cacf56e98291637d02be5e030327dab9a291c77627b6853d544c2a641fdf4acd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.9MB
Sample260712-ql155scw7s
SHA256 cacf56e98291637d02be5e030327dab9a291c77627b6853d544c2a641fdf4acd
MD5 4c4217a56d4e0c4dc88030cde70b85ab
SHA1 34af778779361ca75449c7f1581f1ba679589bd6
SHA512 80bd073454a782ab277ca0fa8299e4904e6b972e8cae3acc0a35835d9d2240ee37e3afbfe7b90a123ea2e3c5f21450eaad45db09a0eba12d338df18053d5d7b1
SSDEEP 49152:bi0BSWtOZvUmg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqLdFQzYQyAkq+2:Lt98qRFTauXpdmYlp2
TLSH
T11F167C0AE6B940E4D0BBD13D8A979657FAB13859C73197CB46A0875A1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5244	elevation_service.exe
1112	elevation_service.exe
1376	maintenanceservice.exe
4932	OSE.EXE
5460	PerceptionSimulationService.exe
2872	perfhost.exe
4516	ReFsDedupSvc.exe
3208	SensorDataService.exe
6084	ssh-agent.exe
5756	AgentService.exe
2424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e10325b683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed4156700112dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca56f3b00112dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a37856e0112dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e688e46e0112dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2023e6f0112dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d5515b10112dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000552b096f0112dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2448	2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5244	elevation_service.exe
Token: SeBackupPrivilege	4516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4516	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5756	AgentService.exe
Token: 33	2424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeDebugPrivilege	5244	elevation_service.exe
Token: SeDebugPrivilege	1112	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5644	2424	SearchIndexer.exe	98
PID 2424 wrote to memory of 2756	2424	SearchIndexer.exe	99
PID 2424 wrote to memory of 4772	2424	SearchIndexer.exe	100
PID 2424 wrote to memory of 2292	2424	SearchIndexer.exe	101
PID 2424 wrote to memory of 1456	2424	SearchIndexer.exe	103
PID 2424 wrote to memory of 2344	2424	SearchIndexer.exe	104
PID 2424 wrote to memory of 2964	2424	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_4c4217a56d4e0c4dc88030cde70b85ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 86e5bc983f44b5ea8f3b55fab842d37680fc3c39cefcaa7131d42f5d50cf7233
MD5 6909ae56700fa04e3f2d9fb0e49be298
SHA1 d6a74ed6d23cf80b5fde0990cee9ce67b8c699bf
SHA512 dd8f4a07598c9c69052cf951b7a707fca8cf0510a4f18d636480feaca1d9d3987d6a5f50d156b142e5508657d280ee46d7e929e42627e2ea729a8b1ddeb4e5c6
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHdFQzYQyAkq+2:x3q6sjBqdmYlp2
TLSH
T1FBD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 90d2bf244dc0e72e0c3e7f3d8c1f1fad99de2483ac9f782463126fb30de8e181
MD5 120cc005cdb62b4a034bdb2538c427bf
SHA1 f8487c6ea30e40a5813612bbe17313fa19df8a0f
SHA512 c83eef9026dd7806f284bddcfc7d624d06b4ccba66f802878748467623ebbcb40e8730d3e4aa3736601c87ed11da09dd161b57c9add55d72aaa8d98b83833ce0
SSDEEP 24576:DXYfDtczAGdoY2A0zb87EyKHbkqWdHF28/:GtcJdFQzYQyAkq+2
TLSH
T1B265022867E508F9ED67827CCCA2C411E6737C9547A4E7CB03A49A690F233D45E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ba1c100f667a700c637c93bdfac3e596d13ebc8e93d9eee2122b0b37120250e6
MD5 c4c50ca40cd7ff7696a0b0a311b58606
SHA1 16e1f5a739607cae1f17fd3c27fc8c4aacb53881
SHA512 8c521c32dade1b97c320563d5b42478341eccd1b4b0804564d46308d06052a08cf5a415d394e5de4b36b3618a8e481a052f7643fbaa7e364147287e636a4d475
SSDEEP 24576:u0Le5ji0hmx/rMvdoY2A0zb87EyKHbkqWdHF28/:uPji0A9cdFQzYQyAkq+2
TLSH
T10D85AE16F6748731D073C0B9C5D2A68EE97130865B308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1765df22b20c15014705a701651d00d72691bd9ec758be23d85abe472931a758
MD5 06a77bee16dcd6863ff3ab37fba2ccf4
SHA1 bca7c67b14694f950bf1654d07555a2581ba754f
SHA512 a6f9da38a23804b6d641f883ffdb86371659e0eeb238b892c0ddb9ca9cbbde5c84f48c9d22970a60cca3a4cb52710cd2af6f2a867e17a8b6bdee1f402fa0724b
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyu5doY2A0zb87EyKHbkqWdHF28/:n/ezSC6vUzPveHjyYdFQzYQyAkq+2
TLSH
T14D755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a96bf630919fed99dd9b003362c7bdee01cf20d0fd0bc45772be8cf837255702
MD5 fb5eabb16c3221dd0de05d01b18a08fa
SHA1 28622889b1050b6f8abfef97b81d67fd041c0bf6
SHA512 2dd0633aae64a9267cf2c61754f2f416373e1fe9e5378e6a5266dd5e93f9421e2c02cfb053b371ef7dd24647b33f0613a637b3b49e08a4a6b8344e802e74ccf0
SSDEEP 24576:zVbqPb88hv/l+YadoY2A0zb87EyKHbkqWdHF28/:zVO88hXl+RdFQzYQyAkq+2
TLSH
T15155AF66F5748331D073C0BAC4D3AA9AEE3234415B318ACB1246D76C2E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 463495981ef6f227d6f4455d3c9ea416fa54f15ff1bc3fb60f40c014816900db
MD5 c3cd68c6f8b028df1df19e4819a21e47
SHA1 0e2fecba53b13b04c6ec830300c7888f286fd88f
SHA512 6f3975854f364bde24d36a12205b254e96bf35bfddfa2e0cc5c5a1ebae87c53547b4314c1ba2acbd63835746ba59734d87c5128b356c2c8d8e7835a728c42115
SSDEEP 12288:nhDd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/K:nhDdoY2A0zb87EyKHbkqWdHF28/K
TLSH
T1384523A5077639E1F39B4270B9FDD05682D50DDC86DE4581AA203FCE4E382A0CDAE1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 44d041561304c621632269a9e07135e700f479e236d6e64384734a567e5e4b73
MD5 c71a9b62aaedc4c4653208892e809b20
SHA1 13c0851bc5f456a274db38d0518a773f2df52d93
SHA512 77c76d341704131900b0547f80a942768d46aa32671d90d328ab95c20db071ac9e4a27f4596814e1930d937dff0245685ae4f5d606cd83d904b438c1631571c3
SSDEEP 12288:/eBNUbTVO86Uid/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:/JIUidoY2A0zb87EyKHbkqWdHF28/
TLSH
T1C965CF7BAE28FCD2C27E8DB85A91C640D7B278704B5293CBD165834ECE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 de066aeaa5ab45a87ebaec6651af79ac26ba72fb8f243e1145d22fa36cce736a
MD5 dfbf26b78e493ec43f0313b339843a17
SHA1 5f444e0a62e83617b8c785787d6eeaad491b533a
SHA512 0fb68fc50ee0c03349889ccf8736faf6a463528aef432b1f080a51442eb2a18eaa7f981b92ab411feea9cfa47c15fa0f312b26b1b5e6ca418243d19bed37db2a
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:zQvGAdlCEL8c/DRNw5CpdmYlp2
TLSH
T1F3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 71f0c18417b6646b9099d348a26107c6cf174b7c724ba1b0c66fd49cc4abc354
MD5 61c978e0bea163018c8cb869a37acd53
SHA1 99da6dae475aa023ff69b8a0181092e73cd64af0
SHA512 56ac2005c7ebd860f247d5319a6f44df5efef1229c37950d58b0672ca050de3d76d34d2bdf7f5460a4054985b7c1b568f9e34335b87972cb250b10947d544beb
SSDEEP 24576:JuewsAjMdoY2A0zb87EyKHbkqWdHF28/G:oljMdFQzYQyAkq+2
TLSH
T10575E031FE75E432C3BF0DB21B36C716546D79604B921AC3E3A85E8E49302D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa81d23917feed2c5aa9c20c86e51034ee6965d35c3ee26cce57ca87285ae165
MD5 5ef37b6a61845e4264bffa3c8a4e23c9
SHA1 ffca51e0f9777847b00098dd8ad668d45bf89be9
SHA512 d530ce8c74881114a4431755693045b109fff3cfc0102314e4f3e4831fca340bdcbdbe1931355e831aced2a2f863344327a3a15a30ff674381aadcac5e77978b
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHm:8UEtQevvqc2W1cpV2tI32m
TLSH
T10A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 29613c6acf7c95bdc50a12159ec318f6bf9a5d7e6005e9223fd7e5d7347578c2
MD5 9aa36ee6311539619ffed1465f9ec403
SHA1 3e11842341a3791d024dc3c6b57cb7041615c07c
SHA512 d6e34eff8bbeaa2aebc087f294b8c0a0128c9107ddcd69a10d05909e470d52a6a86e2445b75b3c91a811effed1ced97fdb1e94503e15907c70e4c97d86c03b2a
SSDEEP 49152:JCbRquA/m2yL5zLfFiV+XenmE3/zsdFQzYQyAkq+2:Goq2Vjnm1dmYlp2
TLSH
T156D58D0976B8C2E4D1F6C37886A2C647F37178154B35A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ad94e69ddec3f2e5d474f013d7f54e949805485aed0a0359726ff693184f5e1
MD5 9e1cf5bb391a0e40d2b3e2d856a785c3
SHA1 d87934d1c58a8e7acbf140d6108705d985742735
SHA512 84c0a710a590b653d04c5870d9dfd34bc2b614c8631fd746686d9c77d85602ec4fb0ba6974886709f8036b92208fb1e1686f71f5a5ce491cc4e0c36619e99481
SSDEEP 24576:/AhGL3IFoiwtA5l7S53VdoY2A0zb87EyKHbkqWdHF28/:/AMUFoiq5ldFQzYQyAkq+2
TLSH
T123359D81E7F955D4F5B39AB899B68171EA76BCA95E31C20F2160D20F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 870cd0d97ea620d05b3a1b2c844b69504071b39b0d844f18d6ee96c3050baf55
MD5 2a51cec1ff625a7562242d735f777677
SHA1 6a992dcd9b9ceeb3cd97fa56f45bb38314fbb86a
SHA512 faf3060ef1c632e3d934febbd4e124b9c44c2a2809282b712ac957ce995e33a25e04cf480b8476209d51a6309cab5da89f5f310f58dbfbde45d105cb25a65c28
SSDEEP 12288:7mw5HEjsChNTBFgl0WDm+CZd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVPj:awuaOW4doY2A0zb87EyKHbkqWdHF28/
TLSH
T11F65F14A22A51CF9E6A78238C597C036E7F2BC452A25C71F1760C75B5F37360AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 960b4b4380eab8a4e35afc7e673c3cb31f8015603795d052100d046fd08bd46c
MD5 2bb78802da0183d69d47c49c16709acf
SHA1 7cd91da3d183380395caf6eeb5c885e577279c1b
SHA512 5c959b566fef21a291855ec303e76633d5bc32eb83f020e40e6adfff300b6886062d6d83ad70cc049e6d0591ae937aef2428030cb8b84941a4bd6322100de3ef
SSDEEP 12288:3AZ1Iy8d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:wZu3doY2A0zb87EyKHbkqWdHF28/
TLSH
T11455129A23E530F5E2974278D9E58146D3B23C9A537A43CF2624079E0F32AD19E3D372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6d30f3ab848bc85968509b250af61cdc1c1f5ed5a8d9b746b596f92010474175
MD5 5501c7d74a113d3203ec5cae84fae5b3
SHA1 bc530b840b3ce5cc346a971ea3b132fa4671c1a5
SHA512 d4f63d3be9b75128822bd8a1ac99844954d7b1079854848737c7f56c0e968eef47dfcbee1a647b4495c8787225dbad0654bc3d29a0ed3c40b7dac70522c69ca6
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uz:MQRQyi36YOcPbLvw2gAf+PN3udmYlp2
TLSH
T164667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1569b37c91d50af40dbb5fde963c62551aa9b212576e6684c41f3f456f6b3da9
MD5 21adf61aa7974c1c46ac6672a0322584
SHA1 802c5c0120f65c86e3e18d699cfa73917b4ec5e4
SHA512 4e579d6eb91bf49dc42ed9f4f6b0e1b258e0267d8622c198405634f35c92fc14e33713af94e27c4e268a7efec4e4d80391bce481d07f0f3967196502532d2a00
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uz:xQRQyi36YOcPbLvw2gAf+PN3udmYlp2
TLSH
T18F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9fa67d039fade42adb4306be09b3040568cd3409b7b549038eb94cfdf40a4279
MD5 837f350a54c91704ce5f0e2df7f3c090
SHA1 29993bebb85bdd61849263689fc5cb6851f63424
SHA512 bae63f47b9068f3b8a1552356369c2477d8dbbc612fa43e03775ef06e1b645d98bdc72a8e2a813fc81c858caa9c57db027edb5d4d557ed66a3a060eb61cf0b4d
SSDEEP 49152:J68Qg55nhceWu7PNU3/cdFQzYQyAkq+2:XthLRc/cdmYlp2
TLSH
T117B54933B2F600A9C44DD1769F4A873196D27C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 86d301f185ac4c36b3c86f58e5ea5539eaed8fa65c8ed03d60df65bdf2901265
MD5 02ca2d7c42e365c9dd5ebaeac109efc9
SHA1 7fd2636ddfd74005f554844bffac33b060799c5f
SHA512 0a1a5bae1bff83f74fa5655451626d4a26688351719ce171cc0c7ca7f566cca149a3a653f8da5281018b5b1496a55a6fd40d078a8b62c3d6164758d80949c14e
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99N:oy5112gYy5azzVvt69nLKnhZDdmYlp2
TLSH
T179167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 147c7b7a1ed7f59cc32c90e63bebd4393dc71c4e616a7ff2625ef56920142b11
MD5 0f79a521ecb964321e7bc49111c7f712
SHA1 552e8c668cb43e91c79bff7fe24c85b6abfa1ab2
SHA512 a5c7a40e29c2d4734467a4565979f64a798037bb8cb72d66aca2e4865d1f4b2f58747173e6bc5d2376891c6b839cdfc4a5698580be4883eded6f74c4f22613c3
SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glkdFQzYQyAkq+2:gu6Jmdxd2dkdmYlp2
TLSH
T10AD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 82a85736052cb124b1b6cbdd7fbb6b78a256964d829ffb3159e5b31cd07f05b3
MD5 589c6b42ef87e33423a55ea6550fe4bb
SHA1 2692ce59b56d03f65ed877125e55284b351dda1f
SHA512 c76f44a321f14cebb283ef678775462b2e6454e60f6454805953a7ef35ec9da411ffa4c0fb7b0d2924974571b128a14a1bbf34cba1a620fd4f5bbc785cf55618
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xCdFQzYQyAkq+2:HmifPWR1dmYlp2
TLSH
T148B5BE13F2D901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d44dbbaa9ea1fd8544913768743981054e6f2b94cff2a6ddcf6c32dabb474852
MD5 9c033a91cddd8f20cecc0040e326be0f
SHA1 69126a235a60a7959c3cbcd3d7a59448ac037b26
SHA512 7983bf1ea756fcedd6cddbf1caf2d7bbfb162c1d706998b0d7a1ef268f80effc17e0da167b17b80b2d30665a5b9f7e311b3b3d6e140e14a0f68d7b2ccfb99fbf
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHq3dFQzYQyAkq+2:E5dKii613dmYlp2
TLSH
T10FC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 07c78c1db8891d608ca29caac09fd33ee5de2d6b8c94977381f2c945867ddf3d
MD5 0681125e389c0aee09e8d5cf73d01efb
SHA1 ab9c2f1a7b53447fd16f13e93a23ea5d3a588b02
SHA512 463a643fb2dae2a6ebf06e9cb8ae30271fecffd7c9c96bf582fab362a556d849080ea18061a16e27501233f0ed163b6f7c2d684b87cd9eb79a9abd2f12f59444
SSDEEP 49152:khtSn8EApI0fig3giDn0AP5wGdFQzYQyAkq+2:lX2imphBdmYlp2
TLSH
T16095BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 aedf28f7401dac955910227fc59a8ec4489a06b667f1b473f83f5d62db8c3f34
MD5 8bfc180e4b51980ac62665daf7e6c5c8
SHA1 80f2fd341a876014d2f1816ac4ca454b88dee9e4
SHA512 6746ab0c6b2a233c706b581de103d7b9291b3d52516ac1ed24d6cf1f870c77d658443b9b912788d1aa8f9dc3ef6d5eb0c8e69c3f460001afe190976ab73a583e
SSDEEP 12288:WLd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:WLdoY2A0zb87EyKHbkqWdHF28/
TLSH
T18C45239505B739E1F34B82B0E5ADC056C2D90DDDD6DF0182BB182BCD4B786A08E6E1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d01c71428364eb6fc8cdd9c8aa106d6fb808242fbfa3632bf71b66fb75581dc
MD5 2fe0dcccc05c1213181ed37d9a042460
SHA1 03d1d6ba6da8a509d82251917b4ae04f8e38a101
SHA512 db6a1c4961122ff368c7909c39abcd2b1d55c1a3242a58110e7364b91e4aca07b390ba9ee8bfced68dc09304c96c3153a1bbcc57497ad957d1657acba7035ff4
SSDEEP 12288:MQd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:MQdoY2A0zb87EyKHbkqWdHF28/
TLSH
T16E45239505B739E1F34B42B0A5ADC096C2D50DDDD6DF0182BB182BCD4B786B08E6E1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e876839372b3effb0b9cfea5a015537fa13abb95cddd50dc53d6033982c4f092
MD5 6a28dc81bc3c2b7705728564d7778cff
SHA1 4af73a2cbde493355a105f0b2a8558d32102490c
SHA512 13be9f8a4158f09393ddce9da574824569ed2244a20c3f9f3264a9e63bd02fbd6bc5ed7b0d48f6360eff74bbd344f4cf96ebf09cf26f2a9b1761a6c44db2f103
SSDEEP 12288:2qd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:2qdoY2A0zb87EyKHbkqWdHF28/
TLSH
T1FF45239505B739E1F34A42B0E5ADC096C2D90DDDD6DF01C2BB182BCD4F786A08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ab0ae04fe1602dd41fee4b7f93e65ea9d87b86d8e162908ccb4eba7b7dc33c6a
MD5 403f324ebb24e0f92213f2d73fd67991
SHA1 f21d8da9420ea869f632e006df545973d1def388
SHA512 781952e05d44b275dab83ae5d2335621f1efcffe3d552e3ba5d24fe138209036c161c558be1f010ebe5ba60931757aa82ca2b2c17ceb2d558aee9bdd8c35b81f
SSDEEP 12288:PV1d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:TdoY2A0zb87EyKHbkqWdHF28/
TLSH
T16845235517BA25E1F257C2B0D9A98052D3E57CDCD7AA02CBAB101A8E0F703E09D3D7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fb5c507b3dee11ef050f56db08243eb6328fb8cda92580f23161480f164ce528
MD5 c887282e238ecd46ccd5e0a9c4fff825
SHA1 3656ed4d764c363de70bb994a770e32a1d1ebb00
SHA512 6b597433b428271f04be342bc8ffeebacfa92e0b78c3ecae41bb8157b31a2d2b8917c801b7f1afae6f68be638251ff4fe0ade3d0bbd3d801159d51269c6eaa60
SSDEEP 12288:LNd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:LNdoY2A0zb87EyKHbkqWdHF28/
TLSH
T1CC45239505B739E1F34A42B0E5ADC096C2D90DDDD6DF01C2BB182BCD4B786B08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 39f782b53f2b8f1e4189c4097ac91d2d3e1ae618986bb50a99a2fbeddc2cac23
MD5 bcd86a69c7cc585e3c7e6718ef6d7e59
SHA1 35edd29b793ddda59a16192801911bc6e8efc160
SHA512 b2d41589341c49cbc3d9040319f122c92e3359b754db70f3ebd260a5e4e72c4f9c010127a768d9bfbf57d2a1d060dc0b5326341076e390a894dcb88ec125a4a2
SSDEEP 12288:U0d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:U0doY2A0zb87EyKHbkqWdHF28/
TLSH
T1D045239505B739E1F34B42B0A9AD8096C2D50DDDD6DF0182BB182BCD4B786B08E6E1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 afcf8db980c75a5fb31a35af4225f9a78a260bbe708fc05b7c54d8ac52f5610e
MD5 e9c9f6dc8e706b32347f7c910d2c9ac9
SHA1 9e70d3999e2d5178e072e963ef44a5fc3f970e0f
SHA512 fa02188b9c0a7320280cdaed582136fdc47f260bb440b240e25a8841753c1dbcd598384c10ebc110e085900d3b001c64aeb9ba2a62f57199e37d8e76b0d6779b
SSDEEP 12288:kId/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:kIdoY2A0zb87EyKHbkqWdHF28/
TLSH
T1044523A505B739E1F34B42B0A5ADC096C2D90DDDD6DF0182BB182BCD4B786B08D6E1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f01d10e043bd3481f23102496f3a060b584fcb477a870c8d06a3fb893ea303dd
MD5 7e20897284675415ff5bb8bcf3e1ef68
SHA1 144fd33e06a0b8073ea96c8138daab541a5501e8
SHA512 18d4b6ff475f32189cf689ccccd0470a9feab3a75c2a0769f2d1da2a2b7bf62867f930776cec7a18c2ed27d5c1df446d0f572fb6fdf98b7d820cbd62288f4fe3
SSDEEP 24576:zZM3zFVSOwdoY2A0zb87EyKHbkqWdHF28/:zZM3zfkdFQzYQyAkq+2
TLSH
T10365019573A01CF4ED67823EC9658906D2F27C590BA0C65F13A4366B4F333A05D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1c4db6ed494d19f646a391fe872f06cc5f1753df71e68416884f344461f953cf
MD5 163f47222df20e1a4a85cd8a7418e944
SHA1 cbc6b6a876f5047842480ace2e818afac5b3df6c
SHA512 3b912250af3ebb2deb1c26eea028487dd7e6c1c87180d19531395bef42f4d7320a42883b6d409d8267daf1e519465a893025a3d187d6ea1badc9f078a016dfbc
SSDEEP 12288:Qnd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:QndoY2A0zb87EyKHbkqWdHF28/
TLSH
T10F45239905B73DE1F34A42B0E5ADC096C2D90DDDD6DF01C1BB182BCD4B786A08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 387248ec44d05c3053ae0647f2473c08f9f37297e852dc897e8f0b99b0359127
MD5 5a9eb2f692ae81703f6cce5e780e7718
SHA1 c394ff5607a2a7487aa25bcc22cbe1c9a8ea1a4a
SHA512 20c2211a12e934ec39649b0c345a8f9b2f3439a895e11273689fbe821532b21d16a3ecf31579a9c08d5808d8960eb068fa55632d689feb09f1adae7003a375c5
SSDEEP 12288:izd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:izdoY2A0zb87EyKHbkqWdHF28/
TLSH
T1B645239905B739E1F34A42B0A5ADC096C2D90DDDD6DF01C2BB182BCD4B786B08E6D1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 07fd9aba708cd78f4533869abccfbede4b8f6b0b11bdfc119bbb65e13de3314b
MD5 ae823998de02c9c65ac243d81c465768
SHA1 4159abc26d38f8f26290182ccf5f3b22090bc1ea
SHA512 bbaf1ee6ebe3c74cb54d07e5375a5251c8ec43a7103c0a36c33f013588d46694cbfe2c7e173ab20dea7f0dd5a26ea1b166654443e3d324bcca4863cd0d7ced6b
SSDEEP 12288:uyPz5L88d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:zzy8doY2A0zb87EyKHbkqWdHF28/
TLSH
T15155125723A230F9E2678234C8A64502F3B17C7947658A9F576407BA1F273E09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6af0f53c41ea00718420842341ab610379e3435d92e046bbf1559cb90721212a
MD5 9e3fbc137ed5bcaa388e6b7e3c177f23
SHA1 7a8ff746cba4d62f490f634a5ef17dacedee0205
SHA512 65e4f40acc2bd3355a73b5be27f2e25bb4a13e7ac7c0dc3d7d63b8c8631892243e973448bab380c6bbc50b26768a257cf0b8e360af34192df8fe502431463f57
SSDEEP 12288:Ind/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:IndoY2A0zb87EyKHbkqWdHF28/
TLSH
T1FF45239905B739E1F34A42B0E5ADC096C2D90DDDD6DF01C1BB182BCD4B786A08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 39b05d6dd10e5afaea08b54c2dfebccb5d0b98f6de3442847db9ee88ccaddd90
MD5 75f2943d0538467f8993a87733b3efd4
SHA1 df09fe5ef5fa006bc9ced6b67ea7212285070d5a
SHA512 66fa8291015476ba8cb6bb7355404a4de744d2fa4f48441da61d663c12b1a7fe6c74b3141f6074034004f38ce149baa1dbd129244550f0ce8800f5df2ad69c9f
SSDEEP 12288:lnd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:lndoY2A0zb87EyKHbkqWdHF28/
TLSH
T16945239905B739E1F34A42B0A5ADC096C2D90DDDD6DF01C1BB182BCD4F786B08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f0ec0664efbcd990b513e10a6d9615f7a591093fb96eaa9ef0294c2de76fcc31
MD5 5d9476f2c3eef99d8c0f25675d66b520
SHA1 a2f084f7c9ec70cb1656a34a8ca643ee5184f7ec
SHA512 f703291c0241890b02f1963c6107cdb2cc55e2f4df7f67dd6367c22b56b204f50b2dad31fc852ef7e96e7ce13ee111b9a27b6c5ff0a63ffe14b5db0b389bb64a
SSDEEP 12288:fyPz5L88d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:Szy8doY2A0zb87EyKHbkqWdHF28/
TLSH
T16B55125723A230F9E2678234C8A64502F3B17C7947658A9F576407BA1F273E09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2b850aa6a2b1ba5af35b3e083e87728e21c0b6bae79c20cd33929f36efec2fe0
MD5 47ebf8981d0cec021fca690f926d8fcb
SHA1 d88bd4752ef27866889141fbae923adb0553d278
SHA512 d18ca0be2a7fedff034d861b2702723b4a18b2a6396678ad5ac98f8fb540d4ded424edd0dd4e399ebf861f1294b9fe46f396f0cb863aaa8fa4e68ca986f45cf2
SSDEEP 24576:ITNaLl3z0zD6doY2A0zb87EyKHbkqWdHF28/:ITALlj5dFQzYQyAkq+2
TLSH
T1546501A473A01CF8ED67813EC9658906D2F27C5A07A4C65F13A4365B4F333A05D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f541078887e3bb5eb996c151f63df54f3d5c553dce6598040d473f1d079140aa
MD5 aec0e6acab6e55489197126a5d3ba198
SHA1 d07c9a9a907a15a250200001925b24a545879cd0
SHA512 d9f7d7f7873946af2461b015e16d4eb60b1aa151ff305682da617dcbe2a0af87de11840bf78b58fcac149c6f17faaa5c2c86c48e37080e5250f23940b787c41d
SSDEEP 24576:I3Fd9CHKy7GZOdoY2A0zb87EyKHbkqWdHF28/:SFd9CHKyakdFQzYQyAkq+2
TLSH
T1D275CF90F3E414E8F1B78A35C9768512DAB67C991B71CA8F03A4265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 57be1be08ce53ccb8d652c349fbf7e136c8fe6901d9f5c21aaa46e0730246a9f
MD5 ec18ddd9213daafc6383114d6df1cc12
SHA1 957c6ebe3ee150a5678dfafcb326f8f99c28ebb0
SHA512 aeb9830fc1d9621042b92d99c720bfb44ca76d3e6f543a820652d48add023b16f16deaeca6121074e7ec2880f09ddfc74bb5e1a639039508393b1a71682ff839
SSDEEP 12288:QKd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:QKdoY2A0zb87EyKHbkqWdHF28/
TLSH
T1DF45239505B739E1F34A42B0E5ADC096C2D90DDDD6DF01C2BB182BCD4B786B08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9a5754a9dc4aa4840ca2d2b530ee34cbe74c8e982fa746b71072488049fa56f2
MD5 34d7a17f27132f2f9ba0af3823b1de71
SHA1 308077b78f15a49c64552b57ca160544b172046d
SHA512 e770b22754b99b3c4ee11ec0b2b85fe95beaa5d82c76419c21758032c27709ade35ca6cead166efe900c17e9d2aace70647ef7caf6444541caea027d72f0ce28
SSDEEP 12288:2cd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:2cdoY2A0zb87EyKHbkqWdHF28/
TLSH
T1AF4523A506B739E1F34B42B0A5ADC056C2D90DDDD6DF01C2BB182BCD4B786A08D6E1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 59c7db616b802645a84b577ac124e9647d478d8f17f8de7fc74a46da8adb347b
MD5 cfacdbabfdb3eaa4b8d36162a9f17bbe
SHA1 46231ab5b0af7b88aa0cc6b1672bcd918429b998
SHA512 6cfbf6c34937f5cffdf74e3f854c03538a80514578cfe6b2b1cb9575afd31bd72860b2035d1cdf986796746db3ca170202e7a32a35212c65a41b6618658a502f
SSDEEP 12288:Qxd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:QxdoY2A0zb87EyKHbkqWdHF28/
TLSH
T11145239505B739E1F34A42B0E5AD8096C2D90DDDD6DF0182BB182BCD4F786A08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 51b607b73fc5221bed0d24b3305a040519638c762f30afb69498b727dab8ac6e
MD5 f96f1b458ce2f91df4a8726ba86ddd69
SHA1 d9094358eaf118ccc56ae1e69ce599f24ce9895c
SHA512 31aba24b90b946453f8ad0cb813da9082833117c1d4e8606686486a478c764f7cf0574a8ce1872013ede68196c9db955f185c2d7a8a5060cded2789ebe875973
SSDEEP 12288:und/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:undoY2A0zb87EyKHbkqWdHF28/
TLSH
T1F645239505B739E1F34A42B0A5AD8096C2D90DDDD6DF01C2BB182BCD4B786A08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3a304ede27ea56330f00d1fe3f57a75bfcb30f8027b3dcc408af8d7e8cf9c569
MD5 88af90761c753a4fd4c782b6599f85d0
SHA1 ec70021c77e4c72bb09e2396ef7526dd91dea54d
SHA512 9bac5e27f61be74bea73249e175e52c0174a7cfc77a1208b0e60d381ebc10ceef404cc363d005632877ed9233b38eb71120b3babe07534d6118af5d105b19996
SSDEEP 12288:6Kd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:6KdoY2A0zb87EyKHbkqWdHF28/
TLSH
T12145239505B739E1F34A42B0E5AD8096C2D90DDDD6DF0182BB182BCD4F786B08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9ec2a26399f8d84f090bbb686cf8b010c43bf11469b0d9787f521a05cbdc95a1
MD5 f5a8badf4f9fe94e97655ed81845d9a3
SHA1 17658ba88735f3318af2f08c8805cb10698332cc
SHA512 e8a4070c686a5acde1696bdf15722560bc304aca602c2eb86307fd79c977cd54aa7c2305379967456bd0a2c3ff7a6acfa07676832ec58f5717d59f02defbb9fa
SSDEEP 12288:0/d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:0/doY2A0zb87EyKHbkqWdHF28/
TLSH
T16A45239905B739E5F34A82B0E5ADC052C2D90DDDD6DF01C2BB182BCD4B786B08D6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 82176966b27bdea5600f55216d96214a2f9d9cdee5c0d6ce0f3cd6a984314ee1
MD5 5a9ba189e23262b9fccacee217401717
SHA1 6241d63babe0e752ef5453aa568fcc841ee2d178
SHA512 34aff525e5780dbee1055149e5517ec324a23ce4806cdc6ae1974267b00b9ff2cee592201d885e764c406be4a85826e332e6cd8e3cbc3c4a40df3772a5d227b3
SSDEEP 12288:TNd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:TNdoY2A0zb87EyKHbkqWdHF28/
TLSH
T19D45239505B739E1F34A42B0E5ADC096C2D90DDDD6DF0182BB182BCD4B786B08E6E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 39a94c410a86c7da2a379aa8983ed05143f5cf6d78b5b020dfc5424e30112388
MD5 dc16e187b1d15fa4279534db6cd709f9
SHA1 08b8abadda87a94b826c04f1975ee28304b5459a
SHA512 23783977eba48baf400672e701ef9b622e68a86879c4ea01015a8eded76825dd1a60b4e65587e13911ce59bde0a9150a06df068d76415d64aab23b211f5a8751
SSDEEP 24576:bfwvKk9RX6wkyAIjdoY2A0zb87EyKHbkqWdHF28/0:/MnYIjdFQzYQyAkq+2
TLSH
T18E85CF29EBDC04E5E1B7823C99B7460AF2B178691B31C2CF125A53AD0E37ED49D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 31375dc160e372b61871e10e83193d4995ce6a5a65142f46156c9d91735e2c02
MD5 980f06316c7daf228164fe6bbc65ec1b
SHA1 935a2efdb9453c3b60e16ea71a35fa014b479c1d
SHA512 0ef94977bbed5703ca468342a91a5f8eed2e23d4aeccbe90cf49a131a17568da327596d1a0de4ccac86bbdb17a7ccf246ad90c83a486f89df24347db4d9194a0
SSDEEP 49152:3YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mdFQzYQyAkq+2:yySzPOdmYlp2
TLSH
T14C067C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a7663f25e008272f798dc75e55828181d6a9f8fbca80082d9c9d3b43b081fbf0
MD5 b651a7c87827ae4a226b5b37a763f105
SHA1 22e04a69e1124ae58413a0b3abba414f1b0e9c8e
SHA512 07d0bab0495bfc8ac5e910e87cad11530122a0d2992a31e12a5522a3ab02f18555e888d52036979883e3b4f1540197af0c9b1f18ae78df621bd92b774e9d1658
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYgdoY2A0zb87EyKHbkqWdHF28/:N47JUQjTirIhCnDHUPfF/WdFQzYQyAkE
TLSH
T15165AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 31a77a67a8fc40011f3c7ad56888252c771acfd2ee6664e2cd35340bc369e0b4
MD5 3d1b7819defbbb0339a638566723576a
SHA1 3dbe848ffa8ccf8341a7a801975087078cb6b68e
SHA512 8a23ce61158345ea47bf5bdad5e26c290ba638f3b17f00c418e30c5d92f5f8c3e61a54611e9b2e912fc11fa7a7839f85a1da83295bc59a08c3b615de94c55d73
SSDEEP 12288:pJsf3d/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/:O3doY2A0zb87EyKHbkqWdHF28/
TLSH
T11755F119C2A812E8D16E4275C7568641F3733CA983E293CB63D0FA7E0F356909DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 304e82857cb1ae0b27d78a802b775eb992ce47dd0c54361f5199a74f225ee1b8
MD5 080a42a1785888e4e9165c4665a956cc
SHA1 8c9d04343ac35c6dc10bbd85801f79e8d8687418
SHA512 b4f16ec5eaf82237a235cc6acc26b328724d341e4b1a5ca8dbe3af0b04434e8f4b1125b1babdeb71d7e882512baabb4fdf2a3ef36e97e5cc36bdb36b9920cd65
SSDEEP 12288:KdqbU3fGenQEaTfitGk9FgcNIygoCXNl5L7:KdUUPGeDaTcGkTSygour5X
TLSH
T1CE453940766AD75FC6AD40325E37D1CCAB707D41FE05AB0372C89B2FC576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 99c9aa5efb60c6f8d8242f24a1107c582aab7dfb8402fe2d0be4e31a5d067375
MD5 91ac2dbd3a151c566706397fb9173aa3
SHA1 30a1c96019a143b774559fa84200aef1812a9736
SHA512 331cbe88e476e6875ed3085ac27efc7e8ae7a47084a7553e8bcbaa1f367c756ef75aee02a4450f5950d3b953621ef7910816ca249616516fd1e3d2390a4442a4
SSDEEP 6144:bTimd9xfpTSI1UI1T4pFcbVtMxbcbVtMxFlVmkQICivqKla0ZL:zJ4VlVnxlXR
TLSH
T19B65D9816437A3CFD1FB6031072A5A4DAB64EC42B7055F277388493AD82BB65B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d25d1e18cc4aa6a28aea903bdd220106645db78e36312b955b384694c4df7940
MD5 269bef95be951534c674f4302c0db69b
SHA1 82ddf289f930edf48a3351d66cad0786ecdba1d1
SHA512 13f3e6e048072115528a4f8a99de98e4c528a38d3a7c25b17ad049ff25e25629461b2c53f5ebbb0660985b17985f8957c0ca0c30765bdec5fe5a79d7d2ec00e6
SSDEEP 12288:Mn7Pd/oBbZSh3ZUA0zb8RQwNTEqaaK0wFbronqWdzLVP2le/b:SPdoY2A0zb87EyKHbkqWdHF28/b
TLSH
T1C845236507BA3D91F37B42B055ADC021929E6DEC8B9D40C3FA142BCD4A346E0CE7D69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4358b9c37020b71397cbe10ada582ecddb0790d4ab5940e15cd4b98f40879d00
MD5 3188450bdf2cc0ed0446b4ddee49d795
SHA1 5cc8e687d3e8709fc2572ee233ca6394918cdecb
SHA512 e8aee3d78e950f381ffa63bbf99f72e8a0b9d0b22c26ed9d5e8410f6481097e36698a3668fdc83ae7378b442445223dad7e044f9ad8650f89c4a61f59557f0a9
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bY5doY2A0zb87EyKHbkqWdHF28/:Agb4mBIBhGFgdFQzYQyAkq+2
TLSH
T15865AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ef1ff247fefa43e522e53c78c75c9de028266ef738ea58ec4028317795b7dc71
MD5 08ea8ba8fe0977f4dc2634f7d4d6f31e
SHA1 6a75557d7ef29354105df8a5bf16e6c31fec9ae6
SHA512 7a01dfd0c2d8618b2f7144db7166c1a708c181cf911748072112899b169911aa392a46acd26eb755a4c2508d869bb79b9b8ec9c3fcaf4edde379be7eb048f950
SSDEEP 24576:qG88u8FpJqH1pzria7/mwdoY2A0zb87EyKHbkqWdHF28/:R7ZFPqVga7/RdFQzYQyAkq+2
TLSH
T18885F16567E101F0D47BD13889864663F6B2B8250364EBDF07A88B951F23BE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d9a29165ac69c652cde6e54fc1b828ab861945020fa5b8d776dbba160b45a598
MD5 16e55daed85999298a595a1669288047
SHA1 558ff1d9349553fb342dfcfaa34f979fa5bf8bd8
SHA512 15d52ac72ebb30e7f28f4383dc554684450081329d88f9e6bda6cb26fd1316817f5e0cfa11fea696a0d61c2c3d737c7c04528cf4db0953a552e532e6a8fce2c3
SSDEEP 24576:OPUr+NQkdoY2A0zb87EyKHbkqWdHF28/:OJQkdFQzYQyAkq+2
TLSH
T18665E12F22ED1CE5F67AD17C85868609E7717866071292CF02A0817E4F67EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 972c59406da83b73e44c6b23895f7e1513a02ec70941aa5ae86893480322b68c
MD5 572f4d9dd2562744000205aa35ae3024
SHA1 7989fb991860d511d9d147f0c76a5f445020b987
SHA512 106efd756f87e4c7e6b888a1dd1d45767033c4837c91bebbcac28b2e88507dd49e47de4c1db3cfab1e74168fa1803a0d9d3df8aad4eeb04959c97b52be3af009
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0dFQzYQyAkq+2:+G05lO43b7dmYlp2
TLSH
T165D5C06E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0807eacc1bd35632e2fc67cb73e0ca2e8c9ad9dec95e787b23301b4c09c437be
MD5 91bec700c7360c84adabefdc2e7182f7
SHA1 0921eb63a67ba10218c4abe22f2058a16c7e1121
SHA512 c2f60a9d02cab609fa5749dd54ca4e29e78596041e3a19226f31dd28e66d43555d9b70e901af37ae563309caf66f80245835f3cc1d788023add8fcf1dcfd6b77
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnmdoY2A0zb87EyKHbkqWdHF28/:3a5POZ3BJt2pasx2+mcdFQzYQyAkq+2
TLSH
T13065BF5EA7FC01D5E179D17CC583861AE5B1342553329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1cb0b9b4c8a90acfd524993741a412929d39edd0b657e9ded05a815ac97edd31
MD5 ae7aae9abb7433007a74c07f6b6a0772
SHA1 1a5c21d1e4ea8ac38cc7078ad6d91c588e8336e8
SHA512 3ac1eff5b3e421d574635bbce6e88f8aa003717caab6dfcd3429d880a8a5818c421415e97a391270ff347b04d216121d3e096c5840f53d251eae5a3c59de973c
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkYdoY2A0zb87EyKHbkqWdHF28/:cNc/zEOVHFxdFQzYQyAkq+2
TLSH
T1BF857B1622E901E4F1BBE1BE89779546FAB17869133486CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 067c804421e7a358e5fdb80e632193f27d1160fd53b2c44ebda028ff64eedcc3
MD5 edbe4ee1f44cd6f5f5484dd81f32e8b7
SHA1 e55fa1cff68747d7e8c658559c9896eaa9a01d9a
SHA512 23bd2bf9a41099254099819fea391d4b0d884efaa4330123be1efedc3384677621d60e53a14ebbd7546d9a1f5635858f61c507847f5f3d2ab95c8d6dcb6c9bfa
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmodoY2A0zb87EyKHbkqWdHF28/:9TMwBtOmodFQzYQyAkq+2
TLSH
T18055AF6EA6B806E4D1FEC6B4CD238512E6727861073253CB5390C13F4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 debcf36e1f3462f9a232c724017e981844e2d9640aa3f2ba53c434fc85f0adf0
MD5 0dd89e00c1f067b7aa85a369b25d9f73
SHA1 d5971f9ffb03852904879f593698021771ae806d
SHA512 fd58fd99c5a4d20ea20cd170ae3e4a47802d77b6240edf9cbfa56df2e62bf9dae3e01adec08016670f153851d703222ce506b000071c2baf4cdeaff029713854
SSDEEP 24576:ID3FHshBIYQgArdoY2A0zb87EyKHbkqWdHF28/:IDVHeBIAArdFQzYQyAkq+2
TLSH
T19E75E17DE6AC04E4E57BC1BCDA638506E37138AD032256CB129481BA1F6BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1112-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1112-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1112-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1112-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1376-62-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1376-59-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1376-56-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1376-51-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1376-49-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1456-428-0x000001E90F010000-0x000001E90F735000-memory.dmp

Download

memory/2424-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2424-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2448-0-0x0000000140000000-0x00000001403F4000-memory.dmp

Download

memory/2448-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2448-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2448-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2448-33-0x0000000140000000-0x00000001403F4000-memory.dmp

Download

memory/2448-34-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2872-87-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2872-88-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2872-93-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2872-318-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3208-117-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3208-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3208-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4516-341-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4516-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4516-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4516-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4516-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4516-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4772-417-0x000001CF81370000-0x000001CF81A95000-memory.dmp

Download

memory/4772-337-0x000001CF81370000-0x000001CF81A95000-memory.dmp

Download

memory/4932-65-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4932-71-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4932-64-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4932-301-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/5244-24-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5244-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5244-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5244-16-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5460-75-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/5460-317-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/5460-83-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5460-77-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5644-326-0x000001DAE8350000-0x000001DAE8A75000-memory.dmp

Download

memory/5644-427-0x000001DAE8350000-0x000001DAE8A75000-memory.dmp

Download

memory/5756-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5756-135-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5756-141-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5756-143-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5756-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6084-129-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/6084-123-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6084-130-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6084-321-0x0000000140000000-0x00000001401DF000-memory.dmp

Download