477835a9072b818578d4b8a4812d0d83bed6d73377cb55e5b52236445eb84a37

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.6MB
Sample260729-3vxkjaysew
SHA256 477835a9072b818578d4b8a4812d0d83bed6d73377cb55e5b52236445eb84a37
MD5 c28dbda795348af91989e0e4524be9e6
SHA1 c0db12e2ef26fe2a36179e0b2b3f81962f684c61
SHA512 e3c54b2d5f2e575cafeb0494ae696546b544625d79f4a94b7c93daceae33ddfda6d71f9eacb47ba281d3c7fe1091ac7989a946fc43c458cd8aa1c99dde672791
SSDEEP 24576:bKLvkmFmic/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b06LNiXicJFFRGNzj3
TLSH
T1EC85E155A3D401F8E5B78038CA560A07F7B2B81A0320DBDB5398EA751F27BE15E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2052	elevation_service.exe
1368	elevation_service.exe
2480	maintenanceservice.exe
4472	OSE.EXE
3224	PerceptionSimulationService.exe
5980	perfhost.exe
5560	ReFsDedupSvc.exe
4400	SensorDataService.exe
5948	ssh-agent.exe
1840	AgentService.exe
2204	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c2451fa224febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a151245fb51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078f4301bb51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5dafb19b51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001130391ab51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4cd1f5fb51fdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6060	2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2052	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1840	AgentService.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: 33	2204	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2204	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2204	SearchIndexer.exe
Token: SeDebugPrivilege	2052	elevation_service.exe
Token: SeDebugPrivilege	1368	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1480	2204	SearchIndexer.exe	101
PID 2204 wrote to memory of 4524	2204	SearchIndexer.exe	102
PID 2204 wrote to memory of 1760	2204	SearchIndexer.exe	103
PID 2204 wrote to memory of 5568	2204	SearchIndexer.exe	104
PID 2204 wrote to memory of 5028	2204	SearchIndexer.exe	106
PID 2204 wrote to memory of 1164	2204	SearchIndexer.exe	107
PID 2204 wrote to memory of 3492	2204	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_c28dbda795348af91989e0e4524be9e6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5980

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f3143cc7ec923a6e9490c78c0f04a6ba17e0ef2fc2d10e49d621408a90bd2d0
MD5 62439fa0bca16fea12ace5f19d99e9ef
SHA1 13ba38d35c7899043019e0ab165187ce5f3cd160
SHA512 30f48f080d53d6c5213bb736602f90039cc19168624e3460a30a32b62b2901e572c4d2ae67f6a2b1f26ef50f3d9b0b46fe57e5b37d9888cb13f801de38607710
SSDEEP 49152:6b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnGLNiXicJFFRGNzj3:s3q6mjBN7wRGpj3
TLSH
T16BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2b25b3ea78a653d225fb1f1780443a5aa9c781552e6b0c4599e03044eee02d22
MD5 3f0f83091ae5165b098b711afd7950c0
SHA1 c1a6127cbf427486bc6661d5c7aea3a3b46c2e28
SHA512 44441b2230a8dce951cf2959841721b24c6c024c9f8efdeaccda6407cd7190012b4cbcd5a18cc33c81015272bc8ff200dfeadde6efcc2008ba7217f2ab45b7e9
SSDEEP 24576:YXYfDtczAG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PtcvLNiXicJFFRGNzj3
TLSH
T13E75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a56a3dc35208aa2868aa0e117ff8853724809337b5be61d538ba8f7df43b43d6
MD5 378444427a44cf45333b1f8cc58fe76a
SHA1 565422b28345ebfdccd5b78d3a3ce0b6f65cf0ad
SHA512 b7afbda717a4f0725d07a9c949ae42cb0a8152a43a0f83da2cb9d809a1b107609363668469b1f5c436f126aa0f695da8b9693cad04a8f160b9dc9f870809a6cb
SSDEEP 24576:90Le5ji0hmxhrMV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9Pji0Az8LNiXicJFFRGNzj3
TLSH
T17A859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 228f6fc5d4414d52e72f1b98332c5f25ee5bacd5eba9c0f612207b8491ea83de
MD5 8578df60995feff142d86a14bee2eeec
SHA1 f6462e2654c44c38469faa29eaf1979d065424a4
SHA512 e1c3b6279cfd93017a454f7675960b82636da34dec9807c49e006d19a89bda87bec6bad12557ed533a7735cddb836536fd91490df2ddaf96c589d1437e562fbf
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWj6q8wyuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y/ezSC6vUzPv+HjyALNiXicJFFRGNzj3
TLSH
T1D7756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a749d0fcb81b7c7d962b51457275b5510d82c5db831464a051ce7a3f1ad8456
MD5 08e28dc2d878d669046bdf15550db10a
SHA1 baa4d291baa92e3d84a199fc6970b349c47d8db9
SHA512 a6fd67607112249b0de5b8919d9ef6a0ec48e3a4abd6ae1ad0a93dcfb6d4a97a89d251455a6ff693136d70f1374d56997820755e82b0b8cfaa6ccdaf255be986
SSDEEP 24576:0VbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0VO88hXl+cLNiXicJFFRGNzj3
TLSH
T127559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5321d9a878d58a201acc013667af20dc55a7a360a9855307a5d8779a6fef4fde
MD5 55431397a451e6f5090a0edb91904a4f
SHA1 7b9b923adab0ea6ad3a56a90c6f0ca91bb2024ac
SHA512 ab2811a7e98560bec17cb2e7eca902ec35e79085d84c0464b05157d239dfa46640cd49cb5cd87d65e0555bb0a48c1aa38cd7d1192d0cce5e9c59017088d380f4
SSDEEP 24576:jGh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4LNiXicJFFRGNzj3
TLSH
T1C45523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f3c5b31754afe2e9a2efee9a7135e52f3c6cdb590787991558aef98b5ee14205
MD5 d8679a6d6eb3f3adea23707801decd5a
SHA1 50116e0db82c052b2e688c2600ec7119a8af21cd
SHA512 dfbdfbc847739f0553fcb311065c6307f453057eaaf391f8f771b302dd24976f4b552a8ad8073ce3582a30cb4ec81a5d5244020e14ab0e07b8de4701482946a8
SSDEEP 24576:NJIUa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NJIUaLNiXicJFFRGNzj3
TLSH
T17975CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 47a4c2881b3011a12870f64d1f4c2ca79ad50b4dbd8feb566c369ea779244bdd
MD5 33ee9e8a7afce0698d6f8d996697b7eb
SHA1 d4d68136b1c1baef00bb39b162987dde278af133
SHA512 c1c83f9f9b77db473a7f4504abdd2cc37564ea4aeaaa9c16fa16739059734db13ac22c23dd17ca478169b8df22465966b9661e1c4e507883d7747f11c83be80b
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THk:pQvGAdlCEL8c/WRNw5CP7wRGpj3
TLSH
T128266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e8fb449864e432536467cb6fb63c1ca4c2858d5de2386a7a9432f5f71c6b3289
MD5 24c317eef30661107bd223ba7489e16d
SHA1 d8065bb9d9eb898ad9745794e12ac6f2c591a1fa
SHA512 669da1f537c3944a8d8a8acffae17fb336c8e76b1bf07e31001d1a69f0408eb1929d72f0fd26bcb8bc8ee7cdbf07d5af38d98c229a77eb0f00477f321d4638f7
SSDEEP 24576:NfewsAjs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RljsLNiXicJFFRGNzj3
TLSH
T1E875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f9e8a88f6443a4ebc9102a274c100266d72fb055992069eed5b587881b0f3ea0
MD5 456e5d54c21314ee993b1197cada3a22
SHA1 50053ae5c8a95bcb3858e8e0ede6312b51204e23
SHA512 8b6ffd1870a371da470cac3f966436441218989ef86d796e61a58d15637116357fb9c3c2c4b30489d033a182a135dc0566869948950624543f9c5f6b6a7feb22
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgF9:3UEtQevvqc2W1cpV20I32E9
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a11183d537ca701d567db470c6165f0fcccd55bb304a80733af134b24f671906
MD5 020ea2dba6c206c14cc16b4e4a398751
SHA1 2838a8e4765305e746e5c752c7c92407a806659c
SHA512 4affbcd97ff7d9e173459161bcf7747352d68b2340bb15c4ed826f1673c725ecd4e95b5d210e4c340c130c1e7f9449ce7e3e49aa114d43f909bb32b80f566763
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/zMLNiXicJFFRGNzj3:soq2Vjnmj7wRGpj3
TLSH
T1AAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 998ad9af0eed566962a8d29ea120d2ac3f4022c3ff6394a9a757d003148db9f7
MD5 29aec3d0517fa3f99c2cafe4afaf1930
SHA1 cb6015415171ed668df0a2a1fad7d86985b64750
SHA512 ee3afbbcf6b2ec8b9d576217e8ee1f8c9b70b0799ecceb70b3c44bc7fc1350892210bc2d834af61cbdbab93f86e4475fd451df684a7276595775661270425ef9
SSDEEP 24576:mAhGL6IFoiwtA5l7S53D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mAM5Foiq5TLNiXicJFFRGNzj3
TLSH
T105359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a2dca437e808fa319fde720dbe868bbc7e3a15a8aec7b054191e65fe403b742a
MD5 e33f53840cfe7d55d435ba846ae0120e
SHA1 9fb71ba103ef48c57b7ffe7b6f0e7be4086bef46
SHA512 9a758fbf2d6ea7e0e4f339789ab6ce46e3bd559ebeb7cd65fc9a1eee3b574ab7bae3b6a09622271b3372a9e13ccc21b7af3d6a446b557cfa7918cb4d60e2cd3e
SSDEEP 24576:TwuROWg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TwSOXLNiXicJFFRGNzj3
TLSH
T11365F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 245231e6a15596782fdcd1d7a75c916f7e03307182121a31e98a98f7847f3471
MD5 75d6a20ddeae85324dcf1f2774ca2675
SHA1 8ee6c31bbfedf9fcd240d7b9180980a7f6beed48
SHA512 e6443fb233420ddf17a1be47110c29fc1aab85f6630d0443d4866a52bbb853d22fc1bcb135f94074df283cc5c2a2b631897bff32b959148b2d6dcadc340a7f3d
SSDEEP 24576:HZuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLNiXicJFFRGNzj3
TLSH
T1CD55129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ca241692deade771a6d2cbe77a66fe5844885c7c47c558384fd050c5f928e3f3
MD5 2c996da6e3aaf301a0558fd3abcd1e2a
SHA1 a4e1210fe91dddd587b374cd618b67bae0785b86
SHA512 cb6d941dcf8d0642b51f5b882e2ede8565d464769bead08669d0268e9532a3fadf5a2c72cc91adf389d961f5f5fd7adb9cc470811cf0b6c738edc75f7898c016
SSDEEP 98304:kQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:rQyiKanX+PNiF9
TLSH
T188667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 72506b63b0b8d737b3096d68d928e7bec7583c6051bd7dd3e11af1946b291ca8
MD5 5f75a78800e655a4f5323859a0241a8b
SHA1 066ca844fed9777113041f12d7259240812d9cbc
SHA512 6a3a5c4f9b203bd90162b09b7a699c1be077232f11983534f9c1463e20621f6ee551ee29eaf1cd97b449db04b935f51da3b96ab1cf745a4b38df8e9187558fb3
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:pQyiKanX+PNiF9
TLSH
T12B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ecd25efcc0fb0380bed5915c902abe4fee93372482547ed7d000ea60089ab694
MD5 ce3e0b817922a75dab3c38974b23c9d8
SHA1 1be7200cfaf99dd7b499537c5d4d231ddb5cacb6
SHA512 a82e9b720aaecb8bfa0141d33bb986c134b1bb661bc6e23cc2a64545029a9be7a4dc141300f37d983931e422f182513b9917e4d52c67b055d43f78328c642d86
SSDEEP 49152:O68Qg55nhkeWu7PNU3/8LNiXicJFFRGNzj3:cthTRc/87wRGpj3
TLSH
T144B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d301272c91a35153c45a780645510d105cf5874c92f4404e266eb452b61a106
MD5 753bd7b58c411443b4362e7365d85882
SHA1 6e1b0da9b076cc6ded831fe8da3edab34c10b39d
SHA512 b72a70fabe91b1d397af52f338f40ab4f1594691d743790ecde8e49b9477a97c1329d30c95c96664e42312302583cc15091b2a457cff43a22099781ba5135a1b
SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZh7wRGpj3:wLIHRWhPF9
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cd6dade2947404916240894fd6530a006de90d7126f1d3a1f29b68bcaf2af9d9
MD5 2781a62f1ae8ef788538e6c098a6b111
SHA1 c2e20dca8e860298acf2a9e546e7d7b52142753f
SHA512 9e9ea75d569fe1eac6ffd4ea231896cf10fd00e889107eab8cd1da0f1cfbfd5af301066dbe1025de689a5cb3c8195d8d89916dfcf99eec9c9bac73d15139b5f6
SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:uu6JmIxd2dJ7wRGpj3
TLSH
T145D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 42acb0b1bc277b5c54409799de7d4865853d652b5f1fa4c71a1d5b50923b1222
MD5 dab21eb9dfffc470aa219a9a630d3f94
SHA1 fb3b17f16e1f198cc4f3031fe22b146108886cef
SHA512 35ed5f27799394275421c398c7eea5fcdd516620d67244d5341f8f68621bc6ff86cb3428b32f36cf0a38841a85424373357a6f46bd096d422e00a056218216c0
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4x6LNiXicJFFRGNzj3:cmifPqRj7wRGpj3
TLSH
T1AAB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 66d2cb295e91ce0d4ae11fa5d994c8da8f815a54209710122d9637f4d8b76d3e
MD5 6554f1edb8e38153f9e3780635a9c09a
SHA1 afc582cc21460bcf4049d5a6efa0868fb40a82dd
SHA512 e101064d6f5fee51e04a3cdf0d4c9a863c1b079dd2f95d72b41ae05c3d4e249080e23fbf582d6a1b1c332013b653b80dec5a846e1b7076fdf4795f882386dce4
SSDEEP 49152:xSuZQIY0Be2KkRVtOnks6NMHqNLNiXicJFFRGNzj3:f5dKqi61N7wRGpj3
TLSH
T14DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 67b6ab82e53679cfe0c6de2e4ea336eb84174702c718761e4f2ac4a34383f72b
MD5 3dc114df40a8f070bf3374415c646fe1
SHA1 4e335bc9882ef0b44d0821ef5a04964c4fc7af2c
SHA512 e38d154f6ffff04d33bf21556c7eceba06ca7919089da53e7a5bcef6db26cd37ba01b6b4e66d5234c7d7d67d2d08c96dfa368f1c2e551ff01b8b9db9f3f9a032
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5wGLNiXicJFFRGNzj3:GX2iWph37wRGpj3
TLSH
T1E495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 56710e95ae546abe9b742f0a4147f86351ad77891529afd303c3491b279818f2
MD5 8689ce0fd5666b55f21e5fdde597bae9
SHA1 ca74acdea208167a3cc47d5d237b9f368bdc0fab
SHA512 64fd8d50628e9f8a2c6c19a4e4410ef2198f50fc9382529a38af7250de0575e9a284193ec4f02e161672692bb4e58df541033f48b6ad2d06e15d87bc5ec48357
SSDEEP 12288:51iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11E5523D354C955B1FAFC0039C6755428F5882E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 832d849e8f2b0a86131bd5aee581c5b6c4430ed8f211e518dad80abb34820b51
MD5 0442218f6ecb241ef44e219cc2978835
SHA1 95b1f9a23dbf3239366a890b55b50d9571117e7f
SHA512 9ce2cc50660a900ae49a25b0e2cd3a4ec930eda1d82abfcbc8bc1db93a68b4c751653289a1d7acbb2fec9b64e22145411c639d31f645e24eb99ba1ac5d7eab86
SSDEEP 12288:oeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D3548955B1EABC0039C6755428F5882E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 92bef293b664cd958cf470ffb16a5f3f742e30f284f59886bee0b770873d9304
MD5 a6c10969ff04f4f447063eaed57def32
SHA1 43b1693ce2098f8fe48e501d08bd96c52a365bbc
SHA512 295187cddf9a3baa98d4d01c33a68dadfc3365bf5454d9382abe7f055a2ecd821946f22cec4dc697ef6fd3e178b784772ef46ec2853c1ba1e28ef491cf9a6fe4
SSDEEP 12288:hAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3558955B1EAFC0039C6765428F5881E2DEB5618E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 94eadccab97fe7589a4a976d62095c1b62b7c5da223dc1e264fe98d8591b191b
MD5 a26ac46f873addedb25cb3b186e07a59
SHA1 17f79150624fb2c517bfd11a5a5541c5eedb8dd2
SHA512 961a4e6f594d8469df86ae866d56822244cb607c7dcfb80682926a454870a220660870d636ab8cf2e081fce016a168625131834596bfd9a5da8e6181b9f95cdf
SSDEEP 12288:uVXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D552393168900E1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 29634d4711a86537aa4aa15b83a4f32c0608c8b72d79faecb8494fc0bc3d069b
MD5 afb5c1819e176a9f2d0f0157401a1019
SHA1 6ee89ef7afbb0e6e6b861a158a438b218927df21
SHA512 707be489938bcaa37015462e799320d1686f148555a53fa6f9617bebab83ac35cefebe0a83dc2657f3167dfda43c4f904b78198fef0e141e447c035e18f189ff
SSDEEP 12288:E/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18E5523D3548955B1EAFC0039C6765428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d2b53e192df9d1bf84d54123bb78295995c01380669209cc4f325f05298abcd6
MD5 0504662aab1425d3c88ee45dee21e3f1
SHA1 11de87e53361d4f70ce349737066b814d888a297
SHA512 7909aef9a6986d5336a13ec738603e4a78a04d8c8c12bea44d2eb4f1cfed842406f0e98c1c06cd44c0bdd883374d6b6105c9104db4770b01b36ba4f36e682aef
SSDEEP 12288:EiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ek/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B5523D3548955B2E6BC0039C6755428F5882E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6612f8ace1a8179690ff7b262b0717d8f14e4d727f92f70433394dfeeddc61c7
MD5 c8d16773dcfe09440438554ef636f0b3
SHA1 cc8c370e3d8ffe2419a1a88312e78230147b3299
SHA512 bc9c080eea55631092801735f18cba0534aa46f2de847a502318d23765c586273792fc30384e269c44dcb66a5c5f5e942ae8e9bb93def03b91d1863044a2935f
SSDEEP 12288:jGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1085523D3548955B1EABC003986355428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e5fa3fc45f5cfb2b088481b827ebbcae74a87e1a6807327c655efca61922e751
MD5 ff75c5133f6f0df21e09ae0c7e86e9d2
SHA1 83df84050abef94073ce34cfcfd6d20604ada0b4
SHA512 5d447f590fef5f928437a799204286a544bdd8de7a227e4eb5cc5e9f284da3ec8ba02bced071f226ece430360f099555c2d8383542597d91b842c576cff7961f
SSDEEP 24576:uZM3zFVSOI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uZM3zfULNiXicJFFRGNzj3
TLSH
T1EB750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 301b51da7407221ce6bf4d64f47e1c2e724328c11a6a0359ef880aa7f31a9b75
MD5 1d3036090740f6beaa6f5f6897686b7c
SHA1 9c8e272224f93cb8404ddefa55b406dafb00972f
SHA512 d8224c51a452bcf7e19678485a523ecaaf6ad2fcd6ae1da13dd7a049d616eba56648445f8b5e3ce6ac39802ac6d448ea6a8191452d3d0fd220da7d5bbd8542c2
SSDEEP 12288:3xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:39/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EAFC003DC6354428F5886E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3d66762d99aa9e359a4db7358077e02831376f82e6a28e4b480d5c70a27ed0db
MD5 a4d5c8a9fcf2703828ba926e3a7d2fde
SHA1 f5a0d0e5cf1fa86db8cba86bbae630db95045dbd
SHA512 30f706d54eb0581bff782d113347166967cbd81adfb7b99c69fadb85b01f7f65b728fa2d00fbe966bf9dbb7261b73279e907aa352282367f84e3f0665d3c5939
SSDEEP 12288:gNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3548955B1EABC0039C6755428F5886E2DEB5619E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8f2a373865f68ad5a89837d23bc6c011d9e565779cc1f1a2915f993270fe7ecb
MD5 9f3fec29541837ffcaf40c8c6bfee429
SHA1 f96289f4be562fd6fdd765dd6802d73db91e6dc8
SHA512 df91091c462247f3a7fb9e0e7dcecd870dec1f0c944737c5c358ce0fa49a389fc03eca192d6ddc37cd050ecd83854241d5d1bdf6083ca1b0edd8873c77bef541
SSDEEP 24576:Kzyc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K3LNiXicJFFRGNzj3
TLSH
T131650247629530F9D17A8139C9621911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b9b19a4ba38c593bb7feb62c25c7f172cf850efa2029452a7d91d2cbf121a30d
MD5 76a450d16313da23a9d8e3871d250319
SHA1 77cda1cf059eda93d37a00634e801440d4d47802
SHA512 f9b0e63b86d4367815e698fcc43f2a14e45cd1e231511ab369dcab71b5b27337d792423a7bd7370f7b3f409373672683aeafb7612686af7fda7563223b880898
SSDEEP 12288:5xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:59/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1395523D3548955B1EAFC003986354428F5886E2DEB5659E3E2483D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 26e40e4af01f9664caa7bdf2d61427f9cd7741ff4402970c69c9073913b7767d
MD5 fe28159d20aa92e7298ada96c860d15a
SHA1 d8e76d84f45a784381012182ae01e1506c800bf7
SHA512 5254da55cbbd24341d385641bfe5c122b6cdf5967448f42c8a1fd64e87b383f073700744053aeba4ac512bc5fcfc3f2e85dbba957957b603808a606ea5044c71
SSDEEP 12288:mxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3548955B1EAFC003986355428F5886E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ffdcf36eaa764cf7606dd4892b75bb2153753c6b7bad003c5284c1e69b82c5af
MD5 82e8df436819dfec98be55ec8599aac4
SHA1 8a5a9c144ec76bf438dc0c9fd38909395c3dbf8f
SHA512 458fa7fc5ccae6802dc82b03f969ef2fb8b4b795847c82e39b46f1e9a2316d4b7cff161bc01497b117ac94a63c724209f273987476d6c8b2aaec0d6cbe3308cb
SSDEEP 24576:Nzyc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N3LNiXicJFFRGNzj3
TLSH
T187650247629530F9D17A4139C9621911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 763a56f4c42f9e23ba0568d27b3f2c16cd160100bfd36c368e947ab8027e1b82
MD5 7400003d1497f0ed5734288eeaa5c433
SHA1 961a8f2ca592b4e50e33b3d73c90a264f0d518dd
SHA512 9d7d82ab8ab78c3752f2fffb2f738ac30dfbc69c6a02b8df867cf9c274d3844457e60a565d97cbc8fe8ab44943d4810ff2a20cf03b5036ef7265e1d2e21ab306
SSDEEP 24576:iT8aLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iT7LljfLNiXicJFFRGNzj3
TLSH
T1F37502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 146838bcda7869be4742b80bfaaae8bf55862abbdbef05cc69c075a01d6d3e15
MD5 7f255cbfaf1eb3f94c462e0105e9ff19
SHA1 58ae96ccea8c34231d53a5189b25b639ddc08f95
SHA512 62d3fd6ab98ef861980ff4546f557146c3520a91062d435d531f66d36d7c65592c2fd4476137622557026baa651f4c5a362dedc2eef04d102a1d9d94cb08f796
SSDEEP 24576:Y3rd9CHKy7GZe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ird9CHKyaULNiXicJFFRGNzj3
TLSH
T1F585CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1d4ed9379aba510de0921b6fb77e9f311e543f4e976f702200e290d5b22fd80a
MD5 4b8d96fed35832e214922aa55e69393f
SHA1 f64eda8b63b33c6de1235e69a5b3610637e6c3d8
SHA512 a08c52ba4a01c7b823deb41baee1682118ef8598ff2d63938905c46e53c8819d5cbd2268ac1515b87be229e625c7eb35e0388d05a78892901e74b9b91e294d59
SSDEEP 12288:egiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ey/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B1EAFC0039C6365428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d0bc1b9ca681b5241b88334164e5b85d38001863ce05e5117a44869b364ebf97
MD5 b72860c19f2cb20758828d4153318733
SHA1 5e0f599d5389aa4e0420381d4ac5c867bfb17301
SHA512 95fe03caa2ddd11f5348513c0c5592fbfd5454396cbb12d9c69be3da69974930444a662e6ede2cf4c58e6e197805429fdfad7e01c38b48b8f29bf315d430486e
SSDEEP 12288:NaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D2558955B1F6BC003986794428F5882E2DEB6619E3E2443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1cae2595c5310675090c9c8568984903f1028e126e57764e09f5953755258659
MD5 09e76da52a33d7634ab7f5f60f9f9c2a
SHA1 62daa47842ffe3c51d9c11dd178db1109102866a
SHA512 73b051b90fbf4252a5fbc1bd5bfa8e6897221682570237d78e27bef3aa38bc9f78a2546a95fc1b6bf0c60ade3c6eb8be4eafc89105d396bc278d062b1c3545ee
SSDEEP 12288:4TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1915523D3548955B1EAFC0039C6354428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 69eb48376395aa87f0e15d07002a7593067a193be75b3169954e0321d635fd1b
MD5 4d551882ce6c40d8efb1588e988b9cbf
SHA1 b849b6297a57eaf5c75ebba9e4113ff84f87a940
SHA512 4c51b8701b42facce6a510ab1a149f3dffb2d6cf0afc8ce2a4a4196017567e431e3ab09ed90ba2931d8295c21521ccba3260cf51e8611a1db64045b1e611cbc3
SSDEEP 12288:6xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:69/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D3548955B1EAFC003986355428F5886E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2b7b7706f85106e22beed929b7a358ca390a4362e331267f0c6a28d5f434ea2c
MD5 3a820582a77d67da4e16a50835f42a25
SHA1 b64b6d889005edd0261e3b0e52cc5dd500008603
SHA512 8aefe6e4b7f7e4b4524cf1b000a62ff2a48aa9b20c4221fe25362848196551513ac57b65d07126a7fde0091609a4428059049bff6f347c8628ab310130682593
SSDEEP 12288:AgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ay/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3548955B1EAFC0039C6364428F5881E2DEB5618E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 367b64e1154d0564ae7c26b9d8d3a4bf53f89809a8d4e91ad93d21057f4c8b3c
MD5 e9dbdb255f4d9e835f83cc88d0418b2d
SHA1 57644fe858c6583bd7917ef364f273f2ba16536b
SHA512 432ed48b200f36af6575bef95e00c2d0c5c97d9e55498cce81628e371983e1564f4bb56f5ed01332c914bf78d91ddc78b1997ace5d1b833a9edb16737b8ca8fc
SSDEEP 12288:K5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 94a801d785c375a2439dbc4032d9cac83fd6aad0137f881f8ca4a695d7afb02f
MD5 bc7883783a07fe834a8126aa0afa2f65
SHA1 266a9a9a40e83441a703951fed094548c7ab318f
SHA512 4cfebd0631029e752960e4ff614ff1981fe961744a978c8e6f4e0c1648314cef8d36d4df07cc73cb47acf84c3bbb88c4e8e08b58a44608d5d99726c9cb551068
SSDEEP 12288:p/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1E6BC0039C6764428F5881E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2da4fb867a672681d857efeba9e877b850d75ef1da2af1bfaadae62eefd7a97c
MD5 068c145ac0b68161b34178a910d238ab
SHA1 dc58b1b6c81bc1e6e582a77699dcf287faebd949
SHA512 4e2e81f033807de9d6d571254738f1dd2bbd9321cfefea213111f20d3ae832e09b6b25b45c69a87ed3faf41f225c93dceac61550d3d4746413c0bfb415a6e662
SSDEEP 24576:0fwvzk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fMnYIBLNiXicJFFRGNzj3
TLSH
T1F085DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ef5bf582e7cff1ed440855f4bf6d0f593199d9c56a840472208f08ba580df9ec
MD5 91378074a1abf8b1a44cb43fbe82b0f0
SHA1 3e7846c60bd337166871f64de02dd3b67240434f
SHA512 ad8913e728e89b4703866be7a707c8cd351b074f9c475c58a80c9ac32853ec3e96527e7e8129b8907559da5ab734bcd1d545f3e4eccd36c5d3c2a2bac101cce3
SSDEEP 49152:VYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mLNiXicJFFRGN:EySzPe7wRGpj3
TLSH
T120066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ae90853b843cf10c7234402a82348b870968407b3d1339091026d8edca1d92cf
MD5 668e6a432ff39aeb640c88fdb991f671
SHA1 58656da71d592a30d603769fc93f611909a5db73
SHA512 1d96c9a8f56bebf5e3c6760b8ebcc352c866faa3c2f88cb5d83da7260b7cfa0c367feed8b89dce3505578db32a53ad26180af08d64514b0f68d4e5378c3e3d11
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R47JUQjqirIhCnDHUPfF/WLNiXicJFFS
TLSH
T11965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 55b6df84e87ed2547a37cc637bbfb03aefd97824c7e0fc7de6088e4224f9651b
MD5 7e1bf1442d0179aa75afe31d4fb3e509
SHA1 fe31d3f8a4e15c9225171d69ff15f6b78fec7e0f
SHA512 65dfb00f0364339c4aa419d4ee7ade7fd8ecf2077a95f55cee754ae17097d24266e6875a420a29f1a1a5e8f3c2b51a1708272474d2f12dd168449650cf0abe1a
SSDEEP 12288:hpsfhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fe8cb3aac6747390da3595e13d6381f005a40f4c5e5c4cd863946a465e4a48d9
MD5 55ade03cc8681b949378542ca5f6a471
SHA1 cc55548bb4134a9ccf84f9c477b97a9b85cee867
SHA512 e45f5e902b2c1ed3e57c66d5608759d9a55a6c6388df689234cd81d0c4543a8df67696da345f2aafb740385f4e0ad80d596ff242d9a151f7540331815a793540
SSDEEP 12288:Mn3oWvYU3fRWKAsW20lMhXn+NQPr+qjUOQNSUNs1icJiMoKo:MnYWwUPR/gMhX8ojUdNSaiic9o
TLSH
T156450741762BC75BC6A990321E36D6CCA7707C01EE086F0773C9873FD476668BAB5292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 1564f5b5669c9e74a462830f8b4bfd5c57ebd3d22dfd4e9564612b1366b0f986
MD5 77ef7b9954679140f3407d39c40a5a37
SHA1 2e0ed56a93b43f15659f6b21d4961e0e769e0cea
SHA512 11433fd11a3416568f65ea5977e62c24364cd3b819b3b0f9e229231cab5a2d8c70cb6902e3e708f2e61fecd313ba018b703c07eed0cc52929745512ad52d072b
SSDEEP 12288:e4n6C4/AH7694BUAouxDseqoMAy7s2zFWyGXlpQ0PH5QPLSwcrd46:e4fHSAfxDs0zKlJDqwLRgd5
TLSH
T13E450A4165B7E31FC9BA90370732868DBB749C06B7493B057344CA3C986797EF6E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8f264467e4cce93519c9da402673ad875e65befbb437174f39548cc69021676d
MD5 3975421ebb8d4d079e496b20408fa86f
SHA1 35382d11bf45c0f6e9be65445527045dcf82df27
SHA512 62fdb34618e96b49580218c377cdaf2f819930fce7dcf3ab8003749174ed4e4e4ab929484720bbebdc7462751cd5ca4cff601b308e34822aebf9836e7b0d414f
SSDEEP 12288:jF7piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:51/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C552393568859B1FAFD0039867A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 206fdeaa3e2ba01e2d7e94d28fbc9911bb09bbb6f752a7530ce731febeec0dc6
MD5 86cc689584a55f87fb746e8197731a72
SHA1 62fe29c27c0a47710e208268fbf8b0c22108c2f7
SHA512 5d601bd24ba54d8ad5e90f53e0c08e2bd13c9efe76ea2e03ae8dd1d1aaf5e2758405c6ecb859bed91ef2c2b03f0958019746bbfd755278355f9872d287178a0d
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:egb4mBIBhGF4LNiXicJFFRGNzj3
TLSH
T16A65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b1c0b1498bdcc97101f63cec862c6400f5a4e555501690fb35e9f0096d2bfddc
MD5 081a9fbc5e8d6ad76c4c320a98ac9070
SHA1 6d60127deaaf35fd3313cbcd4e49d5b7f9c9b91d
SHA512 4fa1a3d533723cb078745c1dc9748bbd36134a1252bcf958a06ceb5d0a4f3d6aadda892c50db693cdcd05403c079248067b9719dfbb548bd7394467eafd04c24
SSDEEP 24576:7G88u8FpJqH1vzria7/mI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a7ZFPqVya7/HLNiXicJFFRGNzj3
TLSH
T10A85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 fd03ec4d609eb03455874bd3196ffaea4fe93fd5507b950184b8d4ab0afeb9dd
MD5 d3370ff1f927ba05ded6342df74b457b
SHA1 5b4ad80c3655689b160e1db79bc431cf8b58490c
SHA512 391e947c0d24ae61d66c82bed8b75387f4da0a1e39370ddcb7efb57b7b336bab56bd6fd08380d4d5c01dae9b93531653be79103f8b9ef9c3389ed22954f460ff
SSDEEP 24576:oPUr+NQU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oJQULNiXicJFFRGNzj3
TLSH
T1CB65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ebad47836c0007ca93e87d662c5421201f778e3105ad42956acccdc6ab4168b1
MD5 e21d766e5527ce67e63e26dcb1e07314
SHA1 020cfd4fc05b5f3c123121bf00d841cfa1ff4925
SHA512 83c11c7266c2b2f27d5930dbce400fdafef9e52c74b5148daddd562f22de23800b518917c7695b54c478d3410cb24ab35a42ebc20ff17c5c0bbe0d1f42429723
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkLNiXicJFFRGNzj3:PG05lO43bJ7wRGpj3
TLSH
T1DBD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dad2112ddb0b19f9c96ac5b83eb25b5918b63f0c7b0531b78dd0e697432af2aa
MD5 b75fbc7fad2564282718ec17057d3737
SHA1 16edfd1e0b65e3eeffac13999800dfe120dfea74
SHA512 6b5f00c983059ccdc56193d9d0b9237f10bb31245b0255d5f28467a85bdf3c4d830477dfcec1d2c25e2a173ed6b94cd42bc2e4592ee461d341e315250408e8c0
SSDEEP 24576:mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnm/TwSfVcYG3K/cJHlnFR+IGNe8jg:+a5POZ3lJt2pasx2+m8LNiXicJFFRGNf
TLSH
T11F65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 96fa19143a1c2a73229e914318de950d235fe93df4eebe9330e28a1eace0f09f
MD5 cb5fc3788b6ad59d951e9b2d1ebf1bf8
SHA1 b7f92d840d8ba76ac6f7b5967307a164086a1c40
SHA512 c4dba06b7ae4e7b3e05b18d9a6ab3bb060b53fae2da69de5db3f3e04400ff2690fce9b995dccd1deea319efd1a4af606712fb0ecedebf7e4a7a2cbe3f102f99e
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nNc/zEOVHFnLNiXicJFFRGNzj3
TLSH
T14D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 86c6287a9fa24c62d49442f2ecaf5b4d247a42aa399f2d64821174a2f141c041
MD5 3c728ec0054757ee6512e21ecca6bf3e
SHA1 4e808f389419a263c071e39cfe403045aaa912fb
SHA512 fe936ef7a7559ba822ef56d52a68107c7554c4fa8ab7019ce804496576803b8ff6e1641bb716f92419c35ea588fd93393fc150f69ab442173acb998b2c1cd606
SSDEEP 24576:FzkNvNnaFeYhJNtmZBmF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FzMwBtOmFLNiXicJFFRGNzj3
TLSH
T11D55AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 bef1ffa7f1f68f0bdac3db4706cef9b324ade822ce582c8d6a99dca10c1d09bb
MD5 3e2cf9ff89cbf64b66ea242107c0e016
SHA1 852958c281710d58c88dc536d071f3df03f6d030
SHA512 b1a6d45e1882beb23429f1fd56e0af3ac253adbd0d1c6baf11778ee5bb75d00739ef521040e0ba10d90d5b1e3292c9e277fd02194da28798c02a9348d5b82131
SSDEEP 24576:zD3FHshBIYQgA5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zDVHeBIAA5LNiXicJFFRGNzj3
TLSH
T1A075E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1368-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1368-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1368-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1368-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1368-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1840-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1840-138-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1840-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1840-130-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1840-136-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2052-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2052-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2052-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2052-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2052-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2204-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2204-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2204-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2204-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2480-54-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2480-43-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2480-50-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2480-49-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2480-42-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2480-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3224-77-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3224-298-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3224-71-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3224-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4400-110-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4400-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4400-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4400-317-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4400-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4472-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4472-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4472-283-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4472-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5560-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5560-332-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5560-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5560-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5560-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5560-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5948-118-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5948-124-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5948-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5948-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5980-82-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/5980-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5980-87-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/5980-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6060-0-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/6060-29-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/6060-25-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6060-7-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6060-2-0x0000000000720000-0x0000000000780000-memory.dmp

Download