21ca036fad488dffee04f5335e10934c88c74c97b58c89ede068d8a600588636

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260728-py3dashq3x
SHA256 21ca036fad488dffee04f5335e10934c88c74c97b58c89ede068d8a600588636
MD5 d65a5cb483ca5d59bd01b35182842a0b
SHA1 c7e4bd07e953a7bbf7bd17a8e6052028d25a452f
SHA512 16df95ef280601d8dc3a798406d2f41e8fe5977bf6802e41ce4006fe12aec3a2df9f2389845b4e664c91adfdf7bb85e8300d4e496a7aafae1566e4f307166dbd
SSDEEP 49152:90V8tmfJCiulRM6Cm33aC0npmZNkj8A5cfi6jQCw2OzKTG55ge8Q/lFTjN4:OCJxAUdCLm
TLSH
T1B5167C0BE6B940E5C4BBD13D8A539657FAB27849877197CB07A0871A4F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5248	elevation_service.exe
4348	elevation_service.exe
3040	maintenanceservice.exe
4960	OSE.EXE
4888	PerceptionSimulationService.exe
4680	perfhost.exe
4996	ReFsDedupSvc.exe
4808	SensorDataService.exe
4260	ssh-agent.exe
5348	AgentService.exe
4948	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\def6507483806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\PushMeasure.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099e50bf78e1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d32a5f98e1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000256c583a8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a97b67fb8e1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045e76cf98e1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
4348	elevation_service.exe
4348	elevation_service.exe
4348	elevation_service.exe
4348	elevation_service.exe
4348	elevation_service.exe
4348	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4224	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5248	elevation_service.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5348	AgentService.exe
Token: 33	4948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4948	SearchIndexer.exe
Token: SeDebugPrivilege	5248	elevation_service.exe
Token: SeDebugPrivilege	4348	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 5224	4948	SearchIndexer.exe	100
PID 4948 wrote to memory of 5980	4948	SearchIndexer.exe	101
PID 4948 wrote to memory of 5000	4948	SearchIndexer.exe	102
PID 4948 wrote to memory of 4060	4948	SearchIndexer.exe	103
PID 4948 wrote to memory of 2656	4948	SearchIndexer.exe	109
PID 4948 wrote to memory of 2280	4948	SearchIndexer.exe	110
PID 4948 wrote to memory of 2404	4948	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4680

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9968955b3294c77a199b8be03d4b694b1d16646bbe5c473c0ccca4895047d186
MD5 b0a2e1a34d8bdc43e7a85d7b593f14b9
SHA1 b05f5e52e472b4f0f8a564a9056172c3fda7b36f
SHA512 070ae8f3f8a683868f2955221ee422bb055be892b8746fe63a49d01f350a01359dec4b8665a4a87abdbd5ab7085af369c8edbe57e874788b884049a7b78fdf38
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnfQ/lFTjN4:b3q6HjBDLm
TLSH
T16BD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5165075900ad88928ebdcfc10c0a0826df9b1897cc41dc9b11793836190a4b8e
MD5 cc905c2609efe5eea9760a89b0c6a4ed
SHA1 f49816738009c69b59344e1c6162f6bf1eb100c9
SHA512 a929703f9994aef8fdc53a3a9dfa266c0c13cca0e107c97d79262107efcc96fe39705fcec55bc414893c7d9e7c28787f9d3bcdd1e228fc44d459b23b7f242039
SSDEEP 12288:H1XLsswWkxy2lRq2czAsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:VXYfDtczAsnQ/tbw/2Mkjy6Fr7g0os
TLSH
T19A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5ef60cce9d91a9f87e4b03810dc9e847a31efcef43409d560773b438c9e62a0f
MD5 41e74c050929a001074f988ae0b6188f
SHA1 7b043d27fce302e3e4a5928068c3c7a0a1edbdc8
SHA512 69d2a5787052cd7a045c76f213894c1afc29b1e3f8c2dade1dd7cd9c592468a9ef0395a73fccc50ab01423f2d3992192d58adc65875343ed4521690bb655268a
SSDEEP 24576:p0Le5ji0hmxLrMHnQ/tbw/2Mkjy6Fr7g0oQ:pPji0Al2Q/lFTjN4
TLSH
T101859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cefb09e266a4d2967986cfb4aaa10564a3b9b7b1523d935a53c7fd93c4104d93
MD5 92e56b138fe453b8b48b728cac88ebd3
SHA1 a05a6a722c02a5144f83475971c12ae53d1d0b7c
SHA512 43d495d33613b644d254a9a0a9762b7192d921de340cf3820ed448eddd8ca607aca91de79592fdd62e15f00e288975a45be60ce9d9f7cb076eb4de3dfc6b4186
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyu1nQ/tbw/2Mkjy6Fr7g0of:k/ezSC6vUzPvxHjyCQ/lFTjN4
TLSH
T1EA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ae9548748a41e7a6cc4d938c7aca37cd431bd99e3d0ab528b3856f70580c28f4
MD5 734352803d0d00e7837ab49cc069d865
SHA1 ff6570d778eb3b04b932ca60b11264b7c72a7a52
SHA512 438b692811e3eb0273906aadf18f69efd514431b4946049af4e7aa3876f3b2868b64b476dccfc9ce1b09784030ff64ec4b30f9c8d6652cefe6cd520a17410234
SSDEEP 24576:GVbqPb88hv/l+6gnQ/tbw/2Mkjy6Fr7g0o+:GVO88hXl+zQ/lFTjN4
TLSH
T1DE559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cc2677b288105c5e44910fe8be207da8133787908f871290fb43a48783cfc73e
MD5 82c1ce84a6f7b752ba8694519da8a30e
SHA1 3e0b535c6bfa8d0d7186f497c0dc078d1bf2c560
SHA512 26536be41a1730fbf4a9e482764ac52579a81aedd0c0f506ae693499c33d80d23d33eaa1129167927a8fc364ee1335e7e1d397b4545aa30ea2dce0721b10ce1b
SSDEEP 12288:gz7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:gzrnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1055523796A24F897FF2B06B15CC285826B7B0EC1BFD0A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0035ffaaf8b7b170d05342c437a76e9005e3460b8b12b8c63a9bee57eca9c69e
MD5 148a9cad63239f285bc1fdb6b17609a6
SHA1 f5d27d422f71b1f509ee59e66ebdcb3cfa5207c3
SHA512 2b2effab1db9625831b004af49b417637b51f959f3b9e0005fbca992c2f7a1419fe55e3a2e1eca2615bde5c1ee30a0fe0a5b41e8378966090e849df5e6d94313
SSDEEP 12288:+eBNUbTVO86UoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:+JIUonQ/tbw/2Mkjy6Fr7g0oX
TLSH
T14875CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4de93fee35b1268dbfb0365c51338d33e011d2e725656b21cba3b912ae7c4910
MD5 f7467277c9daab8807ab0d7351e2384b
SHA1 fc3520ecf3af2f5c43d73fb758bffcd388c313b9
SHA512 f7b69490094cbb5f7bcdf1a2353918414260452f307fe4edc8f20d1947420e3d1ca4b4dce12fc68edb5b801e41798a899dee570480f34938390efd36771c824d
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:5QvGAdlCEL8c/yRNw5CKLm
TLSH
T1C9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 63858165c8281c13aab9472988a571dfcb967855fcec82c5b3cf10f9f2607ba0
MD5 e8e8267c1af1fb8f0478d63a15fe822c
SHA1 42bc68dc3bb2692b10da859331a2be0242ce3d23
SHA512 e95088f25eab5e18ac5d2c26c65f2366c8da526dd3f466d9f8ce27607c3abeed4d72b2047bfa0973ee8509fa05e044333eefee91d3f528fbba02826eb165b9e0
SSDEEP 12288:9AwSfxL/2Dc39DLLmt0LDQewsAjGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgf:uQewsAjmnQ/tbw/2Mkjy6Fr7g0od
TLSH
T18975E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4e966f651e27e1f8e71f4ace78eba26ec9a20cd49c04ea769efb0518f977856b
MD5 50ae0841f9420443b77e4bc076e7123a
SHA1 bbfc4185b71af4f63b1d6e17cca3aa9f98454c94
SHA512 770832d68efba435952e9f99ebf412234df6557f32028c1a0034c6b3940631fd9968aa17f173d9f8b81a3a954126a84fc8e6ae041473934ae9e0d416a00b2380
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZL:OUEtQevvqc2W1cpV2EI32
TLSH
T1C7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b620e49ae14a5215b798ce63703f3807e05ebe8bd4f099b2e39668abbb29f5f3
MD5 0edaab38d77d667529cadfcdbe73f31e
SHA1 a92373fe5e6b1bcdf5877d2378813eaf4a5610dd
SHA512 5e2a5fcbe73268d2a7d59586baa325e9e62823798f06a36373956c868e1622c5703cf9de7686afa914101ea47a6a1e4ad1fe589b2783f42dbf81385cc9b14359
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zGQ/lFTjN4:roqtVjnmmLm
TLSH
T1AAD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8eb124ddb4718c0455a493396eff8fcc00265b33621b25792339755cdc4403fe
MD5 7e326df7e297f23b0794d6029adfbbad
SHA1 d3495ca825c89cd6e626e7e968683f367462a2de
SHA512 46b1f311cbc39ae0d69eb0c8b17595f9465bbabc2ab1271d374bc8e75db77780370b3fdb1e32ea69611160beac127fe5c6f5b614f521c939e8352d1e449e24e9
SSDEEP 24576:pAhGLJIFoiwtA5l7S53hnQ/tbw/2Mkjy6Fr7g0oi:pAMyFoiq5xQ/lFTjN4
TLSH
T1CB35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0091c5b01295195136a2152444b069a57eeafcb76a2f0cfd492c84b23a899a72
MD5 65e1a7ddba6a587a2f3f070d0716b118
SHA1 7a540a85a13c0e7d1c5f212c271702ed8d104dd8
SHA512 35b1f951e54d7dbc4a67a0fc2f71e40c518afa6ba381a71a05f37078ba569aa03da91194102a796d3e4747c6fa090d886822e11d8d407066e92680f9c183f208
SSDEEP 12288:hmw5HEjsChN2BFgl0WDm+C1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM0:8wuHOWinQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1BD65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7a7cf082504266720f3ed669f40a546db0fdf3aa4d0560768dfc4ddb217db0b7
MD5 a0eb4c4078a4a1be8f1413125013b8ef
SHA1 c032c51cbcb97690f61b62ebe0fdeb055bc9b2ba
SHA512 3db98f886f1954846ac6c14bdf0393ce41c78cefe97dc101f224af0faeb8d01cf579f96f707b3de696603e4671f41134be6f04d358aef090a2cc3e014f13c077
SSDEEP 12288:oXZ1Iy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:wZuPnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1D955126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b6e313c0f7f5b2d3df65dcefb8fd40a3e3f724362144180214d1e4d6b140c180
MD5 c246eef6e78856dae7136e8bebffa025
SHA1 6c08325b249bc597f2f5e105038308bdda46302c
SHA512 fd004d43720f6e48d31352d2f42d90e723eb295ba518edfb07e9af3f6079063ffb941821bb4a40c14a6e4d386f7f894a971107ef0799aca0b983258319d08901
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:IQRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T13A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7a76876d9e905d218a5633eac9a2e0eebbfc396e4ae8bab94b6358c85b76c54a
MD5 5e76cbb6c76d416c38b01a5b3011e8b4
SHA1 16db903e1c4a34a406e60a03bfeff56eb83f6bf7
SHA512 8c540abc297a4dfe3122a3041ffafd60e8b2b1890aa7e767e96eb9560823a458792fce3be1b7f6aae80068fcbf7fe136764249e2049de3d56bacf82c14ffab77
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:2QRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T157666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd7948e231076c046ff6dad8efb23b4cf2fd0ed658686198fd2f367089e1e9de
MD5 301670d5b7f081ef80f6f8f6d929f76d
SHA1 b959dd82506566967a0c76ca6b4be86544a59f39
SHA512 499c61f846a179befb23d474825a775379cbebbe015d5754e815f416a6b6c5b7e7f76f11d678d0d43d4fc3b611cac3454e995418385efc7e7f24f6ecfce5eb38
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fnQ/tbw/2Mkjy6G:O68Qg55nhheWu7PNU3/2Q/lFTjN4
TLSH
T146B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 079fb343a8915145f9d532627496f7bc7dab47e3f8054b8f22d76faa18065b22
MD5 e17f26fb8777df999c9160cb547e0564
SHA1 0030283828b394dfd050c88750b5b05e95d622f2
SHA512 910bd940d00f71fa48f666678e6786ba7f1feab3284f20fee3435c2cb13f4ea78971591ef37d042d0b114ac5353601c454f1ac01b64a0abf9b8686acc5ae4733
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:7y5112gYy5azzVvL69nLKnhZgLm
TLSH
T111167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1c36e6b970191b7e8a595d206cc6aa764a15a9d7da38ff284e68b24dcdb9f1bb
MD5 f6a172b9db948d994eb902f199c293e6
SHA1 3bc242897e3271a6c869b87b8e3e17873d839c87
SHA512 3ba661100763b86adf71a5fb887c53eb86dc7500aeae1fecd65fb1ddba42d01eed96bf9fbdcdb0f8133232ccf48f78f217e1b1aed59304b41758d2dbdb234452
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:Wu6JmVxd2dpLm
TLSH
T13CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4ed81d8c298590f641f75388fef57f82bc1a48b90eddd4c99c2a463717e7528c
MD5 358c8389b6d1d3352899211ea230a4de
SHA1 ebd07452895053f73cf21a6ff179224a49e5393a
SHA512 8166f1556ce69b1e50e847874a4be84379d9e5710e8c0bc0eb82cafedd24aa32f3596ceb9e6f176fd73c62af986e7db7d48d369f670eb22fef10f906eb8a0130
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xIQ/lFTjN4:1mifPbRmLm
TLSH
T1C9B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a9de8a488a940f23b57f296dd3f416f212f566c95bd2471b2949522f45921818
MD5 6fc7e2c215bae732e6ea1720a3c42d12
SHA1 30a006cdda73840b19c39b8e8f746b6ca8a64b35
SHA512 8402ba46db9695c713a0a478616135b2586aae2a084d9d7704034edbcae9a8198d3e022f1ce4b4c6c7875e690c742f636532e2e7627d222037c9c813d1e874f7
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqPQ/lFTjN4:t5dKTi61ELm
TLSH
T1CDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a3d5b7d1c1b2b90222142c4719d44dad287c9d65e331cc10506d3a83578e7884
MD5 59b82d194bdb64794184a0e0a566bd81
SHA1 94659a03aae438db29afc7b2cc4bbb4c75fc64d3
SHA512 70cc0b97cb9a1dc9f605e07833461434877e70c7d58cf7063d6d9816ce490e7e3f07bd450f94ea61f0a7c1622c2146c901b4ff516a4d634681a93378ca02ca00
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wsQ/lFTjN4:iX2iyphyLm
TLSH
T18C95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f224a93dc813e1002fbc3fc764a8c5287d3fa6d73f844922758074cb39ccbdb8
MD5 87854043379f470215bf9b93e70a477d
SHA1 20d84c86341bdb28b74049d4663f236f048537e7
SHA512 d4c4d28f509a45f876aa151ed6a3e9196b10783502bd73eea30b1a791721fdce977339420538887d22e8f9a5359b163c394419c65b75b8abdf99597c96747068
SSDEEP 12288:KDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:KznQ/tbw/2Mkjy6Fr7g0ol
TLSH
T13F5523697965F98BFB1706F18C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3df9365a0805c02fa3013e0c2ffba3c9920b35944b1836f74cceffb3d350a348
MD5 e41f9d47921285b3667f4fd7857755ee
SHA1 9632cf02907cc57b7789f2004d7d597e4da8dc0a
SHA512 c3ac1ab8227aeb428a84d46255b85b3d2a4385977d96aef25ed6d5e58dfa8e5a4eb0d56da44b3adc11ff2c3f1fc8a4cae6765d96807c2955644563faaf7b9b29
SSDEEP 12288:D6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:D6nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1D25523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 89bfce8767b1078e7a8feb54481476eb8e5b8bd23c864603ebedd8e963749352
MD5 a1ca91ddf7fa0cfcc5fd6e989a50ce75
SHA1 f08e2e00680721756c2a3111c1bf262c74f9b51d
SHA512 d2558d53bb4b7a384495d5e954618744ac2b8f19e0059d9ed51975337734f1a9f28e88065843341fec2edac720af8bd4c0325bb17416ee3683dab2ff6dff8dd9
SSDEEP 12288:gQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:gwnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T19D5523697965F98BFA1706F14C838182977B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 73a465fff36d70f211b9b30172e4ff16eaedd798fe0e3b48609bad271d6fa204
MD5 4a79dd6965c4568c0b8374a847fbe467
SHA1 f20ab8c54229ddbc093c814d46e631aff6378e2f
SHA512 9fcd251a8938740efe6bdf2acc88566a949fc74976f8809445d2e20acfbf4b24f7f58652fe6268459b41d57ab38c9a790e51e0d0e68b3bdde2f79eaa7c9e6025
SSDEEP 12288:JVxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:dnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T18B5523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9c44f0becfe1074b041ac6253c3e082094b3325c8fc1a8a5ca3d893632019a12
MD5 beab43706641db11437717cf71cd37c8
SHA1 da3aeac7cf0783c8d3764a6cc20db478101c632d
SHA512 601cd6d221781a2c89ee0500e911ec96696ddf48fbc1cedbf5977e9fd9ba9dcfbea32f867e872035e7535a50111acf13b667493573901a70016836e0eb591515
SSDEEP 12288:zpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:z5nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1DA5523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 83f61b8ca8a33473267466616c1f86445769e05cac47a203d1336f7558f2b9cb
MD5 b46f4bb15b72c343188146bb799a04f5
SHA1 4dc7bd80ee2b1db9bfadbd69a9e1ed615a9bbd24
SHA512 a6d382aeaebc44369ac26f870ca24a86fc99c70b020caf6965fc829b2cf05748df780c2ffa8f32e1aaa26e1f51991e6f3b93642154a3d612df8cd9ae53b23d61
SSDEEP 12288:GuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:GunQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1265523797965F98BFB2706F18C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9b132ec3914c0f22f0e8ed4f05a5684ee855a8f3f9153dfff880639a7d618377
MD5 ba406567a39b633df82f6e1f5202dce0
SHA1 5a2631a1c45f5ffe132cea9e6edfd1d7606e962b
SHA512 0cfdeb2fc1fbf0e012d27deaa6a51f49f47b91805c103db1fd24484277e68d2710736897181ebdadeb59d88f5a2441a46f344150ebe604a98d102043022f1967
SSDEEP 12288:qyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:qynQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1E95523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ed2376b485b62db34c2715d7829a54dcbb141342be64d17c5ccb82b86f8966ad
MD5 4383341088e43b92503674fd3d9f97fb
SHA1 7b209ed256839ab03ac584f36066a1431f2feb05
SHA512 e746f47e6a0e061f512dca572129f69ae9995bdc3ae4c33bde983b1d9ebb90299ca83782745a7d23f9208b7ca9683a97cf021ebaad13743f10487af0d3f3b84c
SSDEEP 12288:diZwbDzzFEoS2cPvyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:gZM3zFVSOanQ/tbw/2Mkjy6Fr7g0on
TLSH
T1727501A5B35058F9EC67427ECC528906D7B27C5A1BA0C70F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 62b7cf5e232f9109a257234f0b59ef8571ee711c5ace5fe317be16f7b0943057
MD5 2bcabe2be913509cb96cdba406c8db92
SHA1 6653f42187c8009b662dcbc32ccd5552c546191f
SHA512 67e26c9574aa8a6d870e7db70817900d911af1684ca738dd477348f0a2dc3cf307277ba09b2c73ddeceb5f8126e04a555b958d1c5cd299bdc70a83b9637d336b
SSDEEP 12288:4fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:4/nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1F05523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5863032d02c04b5a7b61a39b9655e88f7fe8fe60672378fd6fd81a494881c7cf
MD5 15c9c9022861c782876665a5990f351e
SHA1 fec2f738c0c1e63706cbb8c39a9c4ca83bbc4cd3
SHA512 136ee804d5e9485cd2a37be15e851248d00f7dc73dfb9e32e2230a8210088e36de754f5f0f826209628de439b74a3800a015fc9913fe716fc1ec2be26b38ef97
SSDEEP 12288:arGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:abnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1875523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 cb25793c1ba8db65fe780d3d539b41181ca9dfa09ebfe44185a99e9e2187a181
MD5 f17926df460eb5878a9b5b455b52a2c2
SHA1 95a995e31ab4fd3233f33ae10035e4a0adab4a67
SHA512 f458bf0a21497d3e0abaccbcd00c25591df8086211a76c15742247f2063088448970f73ae22bee823ad6cb1d4c70ea6e16eb56a12a1818d145ba8781d9711730
SSDEEP 12288:yyPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:vzyWnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1D265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 69013d71f9349c59286c5370bfaeb552f89615ab20366d6f26c1231278c3948a
MD5 be1c396eddf2861f01ef0d449e0bad7d
SHA1 1b67c2708ee31b4785e607fb43f400afbd77d100
SHA512 51c6b8faf43e48c0856077c4f1f6845d868b17c57777f23950e7d6b08430201e20a9437e381f47c09aae126714848678c5d3c5cbede232f92840025176f77b05
SSDEEP 12288:TfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:T/nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1DC5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 86c07084e8be6dae91d1a119e184cefb145652a33631ddad4934eedf28449dad
MD5 ecfaccde6c9b1c9140fc3aac099eb50c
SHA1 0254dbc43f6883ade6195f55d79ad6c5a5f68a09
SHA512 bc2a7a371bd222c19d5952095f645d74e74688891bbb8042f4c2d9cfdeffbb78a0c4d2ab4f6ab7a17e62d19d968a03e84f80b3d4d9351ba155f284cbd6721b3e
SSDEEP 12288:cfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:c/nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1C95523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9e2df41c68ec9dc61016b61cbb6a1ecbf1ee77c25bd5bce0f77b5facecf36d41
MD5 8a09a3c98b5032a741251093c4c16589
SHA1 17c07517121cebadb98ea197be7aa0dc4360e957
SHA512 3e0eb2cdf75576139de2d90faf742aef5ccd8a745ff57b08675d322d2ea010113d6082922dbde5201b2a3fb640d48dd7c79aa228ce8be3305dc24b88a607ec86
SSDEEP 12288:SyPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:PzyWnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1AF65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 46ee86c8515d4f9a1c4b4d06de1b13462ebde5219b9d84c62177f17e513d8a4c
MD5 ee701a13a64bbbf53e5dff9a6f17b983
SHA1 7b0bf1671c1ac62ec77a502c6aa39844e13cd6bd
SHA512 bf7f2f34517fe67152ddbcf31f297fb72824c527c46cd9f71c86ba1005728b5871250cec3c9c161e10e01b159efb99a05fd03e4b299f60d192c73113a0b02bce
SSDEEP 24576:XT0aLl3z0zDAnQ/tbw/2Mkjy6Fr7g0ou:XTDLlj1Q/lFTjN4
TLSH
T1EA7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 46141c4888dac6f4167a3e31ee75d72604b570ccd375aeff9e8ccb1e94353b93
MD5 3e5ff8e77434bfda80642cbb63b5c79c
SHA1 ec920be4b79ccfbab7728a8acc569e05aea56508
SHA512 471d8f3b7fb9b2fcb354ac4e4a3a9365648646dbcce59cc5b69109a3f0770a8231aefcef09c035939ec87db34978d32186db98b1ea6a0392227e6ce9210096a8
SSDEEP 24576:T31d9CHKy7GZUnQ/tbw/2Mkjy6Fr7g0oP:z1d9CHKyaeQ/lFTjN4
TLSH
T10285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0e8785604914cd14ab37d5415d4b38bc0778acae2e7df5f7ec5fb9e1cbe7b7c3
MD5 4552df9b4e5f52240f99a73ad67bfd4f
SHA1 fe5ca91b377bc8330a60201c65a2bc89a247a5f7
SHA512 7777b05dec84d69dfcaf151cfc460c356895dfe0b0d8d5f751963eff7512b9c28e1858308f725a2b9fe20b94d8343f7460617760abd4e853fee52c2b07c71895
SSDEEP 12288:HwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:HQnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1F75523697965F98BFB1706F18C8281829B3B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4657f31f6804ae1aad9e73211353704fafb7ef5b9f5e92457f2f181b5c5fa02d
MD5 3f97306c405aedb70954b4889d096c51
SHA1 7722aa1976a7a97d6d8c440960b49a25dcb4d754
SHA512 85b15cddc220cc27a860c34a078d1f2e49e82e713fb3023b5bf40bf19fab2a1ebb24ba64f88222169f35aede97a74f803a230c36120fdc833bf218d4ca066703
SSDEEP 12288:UWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:U2nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D55523797964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 91d97328490eaba0c123d1106ba2bf38bfd8ec94268f44dcfa94a6237a95b804
MD5 f0d282cd8337c23aadf6265e96c9706a
SHA1 68d98b369c44fda27df5c1e90e8effe5662f1a68
SHA512 5b75109e8e7f3f49f2006b710bacc6001e23e7727a43aca6debc2c46fb01b0d00b42b1c53d871f5e1d3cbd7f350066c7bad203e133c60dbd6623f9a26f11a8a6
SSDEEP 12288:tNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:ttnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1D35523697965F88BFB1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6bf0761e936e30ac998d0170fb79417c5ee58de5001725efc55126a0b4aa8756
MD5 0a8cd789b0cd7bdca1f27a88b67e44a0
SHA1 89edc77ba79967a7c17fd0e1059ad28978ffa371
SHA512 56592f3909e6611dbdd5a28c282b1663b9655a0af8f17e089a4ed1c768a0ccf9575fd3a6575d73c658319db32426aa5784e4d45a18e547ded5dd259453f76555
SSDEEP 12288:mfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:m/nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1445523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bdc9c5818f6c31c6d42208f9650f8360bb795ea2b24ff966e871f1df92015ef8
MD5 ffc47a34fe38f5929fe7ce09faf813c4
SHA1 efa75810a3f6ceb2f5d7d7b3d0ae7506bd199ff4
SHA512 71b148d7ada55fc182136013acb298a09c7df062cc4a7f4dcbd838c0a883f666f58400c789d7bf4f558f9fe4d8249269c9a79f57d01e3ffa0bd4ef34a233590d
SSDEEP 12288:EwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:EQnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1705523697925F98BFB1706F14C8281829B7B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 70d784eca262a175cf795d8a6c7442475a459d411e2c8523d16a7b2aad0782f1
MD5 3c1fd2bf8e18b6a7f754066abdcc15b1
SHA1 86c68225cb6a6c6c33925f5d3700d3164d8cd857
SHA512 d5b798592b4f3889e824192df5800b94b36f5849f96f2e0bde2b5ac844398f34a6a9e8bd5fc2c0fd2411d738bd76c484db5f3e7134f7e9f922def673f311669e
SSDEEP 12288:53GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:5XnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1D85523697964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 db5984399b51a4b6b360cfb46b8b3e5dac5dd74cc7259b71655ad04feca4e23f
MD5 60c65e5eeca82b8d900bbebbdab1d88e
SHA1 0462cbcc95fe976108f4c1c009afb2a6f2157ffa
SHA512 0f0485670e9c8e92f0a757c2c1c0f8a2021600967c45243e3808d58c5a212651cf818d378e7989a9b73a7ee8c0fe39f13a6305c7dad74baa2384d64dc41a9d4a
SSDEEP 12288:opGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:o5nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1585523697925F98BFA1706F14C8381829B3B0DC6BFD1A38F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1a6589f8130f0678f83231f0efe02bcc90e3f690bd9374f665ac6c6e7fd94d36
MD5 cafea05cbc24c9705511974fa19d2790
SHA1 28dfe6dd9f7eb5c4e3c835bca0d4c184043e6797
SHA512 e0cf28ebcda91deabab5895dee768b390ac8d917bd2990dd165009c54ec4ff6378ac95558e918e0d5a329cca01ee6e515cb7e36bff3984266f6db2dbd140a914
SSDEEP 24576:ufwv/k9RX6wkyAILnQ/tbw/2Mkjy6Fr7g0oP:lMnYILQ/lFTjN4
TLSH
T17185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2c86f297ac0822b560b55e938377d47267faabfd20d739ead76b96cd3b2ad4f4
MD5 55ac87f784f7341d334587af042515f1
SHA1 b2b5234685dd2401c67c39971b9d7f7e70348e19
SHA512 68d0d49f23707e3d81d792c4abe3aa7a0fdc6deff76fea25ebf24dc89d7b27606590328e7771970e4e978f7175f3a584e502a9dde2ee8ffae9b9b02c67e4e425
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MQ/lFTjN4:hySzPHLm
TLSH
T1CB066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3ec9a0ea9c053fd116eaa8d2a009ff802f395b9b530485679601edda3adb2d99
MD5 1c0f7a6b4b5194bd694844d33b218276
SHA1 ce3a19b955cc7d5c38be13dd8764344cb02e5d70
SHA512 2bc3f3fdff606fb93b1da0f6d82094f218ff93bf96623c600fbe867cc14d404a0f648d7ceb58d93aebb2d76acfd2fd95f3f5a0e71fb575ac1b55b26938a8503d
SSDEEP 24576:e47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKnQ/tbw/2Mkjy6Fr7g0o7:e47JUQj1irIhCnDHUPfF/8Q/lFTjN4
TLSH
T14765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 192b70755fd6cfffcb8bb64cc16f1ddbfccf9b4a8f11a2baca34b46dd5f49c1a
MD5 51ac6151dccf9566f2be9a230ca4ccd5
SHA1 96a5377a620970cfcc5b7380f0e267131992df45
SHA512 c5945f80618b704c7f11a3fd9e3c84fea81316e3d48e01bb281a3d1f69b838a28eb6acbd75f90f4bd19b2921296492e9d5aea4600a58e9740817fd8ce2a405f6
SSDEEP 12288:FssfvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:lPnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T12465F119E29852E9D12E5275CB828641B3373C9597E1D3CB67C0F53E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 f177cab73d83252f480364093e0ae3bf0f31a9e201cd94877f6a4b30590da74d
MD5 7a56b0102c296c0a28dc6c782ac865f7
SHA1 0ed4399d57f3a03dcd25eafd0ed206e33c5c6f87
SHA512 829776dfc0d8319c8cc49fb9b3b20732c8034ab0a4e9ac6c057eb89687abbd6aaa05e8f1c8764d878462ece0f79b7ca97de2e7de9ab9de66327160ebaf838504
SSDEEP 12288:ZfqzU3fKiu8/cGLoG7WvegruQOoq8hB2PR4K6u14:ZfAUPPrsG+SQSRZk
TLSH
T12F253900766BD75FC6A940325E73C2CCAB707D41EE459B0372C9972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5f866f9f179212955fce2720610814a8178daf49f1948f8e21cdd6ba4f0212dd
MD5 86cb5abd869f44b6c3f9c9fadf765536
SHA1 dd5d1b0191deb22b51b7e8899a0611ae54cdfd5c
SHA512 61813ae1310ddab7434634ca8e3a9349e96b01212a23a582cdc541a94b472da03e7603177f0e1983265a6527b6b5b2bd4b29947c46c82ec7ba48aa313aa446c7
SSDEEP 6144:5oRT7shd26C8Y7NsIbv4Il7cbVtMxURVG/cbVtMxn3HvDYNmi5ifjNMTIwUh:crZi5EZd
TLSH
T17C55B6816537A38FD1FB6031072A5B4C6B64EC46B3496F277389453ED82BB25A0F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 17ae00aaa59a5d52c87655af3049d3620149c0d021e1ec1552229b074723295e
MD5 3e62c70519abf9c75f845387a6eb7099
SHA1 9b5ee743b408cf131eac395667b50ddd6953c74b
SHA512 9b58c527e4fedfcacd41384c406eb8d52e4c98b22a0caf6065f4bd5cf3044baef9f5bee2454c936d09c933283e4f22c3f67d6cc268b77144820255a4aa6b1ac7
SSDEEP 12288:u67HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:hnnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1DE5523656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aedd705288ad0b191376420dfba9925c3fac0bd7cfb65d0ab1aeacbbf796ec3a
MD5 ed6c41516c1ce1a144ff391e7cd0c52c
SHA1 bb5d126139357d2468c9811d02002dd5918b083b
SHA512 e508cc210771dd224597e8ba662399e50bc4d12ca06ad008d0cc6a07dce87df40cecec8f6e1bb291db2ae1a97de8c3bdd43cd34057da369ac3619df12db996f2
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bY1nQ/tbw/2Mkjy6Fr7g0ow:Hgb4mBIBhGFKQ/lFTjN4
TLSH
T10A65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 899648f0d027fe13bad92c05e762d183390c5c4a9b347cbb9b8b6b91dfed2b26
MD5 384f2b225c5b47b4d9e62c9a8443a293
SHA1 ac5aa6ed52001777faef74926ad60f466b4afd51
SHA512 1d7f5849263ca5c3b39b79deee37f93c20b35dc40059340b2c82068f082b9461542dc89076ef949091cb2601c4d89889454647de4d3d8f1b87e48b0f625adef5
SSDEEP 24576:JG88u8FpJqH1Qzria7/manQ/tbw/2Mkjy6Fr7g0or:c7ZFPqVva7/NQ/lFTjN4
TLSH
T16085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0361e0a45c0533ca5426db7eba22592f0a00717e4b881bddec2121baf95d514a
MD5 53cafb404e75da4a13a909fe9cf47e1c
SHA1 d30dbd0bbc7f78dae7a3632ebff301d7acecce8d
SHA512 2b4e5994cbb7cdd8b80aaf1ac2a56f11062388e5f1329da12634ef2d8a833f2d37d88c9bebd4bfb142e7b88058d8b33d21c57bdbb60b328531c16a76956bbd2c
SSDEEP 12288:KHvUrBFrEjwaQeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:KPUr+NQenQ/tbw/2Mkjy6Fr7g0ov
TLSH
T15E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f27565297b114dde37598c59e48dd8a8a0dd2a68e40f79af3f6a9de1127b06fe
MD5 d479eef7c1dba32b9e6a8ad7ffcbbc16
SHA1 83fedd13739aac31f733fcc5fb0b301003e861dc
SHA512 e8c00d485216b76a13ec6479d51eaa2c82c3329b37d2e7e91592cb9718c0da0c12701fa5ffe6a9ffc2687fe13c06b112a41f205c19c9ae7f54e44951fa66fcac
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuQ/lFTjN4:RG05lO43bILm
TLSH
T1CAD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 783dd03bf6fa3b421fddd52435df921dea20270703b71b930972e8a84e8f9048
MD5 2a0f5f7caedad16968d43132fb7fcd51
SHA1 cd1ea2422332861f02abe677b1d158b0bb0c93f2
SHA512 c546623d85ecf61a12ef3b6bfbfbd39ab61cf628ac4a3c0478bcbba7170507b57e33eb37ce115aaace5a6c04d857e5c3e1812f66632dc34c36dcd53c76b6fc9e
SSDEEP 24576:sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMnQ/tbw/2Mkjy6Fr7g0oP:0a5POZ3+Jt2pasx2+m2Q/lFTjN4
TLSH
T18A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20debad5c166d69db3a0419c5cc9f046a6ea25c313d17873d4f6041660b04a3b
MD5 e80350ac4a4255a79b833c24ce216604
SHA1 2166e3ceddbb460ef258c6c08437af3018739aa4
SHA512 b003ec669baf8175beef3df94887b876e6368bcd5000ce2be50f4b093bafe22d59b7e40730ff8a229b6861a1047225c694cdc9b6367dd395b81caa635d8e4e8b
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkCnQ/tbw/2Mkjy6Fr7g0o0:cNc/zEOVHFtQ/lFTjN4
TLSH
T1CF858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e958a6579172dce26c7c43d766f3b320dbb255e093f35a902dddba750cb923ec
MD5 a82509f50dea4cc086716e9204284056
SHA1 496a830fae5910498906eb9813df625c3060fc8e
SHA512 2f6ace391df4d53d6b39877c4c23f73a45c45fb1b89385847c018ffaa36fc70b5740473cc944a22a57b13a3b500bd439594d91e9f0e8f882233eb67bfe61456e
SSDEEP 24576:q8kNvNnaFeYhJNtmZBmKnQ/tbw/2Mkjy6Fr7g0ok:q8MwBtOmKQ/lFTjN4
TLSH
T1A255AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e0a061e69a1c4ce2530192bb49c5cfeb44c1b14845fd62a179c7da7aab11c306
MD5 9f63e623d447cb558cf1b54dac5cc212
SHA1 a5c102e340c1d00d322b41e1d5b96e58d4011f50
SHA512 8024d06e79cfbdccb6f32b28990b77ad29268f456a7802c42abcdc1648aab1ef91be17dd12e32ffe4fa3ff752aa1e23214b4c1159a57a0166b5fa6d6c32a6566
SSDEEP 24576:OD3FHshBIYQgATnQ/tbw/2Mkjy6Fr7g0oB:ODVHeBIAATQ/lFTjN4
TLSH
T19875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3040-49-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3040-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3040-60-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3040-56-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3040-50-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4224-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4224-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4224-35-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4224-32-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4224-0-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4224-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4260-122-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4260-124-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4260-321-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4260-130-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4348-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4348-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4348-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4348-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-87-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4680-88-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4680-93-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4680-318-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4808-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-110-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4808-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-322-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4808-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-116-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4888-303-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4888-83-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4888-77-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4888-75-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4948-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4948-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4948-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4948-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4960-288-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4960-71-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4960-64-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4960-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4996-104-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4996-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4996-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-337-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5248-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5248-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5248-16-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5248-30-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5348-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5348-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5348-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5348-143-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5348-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download