9536f7e247c566afb2eb79681a045d475e6b9cbcf439ed537fb3dffb08a29d1a

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 992KB
Sample260714-nbtxzady2v
SHA256 9536f7e247c566afb2eb79681a045d475e6b9cbcf439ed537fb3dffb08a29d1a
MD5 67d25054f50dfb7396228c7f0dfe928a
SHA1 a557f2833ac91be29e45e8a4f8e2e88cf59d5dae
SHA512 039df578a6ba72f19555d8bbc6f59b4ec3b64e5cc7efab171104d2ab882e5b08c46b8ac04b673c7d9b3a0d4d9103a06da7e498055be1cae6f21f3a3ed339fb42
SSDEEP 24576:kKLGkmFmiu2Wh+zkiGiAgNe68OzQytCe:k7Q2WgztGGQY
TLSH
T17825E056A39501F8E5B78138C9960A43FBB2B4560320EBDB139CD6751F23AE16E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1864	elevation_service.exe
4060	elevation_service.exe
3412	maintenanceservice.exe
2116	OSE.EXE
3276	PerceptionSimulationService.exe
2060	perfhost.exe
2588	ReFsDedupSvc.exe
5132	SensorDataService.exe
5052	ssh-agent.exe
760	AgentService.exe
3772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4afdda0883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006adf56e28113dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b022b8e28113dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a40c74e18113dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fbe145e28113dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002afa3ee28113dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de8e27258213dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
1864	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1268	2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1864	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	760	AgentService.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2588	ReFsDedupSvc.exe
Token: 33	3772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3772	SearchIndexer.exe
Token: SeDebugPrivilege	1864	elevation_service.exe
Token: SeDebugPrivilege	4060	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3224	3772	SearchIndexer.exe	99
PID 3772 wrote to memory of 5392	3772	SearchIndexer.exe	100
PID 3772 wrote to memory of 1536	3772	SearchIndexer.exe	101
PID 3772 wrote to memory of 6100	3772	SearchIndexer.exe	102
PID 3772 wrote to memory of 1872	3772	SearchIndexer.exe	104
PID 3772 wrote to memory of 4668	3772	SearchIndexer.exe	105
PID 3772 wrote to memory of 4296	3772	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_67d25054f50dfb7396228c7f0dfe928a_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3412

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 57a46c7df6f9c213206a213f585d1971ffabde672e7aa3f586be5a66e5d07c01
MD5 9fd62982cbac0af8921c969098ff12c2
SHA1 67faa429cd8fb00e8d0ded98e983a1f2553c83a4
SHA512 a5da813a6cd23a9c5f9d220f0ac169f23aa3601f78022060e3f7e9444453348d39d8e401c5e5b4990337b450e376d9bbfdc54b51b2baa5db8039f5f658319f87
SSDEEP 49152:rb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnr2WgztGGQY:53q6tjBmgIG
TLSH
T147D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b1c7de06d5ab3b21e00caa1bdc8bda0cc70a45a1177d4696fd4c3e889e08c6e0
MD5 d66ddafae38af0c882ae6b73ffc11621
SHA1 d4753da7c64a9c716575cb4dd52a5271e49516ba
SHA512 3b48093287b96ac002718798637f854df730e174331fbb25a1dc6d10a1447bbdd76a1bfce128462ed6d2027565c8a6d5245d8ab1ab6d8a89499b9f16c12b6fbb
SSDEEP 24576:EXYfDtczA62Wh+zkiGiAgNe68OzQytCe:jtcx2WgztGGQY
TLSH
T14405F13963E145F9ED678139C8A18512EB33B8554760FBCB03A48A6A1F337C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 53eaeec731d786735ce6b64834d98948c1ee0b9503a0844a9147a5267e980f0a
MD5 554715b13faf22ebe43c591a0eb06446
SHA1 b8b1fc0e9df59c1f4c06f4e9db22ecda0994cc78
SHA512 5c9cda58bb9f35fced0bbc3630a9d149fa54c3cc5cf1f2c06b67a6617299cd4e1aee02f875873add5cd1362bca2618a9162b1d4d9d635db8736ad265356098ee
SSDEEP 24576:40Le5ji0hmxnrMr2Wh+zkiGiAgNe68OzQytCe:4Pji0Axs2WgztGGQY
TLSH
T16A358E26F6748335D073C0B9C5D2A69AED71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 896fd0afe81c7795125195da82e3a76d911fa8f0d4775ce0777dfaea141cbda8
MD5 5f221a5f9eb923cdf9b39289f143254a
SHA1 dfaa27582cbea2e8434119b3b7b71d8cd2f15846
SHA512 c723b85086980ebfca989f96c80470a11b0920929f2ed5a60a6a479747e023040cefc2ba4d30e93afb84998700ce1b2ab15363b4962cd846e435590d8b76224a
SSDEEP 24576:Wa7/ezSC6vUyDZaqgrvWx6q8wyuh2Wh+zkiGiAgNe68OzQytCe:h/ezSC6vURPvMHjy42WgztGGQY
TLSH
T1B1755D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 66848c1fadb1cee5ccc8d01f5f16f63da380ceccf6fd2e9b3242f61002cc2a13
MD5 18d029e40996e31daf0ad65a84ee0253
SHA1 b69e25cfecf815c258871e9e3f6e0755b964138b
SHA512 4671f1c81d7c811612f82a8ea4e04582310536a23a540433892464ad616510fcb01e6ddf8a11003cd0cda5568ff06966f26aebda1a7b1beca8ffc6625cbeb49b
SSDEEP 24576:tVbqPb88hv/lV7O2Wh+zkiGiAgNe68OzQytCe:tVO88hXlVy2WgztGGQY
TLSH
T138559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 42d5465ca4ebc45efcdd130400dab6ac07ccde3c2142556ac12acb8c40014a80
MD5 782494107c4a18587ba17d9edc75accc
SHA1 8b8f76f81f466bb21be64700c34abb2393d885f4
SHA512 e5cb72d4e6361be22de87eba0772d1b38af5e0abbcef8cf13e5c88f84a3877d66dee15109194205661e5233cb190db928bb37414d77a701fa9aa361978294fbb
SSDEEP 12288:wG/HFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:wGf2Wh+zkiGiAgNe68OzQytCe
TLSH
T12DC4233B4362D331F7EFE53270B449D33B21AA958504BD590B06AB9E0D74946EF35A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 71708daf59fe64108c6b8a8a2496afb360d7787b546a2759070a291177f14246
MD5 6633bd1d8f6a7a7a304b749611884995
SHA1 5034b91bc1fbcb398d15d9c14dfdc301702ac16e
SHA512 f620178182913b13ce90608a0fd4862110ca56945852971befd44c2ad0981ace66e0c860f9ee1d85b59c3bf2204ff455eb6258cdb9331c50a6d898dff872b256
SSDEEP 12288:WeBNUbTVO86UeHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:WJIUW2Wh+zkiGiAgNe68OzQytCe
TLSH
T1AB05DF3BEE28FCE2C27E8DB956918640E77278704B11A3CBD265C30E9E235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bbd3cf4b83f9a1ff272d2f20537de890f663d529bca059e05bb71aa4060131f6
MD5 096d80560ebf1626f1ec59da1578335e
SHA1 803580917b1da7527dc43d447e8bc754ccb71737
SHA512 9df846eaae127538db6d0ef39f0498a4d77a28bad21519e8662838440d1d0b563229e6766f6fad0bab4e06f46ba1084da2aa1b9991a8923bcec803a6ff17ccae
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THF:/QvGAdlCEL8c/pRNw5ChgIG
TLSH
T19A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 56394ebe2dc936f84dae0ab58a6df8983703db76bfadfb36bfeb393a0cc8807e
MD5 88fb7f4845694e9d6a4cf1de77b8e5da
SHA1 726fca1a715a5ec138be3ee8e72244462f2f6b70
SHA512 e5612a46460e99ce76e6c406db63abdb4c35aa9b784bda7f789dd3c5304070c37151f63fff0141b2fb6a244ed94e9d83ed9e3d5cdf0fb9df1c12709a673af5b8
SSDEEP 12288:AAwSfxL/2Dc3xDLLmt0LDQewsAjYHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68u:VwewsAjc2Wh+zkiGiAgNe68OzQytCe
TLSH
T1E815E031FA75E036C7BF0DB21B35C716242DBA604B5129C3E3A88E9E19306D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 07725ed8235f8c568472626aa0fa67a06a8b773e7022336f8f6c9db2d68a242e
MD5 564c4e8fc7c0ebf35abd3419e25cf434
SHA1 1b61b5da4c6b8588f162b556b47ef1603732901d
SHA512 5c0af80ccbcb29a4c62dc91d5c5f746a7915b4ecb9ce494cc5ae60880ffd73c027695aebc1d1b294c4b9aec85a1b8cac26152d0e9999eefa3e1ba89d2e80d142
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHs:VUEtQevvqc2W1cpV29I32
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e70b3023ca316660ca4c221db2a3340dfcacc1f8a38599eaa197173cae1c3da5
MD5 bc94cc8ca909c7fa4ae61f1a24e6e7da
SHA1 67c0dbd5dad94bf98a92f863e97f3c7dcbd218d4
SHA512 13fde86ac1f3885c0031491c383d8c980a2c414c0c7801fab6d965f7c8818074cf3c85bebd2238e68264850fb5b894c752d593b987ede370e2535f4b6ea8d86e
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/z82WgztGGQY:uoqHVjnmtgIG
TLSH
T1A9D58D1976B8C2E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f731572f952dad7a07f40ae4256cdaa681bef04517104a7678b08924cbb31539
MD5 a5512acca1bf56d31d979337a318ce0b
SHA1 6003176fe2313ceec6473c1d0531aed3b88b7328
SHA512 f8faab28b92bbd4318c31b50129e34184a1eecdee46b4671c04f9a02fe073e13d46b3616b1822b74ea2481089845df92ebdfbb36a7e5fc81e90d3e58b6a7b86b
SSDEEP 24576:oAhGLmIFoiwtA5l7S5392Wh+zkiGiAgNe68OzQytCe:oAM1Foiq5N2WgztGGQY
TLSH
T152359D91E7F951D4F5B3AA7899B68571EA76BCA65E30D20F2250C21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b6dce1e72a56f386ec441cd47b9a2295fd0021fddc3d0fa1f847061f10d883f1
MD5 021d1424ef15e2e7d754283c3e941471
SHA1 24102abc0dca883e9c5d3680012be5ce8fba567a
SHA512 d609bd0fa79b3a9b25f47270d465aa9f42746deecf9232bf35e1febea947d8af27c9c308c5fbbe4d851169f882757a73039f5f166295c9e9f2fd16a0b0268e6b
SSDEEP 12288:emw5HEjsChNOBFgl0WDm+C1HFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQyF:3wuXOWY2Wh+zkiGiAgNe68OzQytCe
TLSH
T15D05F15A33A54CF9E9A792398597C532F7B2B8012A25DB1F0760C65B1F33351AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 97ecaab62a068dca039812d2065265a79e8266a1e5dc7352e45a89ce7aa08c3e
MD5 9e43e1cfe9d1f221a21cba7f1be235f3
SHA1 c3699423d93f307a792e67a7974f4fda89f2d857
SHA512 54bc4b98da6e27b11d3e72524ba2beaca7baeb2c78b7dd98012edaa5e9cd03f2043175939a8f3a70b709205350a7b24c7ae9aac85ca0b82ec84be58f7ddab77d
SSDEEP 12288:CbZ1IyIHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:iZuz2Wh+zkiGiAgNe68OzQytCe
TLSH
T1F2E4122B23E562F5E2E79239D8F04A82E7717452533157CF071587AA1F32EC25E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8b9e623c8281f7ee21b11df7ffbba46ce79bc9bcf35a33ad65472ff3dc16e2c
MD5 49b9888a4ff3cd7ed342689b099a6944
SHA1 405417d447df05a899c5e1fb32147c548b8c24ee
SHA512 e84f5b876e6fa7d08df2fad1b4ef8fe91c6549d8d44b112c189645d15d9cc7dd4fc3f8fe601d49fe4b10056b18a2c568bd2d74c4634dfff23c7241493514b5bf
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UZ:AQRQyi36YOcPuLvw2gAf+PN3WgIG
TLSH
T150667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ffa9c11253fb1a33caef3411259c55459699c217f70a8e5f749cf2f3d85893a4
MD5 7574e6583196f51b3d2141ce0f58dd1c
SHA1 d2d9f7b7821bd7ee48a49d154ccb1c8da1370302
SHA512 c67b05e5617cc9b2e4968cfa59244da1bb305ab072e498693af15004ff8515f0f02ac60ea236ba58103b4a94141df0a9e5d224f7c6d980e309001a353e32c550
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UZ:aQRQyi36YOcPuLvw2gAf+PN3WgIG
TLSH
T179667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7e8b584cc77a0e1854319478d4d6fc966f9ca26ddbad96ab35cb1e3f15687a66
MD5 dbdce77cd06098f7c8f573f73892d2c4
SHA1 d61061cac0ca2aa2c24d8c0835bb16fe655589b1
SHA512 74f3bb52dbe0c303eb57d41643ff3cf5288d934dd519aeee9340a9c10d9cbf35e210cf28e0b36287dccaafa30c783496f3df2bdbc6ffbc43d79579b0c3734454
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0D2Wh+zkiGiAgNeO:r68Qg55nhxeWu7PNU3/s2WgztGGQY
TLSH
T1ECB54933B2F200A9D44DE1769F4A872196D17C758FE0E7DB8501721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 10b04f0daf505203da5b9ac3a702514c81a828bb7db9d06e96f8dc0631c65130
MD5 3185f43d7acbca8348cb22759e1e633d
SHA1 4af6597aabdfc77ece8a4b52916821eabc94aafe
SHA512 ac08c155dee368bfeea1c124cf9a331f8426003e6923d316b8d87fe5df2ed33385b93d94278e0295ba483a0acc2c17688a0289cc81726b26c41ede339eb3e754
SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:cy5112gYy5azzVvD69nLKnhZbgIG
TLSH
T12D167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1113b1fb8fa69e9c5d5963e4f8638503f6f8a540df26adea64aa18436dd98f3c
MD5 1fa026c4fa9c090f685126f8e2ff41a9
SHA1 910dbef7c77ef322180f3ed1a24f63d4c416ec8b
SHA512 4bf951e3548840849a2c469f3cdc9b59dc7be4d41745eaa16e54778d645f16dd91138fe87f4cdf4be016e416b277eefc45b00106f5393f9bdc589a6d92827222
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glu2WgztGGQY:Du6JmQxd2digIG
TLSH
T149D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dde3da7094b83693e4abe7ca44bd81dd7ab345a80e10849afe17d0fd36d19cd4
MD5 e1071c45ced766db244438d24adea5f2
SHA1 d01a522d3802becd41d11c8f1dcc84f215abed1c
SHA512 347bb04249f6b414fc9981fb7b9d9cb24749661293ae3725a3d74e2080d3b9b063a0a4572edfd1cfbcac93d39cd994a0710f0c66e186ae282c9bb1dff6a8cef7
SSDEEP 49152:f1hpsNoJpF1A6yU44CwH7R4x22WgztGGQY:fmifPVRtgIG
TLSH
T11CB5BE13F2D901E8D06ED17887569232EA62BC460B24B6DF0A90B7961F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ebbf0a57fa85508de8b70f0c1a3aaca1293392cdf4e1929060f00e542fbeafce
MD5 47376a4c7605454d910e29d9d3ffcb38
SHA1 46d99cdab0c49df2db81225e4b0e85f2efc7098f
SHA512 00d7e225fb4a0e941dd98d0741866b9d3a30ff7fdaef2ab2e2576a3f63615a29fe28218d8961a8359defdc1d544fb11320e1355120d79c31c8aa1ed9cca97b10
SSDEEP 49152:xSuZQIY0Be2KIRVtOnks6NMHqz2WgztGGQY:f5dKOi61fgIG
TLSH
T19AC5BE03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bc4bc5b00a04d9e5c4e8a9838ad4222bd4a739c084b0e615d4161016d8aea190
MD5 8d9ba83cb18377c329b008fe00c8ed41
SHA1 37434016d47c854c0daa875945b471713da51bf0
SHA512 7fd3bd268e11e90afabf7a103788b3ca2024da07cf9cdc814e7fe3e91b5bd2c01d730265f4d1c48b26357d36912eb18ac7673a857b096c3f5c03539be1f9b903
SSDEEP 49152:6htSn8EApI0figGgiDn0AP5w62WgztGGQY:7X2i/phpgIG
TLSH
T1ED95BE13F2D901E8D05ED174C7568632EA62BC060B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 052d035640f308e78df98da6b63b4bdb38d78217159056002483aad5e894be9e
MD5 eae1cf18f4ad7ab9a51a865974d3da33
SHA1 cc82797d49c9d753f1e745ce7148aab94d66dfe7
SHA512 1ec56c6a7045a4fd33cf921cb1224ef38b4e99072cce78aae26b4d32cca30919acd7991b34abd69c2465550b89da48c14e6568fd5f662e09a437a72fd219366f
SSDEEP 12288:NHHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:Nn2Wh+zkiGiAgNe68OzQytCe
TLSH
T1CCC4233B5263C335F79AE573A0B049D37B60A78A86047D9A1B0B865B1F70E466F34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2f22f0c5757d21b0b59a8bb3b0c829c9c9aae4ff748b85a294b8573cf3be311c
MD5 783d84b7017d16739251db35e220198a
SHA1 2871e39e62e72d5bbd777987828b7ac15224d0d1
SHA512 f59e7c7152fee5f94eb35966b5f7a5e7f54e7cf3a0a67cd7c6cead8b650da874656b4fa92b684c5cc87df32b6b70f205bffafa28129eb5fecb9d5ce9d0e21a3a
SSDEEP 12288:ScHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:Sw2Wh+zkiGiAgNe68OzQytCe
TLSH
T16DC4233B5263C335F79AE573A0B049D37B20A78A96047D9A1F0AC65B1E70E466F34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 21b4a15523799a162480ce07475e6d6051ec0a43c614277b64997800eb935d58
MD5 4069de95491be371fbe7f9a301ba08f8
SHA1 029f73e8aadf07f9d42952059a467876d225cd40
SHA512 6c6a2deb02dc4c2a1cce26ba5851fd1f294e587138f034c10952e391e8281b7f4c668d193f3dfff990178dd3a340b2a0a0ff061f139fd3fba0c0a15933f983ac
SSDEEP 12288:dGHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:de2Wh+zkiGiAgNe68OzQytCe
TLSH
T18DC4233B5263C335F79AE573A0B049D37B60A38A96047D9A1F0BC65A1E70D4A6F34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d9fd50756c9020017cd4706a3c7988a2f284047b400d524e38b1ef478a805f41
MD5 a3840945f688f4fbc7cdf6a239adc416
SHA1 ed359146e54cb0c101d8835f3fe2f67e335c0b07
SHA512 3df8162cae1ac0566ecd41563bb550dfbe758b3d86469e53111f5e3a1adb46888e73f9990a245b24af8bc9e77d3db802b1237c96a18c4415621d8e5772dd56d1
SSDEEP 12288:3VhHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:n2Wh+zkiGiAgNe68OzQytCe
TLSH
T1EAD4233B136783B1E9ABE632D0B045D3B771B6958711BEDF1B014A5A0E70B85AE34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 434a229c62617b6b46b7896b12be3b94a5fef6567ae6872afb4e0d22be56ac77
MD5 abf2806e1590627e91ad9c33f569a9dd
SHA1 52db9f8c3d4cbc5c1822370b9292d3b91a535b2e
SHA512 bc136db9ba42bd29093ae9e5a1a16b21153fa7af6d267ce796757913dbc74b288daec8f0a310a5d4e55ed787303709f1d53542b00ad216c7a7f0f3f561122fae
SSDEEP 12288:3ZHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:312Wh+zkiGiAgNe68OzQytCe
TLSH
T1C1C4233B5263C335F79AE573A0B049D37B20A78A96047D9A1F0BC65A1F70E466F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 aef72891b3afcb6ab91b51e45bf98ab89d1d07203ce0e365f3d628c384be461f
MD5 0a125eeccd5311ddd9f106b7bb367384
SHA1 5688e0346a679b342f381c93f3ecfcc1e4b4fb7a
SHA512 2224e651b43a9bba7c107a2d5d26d3d88357326f156b5aeef723a42d673d0b5e6df9d11f3bf3083c6b4d3a4cc011c52389bf1cd424d8356670dcc2d72eace90d
SSDEEP 12288:5gHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:5E2Wh+zkiGiAgNe68OzQytCe
TLSH
T1D2C4233B5263C335F79BE573A0B049D37B20A78A96047D9A1F0AC65B1E70E466F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 11ce4a8d0fede864dd74b5fca47d623792d1204f467b761b6f5905d363c4d97a
MD5 b7fb98595e059f652f2ab4fa756fbc8f
SHA1 8b5d3a602a39b9ff1c592b1a961f2dee3fed3cee
SHA512 6fcc7fd914e0b87d7c2a192ebd706b768189f86e0e9d8950e73587ec25836c6f64c14bafe31c9c6f01b42ebe4ff60de1b67bc11f6a5db3811f6e90ea0b3afdd2
SSDEEP 12288:iUHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:io2Wh+zkiGiAgNe68OzQytCe
TLSH
T107C4233B5263C335F79BE572A0B049D37B60A78A86047D9A2F0AC65B1F70D466F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 025a2c06fb6d55c0f97b84efe28e68d21b56fff807ba016b6d280927878b183a
MD5 60cb622cbb3a970a94bacd6f9ec51cde
SHA1 a4582c14166838584af13f568de794cdc8081516
SHA512 cc5e2a23b52df91241fee1784b3ad0c3abae8e9e924dcff1ecc7ca3c4e4e2efa07607c83e4475c1ba3fb150c9a564b04baa2e9d30866af97647e4f3fc9463476
SSDEEP 24576:nZMJzFVSOQ2Wh+zkiGiAgNe68OzQytCe:nZMJzf02WgztGGQY
TLSH
T1CB05026573A059F4ECA7813EC8658942E6B2BC5A0760CA5F03A4376B1F333911D3EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 cda660530f3f8bba8d8401cacb19c7a8a67c5e826c3042f50d155ed170278cea
MD5 6ab29be67c700d17fb0386d8501c66c2
SHA1 5fec3ceb0921e4b205fcd35b9e8d8df24c6e4a08
SHA512 ca6dc3125b7d2b7772bc7266ce9c4f681f38b9687d21dc910bcfa0d21f50375bccfe854131d1afde958f389dce055440f0bcf425d887057bd5f1363a890114a6
SSDEEP 12288:1THFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:1j2Wh+zkiGiAgNe68OzQytCe
TLSH
T193C4233B5263C335F79AE533A0B049D37B20A7CA96047D9A1F0B865E1E70D466F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 90b61f20594d638a416d853f3afdd04d5417e9db1dc0f7588ba00556184282d2
MD5 876e093c25e7c99f70a21ead8bd0ba5c
SHA1 a1d7cf2dc8939f0aa74947062a73847a54bd6749
SHA512 0ee6ced318ff650a4aec77990b5e332e753e92f9b26e47dc7602290ec986ceb665b31b3c877cbb719f5bf3e6b7baedb0c6d06d9b6ad4f50d02fdca02fe0708c0
SSDEEP 12288:2vHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:2P2Wh+zkiGiAgNe68OzQytCe
TLSH
T1EBC4233B5263C335F79BE532A0B049D37B20A78A96057D9A1F0AC65B1F70D466F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 964ee39ea76db88d0cd1d98212b716c40ed5462afd2b8483ad5dcd5b5441c37a
MD5 8d11f4953723ce8ebae9fe80f527793d
SHA1 c2e182a1c8dba48724dad8b5ddefceb9fc5535df
SHA512 6d8d57db53c243f5fe7408c7fe2047a8be1129894b00e7db5ac2b29e059df617958702ffedfdeac95e8ba647baf12b31b7d4d43584b3e99c8a84e5c8f1d8ff4c
SSDEEP 12288:AyPz5L8IHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:xzyM2Wh+zkiGiAgNe68OzQytCe
TLSH
T121F4122733A231F9E16BD235C8A10A42F771B87647209EAF1754477B1F336919E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 278a4c3461e1b706177ca8c4eaa838728d516ab2fbec4b8ba0ae3a9f84007662
MD5 1f48fe063a779c20e9b56ae1c61f3486
SHA1 df66a631b2c5170ade6342ddd0fcede27e1e6fc0
SHA512 ecf17b636ab3478fe8ad808eb3d155e424899ca8eab7c8588ea2c3f67f4115445b507280ce747a338b4fd99a5237e78951016e851e9c0a0b43e6dd9ed8200890
SSDEEP 12288:/THFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:/j2Wh+zkiGiAgNe68OzQytCe
TLSH
T181C4233B5263C335F79AE573A0B049D37B24A78A92047D9A1F0B865E1F70D4A6F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 dd80731187f466c2d0f10b273c5e377cd95f74453a95c0febd22be4631661b7e
MD5 e6fa44e45f15326f748850644dca048a
SHA1 ae32384b12f7c219c8345ffde078eaff09ec873d
SHA512 d36381ccb91a1515cf14e2fd365a1b9d664fb9d2b9730b0561619ee1638a10ba067e5c0ab86706dcd97a86dfe1e819d9b6fa7614449590f660e7c9a30603a98b
SSDEEP 12288:MTHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:Mj2Wh+zkiGiAgNe68OzQytCe
TLSH
T1C4C4233B5263C335F79AE533A0B049D37B24A7CA92047D9A1F0B865E1E70D4A6F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 26624610172682d37bb96df47881b3a50fca48f1fefbd734f8093c1cde1ad28d
MD5 2a949ffed52cff1955fe774a5bee4392
SHA1 0b118c0a92650fd1fcda45f26ae00326b6c9aa63
SHA512 698727a7c95f1b48e4091da79652219f2a2a5895899b516cfa02209ad15d1ceae965d6a768d0647e1f8fac1764dd8682ae1a8f4e8a3894923544bb93cae823fa
SSDEEP 12288:4yPz5L8IHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:ZzyM2Wh+zkiGiAgNe68OzQytCe
TLSH
T1E1F4122733A231F9E16BD235C8A10A42F771B87647209EAF1754477B1F336919E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8b8a0dc1800b0c18c1048a7e5ed7f4e7270c363b705e4194f008920af10dbc1f
MD5 48eb1e89d1d644a370d1018c877c1c82
SHA1 0c1692786fda93e378ea8087ce7a477420749c22
SHA512 78fb504b98ec6af37abd65a15f12ebd3f0151134f3d598104ad5749523b112970e84a908b3b5f3c9f419aec840f67812241e2a5ae0f1ffe71c27881da187bcc5
SSDEEP 24576:BTuaLl3z0zDu2Wh+zkiGiAgNe68OzQytCe:BTdLljh2WgztGGQY
TLSH
T1F4050265B39058F8EDA7813EC8658942E6B2BC5A0760CA5F03A8376B1F333911D3DF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4e737b1e13865e28b8afc30a034191d38c365cb7aed35159cda8e624b603b081
MD5 1718604321046e7bb2d8fe296836e13e
SHA1 bdc62c24d23a422bef1a13511a344d0eb8fec728
SHA512 9b2094fc56b4d40bf8f6ff42e3e15497026092a5576f53aeed4f0f85035d4d42e1670eef875137df8af7c4333cd039e6619ee4015cde7fba9ab72e13d1e0978e
SSDEEP 24576:73xd9CHKy7GZi2Wh+zkiGiAgNe68OzQytCe:bxd9CHKya02WgztGGQY
TLSH
T13A25CF90F3E411E4F1B7DA3588764512DA767C9A1B21DE8F03A4665A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d49b0027c5936d9a0d858d89b4083907390ba97987a9f399f50c5b7c5e6bb960
MD5 01ded3092b9ee784b053cbe22b0adb8f
SHA1 2886c1303a2ea73ee8b97f9a72c8c354f80bb288
SHA512 252bfbb70b8557199b1000af8a5d3ebe3366ffb28befac77baf2945062f46b5ab217cfebd5f594d134a31408522f11844671b53919d5e0d0e97a08f8ee0c7ca4
SSDEEP 12288:pmHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:p+2Wh+zkiGiAgNe68OzQytCe
TLSH
T1BBC4233B5263C335F79AE533A0B049D37B20A38A96047D9A1F0B866A1F70D466F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b17a63ce666049d7ab63eb4c60534d24a6d4447d49ce7768cda9a35061d5ae7a
MD5 c86e667da572b3d4a9622ba392c972e9
SHA1 61b55a02f10894b78853f364c1bc391a6e71dda8
SHA512 1f44dc01d59546b974b68e51472847e750490b603015931a40bc6d9ccead00276d883c2e7ecde34e449bab9246c0d35d0fca107cc4073ad13d41fefbd0ea4516
SSDEEP 12288:GoHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:Gs2Wh+zkiGiAgNe68OzQytCe
TLSH
T175C4233B5263C335F79EE573A0B449D37B20A78A86047D9A1B0B865B1F70D466F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 19055017b9510155756618a935d07160ff07d7e808d566a3991c3c14a142d83b
MD5 a22eb848a9605a0f36d70b69882acfa3
SHA1 c3f0d7581ada2896dd90cf3fdcd437fa58c0799e
SHA512 61d8cbca3acb0d1d5e95c4472fc326c4d68444b0402bc57322f79cc98a560b933769b929820588f8414f45fe73b5c6987f91d488fbd6df88106529ce24e1c0ba
SSDEEP 12288:oNHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:oZ2Wh+zkiGiAgNe68OzQytCe
TLSH
T1F5C4233B5263C335F79AE533A0B049D37B60A7CA92057D9A1F0B865E1E70D4A6F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 7dd1d922e24d4bf640db1206d5f1ba20bc53759329ef3d89b31c681873dd5d23
MD5 06d89135e09f468831eb1b5e32e3bfff
SHA1 2ee77372a359f5bd084e734cb05e77346fa0e8a6
SHA512 9260946a53d7d14c9612dc5a965a2543f4846d9f9e5d2c3417f58517e64669822035f8ba82d047fc2b078567086ad07feb201e8b7fa1d0dd0441bbaa0bf9b64b
SSDEEP 12288:gTHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:gj2Wh+zkiGiAgNe68OzQytCe
TLSH
T1DEC4233B5263C335F79AE533A0B049D37B60A78A96047D9A1F0B865E1F70D4A6F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c8fb7d79adc5940c41648d94a2bebf43019931ec4f2a794e471c3dd0d2c9cee8
MD5 29f0c875fef2d9fdf2e4f7ab81227db6
SHA1 2f3a7d2c091aa9e418d9f5f7c57dc4db54088dd1
SHA512 cbc78b5f7043bedaa3057412a61de5fdcda20f2c77d070158beefcedd82d023a202871e2fabef80ca77f4ff1bd78a574f16ec2cfb0e279a2be29a0f7c2199a6f
SSDEEP 12288:FmHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:F+2Wh+zkiGiAgNe68OzQytCe
TLSH
T173C4233B5263C335F79AE533A0B049D37B60A78A96047D9A1F0B866A1E70D466F34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 58309fc4b36f7daa994ebd3970b8500dc2fb569bebe2aee997d5fc231e5c32d9
MD5 ffe2b7c9aac639e4c16b0d93c009c961
SHA1 53cc7b2019b3df7825e9693858a5038b9eb22ddd
SHA512 b83cb7fd2c16db7b2638b9f1a5768109154bfce0bf611adc722267acdf33c07d9d8d14295c729bf506bcd218b5f07a06ccadb60c654fcf2d0a8c18809e15c8a2
SSDEEP 12288:ZLHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:Z72Wh+zkiGiAgNe68OzQytCe
TLSH
T13BC4233B1263C335F79AE573A0B049D37B64A78A82057D9A1F0B865A1F70D4A6F34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 5855ebd50c802ddccb37b08444bae0624cab154c46d786c0a5cde1e8706a8a60
MD5 31438701df5f1474fcfa84da3c62b251
SHA1 f11a9b36aa115e6af1fac17089f1a2fb3e562a9f
SHA512 750fdc2038787652af84304a8acdda3e2ebd98f424113704460a92fd3076a7af7d64fda7026169a89782b7f80b4d3c296a5e0b2cd97f67af2f31a633d4857047
SSDEEP 12288:pZHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:p12Wh+zkiGiAgNe68OzQytCe
TLSH
T1ADC4233B5263C335F79AE533A0B049D37B60A78A96047D9A1F0B865B1E70D466F34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e377c60c0a2ba5c5c69472793007f1af7ae1d5f7e3e2b42aa7c3f4a6b7685ee9
MD5 14dde3073e9f75fc76f28b18811a1254
SHA1 c93a7a6286d6b1c5afef6777e32b53126ce3ce6d
SHA512 82d2c6966d63ed67a8174080b6ab272fc0dea50e61e467338dcaa4b3a095fd51dd5260e37129dc529089f746ca671c2fcda1361a99b2e90c1dfeef38d3df7d47
SSDEEP 24576:2fwvOk9RX6wkyAI/2Wh+zkiGiAgNe68OzQytCe:AMnYI/2WgztGGQY
TLSH
T16A35D029EBD844E5E1B7D23C98B3464AF6B178591B31C6CF025A53AE0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2aa99277475c579cf403999e6f6905dad194fd7d35b8a08c15bef889ae4eb369
MD5 2239f184c52affb88bbb856dcce8dba0
SHA1 fc8a17b068600063c5fc9299ca2d55c9d0901429
SHA512 7627851db32c17e1b793168b126643c894dc16b9c8b1da8d4a020e3c7b09f77659b9690cfcd7802383313c65da3e45c205f7e46ac05f66a2e934db7ae132b1df
SSDEEP 49152:IYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0a2WgztGGQY:0ySzP2gIG
TLSH
T144066C56A1A841D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556931F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 65f2342f864d610ea05841f74edd023d7a7e42995a857a20dcad0dde7e6452b0
MD5 28f2fe092365a23f3a463bac35ff0833
SHA1 ee9d0dc10888c458dc78be5abaf9cd339f3134de
SHA512 90ef3ecb005523739785645a42d63a250174c6a90cbeeddecd5b7b20105c2c63d7c8bf665c70f5750126a2d4b00f35364db36669913a96a5eb09ef1074606dba
SSDEEP 24576:c47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYA2Wh+zkiGiAgNe68OzQytCe:c47JUQjairIhCnDHUPfF/K2WgztGGQY
TLSH
T18965AE1EA3EC02E5E1BAD27885154A5AEA71742E1B31DACF1270837D2F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 768d85d43030ddefacbd5f803e7a8209c47081de7a061222f7edf75f0530ab38
MD5 0105239a1daea3c4853e52d21aa0e8fa
SHA1 6c2f1c904adf6d6a880f4699c8fc9913a9a704a0
SHA512 57e921bc8941efa585f37dcba8f131b36a588457863bb0114ec361c68b35d860f244b288b1d9afdfadc09b70e480896cbd6fcf8f1b2b4aacc6498b07c24b4070
SSDEEP 12288:4ksfjHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:iz2Wh+zkiGiAgNe68OzQytCe
TLSH
T10CE4F02AD29442A8D1AEA135C7554A82B7337C6583E1E7CB17C0F57E0F75A809EF9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 ce8b9afb535d1c6409e54e1984f56e5e0ec381b6943f89ef1034831d3c0b37b2
MD5 564dcac4b493389946244bf5817cedd0
SHA1 9f81de66521b76b6e5921ce7378e31cb32e8c2b2
SHA512 7e8d871717dd5060814d61585944fecae666e43c1828af8e2195b77309dafbd513e5fa4561ae30eebfe98a9199c359fd5728beaa6e327bd3c21de52a267fbcce
SSDEEP 6144:UsBC2na9+nfR9yrHcbPotMxMgYPU3fUkOagzDyb1TeIcyRY1/JhKO98qO0EFkN/U:djqNU3fmCbmZLO0EFkCLtcaA+p/iWET
TLSH
T183251701766BD75FC6A944321E37D6CCAB707D01EE459B0372C8872FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 0236daa2dbf1c437982622c531a6da19601a8d2018fb2b6a2c118015180e0da6
MD5 96b9873db377e462d2caf5cd4c0f10e6
SHA1 8bd5a515bbf1319b269146e916227ea53c5be4f0
SHA512 f798d27b2a65e35b4d8cf8cf3dc3a036f7bb9ee8dabd58a0cc8251ee701b4fd6cbe4014f444ccb53f1e5e4d741b15d93891aa5f5257d592fe3178fbc7ebe0b8c
SSDEEP 6144:yBTeIcyclsTI2DMTeIcy1Y1/JEmOyVxWnVq+RKiPMgCK8RVTATJ+DVqYpdKvl2cN:xmOyVxWnVq+EiPMgC1Xs9SoqsrYo
TLSH
T17155B6816137A3CFD5FB2072072A6B4CB764EC46B3456F26B3C8453AD867665A0B83C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 cc1ecf715b28f3ac158874270729db8c8e359735903e413b49df7f2f8132c337
MD5 fcb999e964d8c0d27f5cd00d11b16316
SHA1 8f9d51f27a982fa592acce082ddeb86a08931acd
SHA512 0ad74fbbbabe3c160680746bbdb20e95e636174453e8ae138dcae8a352e6ef20dd40b710830cd1846c25d7102d695a020f3dd93e2bff10232003a32d4853214c
SSDEEP 12288:5z7bHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:hL2Wh+zkiGiAgNe68OzQytCe
TLSH
T1DCD423374366D331F6BAE63160A485A33B25B6958B00BCDB6B06869A1E30DC59F34F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 41c8bb6aa88aa2d491c221331344c3a267c5cc4f1ad88243c1c231c5d130ebce
MD5 7c8fe6b7769a85b2de56e9b4c2b214ee
SHA1 537627bb713b312276a1142112a1ab60506147da
SHA512 e9b57e337429af59e00f391f9af2164965b1fc8f0833110ed09971e2900ab5433c1588928d0698dd42d8b600d7b57a3a03340934c3d1dc1907bd2c379dabbae6
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYh2Wh+zkiGiAgNe68OzQytCe:0gb4mBIBhGFA2WgztGGQY
TLSH
T1EA65AE1E22E802F5E0FAD2B8DDA64417D6B278160731D6DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a752940339115663228f8283daf913cd3c06bdc54469c4052afaba70e50357a2
MD5 c4e02f30c6f8d79b2d56220101a539fc
SHA1 dbda30d0e24edc94245c3bfafc1e5dde5ca92410
SHA512 71393f8f8dca37f4fb6005a17595e358347a83670d90b2d98d09b21b4c18e95cf60ad046e022f9c6fa69b0e3b05a832cc996b568017998dab6d511d2670b7448
SSDEEP 24576:8G88u8FpJqH1nzria7/mQ2Wh+zkiGiAgNe68OzQytCe:/7ZFPqV6a7/52WgztGGQY
TLSH
T13E35F12567E102F0D47BD138899646A3F6B2B4250364EFDF07A88B561F23AD54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2f4989c3cab9599c844327e8f33ae3a66cbb4b70d0ea681d02c3028853cb497d
MD5 cdabee4f09b423beabba03e49de97f9e
SHA1 65e0cca56696574b03d42b40327fe327f218eb18
SHA512 22f0a9601bb091e5ddc7c4a86db31eeaca88b34ce3b1db54401d93859b992e56b0f85636fd0bfad0bef7f606ce8ba6587f2d20e704007801c2c8b8decdf8a093
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjE2WgztGGQY:IG05lO43bjgIG
TLSH
T13BD5C06E62EC11F9D1BBD17CD9C64A0BEBB23415032456CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3c69edf0360a986623f0d9af90bf92a67f91b3d8211149732a0057fb40e2d0cc
MD5 03c90bdefb9f36717eda1b2ca7fc93c1
SHA1 110e93f21fd02edfde83a053d648d7ac98d8d536
SHA512 5d3dbc596552e5864738dd379db157c5c0198ab294911e44419da9f85585dd5b07fb8a95f207ebc9d86716d38088f35ffaf4098d833946671a1e79425da001f9
SSDEEP 24576:Wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidna2Wh+zkiGiAgNe68OzQytCe:Oa5POZ3hJt2pasx2+ms2WgztGGQY
TLSH
T11165AF5EA2F801D5E5B9D17DC583461AF5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d4c74b1f9b5a3aecf48167b0317d7e94667ab63ce40e216f4ec1143387b31e53
MD5 d7ec54bb0313294d93d96cb386d0e0f1
SHA1 ad58b0543970fed44926e2106c538a59dbed321e
SHA512 9c6508f69467eb85a5a306ed00c4f00be807ff35e0fe704d57ef009bb62077750af758009282036b9c7280fee71918cde203f123d1bb980d7ab943426ae5e816
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7Fk42Wh+zkiGiAgNe68OzQytCe:CNc/zEOVHFZ2WgztGGQY
TLSH
T11A857B2623E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4eccc31187c62d6bc39d5b09f599be9f860ab8de92b21fed5347c9b4a3152605
MD5 9a79670e64a4aa2d9fa442b8a5ba7094
SHA1 17a7e29f56a6e0bc1737232b6a1d7b5c7ca89496
SHA512 eb4f06ff09b10b7c51f6c36b38c384ae93812d51186c48e5b392f71c8ccd3529fca486acd03a2b08ac917a82a136d36cbfb269f0ea8da6508b68493fdc68e589
SSDEEP 24576:l3kNvNnaFeYhJNtmZBm62Wh+zkiGiAgNe68OzQytCe:l3MwBtOm62WgztGGQY
TLSH
T1C555AF2EA6B846E4D1FEC6B5DD238512FA727461073292CB5390C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 eaff31a8028e3bfb737081968c89b88ef906fe28b3466da59d0dcd897f078bf2
MD5 1a610c371d6d67a030ac2a0ca01eeb9a
SHA1 02fb2f7ab74f9055bece860198ca3e35dff2f758
SHA512 2bde6ec823ca884e8326e83ad4ac64f944121ceed0d283ce5360f317aa202c9d1d089c416a17b43480141d16c4b59e9b82097b18f1685faa8d23006a60295ea5
SSDEEP 12288:OHvUrBFrEjwaQQHFoWEAMOO5Kaa6GpIJGqzwSE0UvtgNcYo68Z4zQytw3+GFgJ:OPUr+NQ02Wh+zkiGiAgNe68OzQytCe
TLSH
T1D505E12F22A918E5E67AE17D8582865AF771B4620311E6CF0391817E0F73ED8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e0e3b4f2e5c4bf76d12086e9ac0a88542786d320dea318a343b6130e2e5fbfef
MD5 2bfafceedd614c0e2912c92cb78e078d
SHA1 96842a9f20338dbb05bd726b5cae28672df05ea2
SHA512 6e677ac3a0fb847e1fdcedac24be93d99339287dcd7740e9cb9816c20e7c29899a76cb63ad304327bfbb49f420d79dad517eab6177c4544aaea79da4cd59c994
SSDEEP 24576:LD3FHshBIYQgAH2Wh+zkiGiAgNe68OzQytCe:LDVHeBIAAH2WgztGGQY
TLSH
T19025E13EE69900E4E57BD17CD6638A07E77138A9032169CB0694C1BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/760-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/760-136-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/760-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1268-28-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1268-7-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1268-0-0x0000000140000000-0x0000000140107000-memory.dmp

Download

memory/1268-43-0x0000000140000000-0x0000000140107000-memory.dmp

Download

memory/1268-1-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1268-8-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1864-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1864-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1864-270-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1864-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1864-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2060-85-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2060-125-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2060-80-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2116-123-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2116-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2116-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2588-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2588-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2588-332-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2588-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2588-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2588-115-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3276-76-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3276-70-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3276-124-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3412-55-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3412-50-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3412-42-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3412-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3412-52-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3412-44-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3772-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3772-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3772-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3772-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4060-295-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4060-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4060-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4060-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5052-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5052-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5052-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5132-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5132-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5132-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6100-328-0x0000016197E20000-0x0000016197FEA000-memory.dmp

Download

memory/6100-327-0x0000016197A80000-0x0000016197D0B000-memory.dmp

Download