f3c594a0e7c11dbcdc4d125365040b99edf586a53d96150e40881084863a11d9

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260718-evhjlsbs7s
SHA256 f3c594a0e7c11dbcdc4d125365040b99edf586a53d96150e40881084863a11d9
MD5 3860a50451f1ed3ac6b957b735e3c507
SHA1 82bb96912c32c5fe3d418f5dcabddc3e3acefa05
SHA512 c2f3ed669c27bc5dab4151f01fcd4cea3aa733dc9730d59edab6835487469f171957769cdb071e65639a9ed3828ab6a44baa728810372beb5fc77abd68467355
SSDEEP 49152:D+0XJ4x87A/kmyQz3ZwMYDOf2UmJ8CYKMrSvBuP1cEQWk9Z3TeB4B+kn3Hnx:D+029joYb2+k
TLSH
T1EC167B47E6B901E5C0BBD13D8A579657FAB2784A877197CB03A0875A4F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6032	elevation_service.exe
1444	elevation_service.exe
4888	maintenanceservice.exe
3444	OSE.EXE
6100	PerceptionSimulationService.exe
5968	perfhost.exe
940	ReFsDedupSvc.exe
3832	SensorDataService.exe
4064	ssh-agent.exe
5588	AgentService.exe
5664	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cae6a1a238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a73ff226c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079cca61f6c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001850cb246c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005da32256c16dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028fcf7626c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013b4fb626c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
6032	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4924	2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	6032	elevation_service.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5588	AgentService.exe
Token: 33	5664	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5664	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5664	SearchIndexer.exe
Token: SeDebugPrivilege	6032	elevation_service.exe
Token: SeDebugPrivilege	1444	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 1128	5664	SearchIndexer.exe	100
PID 5664 wrote to memory of 4824	5664	SearchIndexer.exe	101
PID 5664 wrote to memory of 2500	5664	SearchIndexer.exe	102
PID 5664 wrote to memory of 2672	5664	SearchIndexer.exe	103
PID 5664 wrote to memory of 5848	5664	SearchIndexer.exe	107
PID 5664 wrote to memory of 1608	5664	SearchIndexer.exe	108
PID 5664 wrote to memory of 3664	5664	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_3860a50451f1ed3ac6b957b735e3c507_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5968

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2668 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2668 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 716410d4de9225373e10dd358c5c81d9c1e122017d3cc9d52b3398d5597d3488
MD5 f44b176a3327251c0ca0162da129452e
SHA1 50ec7183e9bca9f93ab5fedc6ced52c0162a7982
SHA512 dc1641969a4f40dc79553185ad4ce5efc96defbf9935681608eb9e35503af287aaf34544318e5956ab7a3428e99f20f7edaf516df3d81f618b989f62a2c1d785
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFB+kn3Hnx:H3q6sjBc+k
TLSH
T1BCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 61d554e15519703423c319274ad84bddca658d9d4056b4dc7170f556a7e459bf
MD5 48248627874b983989d750583b783904
SHA1 2aaec233864cdce1653202a37e9f597732cadd1a
SHA512 d503c9e69eeedb7e5876d2a874836679d3f097130934237d2e16b7246a1a212a0e618ec0dd48778f98d3942481e295c8c95a4e611fba7ff54e213bd9dc0a7642
SSDEEP 12288:f1XLsswWkxy2lRq2czAkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:dXYfDtczA7NyBo4kx929bL3Hnx
TLSH
T1C065012977D409F9ED6B9278C8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bcf4edd8ee4f109076b7ba1a2328af944e9da69c3c777f75bb73aff3801677e2
MD5 727a2069aa71842e9d1c84043a3b5ed7
SHA1 8c91cd1d2b9ec3f545356f986a1f24c423fe167b
SHA512 5efa2fdb649dc247eeeb843e2e55f9255d0a52ab112dbab1483f58c9533e35664ceed398245bb710a3183cef82491e9b4b61e149a8888bb53edfe8087cc78c5c
SSDEEP 12288:AXZNYVLeyUji0h90ZD0wxpGZIVuArHsRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:g0Le5ji0hmxfrMuNyBo4kx929bL3Hnx
TLSH
T1DF859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f19d4c357ff614e0529a2f72c7ef6a49575ce77abd66bd3154fb3f30d8bd8d33
MD5 d9f7372e0ec78e77943c2dd9dffe3c78
SHA1 2685340a2dee3b8c6118c815023280ebc83aa6c5
SHA512 4edb26d0dd25e1256eb9975bad05183efee0c745c2cfac86fdc6fbf45052e9f806135d19b8a1013b1e8bfd3559653fd3d77345df4be0b2f6f831073ce8ecd9b8
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyugNyBo4kx929bL3Hnx:r/ezSC6vUzPveHjyqB+kn3Hnx
TLSH
T187755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 30c286cc726dd54bb193ebab21322859afc4794346202954cf37eece15a9402a
MD5 e8b746aaa31f41480b8a5898aec3bb20
SHA1 6e64fbbeff62fab09912954155b132d5581d228c
SHA512 1e4de11de13647684d0c7754e2b02ff15b44473b78fd7304e2b5fcc759cb73ad7cbf5b95c7aa57606bae5b70fcd8172146290849dade8b0bf452c2ea08846156
SSDEEP 12288:KVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98ALDAptNyvUgXZ32dT4ePc7N29CD:KVbqPb88hv/l+Y/NyBo4kx929bL3Hnx
TLSH
T1CA559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8fdeeae167b7667431f5a24bc79896ea19a5fed727c3119c9451d17a7aa1720c
MD5 ba4074eb8eaa6821b5108e4d1981b1d5
SHA1 90c834c30eedd3975b9bd138f67ac85f1dddb2f9
SHA512 49c32f2f281e03de93aad61ff567622c39e18d61aa944336f05782dc739fc528eebfc94e5dc628a2e119fa0e36b2e2db0c91a8de1ef0b6bf3149f4e8f3d6946f
SSDEEP 12288:qmVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qmKNyBo4kx929bL3Hnx
TLSH
T19B4523124B0C627AFBBD3F70745E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 294d0a70a445d1615a6269bff852c676ce53b7f5cecf322896668b4536f7ec20
MD5 40528ed3ce82f2d607f4d1bb716fd0d9
SHA1 4d7e967bc117288ae469625514d5d12dae5d96c8
SHA512 e5a300390ed261d4367154b9501ce282e4393bd157f2f6f414abcd5e7a104302e2eb44345555f59a4622749e3c9db664d5fff3b9bc54d304984c26837c5393c1
SSDEEP 12288:leBNUbTVO86UoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lJIU3NyBo4kx929bL3Hnx
TLSH
T15365CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ad0a8e7759745d42a2fbe634ed6aa5139832f90a0fa06148cbd4eea6ac74ca11
MD5 a82b9f8ec9e777f839f2028eac065d60
SHA1 de5d8b5f0ce652d13f0b47cfa7035fe51a8c1dc5
SHA512 c44b2a3bf2442ce7291df941c8e13a7b7b18291e42aaf93d4829e40ad3ad7090ebec12c92ef3d57d6a8ed1b7408096678056161f5e459f4884e50d3a33f469a3
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THC:YQvGAdlCEL8c/DRNw5CF+k
TLSH
T1CA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9b1fbbde93ba49ffb41db5c6a3fc979fe02d402eefe77ff745874aeb960bb4b9
MD5 90630424531a4129e5ac793c2618e14d
SHA1 8d2ae5891a5ebb488b77f1ac60a6074d232d476b
SHA512 46dd2986cbdf32cd9e0eb87b513054e9ea552d82c9500e57f8ba31f6d6737691ab6d949b84c61c4337d9ff5f5df3bdd3d30332259801f5c78f73317d44bb175f
SSDEEP 12288:/AwSfxL/2Dc3XDLLmt0LDQewsAjyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:IOewsAjZNyBo4kx929bL3Hnx
TLSH
T18775E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8fc40b33bb6de01f57bd72fd116243b83cdbd850ec5c3c9dd525b8c19c275c4b
MD5 40f88e598b78e6d0c193687896365b36
SHA1 d364aa77113616af394d208f4fe3724f55e264bf
SHA512 827c30f4905a27f16e293dc6afa027106ff821f63da94182041b7f7f55fcbd321944e8c4829ce2c45017fd4543951d0630648bec0e0c82a1fee5aa182923e95f
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHm+k:hUEtQevvqc2W1cpV2tI32m
TLSH
T150474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4764a5f0dee7c1a1c05b31331b38fc96b654072199062016f9e4222a7df11afb
MD5 b2897e13bc048b01075f8359bbd43e9a
SHA1 ec2dc106d71bec17efa32c6df93d6c811f98e712
SHA512 f2140869e3631d1750c402b63bbdf8ab6f3b34e9d7713f6135e7799efed6b4e8033a876014cbab609940722e6452317da3dbf41bef37dc0037a78c4065218317
SSDEEP 49152:6CbRquA/m2yL5zTfFiV+XenmE3/z+B+kn3Hnx:PoquVjnmJ+k
TLSH
T1FDD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bdf991799b4aa8be62c504b67f8e63f9e49853e4555af01b03ac022e67e744b4
MD5 95b59143e1e6569d6a287cc1ca1616e2
SHA1 995cdee53f6e6a39574167b295b3cbbe273a2e1b
SHA512 11c4996ac19900785de5e81a8a6e55e54f28e5b75197869fb848cb8da55a96661db5ee9d45aafadf262de24aff8e3f081a44f9d8b71c5e54010ddbef40e96de0
SSDEEP 24576:xAhGL3IFoiwtA5l7S53ENyBo4kx929bL3Hnx:xAMUFoiq5vB+kn3Hnx
TLSH
T1A3359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a2a4f66b0c33eee06c8cfc0b04f2fe2a9e0a58b40c0c786b3ee2e8b442c7918d
MD5 b438283f775f22daeff2d0d144253b9a
SHA1 fb5c68c15e4c68132d068b47490e440ccb22d565
SHA512 5c6e7ff618f38acaa5d3de8cd95f6282404c17723713490cd6d5c46b885c52295941b11626318fb10f2a452e8ae56de9e2ecf548575dbb3f5d8a454324b21919
SSDEEP 12288:8mw5HEjsChNzBFgl0WDm+CTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:5wu6OWtNyBo4kx929bL3Hnx
TLSH
T1B265F10677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 097634d585ca0a3f06943487363af5f90724964221a4ceb5f589d3fdb88ae743
MD5 8d53fc87b60f87f66ae83ff57d544792
SHA1 7e45b92f01b97e8bb77cb408b3050fae903ea94c
SHA512 db6f3b22970aaa332e63c893c50f28a01740ee382cb644e4c3325f2ccfe35f6c3cee41f21316fc109b6db1bf112bc0802e4c8c88d78407735ecf06411ab4666c
SSDEEP 12288:fgZ1IyCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YZumNyBo4kx929bL3Hnx
TLSH
T150551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2145BA1F7BED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9abdacf90266e6d5849bf3a5aa536167b640f5d5fa19981dc815374ce320f8f2
MD5 ff643b8017031ebea47d404f543ad510
SHA1 10cf8444faa180d7e52498037d4644117dd944fe
SHA512 cb8442df71bdd7dabaeb0e6e43cde2867a7e419689af79b34aac22de3c1a8badd2c96bbb85c98e681660f056814dfebfc3ed5ba59a0b13bd7ad889b86a4c7f60
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:BQRQyi36YOcPbLvw2gAf+PN3o+k
TLSH
T1BD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8c66e8457c5ec3a6e8ce71309bf7b4efaf7ee05a940a1ecbd7775cf53a657603
MD5 48e0b5d47183063708ab741dbaf65ce0
SHA1 63d40cd38664f33257e8b786860632b1f349151c
SHA512 c3a78381746bb04b90d9bcfda80cd7101e23e3464ea6636f74c028fc15d79be3203e99157de6c72e3d307f1f688cb051a58e40d5138684ddc050697dc75c266a
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:bQRQyi36YOcPbLvw2gAf+PN3o+k
TLSH
T146666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e6e5c784701481852191395c470109e8ae18651ed222bc8f52a7939880f37a58
MD5 772ca86e846752cd88436e6747eadb82
SHA1 52d808449806912b2e5594443593b710ff214428
SHA512 43f9ef94f2fcb5f4731f26862511d846747e4913c15cb7ecd21a4a00af18fe615679afa25c7e8df55ea6b5b11690b049add9fd89e3adc2ecb188d3ada8f304fb
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL02NyBo4kx929bL3R:J68Qg55nhceWu7PNU3/OB+kn3Hnx
TLSH
T107B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a78b872a6b95c3f602e5faf60231c0ca8b15df89081e37af8e31a2b82ba66605
MD5 213c29712173b06c2f6d0725abdc7df6
SHA1 7e1c69c2d809eb0d324206d44f758481b4ae7f8d
SHA512 786c7337f8fa3f4107b506360a56d79bdb8903374dd4190c800baf9dd954fe68b3866e71468e6da76a31e7787f67b6aeb383304d9e9582b8d08817bad8d40bc3
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99:2y5112gYy5azzVvt69nLKnhZP+k
TLSH
T114167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b39617f68e3aaee881ad7aa6920f3bc7d332273c294f4ee0ece3afa95725605e
MD5 d29aeb276c77810b9cb70e8fc1935413
SHA1 d29e33d8198edd01772b29d3f2376f162df5d638
SHA512 07a26746a9c09223150e332133603f808ae7540491f9fdd35c27a94594e246d0a0a7882a9fbfa64b11d0f39b4fb0e40f47d2f6f1bf06a0d3264e66cd24cc786f
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEB+kn3Hnx:fu6Jmdxd2d4+k
TLSH
T179D5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d044fd3b8af03a249f4264db2b6e8537513e44750606c6601ec819c26f3af75b
MD5 b9e166ed98cedc566f78f67ba33d90ae
SHA1 27b13490bc2ed49f4f48bfef5d8a035b54ba2839
SHA512 92d9199d5a845f12963bbba23a7885e99038bd4f64ae92388e81fcd290aa3ba85e87465716ce785484002224dff26141e7998ba90ab743e0b8c27b34af87fbe1
SSDEEP 49152:e1hpsNoJpF1A63U44CwH7R4xYB+kn3Hnx:emifPWRJ+k
TLSH
T14BB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3e31f354b2aa7b58ac75b0df013a7fd3bef5720ad2786d2597e7ca81674ec206
MD5 34850e58238c036e4116427712aaffe6
SHA1 d280062a7756f99517424e78cc693fc76e47c741
SHA512 3867c45ade817369bedd5061256c5dbfd5f84e5ee44bbdcafe5ba1860459077e8c0ef528c850db3b48073de78aac32105f0d1047c0c313ed00ffd61ddd5443f1
SSDEEP 49152:rSuZQIY0Be2KcRVtOnks6NMHqNB+kn3Hnx:55dKii61r+k
TLSH
T18AC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9bf5478964ee992c8d01fa803eea87fc28b7ad7ee8ad9e4fa4b44a0e42a80119
MD5 c355b3c01dab4acb28d8d30fd1444370
SHA1 565016970e8d72a35e88d7ed457a4a5cc74cd8a7
SHA512 9b9e8b6b3940efa6be1accaa9db7718ab951981850d9addebc90df35de607248e26172a98dec6baf2b2ea5f43cf4cb18e43737f6a74baf647aaf96bb959800f5
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wMB+kn3Hnx:XX2imphN+k
TLSH
T19895BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 18cf9489d72830d6a553600a755dd0bbc850b754d9fe536efa9fbf0c29a9134b
MD5 eef202987b33e0aa754214ecb34d51f8
SHA1 7e08b4562625ed8180f9b6e92dd484d32eb599d4
SHA512 2e007a1db048fe368f0138056df95ec64172cabea43a3f6fbaac63acc32ebdaaa37346b8f2299c127ca116ce28aad5efb3631a761d8ca2509b9b925de714ab23
SSDEEP 12288:k9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kiNyBo4kx929bL3Hnx
TLSH
T17B4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759BCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eddc4539033991b7779abec3695771014dea36fef9bb903b108039008529b55f
MD5 c9824543a60e0c6fa77935b4178f0342
SHA1 b6c8d238fe250ae097658be4ca0f589120f614f1
SHA512 ed40cbaf7e6f835f3fba4281ee5e7c89c686525e843a01bef746063fc13d95266e8cac256e86259094b8bfe621eb416a22bcc4a66f9765ce105219d33919d499
SSDEEP 12288:LWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:L1NyBo4kx929bL3Hnx
TLSH
T17D4523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b7dfe961e3dcd02a97913bf85d909bbd2198eb8950776f79c97944ca2752d459
MD5 8dd578fc7e1b7607001b76d6860777ad
SHA1 7b7e7ce2aa5758aef851548b5e6e8848b580e088
SHA512 29ab92bb2aef7108861e95c0eab763a9887d3149273cc33243636ecfb10a6f9ec61ff20f6de88d0bc2b15d338fad2d0fa3bfc5a55e3ab7aefe17f8d42028ff2a
SSDEEP 12288:8wLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8PNyBo4kx929bL3Hnx
TLSH
T1CA4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e4b0d927b7a3792c218ef00f4a0310c878d5df88449a09c83adc09651a5dc658
MD5 c64b08026b0e700918a7bd6213096056
SHA1 077288d614d9b3afa6ff636d8d66776e04ac9509
SHA512 a1f71d738341d8fd78716a120c25b865d2429e4901e82e9d69327426e6adfcbb0449cb3d53d250d253b7b2e273115d1d281911f81a142d09d1062d8085ab4505
SSDEEP 12288:0VfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7NyBo4kx929bL3Hnx
TLSH
T1FB4523125B5C12FAF97A7BB0D85A8054C835BC8A5B7197DFDF1248BB0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d3c5919e2e9ee99f84e75e8bbc6125cd10c7f9d65831f6eaabf5a97936a44775
MD5 48d79acb9c92b1b7f4b980a408d230eb
SHA1 9fda56d8236a60f6a888a89807563eaa47293180
SHA512 f2b182ab02f639f4e5dc122bf32b64807c789fb1b75ad0cab88e86f3da3f59ff4d4129603e67494b7b31323ae961f80fef14338c0e3dd54c3f6e7eb75607881c
SSDEEP 12288:8XLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8sNyBo4kx929bL3Hnx
TLSH
T11C4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1e8d79af10f56d52de4aec72d512b68c7b53a6feb8b5dae4766e29cf1a20e978
MD5 b7bbca5d3293685375a3e6429b2d99a5
SHA1 7e315ee53690fb28f3e30cb648fec24ad2f06ccc
SHA512 a21e5a3adf2de567a07ef7e5d10daed292a970dc5e32dc35cd7015d4b257779085ca31f2d115c429788b9d21d20a73e597252d34ef6f3d202ec1aeddf2290ae1
SSDEEP 12288:WaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WxNyBo4kx929bL3Hnx
TLSH
T1534523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1d66ef957bda1fd9559bad315d698a96faae6214d90eef2b117b85d06f5678da
MD5 8e9c46552c9c33cbdb5f5a398cec6a61
SHA1 a4523b3e9816b786439779402e76bc80e6f0c345
SHA512 1db1519c289ff4d154ba531637c188fb19bcd227aa9d8b7e3a152c0f100399553c4961d5902dacf31618fa24c081734a1570c6042968881bc25bf796e18d5ff5
SSDEEP 12288:2OLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:29NyBo4kx929bL3Hnx
TLSH
T1724523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 83323678ab282d8c1913bd7f8d3a983e66ed20b7b4bee5945346e84bb3797223
MD5 ab1c026ba5f594623d3c5fda3f9400dc
SHA1 8275c1cabab265a8c03efc84e357fbdac0607ffe
SHA512 272c1fd725d33efb5f103ffeac29fb8b50c1b7b8090a6a8a4d12d45799434cae67e14a25be355a536f245ecd862584625450f6ec6357fd6f538e9ef186b1f981
SSDEEP 12288:miZwbjzzFEoS2cPvy2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:pZMXzFVSOVNyBo4kx929bL3Hnx
TLSH
T1DA650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 494422cbcf6a71697cc011b4ecac96d5ad59859fb85ff36cea7c8a6dd705abd4
MD5 4d42e1617c5bce6f05727efc537b22b3
SHA1 cf5979fe8f2ac724d530895fc7022363b64c18ac
SHA512 bef83fc888a88707716b972262beb645adf0fb82de89543633b5943f9ca636cbaf443b16b134a912ecb5a6c83a0249d5a531845d029c81ddd9c192038914a8ee
SSDEEP 12288:JJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JWNyBo4kx929bL3Hnx
TLSH
T18C4523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ba5639efc5bedd17e546aa7835c7e742ac51484f61ae1db87badca0bacba6f81
MD5 36bb1a7922449e9cd7ae993a743e179c
SHA1 368a3017c1cb8a0c211d13f849961cbf800f5efc
SHA512 75d8aff1b0559f5e3223ca68674d0d5d16dc5f3e6d8bba565378618bdf3696b35c5f2410ce52a11e5797c4dc3082fd8c56b767ac0aeec5252c2ab6024d1c2a29
SSDEEP 12288:ClLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:C6NyBo4kx929bL3Hnx
TLSH
T1D24523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF279C7759BCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9a8a4d344ca0ed0c1ca4a1469b9619d8f4ba920943cff20093325f9598734d6f
MD5 1da033fd8fd7dfbab2caeeaf1f0f4d20
SHA1 ec2b894e2d5a0762ee2eadbbb7abacaa80b4cde9
SHA512 dc740e48c13ab2f2bc1ad9ee9ae17d6e629192351bd61f19bf3d881412340bdbdb74d34cfe8bd25126a3e752df7c10594e7777f799ccb948b87e1130e148b017
SSDEEP 12288:hyPz5L8CLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wzyJNyBo4kx929bL3Hnx
TLSH
T16555120773A431F9E17A6234C8960A05E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ffa31d6e4c039cc91c4f7acf1c31e7d869c9afea65508b494093caffa5ece2c1
MD5 babdd40d82ac2ef336ed2f8b1f344026
SHA1 2b6412eea1045ece437c6e4a79e1d1d06df4c427
SHA512 b8c1652665c176eabb32cbdd7622178e80ad85243ef318db3a60cb432ec7942d062cb628ea7d6794c3881baf9543d9e95cbc0de0cf9ba8f9e4989e39d3b47e10
SSDEEP 12288:KJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KWNyBo4kx929bL3Hnx
TLSH
T13C4523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d8e8b1bed819b9ede19053b574875e315af8e70a3caf4e24118625b2fe4d760d
MD5 44bd7690bb044cbe5f19cb4eecfbe6ef
SHA1 673ee46de6d9d5721758c6c896df9c94b720f5c1
SHA512 a83c8bfe44079501fb1218f209a03676cac2f77cbb5b549bd09b97b7be5ca9f39d1a8b9fc780b7f7fe9a409716d4961e35dc56825e8e497061a093b9d9069e70
SSDEEP 12288:ZJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZWNyBo4kx929bL3Hnx
TLSH
T13C4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 815e002f25c260d7354f40de07c23f46ef33adefc0aae11b2b38a3cc65ccab1c
MD5 5aaad5bc1b6a2caf9601262da6170bb5
SHA1 1ee4a95e1d7934c14b018d9a7c5fa96dda525460
SHA512 7df7f9dd3334b0710a4abb7bc0fde71da418cfae8b4846ee0b764680446647da071dc567ce5d5587ab5ab6cbb1ca69ed3e60a7dd3d6139d634a5d9ea58078083
SSDEEP 12288:dyPz5L8CLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UzyJNyBo4kx929bL3Hnx
TLSH
T17255120773A431F9E17A6234C8960A05E731BC760B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 67b64a95fc1a18ece0f2e571096389d4cca0ba231c7f9a1dbd42cd189ca60cb7
MD5 7f164dd06a74fee4e22791474db2b6d2
SHA1 0957e1c79e4acf5320dc87108434404c4beb618e
SHA512 0cb731c8211c88190b06d75e30abd67412fcaa5a545c6137abc1570f00b46dfb5ff09da40e09e30c002acbafcfe8eec1f718ac0738a187454f759fbceaf4b3ac
SSDEEP 12288:uCd98WYoaLHF3z0z04PDvhgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:/TtaLl3z0zDfNyBo4kx929bL3Hnx
TLSH
T14B6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5bf78fdccbeb520dd632e582fcc9c63a31d3d25cfbce32d3ff0936940e585b7d
MD5 dc308fa36ec11eb67f087cdce7edda2c
SHA1 1a903bcabb15448864e54bde8223de562c9ad1f9
SHA512 9d759191b1b0e4d0b300bba627307eea8afce8596dc73f9fa384e30c88b3067e413c952aa193cfef29d86d1a12ca59805d7d81020ee0de463a02ba29434fffae
SSDEEP 12288:Oi4e7ARdTfgwCHKy7GLbbdIvrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:O3ld9CHKy7GZbNyBo4kx929bL3Hnx
TLSH
T13875CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1cd975c07706d59588b535526090a9d0f328e2a37b557231e942b24befb33774
MD5 8ccb9e162c029694bb39b6e3eacf6897
SHA1 4f127bdc7729a1a2ce2307ce3cf8067eab005ffc
SHA512 abe8c15589bd2fb6740dc3eaf01ddabf81641d0b91078c5b32c0798217afe13915a2d61d23b30f00f0ffa901cdc4e6bc973193b44b59075ef1e50f8fe71ecd0b
SSDEEP 12288:+QLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+vNyBo4kx929bL3Hnx
TLSH
T189452312990C627AF76D3FB0644A8098CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2e2c8ff0490e9c3477670aa6fd273fe2ebc73ac50b3aeff09bfdb6fab99d2b7b
MD5 8a4407fc4504eecc6a7a68d2c5692ef2
SHA1 c2555067227989760275dc914c54d3c8878dbdcb
SHA512 91e93fa40b517c8a2b7a74a09664bdbb5b50d324208271ba61eb9c7c708d6c40ae2555d4e203939a2c0c8ae0a8329930e4d82e3d49b4dec0a55888e72253e7db
SSDEEP 12288:XiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XpNyBo4kx929bL3Hnx
TLSH
T1BA4523125A1C227AF66D3FB0644A8558CC34BC8F1EA597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5c8f5de8658136a325006a593f1071e4f8cf0701f60082780ccfd732b6fa75be
MD5 c6d698fad76a45392ec5d8a96e415b60
SHA1 2477769dc8bdfe6c4dfaf67167ea7769ad7e9b21
SHA512 cfe8914c96dab86a07ec0021c653c752e76f50bf4afd9bedb743c768dbbcf91bbe7944be8d88c51e992c5e4ef17751883541b5135f65812650ceab0ea157301c
SSDEEP 12288:xrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xoNyBo4kx929bL3Hnx
TLSH
T1C94523125A0C227AF76D3FB0654A8198CC34BC8F1E9593D9EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f1b49c17c8e6a980818392c6dc195dfa7383a2cd22d42f77cd0470eb8bbb901e
MD5 0cd9c4c0c104ccd2c195dd43904951e2
SHA1 4d82acedb3c20199b1345a158da55180f74bd3db
SHA512 f7cca09b0bf6482fcef3eeadb1aa970db5a59d6d7fb1b5bf19349941f412b86103ecb2ef23a9bb5c62ee84de175c78a5cf572cf9f7783e169773cb655385e877
SSDEEP 12288:8JLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8WNyBo4kx929bL3Hnx
TLSH
T1624523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 462deae030f54ce809f3bff2b06da0ad6bc68fd2e5ad37704d1fcd1fc78cac96
MD5 00ce66276f2e41df7fc447ce6559bad6
SHA1 a8804341b9344024f03029817cbe8c6575416039
SHA512 cc9f8e03a3ddf9ff21be3fa616653affda6237fab7d2a3b3388770394b60702b7712bc50f2846e5adaa691e2faec45957e6daafedbaf9dfbc8517d7a2fd53cce
SSDEEP 12288:OQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OvNyBo4kx929bL3Hnx
TLSH
T1ED4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 31e8a7046e11d00d365e54f6f84dd6e563651fdf0be70d2796b413a7985d308c
MD5 e42ee154f2785b3022b045e726dc0c58
SHA1 6fbd2c26a6114315d24864fb77c0e46cf20d4674
SHA512 7415ce9000ec2d6bb23ca6cadbba0ec8ec0b8f583bec7a78f8b455d44a13f5686608a96400d4395ec37aa282bb1099a558ae421782dd5a2e0bc745ec1361d9f4
SSDEEP 12288:QBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Q+NyBo4kx929bL3Hnx
TLSH
T1724523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759BCEA34B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cb55398a79e9dfe93a790f2aebf140137fbe9a4bd232e7545b1096faf4e08ef8
MD5 33e8bc22d5e839a875c20484206e0a21
SHA1 f7e53bd2a8822e1eace292513c1740d8ab1dc84f
SHA512 f680afc5fa0dff7c245d048105aa545a3a057f8d616401a46092a568aea7d0b3ee47cf0ed741dc9256b1cdb9fc392e7b0c15c96b05fd553cff39a2726394f22f
SSDEEP 12288:zXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zsNyBo4kx929bL3Hnx
TLSH
T1C6452312990C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3783bb7e8cbf197101f9250f4179a37eafc904bdf20acf91bca0b0d481e5c0ca
MD5 3131a8b14ad77e3ee9127ef43001c894
SHA1 b938d26e1adb2e53291d6e832654e89a950eede5
SHA512 5f6f10def951d5899042eb2eb7a9f6e800a0530b5c3e064be43439ae59e573888c5e9a353ec6ce31b0174a48a912829d3679528eb65835c6f66c9f44ffc93b12
SSDEEP 24576:Ffwvqk9RX6wkyAIqNyBo4kx929bL3Hnx:pMnYI5B+kn3Hnx
TLSH
T18785DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b0fc97b5c221d8bea88dcbb2f099a82894ba2f269a97b33593c81f07dcf727f8
MD5 4e4de150132e4ee488874d1543f72ee0
SHA1 d9182e09a6375192ba86f7cd7e295e96ccaab744
SHA512 69a69e71f0e1c683172ac9ffb3a5a8f080b88025ddcb3245dd8cb5b5290e1cb42192dd7e1c75a432f9d058e6d4e78c29f5c9755a05bcf79f2d85426b0fa8b791
SSDEEP 49152:aYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sB+kn3Hnx:hySzPI+k
TLSH
T16F066C56A1A801D9C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d37bd145f1d166b5f3b1c5073d1906ac68a3a9871661600a694dd7ccfddea3ae
MD5 89847cac56bb98974c7c40967de27901
SHA1 e0a2751a1e8a51fe2a85c2fa290b31374218a8f6
SHA512 9e0e802142384e28ecab63e6df1bde3dcb08120b3c23197c6161e9a79b0f80ccf8bc7508c63db9f79fce3a463af1efe3dd4e317fbcdd24d6aad585c28af0dea6
SSDEEP 24576:K47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYFNyBo4kx929bL3Hnx:K47JUQjTirIhCnDHUPfF/8B+kn3Hnx
TLSH
T1FF65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 24b0b98c8001abb3e334b258df0e84d6dcb6c7606ed7d8b9c6393a4c3a2c9f39
MD5 433e594aebfd0f3cc77caa00281a6406
SHA1 9a73693e0dd737bba635727a39aa85917b656252
SHA512 3dd2420be5805a88f1e6f091f31a6fb67bbd0fcd0c64cf57ea3ba08140fd12b4faac08321f2311fda6467234c7580ef120752998498b9c3a2bef86015debb653
SSDEEP 12288:9psf5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qmNyBo4kx929bL3Hnx
TLSH
T1E755F01AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 df11aaaa9f12ee1a64eda2fa924a84b3317e7967ef066ec74ba57e23a04aef61
MD5 47b0127b60a278455b8fc0b9ae47a662
SHA1 e60b735df41e7603f408a0d6f058dc8809a87983
SHA512 1fcb26d1c9e5fa86b8970669c5ef81d73aa97690a7992f8e326f011aee33d238641042dfe41eae5b912054bf749abcac83cfaec5418076dfc4a23a97a1237251
SSDEEP 12288:hjuvzy5xpVp0nQReC1ofpJYef0GOSCoYw1:hszkufpKesGXX
TLSH
T152452811762BD75FC6A940325E37D2CCAB707D01FE459B0372C8872FC576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d84cfe7293fddda5b282fb4f19d0d5cbd9064f0f6ff00ebb603f824662fe7f37
MD5 522f3074b447e162213f954ec7e4779c
SHA1 fdef8729c49fec48987d45161104af8ae8cd97e5
SHA512 721c2a2503e9188081290b5d0ef1d16b634ef4c23b0763d974dcc33e6bb2223226fd240c3d797736a8f94a311df6f7ff660e37a6e0381d18ddab2410e2ea3e1a
SSDEEP 6144:aF9Y0VJRxzAVoV29OI8xHI9oR2LhXMKmCflLLOJqb3BvJdPZ1104rMOKDexHXOKf:aFE9E2oIVLOQZmw66ghW2tW
TLSH
T1E155C8815137A38FD1F76172032A9B4DA768EC02B7096F2673C8453AD86B756A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c132e58c5719d87a4ecc17c762cd4941ee826e63617f5d571f04acd9e60359f7
MD5 48e25affbac318bc7d2dae545957939f
SHA1 603dd78593d02a7a33ed57ddcc5f0bfb5f74e7d2
SHA512 3258273d93bb4581b19b2d82dad90c94beab02ed73278557564f0929106bef5d5d9bdf7255baf4b62723aa5fd45c1674c5683e9515b83e57372da6eb1882dbf3
SSDEEP 12288:Sy7xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pONyBo4kx929bL3Hnx
TLSH
T19F452312975C623AFA7D3BB0645E8124C839BC8D0F50D6D7EE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1f3a23e747f852235630bc28be76bfc262b9c1bb9d5069569bbfc2c926a011ca
MD5 4502126ec58057667206bc8f54e38afa
SHA1 81045433383c9f9e319a05a6db4af0a3dcde71ab
SHA512 fb8c68937ab043445328d784e73df3e2692f2e96ecfc9df1e992f95b9a0dffd1fb80c5f0d378ed439561e1eeb0f851634fdd37a17a6864df4ec05de5f515304c
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYgNyBo4kx929bL3Hnx:dgb4mBIBhGFSB+kn3Hnx
TLSH
T14F65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7f7aca76caffe16f1e9caff18c1e71dba8b55279cedf794e03594c404c055bd0
MD5 92754ae46f50f8aa9f028434e6cd3b86
SHA1 d46ac9198a0c7d28934fd499b3dc91c1d9260e8c
SHA512 9ca946848299648fc476938f22eb0ab11abbe20e40da757b32cb43fb8e0a63ae57245861a2527e229e0aabe713c157077e664adc996e0eac37f8e93e4cfcdf1a
SSDEEP 24576:4G88u8FpJqH1Jzria7/mVNyBo4kx929bL3Hnx:77ZFPqVAa7/rB+kn3Hnx
TLSH
T1E485F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c4388aa5fbf0283c8277111bcc3edb5d6bb87da661c47e23587b7be958d69215
MD5 b2ca8cbaa11f8a8767ed6af603799cd3
SHA1 a92f18a1c96a94a655e230172da66cf9264fd23f
SHA512 49ef4d7c123b624b7e03256dc3b74f1495648aa70ec4c3ef08cb7b09493cc5afef0a34e6e7d97de9ea8a6a5c059ca1945ef54aa7547b0bff4b4db94d807bba14
SSDEEP 12288:lHvUrBFrEjwaQqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lPUr+NQhNyBo4kx929bL3Hnx
TLSH
T1D865F22F22AC18E5F67AB17C85868619E771B8520711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e0a7e0025c2be91efe815e00e8931810b164311e86463d2435d97256fcf4be8e
MD5 3b32f79f02fa9925d05729b284e87c17
SHA1 5ec53632a201f14aa9eb13ff2733404dd8abebcf
SHA512 f55ccc11004dbd8fa138779db5a4da98938da66fc7cb421b76ad8fbc4119f19a0d69b8e4d8cdafd7648ab209e48308fa412c4cd4caadde935ea8305326f0f29f
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmB+kn3Hnx:hG05lO43b3+k
TLSH
T1A2D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033456CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3b503f9235b38095e5852fb51e190820ba8367c88202955ca0d3b977f20bf0d
MD5 3bbe0c01a9d59635da5c4b3370f79a7a
SHA1 df12cf7b2cfe9db8bef5c80cac398afc9e0f9ccd
SHA512 6f34135018bc3037d95c2e6cc7cda6e29534f23a89610eb9a9f927365e2d4f5e843102acf3e9bcfc6f36fb7b978998946bf15c2ce1c07fbc3b2895d9b70851bb
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnjNyBo4kx929bL3Hnx:ga5POZ3BJt2pasx2+mOB+kn3Hnx
TLSH
T18965AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e0e50eb40758e88cb9afddf19e0fade03804bb8b6c772caafeb76bb3cae7d250
MD5 e29ac964e70c2d24ca63dde109f744e1
SHA1 733e7862f53854445b1efa9252e08d91ed13a0c2
SHA512 79149d06e5cf03e41a687ed373dc113c0c2fec7860756f76d399b439685c47f71b1fa600b9b29c282ef130e6e98a0f26dc29d6ca9cdf82c537689b5d8f3850dc
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkNNyBo4kx929bL3Hnx:VNc/zEOVHFLB+kn3Hnx
TLSH
T1F5858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f7b18bde16ed99f67137b8c13dd58d98360eb6061320a43dca857f3bcbeb4d95
MD5 e010d71e204415d24db87e426152ae18
SHA1 9163f690dbb3455b76a50a0f1b5e72d280805f74
SHA512 95157da0eedc0a59578b5da096b4dd818fbcc40c01e0f4b20f3a915a7f2450f23074a9306be2f322909aab988860e818ef045a1c69a6632ddd31be1fb55042fa
SSDEEP 24576:FTkNvNnaFeYhJNtmZBmXNyBo4kx929bL3Hnx:FTMwBtOmYB+kn3Hnx
TLSH
T19C55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7cc717ee5a88d175396ca19da0acf92e87ba0b91659149f7c7be63ffd9be9829
MD5 3b838aaef00aa5730c145b13b790d7fa
SHA1 2b5475e8e7589000c21dc989f53e579cebfdc4df
SHA512 7c42271929abf3f8e2e222b31f45645b6660dbede34df2e3f53bc53d84c8ec11b247aa87727a37c06fec7ac933871bdf84f0cc9674de13968911655c060286ca
SSDEEP 12288:pQcMxWDXN1Dp/fshBItT1IQgAdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:VD3FHshBIYQgACNyBo4kx929bL3Hnx
TLSH
T11D75E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-99-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/940-93-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/940-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/940-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/940-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/940-335-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1444-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3444-62-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3444-69-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3444-63-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3444-231-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3832-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3832-112-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3832-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3832-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3832-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3832-318-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4064-317-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4064-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4064-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4064-117-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4888-53-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/4888-75-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4888-73-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/4888-59-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/4888-52-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4924-6-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/4924-48-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4924-8-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4924-49-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/4924-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4924-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/5588-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5588-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5588-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5588-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5588-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5664-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5664-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5664-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5664-321-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5664-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5968-314-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5968-89-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/6032-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6032-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6032-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6032-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6032-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6100-310-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6100-77-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6100-79-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6100-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download