12ef42f4710867b03450acdcc61f6715a1cd2d10ceb8a59e981f8abffe15d781

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260727-rlw2vsvsh1
SHA256 12ef42f4710867b03450acdcc61f6715a1cd2d10ceb8a59e981f8abffe15d781
MD5 bcbf261a72d976fdb2bcb4df8c279639
SHA1 de6e4b5d240314ef41a3290269b73848ddc0cd3e
SHA512 e65042ee42608b38adc80050bcc436f15c80f248ef1654493ea81b20af4fd8f5e71b8cdbfd1116314141b099fde3f5b57758d403a2d5419b047f6fad6b3f405e
SSDEEP 49152:x0tlEk6QE+MlzPBRp5l7pR63pn9UGGk2jHviTU7c5lC0ai1CT8NOIDmg27RnWGj:xZ6F4sbhD527BWG
TLSH
T1A2268B1BE6B940F5C0B6E1798A579517FAB27819873297CB4790834A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
432	elevation_service.exe
5092	elevation_service.exe
564	maintenanceservice.exe
1504	OSE.EXE
4856	PerceptionSimulationService.exe
1964	perfhost.exe
4832	ReFsDedupSvc.exe
5528	SensorDataService.exe
720	ssh-agent.exe
1520	AgentService.exe
3788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\411df1c238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d530b2d21ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000068ef2f4d21ddd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008714eeb2d21ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5732	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	432	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1520	AgentService.exe
Token: 33	3788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeDebugPrivilege	432	elevation_service.exe
Token: SeDebugPrivilege	5092	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 2524	5732	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 3788 wrote to memory of 1128	3788	SearchIndexer.exe	102
PID 3788 wrote to memory of 1204	3788	SearchIndexer.exe	103
PID 3788 wrote to memory of 5176	3788	SearchIndexer.exe	104
PID 3788 wrote to memory of 2796	3788	SearchIndexer.exe	105
PID 3788 wrote to memory of 4076	3788	SearchIndexer.exe	107
PID 3788 wrote to memory of 1208	3788	SearchIndexer.exe	108
PID 3788 wrote to memory of 3428	3788	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_bcbf261a72d976fdb2bcb4df8c279639_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5732
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5732" "1244" "1336" "772" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5528

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2804 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2804 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ad855a52a08bff951ccce7e5469f5248f89452cd9917c4e8d4f838f97faf07b5
MD5 2a95bdf7718432c1babb289a4dceb5a2
SHA1 5ae16af5d5ce7fe072bd4f55938bdc767df1607e
SHA512 c078f8363789d3fd3d08653b8922526b5d57ae9deb0efb1f453ef6ff511f0bb2f330664625b57a5b2c3b673de41ec161566500300ea99df86f8ad0716ccac0d9
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnsDmg27RnWGj:23q6sjBDD527BWG
TLSH
T12CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 01a290d8b14c233fe1d31ddca8dd8a17eb97c6529349047a9b21af603fb90cc5
MD5 fc9cf5d8bdea595317dc9532908c192f
SHA1 1b7f8bdfe9d23f55c25be235a59435b9cdaf6af2
SHA512 0cf4ab10f3b508d755edcc8d11efb08cb7ab93f2c8f138e421a87b94b322b98872b2d1ebfa4964a14b63b5a87fd73b3fdeb59bc7c07c5f66c3175cc69af63bd0
SSDEEP 24576:bXYfDtczA1sqjnhMgeiCl7G0nehbGZpbD:+tcgDmg27RnWGj
TLSH
T14065F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E499795F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5726e597d56383673cb26c92fbd0c3ec10526a47e890bb3c534deaf26bbc8a54
MD5 26d419817ebeb9213a1c6897072b760f
SHA1 75fda2ebe174a5648a5a70164553d801e8e7f47b
SHA512 08cb072c3d5ef40af62c27932fa5bddb459829bdda967a651eba9b1e67094536d3f55eef2f8c3f878d6200fb3620aac461064da000053799bdc63896013d2209
SSDEEP 24576:T0Le5ji0hmxxrMusqjnhMgeiCl7G0nehbGZpbD:TPji0AjbDmg27RnWGj
TLSH
T1B4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2bcb4fb8a050ac07d298cd25cf6ec57ecaa96161676b289600d4203eb0e0e73
MD5 42952e1aaad5a9744c5f4cec69565574
SHA1 320f4dce1152611a3d5f0693464c6439b61ce2ce
SHA512 d11fd8a14cfc8034110137ee74497da812ce090dcbb653d1ac0a611d42be92d73af2c9df040a5ee9503e84da326d60101a0e66938c399cab2a6351badee121ae
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyuUsqjnhMgeiCl7G0nehbGZpbD:h/ezSC6vUzPveHjyvDmg27RnWGj
TLSH
T121755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1f2165a106e8b4a5bad8530a5e7d48e46ac374aa51c1a3257055bc04eb48f2a1
MD5 352f15a9b87fcc2babf0c5c89830477d
SHA1 e3862ccfe35fa61b3726e848f499e61907944edb
SHA512 449c59982a36bba5dda3b3f274c14278afbbe4173ad8b8846ebe122c816769a13c4df9b7527dac38212f7acaa281a2c66535ba350912a374ecdd8528a95bb213
SSDEEP 24576:tVbqPb88hv/l+YhsqjnhMgeiCl7G0nehbGZpbD:tVO88hXl+YDmg27RnWGj
TLSH
T193559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d84be3487f01b1f3c84b9161de4a79ada42e5017f5fda3745fa0cd61498c65d6
MD5 b95408b1dd35b1171aa3991e42a98643
SHA1 06a38042135433f6604a071e2d1ac02e7a916f6f
SHA512 fde2efa42c530d47e3c6f67c192064b77c9561c3bd96bb1e25b69737cc407ba2c5c16b335d2ff1440052107b9ae1159484a3faeee482a636ce72fbd02ba2a06e
SSDEEP 12288:ZLaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZLasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8c9f7e97b1dc2525b97bf564edcbb3d7d0bed92acce6519ce2fd117597bde19d
MD5 f68eb113e3982291520c920c88c0342f
SHA1 0389208ed0aba67a32b4bb62ad4d800c029c5ee9
SHA512 06086a69049853fb832ddc7453e6408a244bf0edd1de413f46f9224ef93c84e4e7784184db3102fdb1e216f8f0715150569675b6d3b772b9811020653df5569f
SSDEEP 12288:deBNUbTVO86UpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:dJIUpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19565CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 32b3e72320d7ec4ac35ae888cea91801be2892bdcffe43de807e020b5fc849e8
MD5 8136f8e1f3b0405a59e6268f89892034
SHA1 6f900231d282ffb24d8d928d23e6659700abf0c6
SHA512 7881becce94be4d421cf6eb071a9d6e03a0ed96148910f8c3942cc3b306dd71f6ffb0a357f37e109ad316a84cfbb084b766f80d1c181603d86c581f93867ce13
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:VQvGAdlCEL8c/DRNw5CAD527BWG
TLSH
T151266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 fb7bc32fead83122fb282546cc423e373828256482ceb57725755561a901007c
MD5 ac6cb50df4b46971734f97671470e263
SHA1 cc8ce3aeb90b4c857c5ce733d1bb1d1b4a28db79
SHA512 7c107a830764ac7d2671f6247c6dae006c7d038cf1d165105fc8a070c1b8bc8f7abb9636e01969c50da6b6411d718b7fc381353845a6ebcb9bda19c4ca608c41
SSDEEP 12288:LAwSfxL/2Dc3RDLLmt0LDQewsAjXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:00ewsAjXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3ad5409860012ae01ef34f6bc2d977cf18b0d86bbd2a79039404aea9342482be
MD5 e0fd95849d4f8b88d5fc6cde0c19681e
SHA1 bfabef245728c28fc263b8cf3115cb9eecb12944
SHA512 930f7e98c709a0b5637948b902550e10e8dbeaa892050510a8d03f9de850bb0026fa2b46b547dd49921986b986a6502d155d833cd801d414ae649be076fbadd4
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTVQBWG:JUEtQevvqc2W1cpV2tI32KB
TLSH
T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 40a3b77852e6dff82553ac3fd05ccfab5363f4457feae91764b96856c26f89d6
MD5 ac826e976d9e115199635b9b722e83ca
SHA1 3880c6120083fc0ad575ae9075194ad332b387d4
SHA512 2064556406ec4ecb411496ec6996601d2665b19168dc27825f570136162b6fdfe9d6d4af97b3f1777c1b991b99c966ea2b6cb265f47849c3dfaa517cf80de288
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zLDmg27RnWGj:eoquVjnmED527BWG
TLSH
T1A3D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1dad2833ac34e6818eb365b76c39a46770399b79c74da667d41d11d55ed59c2
MD5 a6fa4abb045ae5f9abbd1c2ad0612b6a
SHA1 f96d2fdcbac4a50edb748446790ff60ac21e6242
SHA512 f4d83be664cd2d46bb3c179423a06c6e2dc1982b24b8cb06547e3acf24b4ac2e3033d936208565d96d7b6575f4678c51c3ee937973d8c8d8d9d6c027448ce5e2
SSDEEP 24576:UAhGL3IFoiwtA5l7S534sqjnhMgeiCl7G0nehbGZpbD:UAMUFoiq5UDmg27RnWGj
TLSH
T15A359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 81411e45c8de7d2e8e5b51ec7e8a3005c67d11a28bb37ce445042f9653b6805d
MD5 6f0f84443bb171c9ca0f06ed3ee3a24e
SHA1 a87d39edaafa7ed08ea1ae38c29c24b5effbc6cf
SHA512 7ebfd676d4c98085be5f5d21d8f987070ee466276f7cfee388162cf955843585c829ba4aa678e34649946eaa76c186d053d508eb27f7271c0037ed5a0f3567ba
SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+C0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Swu4OWbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19965F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 31f7098cf6226afa2b6c1ecf4b44c2a7ba64097250515a4a314704a1b4536553
MD5 dd9c4c1c008ff619cdcf22b2accbbab5
SHA1 5eeac7feb7e60d59542e68a90c144f1c69b7d9ef
SHA512 fa9cc7b2a4bd23e549d8863f9d5ac395b0b5edbc31e1034c2096bde3cb2d8eca03eefc2eac7bb01f155c7ea5a78b25eaffe08ba56c6d2806f14314ac88916596
SSDEEP 12288:+eZ1IynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jZu2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1425512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0dcb5fab0818f8512bc59f8261bc7252dc1e5878ee1d105f6345bb1a5d446f9
MD5 b21a25ac6c5d545fdbd6fffc0828492d
SHA1 69dbd8e89ef979fddb158f2310c638e3b67c0016
SHA512 991c52c4fae9844e20052a7626c1a537ada88abef97190eea91155a8127c89d8a8c7dbdeec1edc2b28cd74cf45fd8cfaddf7fdea4672de000aa16c063b2e9b74
SSDEEP 98304:8QRQyi36YOcPbLvw2gAf+PN3hD527BWG:jQyiKa/X+PNRVQBWG
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 189bcf5972edc2f543c7aaed64c5e9aaebcbcfd90e769744faa5acc33e11de46
MD5 39c4f6f9d03ec3b22f9e02b52c5d3dad
SHA1 c41908399b74a5e880dd195c7a0344b4f0c87022
SHA512 bb1cee642d1cb18a215e1423caf4f81f1da6a31e61e59909e929fb5f7c2d91b8a3af53f2b04311dd74d4652e5443f345c9e1c162da730268d7d4f948487cf1a8
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3hD527BWG:oQyiKa/X+PNRVQBWG
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 84cb04d4d89ef6d33c96aaa5c35f10852364cd41781be43d8a334b50f9cf7e7c
MD5 ea9c9229d0311687d995809cee0a33ee
SHA1 20f6a1735491c2a283b51e740a19d9c835eea21d
SHA512 9c686909d40e6b512f4d29db7d7ee3783ab7e1e60a07ff568709263bbd560c35cf02ef68310a6b097a96133198d175989cd7c44264d1ada7333bcc080bce38e2
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0msqjnhMgeiCl7Ge:A68Qg55nhceWu7PNU3/bDmg27RnWGj
TLSH
T174B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 465bb83e81b1dc71999dbd68ae2c9b227f854279bb233943ad109d8a0fc0dc8e
MD5 b976c23f0693579c97b7ae489c52a489
SHA1 37955b8fae313f3b8b27d4122b413aa1400bec6f
SHA512 c194a787a57c1b7cbb699c211e44127406ca23595e7edb4ff9a1a10c9bc8587b2b70b32de5222cc8f9ec3c8cfd7dfac5b9f6caf53599b214e5d97aae500f8cbb
SSDEEP 98304:by5112gYy5azzVvt69nLKnhZuD527BWG:2LIHEWhsVQBWG
TLSH
T1EA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a27a0657ac22d83e1784a9216ddb9d564fbc2596e3c6c1efe23aad36691db206
MD5 cee4980330104b6dde8905ff502a8071
SHA1 f7e95a755a62a1374a6b245dc8de12355ad31a15
SHA512 66177f3223b33cbbd076556d5eb12938588f13e5e5a0daf480622a0a5275b942576a1f2ba5f69768a74b49e9d6e04f9bc446e28658e7d68001e7c2812fe42173
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfDmg27RnWGj:su6Jmdxd2dfD527BWG
TLSH
T100D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c1f35053783fa6401198561cc8b66c669996244d31b87f70e485161a82c56534
MD5 e65031d2f5d7e884d949e04ccd7e4be0
SHA1 462715d1e5e3279544fc6adcbbd8b94fddffdc96
SHA512 51b62cd3b1242296e32a60cb8dd92bda4735fc4736ae6fcc9fc8e108fc1c4a774e9a659252b4d138d04e438f541932e974de4581749ca80f7d4469014cf83d5e
SSDEEP 49152:p1hpsNoJpF1A63U44CwH7R4xNDmg27RnWGj:pmifPWRED527BWG
TLSH
T127B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 80fc93639529ac2b810365d9524513e8d800d704c07f8a2cc464912c5e1d93a4
MD5 6927b87e32a3a94e43a15b29cc3d208e
SHA1 b61fe3444273ecd21ed5322b56b7e3de6d5d4e2b
SHA512 8eab93ecdde7da4541cc52a345db536dd01ee9b97e86cbaf51091858c1c7c8074cddd1fb39bd44453a037368df9b2fba1fd9ae95f8cdf928321b3cd55950aa36
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHq6Dmg27RnWGj:+5dKii616D527BWG
TLSH
T14BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9c8d811f576b06fcc572f0aed8a60e0a7710d095a81ec0d28fd364054768192a
MD5 a6249bf430539cd2ecd9d8e2c1f00a72
SHA1 495632496d5da1b572a8fa9ab2f53095e06d6765
SHA512 a27c9d5f9518085447d84a7b5ba0a9f52127f764e1f5e7923a919909aa02e4fa367e24f43ced810d0de5f462a532b6b03c308c394f03f4427ba8b4967f68b873
SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5wpDmg27RnWGj:bX2imphoD527BWG
TLSH
T12C95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 89084f0059a1f4bb287d11b17831dc2ad97bc64674db4670e6946493c08afdab
MD5 752e7a947eb24a00970c067439fa44a2
SHA1 dae8242dff9ea5be480c90c5f4b5c35b002900ca
SHA512 2745fac77544414d277492a7c9b3ac9d097f32071239c1622599b8f43971794a90f0593a6383088eea77e1b90eeaefcd0aadfa264ad443aaf561044fbbb4a72a
SSDEEP 12288:fiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D84523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A577CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d69120e8566d031c9dcfcfeaf2537eed46848572d12e84f4b28d8b25cfffa581
MD5 a16308f97725e21d9535966e6d3b4b81
SHA1 3d773ea0181c45a774e61d23d7b35c787a78b2d1
SHA512 9da3358fd0b8751a09836c01e360e33c50f1b7caa4caac0a689a3045f6b523df0c3ac7e918fcd7a412a2ca482933ccc708fa82dfa0d72e1ad5f487bbb305dd30
SSDEEP 12288:7zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE955C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 39621c363e3207ff4dfc3f25add6c12cd2eb76300d320faeef969db0b974e66c
MD5 2db1781d47086a9f80673debb0e87a32
SHA1 5c4857eb9c347e2c7857b70ac9f27ba431f9adfb
SHA512 7cf9648a1d1482c81a07e5f6e0a69d70f5a23326ba022515d31f0b7e7134c101d83cd8985141092816ce9ff669b49e609ea64c188fce078cf804ab1029826a7f
SSDEEP 12288:bRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2b579bc976847d2926eb9ce248bea37bbb305647a183df909b58f67d4115dc9a
MD5 b52e0581b688d04ce47d9a4f78f7122f
SHA1 0f61231fe150d870b3fe208a4723928383c37f83
SHA512 5990f24cc16c8b8e4474009cae91dcc2c90efe3204799ee9f26d66121c1104279ab5d75efcaa2b157427d4ce73f9ad40cfc62268500beae3a740139027556886
SSDEEP 12288:qVYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB45236F635C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 53f39d6c8a699b9d0156970421d4d48d1603deb727bbc011895cd03dd9c4bab0
MD5 22d34cf8716cf8bde473017e1f9645f7
SHA1 2370fa01642baff67b9e9f2640164a70a9c0c034
SHA512 55fd359495ad94bbee59cc647b35f3dd3a203baf4a56f0bfa7c33b3b6ed00c9a9ad65ae4e1ef4381d2e0545e0076446c362e91e7bb6b3779449e3aeef964dca1
SSDEEP 12288:8QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE965C41CAE52648B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e282c03926a87985e4eb94126bdf5ee3e8608ad6332e7d1b8b3be510081404b2
MD5 972b3129c3b84d8c9a79692bcf8c8eca
SHA1 e9a8084acaf101ef233258622b53de7a2017736b
SHA512 f76bc5d34c8f5fbf18f7bf751a44181328106ef541c918b5d103eb4c56255c6d425870de53c6d04af6c047ee51170e4c67ea080bc2843335c5fb30a803a8d46c
SSDEEP 12288:E/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 48bfd6c48d4a2ae7210dd3210499f5075b88501258ef7568170197dc407ab016
MD5 76fc1c93a61c265dfc19599d58129ef8
SHA1 1c9ebc04349f5ee46057c5d8e78bf8a8eda049eb
SHA512 ab3696b7686973fb37cc4e356ec08b24b41107d67704ae5a080da9c631857c6c9b79a357317459046c045daad8c1ccc4a4abf1536a6b2f341921584ef4f81634
SSDEEP 12288:cLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1574523BE965C41CBE52644B5C3E5F11DAC073E5BE92004837A57BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 08920819f3edeccee4787afafdee1415fa5282f67d872dbad3e53d3de4ed78e2
MD5 1bffa1f34883be84715ddc76fe7fac55
SHA1 016e0f9555e23a77731f89285ca47a6bd71f2d13
SHA512 661f82d2270fda1aa7148fe51b869e2ceb6d71ebddc778019d4a7efe7def4790db937fae7fb12c6a3eb24e451dc4864986578422071dd475ca0621de43bb8a9a
SSDEEP 24576:8ZMRzFVSOTsqjnhMgeiCl7G0nehbGZpbD:8ZMRzfzDmg27RnWGj
TLSH
T1D26501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d3eae8e6653d417e8a80252db6c72262a562270a003562a1d821570c3a4cd7d5
MD5 9aa857b0fe8eaeb5185d7308741c153b
SHA1 3d6301ffbb8a10293306fcf0cb0a9f56de9def3f
SHA512 8e4e0ef6971935993dc1102ed1fae0b28de32bdaad3e2c9d8b43a89a948aecb320efafebae464e034b34bea3b58d5514f0e61ea2db0dc013ea1007566accde01
SSDEEP 12288:ZGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 91338bef52379b027ea2a883f927e94aa80583836d7b7676ec33701d2f80ee80
MD5 c4c2e2df92942acc343c6ee8d478b5a5
SHA1 3482abc500f8a699f5eef9644e5aa06283f57208
SHA512 3672b999814bce94aaee823e7eb4271e8cf6cdd2317bb413a33f0a168b8814f522c7ffcd6956a5a61785382a5ddbc8a74b978cadff952a24670683ce76945c21
SSDEEP 12288:WqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6f0ba810760fce4a077211498932942a808ff2ecc516ec171a5b37084523809a
MD5 677d7a5de2acfd804ce39c2d8155d4a1
SHA1 301a8c3261042e2cb988c6ad0cb5f13dd0bf1aaa
SHA512 eb7409a4524ad5d9185dd77126e9f0f11347514fc5ab7af101505faf9573e9925a90475bd1e719ea8aa9b7649c98eddbd25cf7f523a83220532deddfd03ee7a8
SSDEEP 12288:JyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ozynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8e1d343780ddffb46cc7cc2b3ad0c857e53653e8e3904f8d842b849af8fa03d7
MD5 35c1464bd99595eff9ffe5bd37a9ed1a
SHA1 b656538682d0ae9628ecc260d7b6d871e623027d
SHA512 66144f556ad68f24d35c31eed2a9239e11e38381669abd2b32ca12a0e67a761f5fc3fc66d9420e7521a035f8b31f4136cbd1675f0697696ef0ebde28d3c81ea1
SSDEEP 12288:nGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c272a3f080bd8fe7d4e576ee367b62781a31b6618acd1932c11a4acc18476e78
MD5 df126ebac97a3d544f4dfa45e807c44c
SHA1 0928e044d6b7bb0970e38f57613dd1dc2fa0faf2
SHA512 45f5e173a376dde62d15159f64d8f5e66671b8457e9195ce42e0ef99d14622f9f417b1d5c1a657d9f916c86cb1dc5b9c6e9678592272ed39821f55c42d6d77e6
SSDEEP 12288:bGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 80b1b2b385dca65f7d37ff5287ca5080986d8368192bbdbb56328d4e5c815e9a
MD5 0e633ee2d3e76d5968fabf769aa3f583
SHA1 5241a0c8e0d579c774096e6185caf4efbf5b3fa2
SHA512 d44c522497dc33e626d4c51d73ef8cf22beb34acc2dba970aadd714aea5ac67960fa5a507be74bb7e69461a0e53edd8977bd6d0ee8e1881d1c59b9916c039e2b
SSDEEP 12288:UyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NzynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7c410d1ace819f20559fe1bbbeb72fa653e00c711991ee2d45a799747c3db0f4
MD5 4d95fce70ace944052487c1565766dec
SHA1 d3ebaef26e6eb2dc43ab3fc3f82ecb785bc4f733
SHA512 fe76aa2f105da3449de5e4daa59581d5cdc9f6e8330d5f88f4f3494d21280a6668e401b0c791be3224bc308ef9e3c519e281e31317b08ac590b981de9a6af8ca
SSDEEP 24576:lTDaLl3z0zDBsqjnhMgeiCl7G0nehbGZpbD:lTuLljwDmg27RnWGj
TLSH
T1646501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ac9045190797596627126a35089461195b4fc684df57d1ecbf6d6f21f6958256
MD5 83a325994fd99ae9b5ec0a4f9f3dbb5a
SHA1 89d0ef3a07ea429ae5783afd77182c8aaf207ea1
SHA512 a13d98c953ac2c0f9f61ad1550cab5c986e07e59dc37c061dc4ec1a7c46ff5823ebd715fb6d128543139f6dc7f34859b0b04d1d0015533a5377c01abfb051e54
SSDEEP 24576:n3vd9CHKy7GZdsqjnhMgeiCl7G0nehbGZpbD:3vd9CHKyazDmg27RnWGj
TLSH
T1B875CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d73bbc8dc2a2a1eb71b3bb6c70e4bd78a307541edb59c6a12e496654dac39837
MD5 a9475353701283f0e7a4815d72f71c99
SHA1 c096243f06dc49e11bd20adca995e586f0d41aed
SHA512 159d8d769ae2528193c50630703b38b554ddcacf0c7716920c0e6b1c6f7951e36ec6841e2d20d7e1655cab463ed581aedd6dd79f3c0a7225242d6e185ae62241
SSDEEP 12288:dxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BE965C41CBE52608B5C3E5F10DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 10544bedd5693246ad4b3f51f1906858f64e31cdb6e57054548a07cb4bcce163
MD5 cc5c56d7e14c363b2a4a5c768293d70e
SHA1 46eb241d0313bda65770f42b671556899fc38975
SHA512 fd91ef1086bec71fd88e1695109270abbc930f9eba9096b31c00f67f4b380d2fdde0397bfcebfc32ba89d0973c6a360c5957f18b225a90cfe4a9ce4af2066ed4
SSDEEP 12288:XHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BE965C41DBE52644F5C3E5F10DAC073E6BE92004837A977CBAEBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5ea0f71d08c8414a60ae5eec5dd36b94b24157f29ede1b70eaa9bf5b823e11c5
MD5 769f9c05b16cfe62080440cd51805ef8
SHA1 435d8bba1b55447d0420dc4ee119a0cf10e5d1c5
SHA512 13a01729d5471defe52cd883709b8c7a708b7e2b2ba27eb47d87188e7f3395827f79e09da5ea74fad880ab9f1edd68841974c850afc6480398e3e020737c1392
SSDEEP 12288:pMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BF965C41CAE92648B5C3E5F11DAC073E5BE92004837A977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7643af2c3a174782e401dcce2187a6d8930444d0f42a2b7e88f57830ce89d974
MD5 b922853015abc8ec4bcf7d85d7cf7b43
SHA1 ae6c18ba86f359d8aaaf1c2955d1e6554c96427c
SHA512 993c5848840ea7c1d4df20279c00f6e0deff3272c7d30808ffff342427760f202df30d38b56d9344c5d60d5b81dd9741215215a2cab18617cfc1e946eb922c82
SSDEEP 12288:FGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5d79ad6f71ecc14449642308639a860d1437f488a252a9345e3ee0df2f7e347a
MD5 bfeba0c74e8f619612c825c428953db5
SHA1 1074dc6cc34b32483e9c170464d2ad352a56e219
SHA512 a82128ac895cda59b0a5eb0b495c2530605dc45d62a788f0287c6b6915f9b8491c439e036cb2ba28ca5ed0f1407785e4861b06d15cecc7815dc777184f7e8d49
SSDEEP 12288:7xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE955C41CBE52608B5C3E5F15DAC073E6BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a7fe593b5743b6c272366982a053b7149a4aba1e455ce437efd0cd5346d5ebdc
MD5 71e899afa87d334a3cebf940af54e73f
SHA1 7b8805b06465257ff862094a243bf762b83e5117
SHA512 a29656b9c35812d2e5db04259d38e785a3168103231dcf2ea7610406541fa0d6a1e0f40cf95f1850d1083173f6b5ec014507ea64aa2f8f19303f2193caf975da
SSDEEP 12288:HeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BE965C41CAE52648F5C3E5F11DAC073E6BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 14565ea324fabf2b2ab10b89774e07eabd34ff1bc408caae9b45804a2aa04175
MD5 920fda599c672969c5fa61961e082c87
SHA1 1c869d44dffce0541f47bd472db3ea8551678758
SHA512 adf7c74ee59a645a2575cece9eaf604d171b593fd6a048a9b44d8f9400ee89c241b1617fa36e5d0b99dc29e45e621238c087d789425224d156853f5c3175e8c9
SSDEEP 12288:cQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE955C41CAE52608B5C3E5F15EAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d75a1ee380d8b9a09df78447bc49c809496c480534fc97a0f87517ef6b8c2c54
MD5 abce8637a3889a0277491917c3b549ca
SHA1 8215c25101539c5cdc98f07b90e1451c1aaaca6e
SHA512 bbe25e4ac0f3de1a4b6dc4eff4e5a13db017e561015476ea1c3c6366a0f33dadecd3c039dc4679769abadd98e472298c7653eb7a22d3ebabd7cbf9a660786b60
SSDEEP 24576:nfwvUk9RX6wkyAI6sqjnhMgeiCl7G0nehbGZpbD:1MnYIODmg27RnWGj
TLSH
T14D85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 356dd20da0e4d525b5d5ff0d4c562cc2ff84dbd0a9f5e8d26f84637b8919a422
MD5 a0cf17a771a5ce388da9a3249526a1e6
SHA1 2d664429ac06829af266e7c4397029be9195dc2f
SHA512 06f813c225c647721bb5cfe1cc483524b2b40c867be06c1b7b92abb900cc562aa4b49c1a5c0e9e29affa92105d0ec4ac41871d40c7c8c3006670dd8d5cf0c9ee
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JDmg27RnWGj:+ySzPBD527BWG
TLSH
T103066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 22cdaa23a07f3c577382d36647a658cf4b8825dbb85c9450ec635c0dc9f19b1d
MD5 dd26bf86ae9eda2cd9b5a3412f9618a0
SHA1 462888a1e35047c977ef1b45094db698b1f1e93a
SHA512 e85e398ce5d23c89b661bafedfa3718e359e305d5e6722f0330c516627ee592a7a0030ec339f314944a159fe4d85506fd868581f30936b0811fc105aa8baf720
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYjsqjnhMgeiCl7G0nehbGZpbD:y47JUQjTirIhCnDHUPfF/ZDmg27RnWGj
TLSH
T1F965AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 975a28bb731800233e486ee853a811ee7d9103e545dd8ab86ad6d156e4cf73b1
MD5 5f57e02ed240c94d28069e36ed8f272d
SHA1 633d2371fdc1bdb71ba8fb1ab175408554f92134
SHA512 e2649db2b41ab3f4f16c358c6c604ca9e5a025d07f27d5bc05ae76fa57a20ffd40415918b1572253cbf1a3413681e4102b86963845171e3a3efe147d3b2272f4
SSDEEP 12288:+bsf2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 bedbf7cf88c93c8789588909694860ee274feff6447314cf7672c1797ac65284
MD5 f40c7f04fc124740a09848de34ebd4db
SHA1 3b016b29ed8fa89c2a5f372e8b807a253094cf85
SHA512 56927d1cada86e1c2d6d0ecd64376be9e1f3a04b161a32b9ce8ffddeddab878fb555580dcfa6551bf4269459894bb4c439c53356c9adde6c868b92dd45b08d38
SSDEEP 12288:Hjbvvy56ShujqL+VEynHTjuAAGdvj8zGjGq8Ia7fTz:Hfv+OPEyHPJdvQzGjGqTa7fTz
TLSH
T11F453950B62BD75FC6A940325E33D2CCA7707D05EE056B0772C8973FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1b5730c1d158566e2776b981e5066377d52cd975660bb8a3afc5a18fd7854605
MD5 598084d7544621f98155307331dacaef
SHA1 0b1201346f894fa3fcaaf4921cbe0c1bc7fdbdd5
SHA512 859d0444292969d81345b587bb42cbbb681bde2ddc6ee6ce4dc8a1d40f4f9f1f922ea065e2f8a59a02aef4957c28f6c06c0237db70f0911ff0b868db394150da
SSDEEP 12288:HjFyqrDJksuRwI2W8i0WwEuPUU2MjC3SC:2uMU3EJ
TLSH
T1EA65F881A537A38FD1F76031072A9B4DA778EC07B7056F2673C8457AD86A716B0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bc146c83ecbd3d86de6e03c71b70b853f046ea5ef766a3c7553d0301ef7684cb
MD5 a9e8baf411c48fc6c265a4588d818af2
SHA1 c6ca7d35bcb846984f89983d2bbc3d4c743e512a
SHA512 b61559b13ae9fc875fe1036f0d135d1db883f9a8db124a11b978507dbb22e8288367bf8ed68ec73e8b0fa08d6f9af40c492af6c068b36e32bcacb5f6e9f1f793
SSDEEP 12288:L07OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E345237B935C518AE83609B482EAE12D681B7E669F1044C3B90778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f94b854698b5b893899619237e256e8365faa18fd675b77e189e1c852c026325
MD5 62121795bd07a27988876dd727370d0f
SHA1 910b3b296f748d998b468201b8a7763fed5fbb24
SHA512 40604d1a3263d1cc3f9a6fee6643fb7e37ecf0bf9bfe36a2dbda52357a5ef9df451f9cce4ec5d0cc98cc1770c8d040347914d543cd31ffa65af8048bc58bed7c
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYUsqjnhMgeiCl7G0nehbGZpbD:hgb4mBIBhGFnDmg27RnWGj
TLSH
T12D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c2e4512c1f117cd3732f110cd31aa48f44d0e5c7d4f3edeb0d7ffbca18a60abe
MD5 631fc2f0ef4648be5bc69e6f68cc7fe5
SHA1 f886cf4bd438c8bf2f80b775f10fff9e1fd57258
SHA512 f8c5ff3796166ab4d6bd54b892584952d9214b0d5fad3c155ce34db95e0acdd8e2ca16d99488e2b92a89405544776d78dc77d5f7755f78fd9ebe6adbc589d40c
SSDEEP 24576:vG88u8FpJqH1bzria7/mTsqjnhMgeiCl7G0nehbGZpbD:e7ZFPqVea7/YDmg27RnWGj
TLSH
T1F385016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c8b26fd16affd8d53da88e2e99267b8d223120b30725d9bba82502ff7b978085
MD5 70139d5dcf3bf1e34d6453c150a1b9ed
SHA1 e914579f154dc0e2a0f5ed5e85bd3690f7fed3fc
SHA512 6c05d12ad0b73e4152c6f36204a254bcb1c479eb7eec795059990fd24c38d92d8d1e659606e0519710b8632bffeb31ad694e1ea83c1a0c7bd1d7944b08048919
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjDmg27RnWGj:lG05lO43b2D527BWG
TLSH
T14FD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7c10433b73855aadb6153f6867e1b234b08969230aac48e1a5484b07ec3f0da1
MD5 60f3bd7615b4ba2efc6ba4cd58bb2da2
SHA1 11861ba6b37ca0e315e8a4cccd72e636b548aba2
SHA512 5380f30fed3d2e4beee349052cfad6b696ba73a1f4be16ac7a370fca4346d7090c6d23e1a1968a25fbea6adfa8651a7aa74cc12d770eb757344fec9e0963ef5e
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnVsqjnhMgeiCl7G0nehbGZpbD:8a5POZ3BJt2pasx2+mbDmg27RnWGj
TLSH
T15565BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b167c316937f2cddcc3d371f595048de8581cda8ca64da784e00b1519abde75e
MD5 7f76ea61148b156a3701629253f04cd0
SHA1 9f73e3361a651ab0188ce3e3dd4b38990d5cec72
SHA512 15f0c7ba7489ae27f21cf05ce6746489604687ddb620f0b747ec65b9a6d479016c666a0d1a29d6d0321c8f346552ce6d5b40644230e647a02137bb6796636625
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7Fk7sqjnhMgeiCl7G0nehbGZpbD:ONc/zEOVHF4Dmg27RnWGj
TLSH
T19B857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d84751f2c23030eab392389254eb6ddee9455c6924c134cb06b4cdbc4ad1c422
MD5 72c29a7204252f5bd17e4dada6acadc1
SHA1 906e77f7e7cfe7eb9cbfa70aed3d4eb7ae203540
SHA512 c85404440a6880ce5521deee452df42241129fa3abfb1551094b81ca977652209dd9c5d58a7220c646fa3f89977df70e0b688caa76404a2fd6a8f505db3358c9
SSDEEP 24576:1TkNvNnaFeYhJNtmZBmnsqjnhMgeiCl7G0nehbGZpbD:1TMwBtOm7Dmg27RnWGj
TLSH
T17955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 040e83e32ca9751fcfbeeade3e24784065d0ddc1e0b9d118dd223348804b4bed
MD5 adf5bec6cb511afd30f58c87f26d2e92
SHA1 03e73996882ded0c98e39908b495a4c0e999a94f
SHA512 e472866c244cbf09b3c706e37c3db22489fb0e4aee9381988480098e56fb795ab1f9f9ca0ee86447d8cb92fc8cbb7d2f1b20d00b61bdd96c03f85e931227698e
SSDEEP 12288:GHvUrBFrEjwaQPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:GPUr+NQPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 448132975ce8c59ea6fcb36cdd9faec324d20639c2cc57880ee029209665aa14
MD5 6396a4d87da4c0c14d1e04bbd4e6e660
SHA1 2ac31246e69d66cc00b0f0e30b0b4f9860c3f2a7
SHA512 fca7ca5f4f35e22654d2154f6717b61b87150f1967e1f0120e6b266f42e2cbae8ed9d075a1fe3cccbf12c174e6481404149ffdc3d669f4ea6ad14552eee3a901
SSDEEP 24576:jD3FHshBIYQgACsqjnhMgeiCl7G0nehbGZpbD:jDVHeBIAAGDmg27RnWGj
TLSH
T15D75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/432-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/432-16-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/432-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/564-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/564-55-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/564-49-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/564-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/564-59-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/720-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/720-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/720-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/720-115-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1504-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1504-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1504-63-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1504-280-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1520-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1520-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1520-134-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1520-128-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1520-136-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1964-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1964-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3788-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3788-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3788-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3788-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4832-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-331-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4832-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4832-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4856-296-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4856-76-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4856-74-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4856-82-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5092-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5092-171-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5092-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5092-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5528-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5528-102-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5528-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5528-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5528-314-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5528-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5732-6-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/5732-32-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5732-33-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/5732-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5732-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5732-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download