c9bf2ab52e644196cbda9f348aec42e95a957dbddd127e166864b40406608791

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.7MB
Sample260713-e43adady81
SHA256 c9bf2ab52e644196cbda9f348aec42e95a957dbddd127e166864b40406608791
MD5 1b85008b811183caa93e0f3dae429e14
SHA1 ce8386d3b00dfb8292c6bedac2ce1f041f6e383f
SHA512 6056ac29da72b97dcfed92f6d431165b2e6b4f0e3a2f2246be40aa83d74b98de0508375a7a42fcbbc5f07a2bd0d0c79e0144ecafba75b2109899d90e5aa5b50a
SSDEEP 24576:KklYllYkiDaIKB9hh97tkrRNyBo4kx929bL3Hnx:Kke4Vaxrx7tkSB+kn3Hnx
TLSH
T13485F12567D502F4E47B913889864263F6B2F8151774FFDF07A88A621F23AE14B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4480	elevation_service.exe
4464	elevation_service.exe
4616	maintenanceservice.exe
2604	OSE.EXE
4336	PerceptionSimulationService.exe
628	perfhost.exe
1628	ReFsDedupSvc.exe
2392	SensorDataService.exe
5764	ssh-agent.exe
5184	AgentService.exe
5848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6a03579283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e796f3638012dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e7a0e638012dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070d914638012dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4affc628012dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e854ba48012dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4480	elevation_service.exe
4480	elevation_service.exe
4480	elevation_service.exe
4480	elevation_service.exe
4480	elevation_service.exe
4480	elevation_service.exe
4480	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4100	2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4480	elevation_service.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5184	AgentService.exe
Token: 33	5848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5848	SearchIndexer.exe
Token: SeDebugPrivilege	4480	elevation_service.exe
Token: SeDebugPrivilege	4464	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 1204	5848	SearchIndexer.exe	99
PID 5848 wrote to memory of 1840	5848	SearchIndexer.exe	100
PID 5848 wrote to memory of 1636	5848	SearchIndexer.exe	101
PID 5848 wrote to memory of 3976	5848	SearchIndexer.exe	102
PID 5848 wrote to memory of 3376	5848	SearchIndexer.exe	104
PID 5848 wrote to memory of 3060	5848	SearchIndexer.exe	105
PID 5848 wrote to memory of 5504	5848	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_1b85008b811183caa93e0f3dae429e14_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2392

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 25ea37dabc874c4665323b243b4c799f3cb66fef1b1c5246f5b309f32f55a49a
MD5 498b9b96d6af22e517011377cab9f299
SHA1 5f7fe1bc69b1984337b84034254d3bd883f2379e
SHA512 6b53538db3d7ddceb8882021673d0b26b0213c0d318cf0975f684ee168fbd895a80bd1506210aef79a03a467fde7fad0a9fb24930c58e57f641fd850309b72f6
SSDEEP 49152:9b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZB+kn3Hnx:D3q6sjBM+k
TLSH
T1B1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 39f70eabb265f0c3fa190bc5173f470b7d400f79b0f058ab076579cf501b7888
MD5 238656369b9dea2c9f2d344a52c5dd7e
SHA1 475eb7cbe7d7c1e1dc80afdfc75dfeb48218485b
SHA512 a4db5ae28b4f71e44f83d2c036e11ee29a24bd3fc56744cd560af9bee3fd5ec5bd8fc08eb02599bdf5e870924c2c9371a79bb0c35ce8362c70712c60c29e40a5
SSDEEP 12288:f1XLsswWkxy2lRq2czAMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:dXYfDtczATNyBo4kx929bL3Hnx
TLSH
T1DC65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c5911286928495d279e291c0e17f296cc19a95dd29658b7c761c7ea1a6a5a396
MD5 de6123e9e88aa5cb49a581599b2bfe22
SHA1 37e52cb00d2fa40913f035e466897bb4a21ef6fe
SHA512 5e8f1e50e2dc5514730d1e2c4e445989897f90a81feec1d11ee2a3c921c3ed5ed024043879255dc36fb9ce11420c5dd4f6561cc9607437a39425262ecbed8a1c
SSDEEP 12288:KXZNYVLeyUji0h90ZD0wxpGZIVuArHsdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:+0Le5ji0hmxfrMCNyBo4kx929bL3Hnx
TLSH
T145859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 791c0278139a7e4d72f7c7fe20f44fc7ac70d86f45f3b86ef0df7cedf85ebbb3
MD5 649294828252992ba66543eabc9c6fba
SHA1 7bdc1c8b303b085e83108d0f0dde7949963f927a
SHA512 32052a3a1a4534bf3b50fac18bd0f5fa0f14e09beb6e4f56b9ddaaeefd5fce45bea2e942a5236ef56e90a2ee8674b39b3393aa1d218cb5ac741cb395ae0fd0d6
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWn6q8wyuANyBo4kx929bL3Hnx:Q/ezSC6vUzPveHjyGB+kn3Hnx
TLSH
T1CB755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 08c75a4a4cd51b5d8199bc219960280046a1a2e86b6cb4ef71fc155a36a302a3
MD5 e024f1bd240320e27e6e68457215084d
SHA1 008ec81f3a7e05d7f81118cc914a96aa091f718d
SHA512 a3e858e18224b06d040089463190d01a705dd7f59b0f48cb21d5eb8782c63a0d2ed2b30048d4297ee855531cef48ffa951ce6fef6fd8aecc313213236477e247
SSDEEP 12288:KVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98wLDAptNyvUgXZ32dT4ePc7N29CD:KVbqPb88hv/l+YPNyBo4kx929bL3Hnx
TLSH
T136559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2cc59421cd057d53a99abd23c3f69d522d0184ec12c2f376da2d738263952ce1
MD5 8ed76889c210963a08e20d31e73ed0bf
SHA1 e883834e910772ae41b723ec98e94aa86b44aa4c
SHA512 52c489a3d9ce4a5606e879d1a476a773f3143266967db8a727d16d78b69c708f2b59bd3cb31bb6c348adc54beea0534eb67e2a0bbb172c40b86a10022ac26c43
SSDEEP 12288:SmhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SmeNyBo4kx929bL3Hnx
TLSH
T19A4523124B0C627AFBBD3E70759E8454CC35BC8D0D95DB94DE62ACBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1fed29a845837efc1975019ca0e46b69bd89e41d5207e96d01a89c01f9f0c1b9
MD5 4d2a4f8eba6f661f4889fe0983e86565
SHA1 8b4a9fdd717c1929be3e0c37273acb116552373f
SHA512 ae133df80b98e37f9f43fb380ebfd9b4eaa8ee9fc8db2d05f76706aa2a7b8c72cfdd1c12afc8a9e104c9d519b229637db6097151e641cb1db40c88611a556dfc
SSDEEP 12288:QeBNUbTVO86UYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QJIUHNyBo4kx929bL3Hnx
TLSH
T1DA65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 30770c52b8a67621d1e1012c9a731e6911238ecf8b9c617d24f38d81688a9593
MD5 b39ab4ceee97b72083c21acf035703c1
SHA1 ad0ac841fbeb141409b8d504957734e0318fa041
SHA512 e3fbad47483a69bb2dc468f58051744a84ee8cebab2cb519ef7d7bcbc59d62d9804e12f85c34bbfc7927d3ffe314fb192ce019553d33aa9d1dfda22640b238b1
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THy:sQvGAdlCEL8c/DRNw5Cl+k
TLSH
T10F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 91b09a7c7336db7ce313f68a07716b38cbeb108d838ecfbe3f441a8d48a229a4
MD5 924850bddac4ccd26ddf2128da545a02
SHA1 02ad1aa387b104c15ed34abe8271378eff4d4961
SHA512 ce63d845c6d71a6b3e0d4cb8ebd9250bccd1d8e1b07c1483f95d7c9648774615279aa1711232abc555a5ae0a2f947ae946d6afe458acab67ec1bf5f59f983882
SSDEEP 12288:cAwSfxL/2Dc3XDLLmt0LDQewsAjuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:BOewsAjdNyBo4kx929bL3Hnx
TLSH
T1A975E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bc770d705fa90fab2b3e421add41ec73e927ea63c71a22f3114f0fa002674d5a
MD5 ed4fa4aa7ac5f2309c47f9c3a9775b0a
SHA1 17183a2979533af7ebfb683dba60077da18da523
SHA512 1371e8a3e1534140d003a10ce15da618dbad4cc2993fa8a5faf8e72c3e0dffa0256b3a5d8406f4f79a5feaa24242ca3e3166006af9f3243d3b4c480c7af035fb
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHa+k:8UEtQevvqc2W1cpV2tI32a
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 44b8c83da2474c865fcc199ef1a32965be48052e124cc0a1aec42e1c330e8571
MD5 f73270b83a791e866e4f7968ce893de7
SHA1 ed3f5d7fd3da83b385d0356e8de041cdcb366fe1
SHA512 013f0f215d310cda59ced4d635a0e87b7b69367aa214dfcf80a3a57f3a9b6881aab486b36e6782d5289d92153bb31a6c1f53ad83c59cf9349b12904bd7a4d8ed
SSDEEP 49152:+CbRquA/m2yL5zTfFiV+XenmE3/z6B+kn3Hnx:zoquVjnmJ+k
TLSH
T1A7D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 69dd4fa0891680557e1a2f06afe07d068c02e16d9e8bdc0b9768471981e95d15
MD5 a9c987453e85fecae7dd07c1f55939a2
SHA1 fa0124a13f482c6e6faf715c5db72c5fd504666a
SHA512 afc5a58b133a798a616732d1e55af547cc9ac806532fbde06ccc0037f6ac479fe5de5ef8d4167e447f9ac429999bb21e5ca1a95ac72f4b9accd2b0529cf0d61f
SSDEEP 24576:jAhGL3IFoiwtA5l7S53ENyBo4kx929bL3Hnx:jAMUFoiq5vB+kn3Hnx
TLSH
T1CC359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8ccadc6eaec9882a32cff1eb665b498df09e0012be84c369a61f1324adfa48e3
MD5 95234226ff3785de1e1c90ceacc9c2d3
SHA1 3270f32b6bc3059eb669adcb698acf823a9eb037
SHA512 f843b69f7927f9cc86cf3fa622285a5f687c38818d58c52ff55a910c02cc91631cab0948a484a54b6e6ab266fddd9b9b996790642015694c05b7f9c020ea440e
SSDEEP 12288:bmw5HEjsChNzBFgl0WDm+CzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:6wu6OWxNyBo4kx929bL3Hnx
TLSH
T1BA65010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a260a11604fb8c73916132a9f03c7e535a30c0ab7e9fb23077befb9edbfe0026
MD5 b98cfb90ccb043351f83ee01bda1414b
SHA1 956acd0035e12d1ca27623df1eeefffc27ebc005
SHA512 11876b1e4b57b634c14e046fcba3d13618748718651757a0ca54229b0f9b8ddf33c7b3827172a1003d29fa6a011306080c2d60299a8527f3790f8bdb90ff80c6
SSDEEP 12288:PgZ1Iy+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oZu6NyBo4kx929bL3Hnx
TLSH
T141551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e6fa836d551126770a6827e209ba5d4f5b320af514993f7ef62baa3257cc5db0
MD5 48fbeb8584b722c32ce29cd0e78e454f
SHA1 1b70b079a89f15556a2984b121b4da112fe48826
SHA512 f078ca43f6b0d42284e028174b3e5d2ed24a1ff7414ee2bbcdb8e1892b0f9b0f4e4e678425e10a1812deb597368c52f81a01c928353cf56574bf59f089e24725
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UG:bQRQyi36YOcPbLvw2gAf+PN34+k
TLSH
T182666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1e2e96389436046220f7967994f9efe43e3afa73ff66c1c708dce2885090ef31
MD5 1647954f01406dbddfc07c4403bfeccb
SHA1 42bf684b43518d318465b5742487f3f0f495def2
SHA512 b4f0f0b11fdf86e53d43ee00d3534b092a08dff11a56e53e96ddf4701178d0aa7c90edc67fb4d1b97dc1d1db106b6373025f3c2a8dbc2459fc21d9d1131cbb98
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UG:kQRQyi36YOcPbLvw2gAf+PN34+k
TLSH
T13B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 336a32c2c80b88a7b82759efd4db991f9bf24de528ea7bca9d0a232782cf7e01
MD5 fd42e8302cd762488307b8995fe108df
SHA1 493c935cc6c3ce4fc8d04a7de43f83e4483b32a6
SHA512 9e70ef4fdb673fb45c97ce095d33e3c9fde3a90a10ce36e62f1a5df794a19bd24b43b3d1ef2f64f318cb3d5910c3fda33115cd6e2d15e5cbc555e6a9bdd65be9
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0KNyBo4kx929bL3R:T68Qg55nhceWu7PNU3/KB+kn3Hnx
TLSH
T1DCB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f390c9e842e4df3d94fcbc613a7bf8c25fb3e283d3f83f2f55b31cb7afd0bdc1
MD5 f88f4f04185e29e75f4c2c0e5ea9f228
SHA1 578a4addc669f81a667da386b0e9ecc4be7cbfdf
SHA512 4aa2764777f9ebec53a337963ad160d7fcab09a5ef06a34c2008f40b6425fc5b213a4030d1a587fd078b028c2696408a9adee16ec41f2505d631717166065b7a
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99U:Vy5112gYy5azzVvt69nLKnhZD+k
TLSH
T1BC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e81536008a4067679d67e49e3a8eff3548294ef1870c4aac916f9ca06724e138
MD5 0036b64080d4c5066286f7e2d2d2f726
SHA1 4a7ec5fb093c27d60d213e661f59eae178e3c9cf
SHA512 3ab7fa9f8afa5a617f3b1095b31040b68c214865eb00518fce8a5292712087c87b766a94935afa00a091e5576adf8d116712e993610d60cca4c28a474283ed81
SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glzB+kn3Hnx:Uu6Jmdxd2d1+k
TLSH
T1EAD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 19fcf3f067f89290a8c75e5af84ada9a49dc7f1a35b7cbb8df1794dbb5935683
MD5 d222e4559f30018b3ea9fd4a27a31bf9
SHA1 80c6e2eb30c6a722376de4c186813a733173a73e
SHA512 b6d408215e051f8fc5fb4c895a431cd8812bcdb2521e84498a4c2cf50dc6498759f47b2ab2360801e395ee5931831956ad0ce51b85a0023a36f48c6960311275
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xIB+kn3Hnx:ImifPWRJ+k
TLSH
T15FB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a65bc36a85c27bdba9edeeced8091e1fb6cfc693d453a7fd9ed70d6a0df0e37a
MD5 5900ea55330d26264cd9dec01dc2d6fe
SHA1 bbc1724c9010929b8d66a986379c00cafa150e56
SHA512 68866bb92081b034d957e371c020e04bf92df564f304454d931ba1ecf518d4c9ba7c6cf8531d1c242e93c5fd3907b1802418162f23fb459db1780b36903b1239
SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHqpB+kn3Hnx:x5dKii61/+k
TLSH
T15FC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e244a31e1427dae1c1e1003d96dee08775398f0f2a79316125c551c9fce60bf2
MD5 9a43a30f7f250f69e8c732bf579d8c71
SHA1 7defb29e7d14bd66bb8a0cbbe78e19922aa4c560
SHA512 e52de65ad3f8c59cce0846e5c00e5e234626846769ea26c95e71e93588086620a589c41fd4659331322652b91009826b6dfe3051b95fcee1acc9b4c42149462b
SSDEEP 49152:AhtSn8EApI0fig3giDn0AP5w8B+kn3Hnx:RX2imphN+k
TLSH
T1B195BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 da79b111bc17f45f651ecfe12a03d0a6598e1e324a51feed7cc0bcb5b6c7ec8d
MD5 3ed4bfbb06f9dab0e11425d42473997f
SHA1 a11463b0d6c7a7fd617a48732e123a5116a77eea
SHA512 34f7c11023fecdf0651febf21b411e312fcf82121071478d3e96868821d4c3f8c4adbe30d2abf5511a0ddd3cf85eb704e679e445445d22198eeb62a6f6fa4b46
SSDEEP 12288:gJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gWNyBo4kx929bL3Hnx
TLSH
T1FB4523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95793dd055ee4f1a181e6da2f1fb55fd4970f2fe9394e0f25fb9e56294cc3efc
MD5 ece1c4b254236d410e633d612a392731
SHA1 39eb8fc977554d817f50ccc9aef7ddce754a5ac4
SHA512 c83cae3aada4040cf94228f6821d2eebd2311da80b49af20c522b94f08aca182977415e65d50f97e8aa6b6ad3394d30d329c8a933959b50f4e024f09ec53b171
SSDEEP 12288:+SLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+5NyBo4kx929bL3Hnx
TLSH
T16F4523125A0C227AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 42e2234418d66a39736c2e9ad55a3b6f8ff1e497111f0a0d3043aa8478d588a2
MD5 647869bf4b4c778c47092de1bf8b4b7a
SHA1 1c3a260224d8cba81dfe7cb762c4e892885809f1
SHA512 dba568a30d75b0c3e7d93af3960b7d2705345b06e65bdd62d86a8aacc05e5132089e4f4e9a8307221efe6f4d931c57df87884a247f9a7b290a57b0e6af669faa
SSDEEP 12288:ggLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gfNyBo4kx929bL3Hnx
TLSH
T12C4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8a6798b6c5b86bdae1b5d907978d5498ce0b3b36be08071b82e320b275a7a0f5
MD5 37275e300c6e3983a6c5ff7b2d810dce
SHA1 4f89f70febf56c3d050b352e592aaab98522753d
SHA512 3a7a52905cf2c5f07c2da7974c1aef8fe90c710f35ee6b86b011aad343fc0c02ac7a52a5c590836747ee65007b953c8ca925d4d042898c104b2691e21af4b055
SSDEEP 12288:6VfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5NyBo4kx929bL3Hnx
TLSH
T16B4523025B5C12FAFA7A7BB098568054C835BC8A5B7197DFDF124C7B0EB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 071ccfbfba82db4fa6f70990ca58b88d380b682c002bcf96a16be231afef2745
MD5 524907539bb4a18e9f51704d961dd6ca
SHA1 fb53a01e7484ded3bd20acd4ab68a00207892618
SHA512 9e9b6c6a477d078e90ba836c0bdaf45d275b15aa03f46e470d61033a33efdfd1e9760b1b7d09438297f085d72504acd552bba8d8da4026ecfe7d9d89b84e79e6
SSDEEP 12288:E3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EMNyBo4kx929bL3Hnx
TLSH
T1F64523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1b7786aaaa5092c265e57d791d059744d1947c65cb25ce56a9f9dd6a942f24e2
MD5 92f0f89e7621de0139eeb71fda5bd124
SHA1 0781862a9c7d67ff886bd7f1b1793802574b112e
SHA512 64fafe6f0ffc851d1f59d7d36fcbf537cf349101bc4308536bda8583ee8e51543ff23d1e7f9e145a6cdb2507e3535b31aa4ac61d2cceb9f12f937a47a0445cd7
SSDEEP 12288:k2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kVNyBo4kx929bL3Hnx
TLSH
T11E4523125A0C227AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b51c9967034464669d696ca65c5f0b9478a5dfb00e7cb88da71f11f797c7a807
MD5 f9e801e149b85200ec7afacf1eb7aca7
SHA1 d79bbc4aec5d0954f131f54f2c3517af8702ebb9
SHA512 f3ce25cde85f147e0c9fcc9fba8c9fda8ee5a48b6c6a7892aea3bc1185f68fe592302340ef24ce8a1e4641718ac48e3401556d9ede877433b2eb014f4eb69570
SSDEEP 12288:bKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bBNyBo4kx929bL3Hnx
TLSH
T1084523129A0C227AF76D3FB065498498CC34BC8F1E95D3D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b719cbcd14ae860b4f585bfac050da96cdaece274b5cf23a14178dc08dcfb28a
MD5 a19d5bc775fe991edc0d35ca21163ddb
SHA1 f53e8e9f62092fddbdfd865df0120cbe0cb74db7
SHA512 4575837cc0f238d05053a274552927404407be1c9f4b8e74393353f45bf03a44fb1df59d7dd22f6b569b22472f151df711e259463f3adb0dc8bfe29a4bacdb8f
SSDEEP 12288:OiZwbjzzFEoS2cPvyyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:xZMXzFVSOZNyBo4kx929bL3Hnx
TLSH
T109650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 be606f9347773faacf2b2b4637e6c9ddfc0a52bfc5da5b7f5ca8c22fa83607b9
MD5 77c38582268e6c583528fe68c8837555
SHA1 e271f0d9601cf8909326a473841d86c7feee8acf
SHA512 4b228cdccf2fa29a42cd62842c8255f5f8f39dcfdb64b8051864e13ae841ff3333235c49179bd81e9998ea57e2d11ac10e6812cd1cedddb29dd87c81798861c8
SSDEEP 12288:P1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PqNyBo4kx929bL3Hnx
TLSH
T1CC4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 25d25ace7b04450a96d4af65d14201713d6f7522e5e1b771912c99ea64ff262c
MD5 32db4e4359cb2d170b4c0376c7c3d9eb
SHA1 bb6025630c0f243d7854507c25ba1de7903506be
SHA512 ef9dc150ec1dab25bd4f0cf163b0e29a7ccc70a61cac45b7eda4e17b2fd9a0dbb1e0df24a873b194fc48aa6cbea541a90e757dc4e2cee751d00095a265c1287c
SSDEEP 12288:5xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5ONyBo4kx929bL3Hnx
TLSH
T12C4523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2aa46d1fdcbaabf4a94639d03706987a7d4c2ba73ff3d500260bf72501d380e3
MD5 690542ec55d597411b9cb9ba67c561e8
SHA1 d4956ba06a9e4331d85361e2f0e64a346168a982
SHA512 90b3f3c01050fe9477f397ae9b54f8307081acac3986d29487dfc0ff2b041827b535526279fe9ddf267fec53d11381a3c4984998f93366dd1168176a1be9225c
SSDEEP 12288:UyPz5L8+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NzyNNyBo4kx929bL3Hnx
TLSH
T1BE55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 684bc8ce0356c4fecae644b0d9ed5bc13100aefe047da92b6e5175a266f13a1c
MD5 7ba7ca0cbcfa302cec50c1d47f244828
SHA1 8a6dd39d5d02c6447d2757cfc71a42030f3971e5
SHA512 71659d9defd98db2463b59d1aada5ef9a36b91705d3f752902149036f7da5309522447dd417560b43c7144893bf0a2195037cf0194e30a17ad5e9765f297107e
SSDEEP 12288:B1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BqNyBo4kx929bL3Hnx
TLSH
T1064523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b532b3acad9cd0e6fabfe232b9c6ceab74c970fa31871737019022f3f06ed306
MD5 08e83bfcf8465220ee2137d8972ee3eb
SHA1 9c4c526cd0f57d2f791817bfe90befe10cfec05b
SHA512 7108e1d2dda22fe0c30a6d9a892f410629c594ab2efcd76258f6d2907887727295f20363b52049cfd73a5b02d1a9f571b9ad3ed85c0548726396fc07bedba10f
SSDEEP 12288:L1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LqNyBo4kx929bL3Hnx
TLSH
T13D4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 11baa1f83d9598617079c820358278df13f24caed57d8f94d18069bd186f7dc2
MD5 c06c5e88dd813a645d5c94c43d2c164b
SHA1 303c4502ae87705e4e3d8019f38e86d4a46d3e8f
SHA512 b922759907ffd1918504f7469f605c7b67c1f6713b2374ab1693032b1f5e0687d59493fc289bc2cc08c3ab7e5b087026e7fd584faccb6a079e54c644136abaf0
SSDEEP 12288:AyPz5L8+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xzyNNyBo4kx929bL3Hnx
TLSH
T10C55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 95e7050d569f7cbcaf970f30e84204bf4f07adcb444844887d915d853bfccbad
MD5 ea6d32d9954880b4ee41e34deb51d215
SHA1 c8a5c844caf0072b904fbeb9b5f236b2f8385ed9
SHA512 1731199cc5e92cbb780c5eee42f4b77a941aa33925e887e73f261ffaabe28e2a2cf80fd9cd1539dc16a0e1d6891c67658c3c38443e31caa9494aa1be18a4d076
SSDEEP 12288:7Cd98WYoaLHF3z0z04PDvhQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:2TtaLl3z0zDvNyBo4kx929bL3Hnx
TLSH
T18A6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 25c569196f7fe8463be5b394360a5f91fae643592c639d52a5e6c0780e7ab7f1
MD5 9e90568cf02ea69e12e4d9a454d999cf
SHA1 01b6c55d7d97258b9378e86687079f3b216e1958
SHA512 d5363e54c6760915e42e631cbd25876062c8d4208acd4ccd3d6ad7d7996c74e01021dab7a4879f460bb1b19c316835bfb8562f6e01812fb427c085d763a36eeb
SSDEEP 12288:ri4e7ARdTfgwCHKy7GLbbdIvrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:r3ld9CHKy7GZrNyBo4kx929bL3Hnx
TLSH
T17F75CF90F3E810E8F1B79A3489764511C9767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 aeaee906dd45a1d5111ba49afbd13eb1162856fea4b46bbd9cc11c4d1cdc661c
MD5 441240c7a102ccb00179e91227cf1ea7
SHA1 68fdc5443cb1ce11afb5c52439d5c943d6be086b
SHA512 59a4d4bf592a853688e118dc358ebc7ece58f6bdde912259f056be7323b6a6a2653a5f328ad20836bd57d27cfdfe19cad6b822ac38a470c98e0656b70c3285cd
SSDEEP 12288:AALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:A/NyBo4kx929bL3Hnx
TLSH
T1214523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d35f5877105c53cb032947a2e665df66d45054e31b0f41f4e08c35f4a198a9e6
MD5 a8ab1f410c752a7429a5b375efdbafa3
SHA1 2091a5e17037d9c09b7800ceb2683d3783f190e8
SHA512 3013d2e033b81e3b62242db8d01dc81a500f4953c6cce731b6430a80c8b4f25117c0299f80bf5e84bbf8c93576b1baa4592fae3d159d7abab996f10d8c3713d8
SSDEEP 12288:seLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:stNyBo4kx929bL3Hnx
TLSH
T1274523125A0C227AF76D3FB0644A8554CC34BC8F1EA597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 aaae6d5c32e2fe8352dbf698a4b35849116f33abdacb2d10e38eff66c284b030
MD5 8edf66e464448a3de3cc8fc3e28eea22
SHA1 56a682707e8500cadeb7a77bf38e56855e85c952
SHA512 cb3057186d6da60445deb4e7271fb0303faf6f8acf2fc661ac818643b908bf1032742795811c65f6619c9d2a84b8d437aebd9d6244fd224ef3ab0519568a6889
SSDEEP 12288:IrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IoNyBo4kx929bL3Hnx
TLSH
T1004523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4180d20be0d9aaef40e2ba36fde1fa162934b26b25cc0216e02c62f4b628bc1f
MD5 e6a66caedeed1036539a6aa14f4ac5ad
SHA1 94072a28de0a001004c2c28ff22c89ccfa273a80
SHA512 68f400453fac8f21f6ac32fb54150fab1437f64bbe19c16c6ed130ccf060ef3a3a01eb2df260109f7a43fd0b375a3b1b36d1dbef1b9ac1687515b041312b4145
SSDEEP 12288:h1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hqNyBo4kx929bL3Hnx
TLSH
T1A24523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 63d8d9a13e38c17bb7cb25768b5a71c0a7486013ac3a76130f976de298747dec
MD5 9c6bcc4611cb529317ce5021ff26a7c1
SHA1 a55a6e72f0ec0be2241fecf339615147cafd5c3d
SHA512 1f1d8531b8d1ddcbf50d5af75308a6eb3aa16f61bfd203df3080e6b94bdc3c63386db38ae03b2c21417aa8f3350a8c19038972c7bb3d9add63a8cd877751b9a5
SSDEEP 12288:RALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:R/NyBo4kx929bL3Hnx
TLSH
T1D84523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 89af5c2c8cf6b68e90b6c157e781000c2c2bbc6acdbd9ccc27605f5a0af67df5
MD5 0f6146ab66f9ba1a3baa4d99348c6065
SHA1 a39f7768f9e91d46fb298660d9f2855bf096cb6a
SHA512 8ed106fca47095afa69a01dedd8851412e60c04a2babb92b5838985ae02b948ab6a22b761b39e5665e26a995a8b2a636eabc216ae138ae42d31b2d39db07bc1c
SSDEEP 12288:1NLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1SNyBo4kx929bL3Hnx
TLSH
T1A94523129A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF27987759FCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c6e7804c863c6611dee3f3ab6ad5d4ccbced693e6c02da926e430ef74d6b08db
MD5 767f2841c8e731e7045573095cae8bfd
SHA1 f589167de9dfa9d60378b8e0dede2d2dffa4325c
SHA512 09935a8041358a29bcb3259cdb62adbddef23aa698368878f59fa4fc238c707ec6703e2a2d4e6fa3a1c22c43ceb8d8fae42c4cdcad469a5a29f4aaf1f341f946
SSDEEP 12288:l3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lMNyBo4kx929bL3Hnx
TLSH
T1044523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3dc900118783173a96b5c08dd90f4e33da10b3033041bf7ef37ddf9209da63cd
MD5 be03ea60ef3a33221626bd89a0c26762
SHA1 d07eb966355c5b2e1395c3414f87dd246d7f4b7b
SHA512 c59ccba406ed4c12221bf3f6e40e18ab29d391a45a59d4cddae054f4bceb334681f4d7ad7c6e06c402b2d88ce3d6a188e00dba5f923a034a05bbe7a907f9d4ab
SSDEEP 24576:qfwvqk9RX6wkyAI+NyBo4kx929bL3Hnx:EMnYI1B+kn3Hnx
TLSH
T1D485DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c27fad222c4f2b2dc4cb6ac0397eff8e0c74d64340138f822b15f8654f840fc
MD5 0e4f5dfd82999a8b548f7ff4cb77ae63
SHA1 1b235949e76316f695c49d9f5d1e3f55df375ac3
SHA512 3b5b3dafcf890b0ae3ba3fd02bfb4e27a7402725875a286e5bf81db45252bd533efc14f64aea7bcd4d5514714f958552f867f9e9a626cea675a48bf6207013dd
SSDEEP 49152:pYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cB+kn3Hnx:kySzPY+k
TLSH
T1DA066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bd5e0d53eb34e74c688c98503818ea16c9ce1548a64213d2c2834fc8db55d4a5
MD5 e1a3f1caabb3beb5f57493d4008535a7
SHA1 1c59a4cf3bf038212c77215df28cd4c01d1a0dcf
SHA512 709d918749ec9a5e32ecbbdf6289375eda16fca1e4ff234d5eaebdfd91605073051d2547483d4b48110d43db7370efa94338e56f75c785d09c82b7dc7da9bb00
SSDEEP 24576:x47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJNyBo4kx929bL3Hnx:x47JUQjTirIhCnDHUPfF/sB+kn3Hnx
TLSH
T1D265AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 42d42a2d436e4ec30652168ce4b55f705b305436dafe26413f95839a10a3736d
MD5 5d8546c97ff1ccb392dbc0e45d44b7aa
SHA1 ff71b1f3b055eb8b977811a64b902035e0f177b4
SHA512 5fd027d0cedd5b1914daacf4880557b92ce08dbfde0f77a637636b567628d1e92e29db669c1c9d9ddc5505918003e22a370b820d0d5bcbca3ef6e3f351038d8b
SSDEEP 12288:FpsflLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:i6NyBo4kx929bL3Hnx
TLSH
T1D655F01AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a355477116b712886e83211325fc2f5cd9d29ea8939efdbcf04292682e585ad9
MD5 8968938817b9e391c617e78908e968bc
SHA1 b46674f8d7165ecbc1f5ea986acb82faa8d9207a
SHA512 55859026661a55b972d73b850e5657442a7d5301fb7ffc84764f99355c3e04150a66833ded18c9263796a171f2fa6b4024fe19801eee851dc8c8e2263a9f476b
SSDEEP 12288:/tq1U3ftCRYxiNwSuBOJSyXGrZ4P9kqv+whH3mVKQn:/tyUPyS4eQ9kI+whH3e
TLSH
T1E8351740766AC75FC6AD40321E36D1CCAB707D51EE05AB0773C9873FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3a1714f034655b3e240714b50cd19526667317264770f93313e79611396a75a9
MD5 eefd4ce1b9e0faedb7a9f2d0757a5cc2
SHA1 87b176fa24c16f585237c454709f5d503ae68550
SHA512 1c3baf7bdfa2050358bd6ce6d7b56817c9e8e2433d9c5b3911e2d560908e2955f8fe7e3d88ff33b99da4e42a47160dd5ac7c536f01b77b57edb16550ef0bdb74
SSDEEP 12288:miNwSuBOgiNwSuBOZHiNwSuBCMrSeslGiHwXiaOihiNwSu7D8gwruMOphiNwhzwa:ZwGxyJC
TLSH
T19755C8816537A3CFD1FB6031071A6B4CABA4EC46B7055F2673C8453AD82BB25A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7445aea01e3464072a9531263ccb935fa5bdb5fd6a693d1f1ce554a8ea9babec
MD5 d2dc087da49bf1242b40f6eaeef39ad8
SHA1 f072debf6758c4c831922af3917d5351875bd67f
SHA512 93d2b896a75b23c4e6db699583f6a9f29e1b2c5a41c0a37f2b0f682ca56a0b0f27e8266916290ea291979374666f6e451ada094ca00adab8ee86351e47393409
SSDEEP 12288:Oy79LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NiNyBo4kx929bL3Hnx
TLSH
T176452312975C663AFA7D3BB0645E8124C839BC4D0F50D6DBEE1258BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 012f2e03c4b78a325e82d6b696341c0ba3320d87375f974a17ea16e9891d061d
MD5 a7d71e8ad1e26f4b67fea474d0fd8243
SHA1 9476fe0efefb27d8149b1b25f95bc5ccb23a34f1
SHA512 a8b4aab6da075cfd1a245627e05961123615aa3b73d2dfdb22811aa8632a2eff34948a0cfddbc7ef2143f6ef3f1d162ed442058c530173056f9e39c25a9004fe
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYANyBo4kx929bL3Hnx:Rgb4mBIBhGFuB+kn3Hnx
TLSH
T1AE65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3c318d82a614dffca28b617798d2052d07c4894169eff941bff0c30dcd134cac
MD5 eb53f7b8388ba66dfb3fdd34f41d2d3a
SHA1 656bbefca35bb6513f8ab48711da24b26bbecd59
SHA512 13e7027c8a0c429b31136c448e419364ed0b25c39810a9b744902d288ec1f89d0d00c184d4868143bb226dbf7faf47d2a72c4e6b75042cdc9ff4d535f031fee7
SSDEEP 24576:KG88u8FpJqH1Jzria7/mZNyBo4kx929bL3Hnx:x7ZFPqVAa7/rB+kn3Hnx
TLSH
T15385F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a2e789c39360f225e71814fd3a9bc370d9c4043761798786ab8974ba17f47ddc
MD5 9ed90ac7af8cc2071dd5f5c82dc092a8
SHA1 58d346a170da457ca518b846795329d9fa1014ee
SHA512 23dfd058fce8483be7999bad5c1e6c2363bdfb7bf2305390ba91bfd3b52f4673222e95bf4ffb1004196a59c841c8fa49a8d6ca6c64405fa7253ef894d766e232
SSDEEP 12288:ZHvUrBFrEjwaQGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZPUr+NQFNyBo4kx929bL3Hnx
TLSH
T1B665F21F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bb096e45f53f37a922c5c13d24a4c62651739c166879436953cbd654d5b421f9
MD5 590fd1019c8ef2f1c60c5b229bb7360e
SHA1 2960fadf53f9aefafc2b96976d7c4c057ab7d12d
SHA512 c406f16a50aa820c0086ddb6c319c1499fad920809187c6d00a2fbc1bd40655999f6032e249e90d7fd3ded3442dc00e5461af1ab632ee4cd9b6cc4b9ae7953db
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCB+kn3Hnx:hG05lO43bL+k
TLSH
T16DD5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033456CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 54fa7815e6fb870555e879c34fdc047f68b7e86d3e77dba5b24bfb87d60729e0
MD5 2770b8fc40961d7a40146ab5501ae74c
SHA1 c98535c6e2283be09783c37070afb36698a28a0f
SHA512 2b273a4798e2a115de3b68357b1c652832a79302792d3dee8f3659aea9cbacdfd49214c43c5f09eac592304e0cd7a5360dd7d758f0cb409cde76d3a4092a7503
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnzNyBo4kx929bL3Hnx:aa5POZ3BJt2pasx2+mKB+kn3Hnx
TLSH
T19165AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1152cf4c7e45fb1a79ed938244fcec9661c7e2c67aaa4eedd9a90efcde5a7f29
MD5 a51ab124bef05e7d78dea637567cadf9
SHA1 bb692a40d0c53e8a95118562cf8dcc8d5f0d4f0c
SHA512 8a5f611b1b92bbf883adc2c1e13d4df65d756eee0c623c0d231082c142a2e065288dab94799413ce78f1af61a90e2dcf7e055c0e24222fc1336834dfdd603e14
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkRNyBo4kx929bL3Hnx:SNc/zEOVHFLB+kn3Hnx
TLSH
T139858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a5aed577ddad931ddb590a34c6e77b20c194c0a5f2ef7ccc567e0865e6a132f9
MD5 66ea41e8e151c0f88dbcd5509de8e817
SHA1 fbebe7f6e6442762dabb19758b20d076f6ea3f37
SHA512 f6e4ae8c075d8b4549d0af4764a6c75af133443786deb0c76365b3d9b7960584dbdd3b7df9dc8f1ebb2cb6efe23fab044178549c4b2e917ba22223c45ccfe757
SSDEEP 24576:UTkNvNnaFeYhJNtmZBmcNyBo4kx929bL3Hnx:UTMwBtOmHB+kn3Hnx
TLSH
T1DE55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 77da9002b2effa602b5a21f2844ff1434673013fd340639917acb1fee89a7cdd
MD5 5936fbcc486dbb3947bc954d75e30354
SHA1 e0148b96ed791300f25b3079da19b2c8cddbcbd9
SHA512 6cd600949e23c5b908978ca21db26fb8a7cf93d5ed0371cf02adfd550d5c254b48b59c4c26aafd60b8e003d3c370d8126ec200bbb1ab6717f17b3f3e5b5b6f14
SSDEEP 12288:uQcMxWDXN1Dp/fshBItT1IQgApLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:0D3FHshBIYQgA2NyBo4kx929bL3Hnx
TLSH
T1DC75E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-82-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/628-292-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1628-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1628-326-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1628-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1628-86-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1628-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1628-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2392-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2392-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2392-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2392-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2392-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2392-309-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2604-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2604-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2604-243-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2604-59-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4100-7-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4100-15-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/4100-13-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4100-9-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4100-2-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4100-0-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/4336-78-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4336-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4336-70-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4336-277-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4464-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4464-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4464-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4464-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4464-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4480-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4480-18-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4480-26-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4480-24-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4480-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4616-51-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4616-43-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4616-50-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4616-44-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4616-55-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4616-57-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5184-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5184-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5184-125-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5184-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5184-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5764-112-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5764-110-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5764-118-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5764-312-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5848-313-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/5848-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5848-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5848-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5848-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download