad3567097a440be37047be788e500ebdaf10
MD5 1db4d0a32bd2a7d1a066e7e1685eaec4
SHA1 66b6efe52276f85c7078df8edb1dd8a88cca1d00
SHA512 03865738175e507e179869e3cc6a87034aa47fe635cbde6a8df8b078ea198fa216dd19aa00a96f1073fc5d712b4c2a010353476dd90948be8da2c38ba3652706
SSDEEP 12288:Y0RlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:Y00TJkhwO8EigzknHy1W
TLSH
T1556523540E432A4EF1736EF88B70D2DED5B8FCD97845A28B5E1E7EB43CBCA195A01124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 b76b519e80338ded94568bd08a0cbff96aef06db954e2444d91bdf9dfafea6eb
MD5 e5503fea9ce49a74b2ac15ecf761291f
SHA1 28a97b23b8a36a30b3bcc1e14a9e77ab7b158a67
SHA512 6ddfdcf5e3b0e7a03715a1c4a6dcd85484b6c984567a61a138902012147ebe8f97ecf1f56ee9f7f2e4f686febec844ced91f317b25a520d7c15b4eefb1937939
SSDEEP 12288:JyPz5L85RlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:ozy50TJkhwO8EigzknHy1W
TLSH
T10875120727A230FDE1779278C9A15646F3B2FC752B208B9F176817752E376509E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e62933031db0657c84dfcc3ca901604b3a552ce60f2de1853a0c7ea312f092f8
MD5 c9890fd4112a0e95a18b3d4810ee9520
SHA1 264050555d061888a36ad4c46e24b89cb8f368d0
SHA512 ea29860d4b4325ca21d6964e04015fcc60ae9c6fd3bcf875429eaa9c5e9c4158bcfcb531527be1e3f210a596623d76260037f9d29da72f973ee72d1e3711d878
SSDEEP 12288:jYRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:jY0TJkhwO8EigzknHy1W
TLSH
T1006523580E432A4EF1726EF88B70D2DED4F9FCC87845A28B5E1E7EB43CBCA195A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f209f1212c8f0044b51a8a8facc3c556dad94e8a5c5646ff355460af01d30ae9
MD5 2d62e57089535c2dc282b8e01f495323
SHA1 1b02fff2678e9bb350bf5e21c87833d4a4fa5aef
SHA512 3ab5ce97440021eb3ea7bc27c4f4880fc855149b4a37015fad9213dbb752c14f4b0865a89b2be9472f5603339c873de5a5fbf7000efb2de7067c40ae06367161
SSDEEP 12288:fYRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:fY0TJkhwO8EigzknHy1W
TLSH
T1326523540E432A4EF1726EF88B70D2DED4F9FCD97845A28B5E1E7EB43CBCA295A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 531e09e6018ba5d424d9dac0c7cd9e3c4a620d8ccaefad0235d43ec3b4f58a7e
MD5 b2873dc4d5bbcd04abd3c70aa4b6e409
SHA1 0fb1c45b2ce58d9b9a4f2ab564fc72cdadd9ac94
SHA512 f7b88801b93cb491cc79758c49ea8b2ecc9ee95e8349efb151842e166e12abde6d87a1e75c5f1ddd947f3471d992591861939bf7a26d95c8a4d020612a4060c6
SSDEEP 12288:pyPz5L85RlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:Izy50TJkhwO8EigzknHy1W
TLSH
T13475120727A230FDE1779278C9A15646F3B2FC752B208B9F176417752E376509E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c6e9f7028a80d995b8d57aa99666215870ca360cb7bb3e142c31c5075ae54293
MD5 91257a5ecd9b4cbf25364ae810cbb1b3
SHA1 15134e1395bfacd1cfc3fbfd794a6c59e1aab576
SHA512 e264a2f7a8dbdbb5ff694a650d734c8b5a3702933892a85ebaf51e63b7842356b80ef21ca4bee1b3689aa866a84cfec42cbfcb5360745567c579a78519f50def
SSDEEP 12288:kCd9lWYoaLHF3z0z04PDvhjRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:dTsaLl3z0zDj0TJkhwO8EigzknHy1W
TLSH
T1A17501A4B35018F8EC77867ECD218946D2F2BC5A1B60C61F07A8367A5F333611D2EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 64af393e45be8c28d61f6d3996eea458ecf265440873beaecbebed47159b4817
MD5 7164cbe2c126678adf56801ba88a1a83
SHA1 d1a0422fac856ee41d6cc40f6695e421c8b1bae0
SHA512 e86d3b73e38a3771b8227164df3aa3a63c96546e5e6b53aeb0fbb048089b0a86dbc981f9be8bf89d6199bc4f5c643f803805997e52f47f4c88add1de74cac786
SSDEEP 12288:Ri4e7WRdTfgwCHKy7GLbbdIv2RlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:R3Ld9CHKy7GZn0TJkhwO8EigzknHy1W
TLSH
T17795CF90F3E414E8F0B79A75CD714511DAB6BC991B31DA8F03A826691F33B918D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e5f4639f10569162e8065ec3b644f5b8e31fe92841b34c6760dc735a61462ed8
MD5 150474e23634316fd93508e28ecd062f
SHA1 d17dc582434f1ec62a98a1efce5e4b95ea3f3b0d
SHA512 402829f5df556352659e35655c647b03fc8073a4ea15706f7ad1497df3a9db9b5112cf2f837cb311e2066a8d1d99ea1afeacaa0eca6f75aea46678c61a63e409
SSDEEP 12288:OTRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:OT0TJkhwO8EigzknHy1W
TLSH
T1C06523540E432A4EF1726EF88B70D2DAD4F9FCD87C55A28B5E1E7EB43CBCA195A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 42716f08f9689260b993c185cb8c806ebad29b27d630a64abf70e88edb0f6c8e
MD5 09b622f4a3106fc7010c48c1b99c8979
SHA1 94c214cb35e9d714c8782bacc8ec2531e894b480
SHA512 ebe20d3dd7998859b40480723b3f07f690b2bef251503d8ac68a76b728433f12d95b755d22d83c0b1e64946584aa71ca5441ab21b53f33fc2d512340426c4193
SSDEEP 12288:LZRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:LZ0TJkhwO8EigzknHy1W
TLSH
T1B26523540E432A5EF1776EF89BB0C2CAD5F8FCC87855A28B5E1E7EB43CBCA195601114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 eaca9a01d6a8f2766de5855dc54083767ae99a4d29fa7655d3d4af65360cb0d1
MD5 7b653e1be8da7c9083e37eeca11e0699
SHA1 38f33c72c123d7636e6df1a9eb04142d153a6c01
SHA512 986edaff07c7b653141c9c18d49edc5832c4442ece351177392473b7a618b78c036f318ec10f8d069062b44d35ab46413d82534cf8f2c0097e4b7fca4e0e20cf
SSDEEP 12288:x2RlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:x20TJkhwO8EigzknHy1W
TLSH
T17E6523540E432A5EF1726EF88B70D2DED4F9FCC97845A28B5E1E7EB43CBCA295A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 6bbb99bd02751536daa659eb4ba0ac884e0461e979059765097de1f7ed0ee55e
MD5 07c411dfa59aba04d1f05a8bd3d00ddf
SHA1 f582875b496169c9f9c9e92cbbadde775dfbfd7e
SHA512 0b87fecd393d77dd8ff11074b7044d6ed79c83f7d9ccbd76272fb531cd0a92fd5041135141c9972a29c3a894a5574c443acdd0a8154dc5aa0cb21602c40b43e0
SSDEEP 12288:1YRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:1Y0TJkhwO8EigzknHy1W
TLSH
T1D36523540E432A4EF1726EF88B70D2DED5F9FCC87845A28B5E1E7EB43CBCA295A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a55c2a39290101150bf92866786c55adab4002eb9d446ba304b706e0974f80b6
MD5 f8d114c7eac750811d504572dc23e5ae
SHA1 1cfe9eb98f09191a5290a99d7549c512ccdb64e4
SHA512 1ae4cac8be664dcb7d47d2a5140fbde1158fd94f291696db8b11cc0aa03407578c510be608fc12816c9f0c9680e315f0354b8b912608d4d9b25d8e98d67d2d91
SSDEEP 12288:0TRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:0T0TJkhwO8EigzknHy1W
TLSH
T1EE6523540E432A4EF1726EF88B70D2DED4F9FCC97C55A28B5E1E7AB43CBCA295A01114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 9c05fa8be5d126db8030ce0fee0ee67fc323b28d64ecd300fd0c99d93a129d35
MD5 78639e134b4cab5c5d5f16d2d2618a58
SHA1 36f1d11892b1c187d6c637a9af8f0f1ecc013d32
SHA512 6317a5e1687018040fe09d9cd1c7475c3bd077e91700da8991d88f282d6969c7afdccb20cf25965309ae4a0b5ee2b988982ff841419705a377a2933dd7e4d1e2
SSDEEP 12288:5QRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:5Q0TJkhwO8EigzknHy1W
TLSH
T1EF6523540E432A4EF1736EF89BB0D2DAD4F8FCD8B855A28B5E1E7EB43CBCA195601114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ce561865753ad37111c4120fbdfaefef71a6f7a487150b0875af41abe01e76d8
MD5 03b6a36ea5d4881ffc3f21e7026ff14c
SHA1 e74b74d64aa5935b191b477805ca6963553e71d6
SHA512 8c89e177d3d1b0932fe9fe8311a67cf3c1e44028292f43dd7bc5e194f43a27d7efd3a7857b7da12250cec889c55033b334f277b272f63e0d0e365128770c0249
SSDEEP 12288:KSRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:KS0TJkhwO8EigzknHy1W
TLSH
T1D26523540E43264EF1726EF88B70D2DEE4F9FCD97845A28B5E1E7EB43CBCA295601114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 45bb18e7d0753c245bf04592800b4ea3dafdc295c5c1c1e883408b0d403d3bec
MD5 2bbb7f781efb8db777fb7d8c79cb2a7e
SHA1 b3b4cd93fe076a238283431ee71735c1a7833d13
SHA512 66349f8b0f5aac9e94cd3ff8772fab8ec22adbdee07e14fd542feac20c1d68ec479768c243b1ae42dfdaaea6b35129647a931e8aac5fe0ed7dce038ec384f2e7
SSDEEP 24576:Cfwvhk9RX6wkyAIE0TJkhwO8EigzknHy1W:3MnYI/TJLO83y
TLSH
T17F95DF29EBD804E5E1B7927C89B3464AF6B1B8591B31C2CF025A53BD0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c5df5099910eeb1c8a24c15399b7520c7a98510c919b98245ad1fd0efa936af
MD5 f9be62c429e4bd1492db5d60c282a311
SHA1 33203ffc5c9562787860fe44cbe83026cedc7e1a
SHA512 24ab63eb482503d0fe65a98ca63ed21042baff70b611b946e2ad5953525bfc24b0af9ff5686d93518b8e5530f39cf1e2fe26bbc57e7e2e385c0695865f88f910
SSDEEP 49152:0YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MTJLO83y:DySzP0T0
TLSH
T108066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3931941881d17211c8f58fed80f0b804f3afb0084e86c8c332d06e3b3397800f
MD5 14b0b269aae36d3280f35d8d8a55b927
SHA1 cf1dd35ed980e96a88807727299e88980861b5eb
SHA512 3a5be7b78672238360c2148aa39591d792bc5d5b19e4921d78970a1a986f81a97cf3e3f671547e4c8d841fd77491e922e918c2f81b9edaa55f028e33c717f7bd
SSDEEP 24576:247Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY90TJkhwO8EigzknHy1W:247JUQjTirIhCnDHUPfF/cTJLO83y
TLSH
T16D65AE1DA3EC01E5E1BA927885158A5AEA71782D2F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 d31e4068f8d98f7d451894f17873b2513ae9930ede925c738a5d026989f6c8d6
MD5 201b395a4732657027f734c76f80b04a
SHA1 2de8223bc5751243ae337a0edaefb28ccf218fac
SHA512 5471a8dc5c76c63b6606fbbeb8c38c53b177e8de071fd5f865c393eaca851f378fd311f8d0402b9a8950fed7a8c8ce24a638b075f2314d16028e8ce2a1b3f36d
SSDEEP 12288:MYsfIRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:mI0TJkhwO8EigzknHy1W
TLSH
T11A650109C28512E8D06E6678CB618681F373BC64A7E1D3CB16D0F97D1F7A6509EEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 99bb52a93a2597ae748f5534956509aaaad5895b00e022a954bd83921de3793c
MD5 346174ee6cdc5a4e8f52fb7fde895e7c
SHA1 b4fbdc19978e91523fcdbd0ae3377ccc6d1efb17
SHA512 2d0b0419c151604a19ef1e46a33da03e2d829ba2f539a98a676119b24aba98db9df1482f8d228760025bfd940992ff048c8213fa06be1e6adfc23314ab378e4f
SSDEEP 12288:ZRBwVnUPla/bFMzG94ff9SEXPf5zwrcI4dh:ZWUyMe4HTPhMrDWh
TLSH
T18135F6107626C75FC66D80721E32D5CCAB707D42EE05AB0772CC8B3FD576659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e0fc033008b773835b8f056f5149657bf097cfa9b06c379e56d4603a2dcccb99
MD5 38d6d53dc9706a6b90f29a3b00f17556
SHA1 eb324fa996b4203de2484decd69d7f9a9c19ff03
SHA512 7af6cfbd07c91040b117817285e003c81ac408465601f1bd6c1524aac2b0cbc29f84dd440c480c1d70cdd1bc55ac35e3423651427d658948d3ed98edb3c199f6
SSDEEP 12288:8hheOOIY38s3SPfP2q3FrFJtsuBPKL3TOPoML:P3d7ML
TLSH
T14865D8405537A2CFD1BB60B2032A5F4DAB68EC4777459F26B7CC443AD82AB15A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 80e9045ab7f5581177c5a66bb227f5daca69ab8a5ad488a504fd9cddd488bd5b
MD5 5f4f15ffc73322665ce3cae8c9b72803
SHA1 160502dde63265615ff9130e0ec998c1f043b504
SHA512 fe28f85d88d27966ff2c3dfda88115f8a840d32246378b698e564c294e9f435dbfb54375732a6d61c277cf4b52f1a163d0471c554c1027a129a4a673aedf9dda
SSDEEP 12288:uo7ARlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:zA0TJkhwO8EigzknHy1W
TLSH
T1236523504F472A09F0766EF44B70D2A9A1BAFDA87F0091CBAD0D7BF46C78E159E30615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d9afbb2367658e4baba3d83a83c47388cb9536728a7fbe90c417a3719f38efd
MD5 73263a5f2af2bb3c22299c3218d74faf
SHA1 66e2cdefed856ccdfc1f5f2a9110f8238233134b
SHA512 cf45039afae47b488dd8d509666be7c80f3780b14057e5593a232b7b2d2d35c392c57e8f5c844a897743ddea60434bbed6528935f4c813c524ad1fcdc1bc61fa
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bY+0TJkhwO8EigzknHy1W:Xgb4mBIBhGFmTJLO83y
TLSH
T13265AE1E22E802F5E0FAE2B8CDA64417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 dcf5b974912cb4e3a239288bd7b1b4c7f42f9ad6a3cf067690c2f199cfde5d16
MD5 0bf86379a10a64f4e9916c1ee884a6cc
SHA1 42dc3237c296191e0863d816122347e47bf93497
SHA512 a02f2e6d7c7595f63c7ab0d539c8ca4b09e62195113cb809502ec2c3ecf82ef1f3709deb8e40031ef54c5f4c9cf8faecf8e30e59123ee6b1da127023f635ef8a
SSDEEP 24576:nG88u8FpJqH1ezria7/mt0TJkhwO8EigzknHy1W:G7ZFPqVZa7/VTJLO83y
TLSH
T14D95F16567E101F0D077D1388A9246A7F6B2F8251364EBDF07AC8B611F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fd139aa3e4569bf96f1d30405fcd59b59224d90b96f522d5d14a7d2163824c4a
MD5 de7b7055a8ccca0975b6308a49ce92cd
SHA1 ebdfa8afc283e1d2c716386daab743ecd3ead9bc
SHA512 5941d0b8628b3cb86ce5a3871ca4ebade2c4255849bddbe5d30e1e7b733390fb2a53fe7f8ff0f7769ff8ba5f93b3e9f7c27406e39c3f8f0849d7579c3de16185
SSDEEP 12288:eHvUrBFrEjwaQhRlglnwZaJ3MmGhBGFoQfEigzknwdzRQ6IdBVy1W:ePUr+NQh0TJkhwO8EigzknHy1W
TLSH
T16E75F22F269918E5F676E17C8A92830DF771F8621711D2CF02A0817D5E67EE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f7c6d3277fbe6e0b1f43c8f844174bc8ea40bbd2a96459956685fd09f2ff44e2
MD5 75c5e28731136b660c0220c6eda19e92
SHA1 173b67d5b67cc596d930ec886406a0669787cea3
SHA512 e543bd14c8ab449785af9ba9b39169cddb274ead8a875c9c33a1427173a6a762a423b6019327db3007879fad8d8c10f6ab5757d77cdde3e5d17756c7a04ecdd3
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSTJLO83y:IG05lO43bXT0
TLSH
T18FD5CF6A62EC11F9D0BBD17CDAC6860BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f656454db4087b1b98f8d444e5f5074bde37a3f1ce540206efe5ad66b0ff7b0e
MD5 849897c0fe7c3396daf5a2c896e87afd
SHA1 1b9715ed252a3744bcb1d7c5135b7022931e6c6c
SHA512 1ee3c13515f5ec1ea77998bcb289dd094ff25b8d8471704c16d236d155c3d5ec20f10b5c5906c8a4ee53a7c5e5f9bc9c92503e6d22ba1c5a182b643f9180c909
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/0TJkhwO8EigzknHy1W:8a5POZ3BJt2pasx2+m6TJLO83y
TLSH
T1F065AF5EA6F801D5E1B9D17CC583861AF5B1742553319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f5e2e24dcaffb4131b7acb37543ba94ccea3b6017065feb974da26bbf9bddd93
MD5 f70bb95555533cefa8a0ef72deb9b175
SHA1 aa9a4f571d8ca19d9cc2f896cdbdbed712ca9d15
SHA512 aef65bae3f03639efba1bc8a67a399f50f4a5fd58b68572c2d97d26c4dffc0814c199e18b5bb48f35e336e9b357c94ce4f8fd4e94dfc1365647f98b1eef80ef5
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk10TJkhwO8EigzknHy1W:LNc/zEOVHF1TJLO83y
TLSH
T1E6857B1623E901E4F1BBE1BE89779546FAB17869173086CF0291851E1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6066b5728b55b08cf8c3af07188b8a772ac485e77350ec9c22a8ed070ee623a0
MD5 b38c7e079355e84e371dad610d770c68
SHA1 ab336064261d06529010a04d075b63b70522c6b4
SHA512 62301c3b4608419991ce522c223aa2aba921023b87a3d029f40e1dfe0313ed8688cc9c1022bc6e5cc4427a514200e5745744910609ab75297b16ad556c06e2a2
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmk0TJkhwO8EigzknHy1W:gTMwBtOmfTJLO83y
TLSH
T15C55AF6E7AB806E4E1FEC6B4CE238512E6727861173293CB5390C13E1E679D89D35F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 600447f0ff8bedf550c05c7bff28468b87f9679d9509abc89e2ccddf6aea2e08
MD5 ed76b1ab86fa9a14aa9c83f61aa6a2de
SHA1 49bee5773d53f49c2ee4aaee621e428ffbc29f6e
SHA512 6d6333f8d24fa1df6584ed0c965bffcaa853ebb6edd9c1debea9e310b13a3e69a79775c231953cc06b40796977b851dde379e5c454a3794c7e061d4f436b7eb5
SSDEEP 24576:kD3FHshBIYQgAM0TJkhwO8EigzknHy1W:kDVHeBIAAnTJLO83y
TLSH
T11185E13DEB5D04E4E47BD1BCCA638606E77178AC032266CB069491B91F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1028-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1028-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1028-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1028-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1832-116-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1832-316-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1832-118-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1832-124-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1920-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1920-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1920-131-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1920-137-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1920-139-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1976-46-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/1976-47-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1976-2-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1976-0-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/1976-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2796-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2796-65-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2796-269-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2796-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3832-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3832-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3832-284-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/3832-76-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4264-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4264-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4264-317-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4264-110-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4264-104-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4264-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4792-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4792-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5316-88-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5316-300-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5572-63-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5572-61-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5572-57-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5572-51-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5572-50-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5588-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5588-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5588-92-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5588-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5588-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5588-333-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6096-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6096-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6096-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6096-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6096-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download