a1676a2e6b8a50f10f8aac76fd350fb4a45b8ced0a41bb57edaacb9ed7595afa

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 8.2MB
Sample260802-j5e9fsybla
SHA256 a1676a2e6b8a50f10f8aac76fd350fb4a45b8ced0a41bb57edaacb9ed7595afa
MD5 9c9c9d02295c5c08b6ad9ee2f65a6167
SHA1 35080a47ca206bb76894ecff4ba6ff0235a7ad24
SHA512 f3e03f238161a0c88e5031ba4bdd6e700dd24c0da8463f7cea2a3ca43933156f5af7fcf7183f0b85c7bf4460edbce66b90d3abbc412f65e711e87596b1255e5f
SSDEEP 98304:Mgo4DknwzlPhPxYmzkRm6wZ1i0tsKzDeT007kxw7wRGpj3:MZWknwzrPxhzmm681i0ts0D9076sF9
TLSH
T14296B05BA7E800E8D8B7D17CC9978503EBB2B81157319BDF06A4566A0F73AE05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2464	elevation_service.exe
5000	elevation_service.exe
3368	maintenanceservice.exe
3192	OSE.EXE
1888	PerceptionSimulationService.exe
5664	perfhost.exe
4952	ReFsDedupSvc.exe
820	SensorDataService.exe
4488	ssh-agent.exe
4320	AgentService.exe
2764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fe215e80d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d64b30115722dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016ddc40f5722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e1128115722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037e0d10f5722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000219722105722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3216	2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2464	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4320	AgentService.exe
Token: SeBackupPrivilege	4952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4952	ReFsDedupSvc.exe
Token: 33	2764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2764	SearchIndexer.exe
Token: SeDebugPrivilege	2464	elevation_service.exe
Token: SeDebugPrivilege	5000	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3612	2764	SearchIndexer.exe	101
PID 2764 wrote to memory of 2452	2764	SearchIndexer.exe	102
PID 2764 wrote to memory of 5968	2764	SearchIndexer.exe	103
PID 2764 wrote to memory of 560	2764	SearchIndexer.exe	104
PID 2764 wrote to memory of 3080	2764	SearchIndexer.exe	108
PID 2764 wrote to memory of 4480	2764	SearchIndexer.exe	109
PID 2764 wrote to memory of 4248	2764	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9c9c9d02295c5c08b6ad9ee2f65a6167_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5664

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7d35fa567373f6fefcc1b8c01b43c7abbddadd2c3b3bb57bcd83157741bee42
MD5 df0292dcdb3e97099bd9d113985d88ed
SHA1 d392718c3a0909608ba9fb690c73dfcefcc0c776
SHA512 0fa8969fabeb375fbb31db2e0a7fd937392735272c078f14e8eae7a24ea165896d5c392f8eee2677c57fa2da82d5d41159db65544c84c1d60d1314110aff0340
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnDLNiXicJFFRGNzj3:93q6mjBM7wRGpj3
TLSH
T101D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 80b0a686815128af504c69fa576b658bae3df0f4a8bfe07e2dfd427006dabed4
MD5 059d6e5a8df3f165b41981e7652d8678
SHA1 af5ff66b2ebe008a9d94d9a397e19a8fc1442710
SHA512 d705eff5425cf7288aa77f8de99c14fdbece51cfd0dd37e90403200f11a04459f3f0bb1ede3e528f965ad2635c0364d0e2c02016808f3fe897ac073afb253190
SSDEEP 24576:rXYfDtczAK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:utcnLNiXicJFFRGNzj3
TLSH
T10275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cb79abbfabf2bf0b4704a27a2bf2d81c983f74ce8a5110776875a62fa91ef596
MD5 a93002821f8557e52c711764ce2f3c09
SHA1 bfac57f5ac0f3cbc77275e2a14905716e137e0a0
SHA512 1b0184a3483f1ea4c55d0dd496867ec561d88f67952c4345c5b23fc55e38a7b8ad1b133245bf03afe838e5a4f82265fc55663589020a3aa39f5bfbd7c5b38b15
SSDEEP 24576:F0Le5ji0hmxhrM5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FPji0AzsLNiXicJFFRGNzj3
TLSH
T19485AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f8910b504a54ebc663992fa269362c17d5644e39530b0a0a3a554667189eb125
MD5 4c6b5e255b73070c66abb5f76614b73f
SHA1 10262acdbe0dbb75c92f3c73fd4bc04ea7cd8754
SHA512 42a6143bedc36cf13662bcb71f9acb59826c08764c8f511d0cca49606d8de5de3250edc80a7e12205af955c8d6c3aef338e073f071368971fb430f9fa8c21bb0
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyuX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m/ezSC6vUzPv+HjygLNiXicJFFRGNzj3
TLSH
T1EB756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dcfbcd761672e698be547b0c862812f650dea017418b578cd1456dc1673d8bc1
MD5 a74e7a7e5529f90df6c5725f32761ebc
SHA1 585abf806e3b5eae1422f70a38bc2d5faa661296
SHA512 3fa4dc447750bd922a5d79f10d27a0b27ef367a418d7b47ed429c88220980e2fc8dacd39498f0f27fef6e2626a16b588e89c5ea22a5539d3fbe475157b67914e
SSDEEP 24576:iVbqPb88hv/l+BW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iVO88hXl+MLNiXicJFFRGNzj3
TLSH
T192559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f43ae86a40bb39d156d0ed95b6b25c39628aa1ae728d388fc7e328475760a16c
MD5 20d7d8f48fab1019de2ab65fd0854c17
SHA1 90191efd3ec35b9beadec6bf406c7e695b3b3e0f
SHA512 921d684769337201ab2ddfb77b747b60b99173a5bbfdd3a3d16db5a310afdebd3cc18dffadfb81b7f8b46614588a77d8508f1d7154021c1f4ca47fc777277469
SSDEEP 24576:uGF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jLNiXicJFFRGNzj3
TLSH
T1E75523D3468865B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c5152ee70bdb591729da3b3ffec704abb804e693d2eb5894479c1771ae8c7296
MD5 35f5c099120bfecd835370613e951a2d
SHA1 548d342ce4a87f3c6faf356ec349176a23ea2270
SHA512 809d81a357c131513622cd406c2c4f04c1a0af2774856df91d6b54cb120807830ad56df63bd6ad00bde707bae34ef51de7a4e923225b5e195a174e166f30980f
SSDEEP 24576:rJIUe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rJIUeLNiXicJFFRGNzj3
TLSH
T17C75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5608490bf210d67d6f48f1cc1900c7efa107c7b00e69f0c3233ec1692105d59f
MD5 31a2e7af5bbd9dac9a03f8d5b9b48aca
SHA1 e56f0fa7308f648372ff097e81bff27c1494ceca
SHA512 0434dd195ff3a77dcbf8c285a6554ad94d9c61b10cc883f76f2a4459a30c87d0e74a5633004c3a5d5ca4916fa111cc353a0cd5b921a268f2480d1403d761500e
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH:GQvGAdlCEL8c/WRNw5CH7wRGpj3
TLSH
T1BB266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9ea519621dce51c2430ab37569faa6a98574785f0f5e1ec3889203701d84ada5
MD5 33dd47d04a17503a26c229592b6ff3cd
SHA1 1ba6ca71ca14a97e84bf1ef5e01bafdaf509ff8f
SHA512 103e1a30cc7fbd1023bee340be0e9de187366df9da4a6a510b037747d010f498c525d3f4273f34381fec9c2232415ad3f8ad254644b1b2b9f113fec3b8bb5f12
SSDEEP 24576:1fewsAjc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JljcLNiXicJFFRGNzj3
TLSH
T15975E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fd9280f8f00deb0fbd287effdffcb019614511e3710d333c21a4f7e7d53e5d39
MD5 b7dbb456197018a3da7cc475bc0bd419
SHA1 75b8e213a9228f6d9ef8f78ae8a627bb3e639cb2
SHA512 6828270e392daae939ea0fe0d331790a5930458c09ca86e2a41fd3abf4f7b50ec00aa2df2051d1b748c44825dc082b61876c61fed60fb9fc7c59d121d97b6ad7
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgF9:cUEtQevvqc2W1cpV20I32E9
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7fa4a6f14811252f8a58a59dba5399b5858db398857867f6203c75d1d9b16dad
MD5 9b380ea76e5c687017b7e9793ad87448
SHA1 0079eda1f3cb895ecd31c36425b29735ed2314c5
SHA512 d85448ced5163481b2e124a301933bb7aa2e40b24ebe7db428f8ff3f581395b1944a43d15fbf0083d2c98d8211e15f5b89ef1ed1b5460d79254d33c00724cb22
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/z8LNiXicJFFRGNzj3:roq2Vjnmb7wRGpj3
TLSH
T1A9D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 387f597da3ba37a785c2de4666ea375424da1c0b87c3a0f5a901b62778dfdf4d
MD5 b29ef35a07a86fe70fedfba52abe2a76
SHA1 b83da85711cf187f87cc3bd69ef200fd140f9324
SHA512 7e7b14205ad4aca38f504277023e7680e5351b4cd7d7aea1a879ee56e5b529656c77b1b51085f67d01a808027bd2e3b8ba5560308661ba1263d1d7a6dfdbd4ec
SSDEEP 24576:ZAhGL6IFoiwtA5l7S537/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZAM5Foiq5LLNiXicJFFRGNzj3
TLSH
T11E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b19ae4c8f7e5bed71855e4574862694cd093ab9e6d59f01bacf0f3af3c26c23c
MD5 bb5a35b4d704a46e1b74a9e878e6de08
SHA1 5bb4392f9a6387ad518b02c869615279d4f08491
SHA512 e7ec4dc095677525562c7d1c4be29f5fc20421790c2ca8cd0fd826a6e170314ca4caed7990ab683eecd480339103cb62c769b4198ddd4ebe2f0592a0097e2ccc
SSDEEP 24576:SwuROWA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SwSO/LNiXicJFFRGNzj3
TLSH
T1F165F18632941CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ed1563aac707a809bb89b4b425842a2a581d95e6e581c4489c15e599fe340695
MD5 51ab7fd8e38932ba7a2e55b2c7d888d5
SHA1 66eb4b96e0392b058b701ffa77b73aa36b63b741
SHA512 5eb45fbec67c0a802ba1ef9fdcf16d202f75f3f145984070ab014d3f7993b65b6f87d914ae47ae522b82fe69d36d1ef2a06d0a82e2618a30f694070ca91d8142
SSDEEP 24576:lZuB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iLNiXicJFFRGNzj3
TLSH
T1D655129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7fe58ffae9970cb2880a8616931c364f1dd5e5c22fd5aa68d580f2b508d56c90
MD5 d5cacf845532d86d255d1c0712a3df1f
SHA1 22e44e6d5ad76cfddfd4b604511da7d9c1aa2b59
SHA512 e55a93ae535e05be313bf9994c1e4dac2ea8d3e375e2a56ef731e229369f0bde6751ee217636345ffe1a8884c1e98f6f95ef3e50e86fbc3094c8ea15d9b9ca2c
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3S7wRGpj3:BQyiKanX+PNGF9
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ab817e9a543a8b4471736495f1cffc4e1f481910c7089936ba1e956a94e5a71
MD5 8e1947ff554c712c7c4a22c26c875afc
SHA1 0270daeb5fb1a6e36de3d720405cfb23ad923a13
SHA512 c863d33e9d974a96aea5c40d07acd5a5288ebf892ed57b6ee673dab373cb3e3034f06c1aaf08e6ea1fd13fd7efbcde8e5e3769deaea4a2122b8d9d1256e6d302
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3S7wRGpj3:IQyiKanX+PNGF9
TLSH
T13C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a73faba4f1f85a87039815c391c10baa1646bf61b0888da0b2249a8d74ecb33c
MD5 7552910425eb77dc6b03218d11630026
SHA1 1208ab1e4e6d815ebba58281601d858929506f0a
SHA512 499ee6179855da92f1d267e6aadc8e040f17acf3875c02c2d9ed80ef3572b388b1dcfe7ba497b7a1f2de5ad0f569c0462b82c89c72d5926f218944d1ce2d9671
SSDEEP 49152:f68Qg55nhkeWu7PNU3/sLNiXicJFFRGNzj3:ZthTRc/s7wRGpj3
TLSH
T10FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c6e30e1114dc816d4c76b2684a1a68d84cdef0b6b18a133374e9c47c4909acf7
MD5 203c20bd1d17c48ed1313641930cef80
SHA1 8fba1b1831d3daee6128a4aa05f4ff0e12d14856
SHA512 e52915436fabff7b37e9e0ea25385a6acd49f0188833d43c2325a1e6d20702492f865b6505a64071d4376b5323c6d4e5b13a8150b38ae4fe2c4ffb857fb1062c
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZF7wRGpj3:BLIHRWhHF9
TLSH
T195167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1562011f8768713a317d24a6393b5949423fd2a6e3099d369fd95991eadb45b0
MD5 3f33da564fdc31446b669e800f736b09
SHA1 3436b6fb0759525964f1e3013376f406d94fc6b6
SHA512 2420cf0cd43bad29dee3b0aabb2012f4ea8825e593bfee87fd69021f437fee6078783f8c02f39af1242fcd9de4ce962bfe7055209e640a5aa32cee3f7b0311cf
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glwLNiXicJFFRGNzj3:Pu6JmIxd2dw7wRGpj3
TLSH
T1EFD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 80f619a5d2c93f83834af9274aad6bd6c77b0f0b1541abe9f4ba5a00e7bbfc41
MD5 bcf319b89dfefa61e922228340ce3ad2
SHA1 c750068def28c3abe143fc0282df96116998294f
SHA512 5e80acb0899bb86b674f33f2468255f50f8662b744685019089bb96c4d254b94411f23c3b291b6583bc8309882f7fc38f76401194cfecf4a811f07177c82d8c4
SSDEEP 49152:/1hpsNoJpF1A67U44CwH7R4x+LNiXicJFFRGNzj3:/mifPqRb7wRGpj3
TLSH
T1AEB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c09ff94560c572de66cede7a9ee10189f62678c6a24e08858a39cf265cf660f4
MD5 75afa5f5b9690d515b0f15d7e248c12f
SHA1 292d079a6d6859c19accc71e90a5c0192b246b3d
SHA512 66a0f542bef08260354cb6f9d356aeca1b297492650c4422d35c278b25add2571aea869e9ec456e570d33d396f4f98a73737412585eac298a54b61ac1acf8b34
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqBLNiXicJFFRGNzj3:p5dKqi61B7wRGpj3
TLSH
T170C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0c980f728689648ed3441d937432b3ded5106e836670dde1f718d74c50594a3e
MD5 52b1dcc6bd29a8e001b4160dca51da9e
SHA1 ef218d66f1f238fe50d2213d11b28d86ec6b3f11
SHA512 fa89cf5346b8949438ba28856e32b3f02a57deac35bbfff6652165fc09eca7d721113ca5d4d24a9f9475d2f2a37f6684692dc25dcd36bf6c43a9a829217448fc
SSDEEP 49152:0htSn8EApI0figjgiDn0AP5wKLNiXicJFFRGNzj3:VX2iWphf7wRGpj3
TLSH
T15495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e6ec8c878a37113932aa1f55834f80184307a1b3c0bf45815313ab9a1a3c2fe5
MD5 9af166a3d5b0c6fe2dd5dc2b5ac70b52
SHA1 061410fd6d3de1e5c429d19f0429834ad7cf0193
SHA512 3f2ae33ebdddb2f9ef0185fbed9d30620e700ab25c8e3721d0196ba3716d1e00858ba787bcdde3b0aa16dd4237cc26c429e1a601ecacbbd8b153b6b59af9f417
SSDEEP 12288:rBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C25523D355C955B1EAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fb516a4d49cf18d06130a1deb751ec43a6ce2aeff104ac213cc0605b1520cf5c
MD5 d40640c197458d242a3cab68f4048e70
SHA1 8f4babf8cdc341e96294d496e69bf1ec389bb5f8
SHA512 03a23d7a3a767a5b8b0357c412c52641eab6bd55311e6cf18aee2f6bca0949eeebb091fa8c200bb09173c7b8b3f66ac058b1322924a9f06275844306702648c8
SSDEEP 12288:BuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3558955B2EABC0039C6754428F5881E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 33dda9c03dd611e3039faa7f30df70e6ec1d6117d3575553e0ebd4dc797b73c7
MD5 023b176681fd2ddb499c5b3aeaeef57f
SHA1 8698d4884d745883e05a07392df82885226631f9
SHA512 8afc4589cc6517be380b5659b9ad5173b91f247cc3a4fd45a727a951476e6355cbc7f470316e6da4a22ccd5b9e954051423b21c2cee1be29ede7cf3eb73299fe
SSDEEP 12288:XciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 022ad07c9ac552a792c00df1be119adf1e581262df1be03e177031ac69d70257
MD5 53dfe9d772402cba211d373e6c96dc2b
SHA1 47698bc6ecdc0658ca2193c244a56416a0038334
SHA512 4e4a0e930209cd64f65c5ef810519e1221736a602e48f470dc49a189cc31de5ceca757a9b01d0e696e7ef83312736aea3e4c4147edf4dddc3a3e68fa2291ae31
SSDEEP 12288:cVviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T172552392168901E1E9FD803DC6764428F2A47D6CD7365AEBD3003D0E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 84a35e37684793b07048ba0f7c5618e64cc08c4224da0d0cca391924de37fd4c
MD5 d93c45c451e96712a8b0f8e1f7a7f12b
SHA1 4aedff8859845926cc0a836d14c874159b41d329
SHA512 f237ce214f1f2b7d84afdecac258a45d3e0f1553aa16a546b7d5d28e27dbf99fe28b03985a2699a921165d439dd3f9574f6f8a10acdc9837e00d85e4649c1c6b
SSDEEP 12288:yniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1599f7318a543a3ae2a248ceff5a808ea7d18fc337a66ee3e793798a8bb4fdca
MD5 6c53ad12ff0659b3f5ad8957819bee8c
SHA1 43908ea4e956b16a4c29915e9794558a1a2d848d
SHA512 939784d96a55cc4a80ef6d707ea25d308f0064d6beab24a9fa98413dd7c12c0b658b0f546821bd9062f054a30328691ff56c68e9e2ae102c2e0aaec426015c0d
SSDEEP 12288:diiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D3558955B2EABC0039C6754428F5881E2DEB5619E3E3483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 044e365767e5787e49ce7deefeff15e7d1f05db725e18a8524f48067489a9bd0
MD5 02c34ed5352a9fa91f310dfce835e4e4
SHA1 448e33de030f68296942f0af620d46ba45392e76
SHA512 271e7624d45d152dc7a0db02953edec8e4152a6a74c0ab87efb89f228c9397600cea3c93e01b4a95c16059a0865a18f98eac8056c1ca86b00b77366d3a2228d8
SSDEEP 12288:SmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3558955B1EABC003986354428F5881E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 134440d728f4a6a368842614c57c3f4f0956e43504185c1878b46e0c7015f2d9
MD5 d546322590e5680af86813b059b3d4b8
SHA1 c7699006006ea18f174bcdafcfa45a6de3ad38ab
SHA512 9a41ba1c872af067eaaf7b8c5d7bad72be3d643dbc61b1a199b3a5c241e613609468d422301df39a543cf9750c09dc350cb6e04e28ab65ac43f5d670477fa080
SSDEEP 24576:YZM3zFVSO4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YZM3zfULNiXicJFFRGNzj3
TLSH
T1FB750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cca6cfe123e142d48b9310dda540ecdfca80d26557461240ec6e764765d78d10
MD5 5b07da5cad0e06e08ac91c4414805cb6
SHA1 ac4f3821c54a492ed664dfd1169c4314a621c0a2
SHA512 0f8dbfa5d57d57e1cde4cacefacafbe1af263ce1f120f41fdc08a1b471bb4d5af4f92556f6a9796dffb935e58a80d94b30c57d2c47e50414a0342f3ae5fb25ab
SSDEEP 12288:RtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1155523D3558955B1EAFC003986754428F5881E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4450833a989147a3670e663b993f7790841cc94887d3f4df888bd364e79635e5
MD5 b53a19509444cfeea9fcc5ca1803cb13
SHA1 3eddbfe3d7da82b53728883c5f00baa466eae603
SHA512 46cfd87e16b578a5020d213ff78ac19967ee57a6bf385bfba910fc9f3144fa2c8c2c213cfc6a4d77d2a08c336fa8e327d50c06b94c9512194a2a2077b35ce849
SSDEEP 12288:QpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3558955B1EABC003986754428F5886E2DEB5619E3E3083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 65748479884f5a205cde35d3117ee4f4073f43804bfb8259ed10cca3c4248bd7
MD5 0c1f4cb7b23544a179c8596796442484
SHA1 780c48948135a3f33b7d13f6a14342f4579b33fe
SHA512 00615bc0dba478ed2553afe8372717a8f45e5d795ebe771e35d207d60cda096295f0e22cbba249cb05f1ee9fb751f76ee96fad6cb489774a3b41253cd1751124
SSDEEP 24576:HzyM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HfLNiXicJFFRGNzj3
TLSH
T102650247629530F9D17A8139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 eb59687198a9c157833a2371c2317be47d5bea085a1e98e08122ac612d33a456
MD5 25c4479745558ae61170d9820f98a3a3
SHA1 b6da666050bd29f195e3b70a662ab1e8b1f18c8d
SHA512 6b20d16dc354db58efcabdfb9f01cf571c235a89a260602fb30e61052ec905042c014343ffb07b2109e297de335df151e1e18dad70c8a86e5a03cc88d4bd9dea
SSDEEP 12288:vtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3558955B1FAFC003D86754428F5881E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 510118009b999f95582177599614ab27ff50a01238a1fc02c1c6d7185ec2d455
MD5 565f958e0ce68550c54cb9712382d474
SHA1 eee3e48793bc102868a66b2c1081192db9b161eb
SHA512 338638b8d1d6a795837da5c570d62f684da25662fa98f04b9bc7ac53c10899eea20710ec883737f3bf2f6745ec8bc50fabe85db333be5b6fe40235fd156c46ba
SSDEEP 12288:ztiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B1EAFC003D86754428F5881E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 62f17b057f6d2b0e80055bfc8c00d931f62ffd23980c065ff224e3d7179acafe
MD5 bc69a05fd16ba304a4bbfb88e2a4411f
SHA1 180ec5d92821039b0daba25ea0750bbfbc2cc5c2
SHA512 fe154383d371da7f2ac5a5974d8b0e589d009e4236136b5c244ab878a0e1da40c4d01888cbf953ef59fab783796f8d31949b2589cfd41b60b992cda8603971c5
SSDEEP 24576:nzyM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nfLNiXicJFFRGNzj3
TLSH
T1C8650247629530F9D17A8139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 443f496e16796657799e081a7b3d2b829bd5968f854f94a21e32816ac6173b9b
MD5 47f6d06856b879dc51791d966025c6b1
SHA1 b0c2d2b797a979edb19c091aa96ca62599d110f6
SHA512 4df268fafa85a36ef8b90aa8a21f9ce2b726e588ccbc9ab98a1baf6c6230d81283195feea6b677421bd8e45189a5c6083d2aa2686a35641ab2689e986275313e
SSDEEP 24576:TT8aLl3z0zD2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TT7LljXLNiXicJFFRGNzj3
TLSH
T1667502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 74720ae886b75cbc3e8d117fb0d7fd9b3d37fdf997d6ac0fac49504f50334703
MD5 f360ccf76e421e281470c8fcc079ee19
SHA1 6cebeac9462501e7c9129c27f6ad2b9c45c6d6ad
SHA512 ceeb7f248fc13176826242d6b6796f8035784b85f1995c9c1e52ed87a4db0df2d494a846a61aaa7b240075f3119174e1fb6bddc85ce228608e40987635f6611b
SSDEEP 24576:Z3rd9CHKy7GZy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:prd9CHKyaULNiXicJFFRGNzj3
TLSH
T1FE85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 90164cd021ea5fe06d05abac95b7da88a475c386ece8facba49767fb9e89ab5d
MD5 8c87945ab94cf67a7e51dcdd0fcee0bf
SHA1 97c96bbdb0cae529bc9a0845f9bf785f7b30d558
SHA512 717d0b36019e412daf675a5edbd9cfb70c780a69b21c443953194245d90b76d5c41964988ed9c51bb904bdbc969de932f3832b530a731815b70f1a871f921b0f
SSDEEP 12288:h8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3558955B1EAFC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6348303498eaf1c3a0a6f232f4150bd04d30019c403a4155ff7a2dd0cb26e4cf
MD5 c090bf5ac0532b7ccbb253dcee626b85
SHA1 d1ae4dc9feee64b9e2000776849e55638fd62d03
SHA512 787b2a146dca1cb3a74f5cd9b15abd8ba3dc4f01016c59522930f74da4a2e7d42b125c1fe595e0dd4e0aa131a81a76bab453acc9884b32361bf97ea92b7b9b03
SSDEEP 12288:EqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Es/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D2558955B1FABC003986794428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fa202a86831d15288275255760ac217f2420d242015e054f4b3eb09b3fd34b63
MD5 befba877e48932b5f13c49bed15906bf
SHA1 31eff2614b37a81c5c40c46440945e466f106da4
SHA512 a5619a45eed3fbc97167f69c6d1b86a8ebb37e0f96000344a263c24eca0eb9cb43c89959775d478329feb254635116358c0506945fd6c1be8dc00db921c80ee9
SSDEEP 12288:KbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3558955B1EAFC0039C6754428F5882E2DEB5619E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3a9527aa3d9a48bd6a22de4cd53312288ec09432cb8551872b2260aa020d25ba
MD5 573c0f7c76dd0eb8511fb7f7098e446e
SHA1 6d1913a035de0ea662e7a844c698308780fb8adb
SHA512 0ccefd2b77067ef47719ca2fcd1fe8f0363627971d7ce074239d73c42a092de30caee5a48c70e9482d897d080dc9e36bfd7c795de105e1540e5dbf7352412d5c
SSDEEP 12288:9tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3558955B1EAFC0039C6754428F5882E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 29809564d00a498f2aa62a0e2fac93ee39a06bd253f2af810aff2d32db10f68b
MD5 6b52636085e84b10c6ec25e0561dc967
SHA1 4cb8df22b8cf492ad5818a4a3568def57fe61530
SHA512 9b57d12b4fa434ebd40c8057edde7cb4f4b39f1dcc02f59fa57f9774c71b94b8568f61593c8d8fea8fb3765dd90fc652128e5823fc612206da7bb78bdb9095a0
SSDEEP 12288:08iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 aebcd7a08904b427340758a408a59db8661c19fc4cbd262ef90ff3a0b06cbc67
MD5 d28a99b8b93702d2c13a148bb7dbb366
SHA1 6acb51701792488ff5826e6841ad9f2833c42156
SHA512 8e0c9421de34d2f15e6652f2050cd6659d6649bfae0e5117c8d9b07c14babdfe1b7234921c6983a7e485baf077abb23d27af1c432c879a9cd863f89336bd7a0d
SSDEEP 12288:EFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523D2558955B1EABC003AC6754428F5881E2DEB5619E3E3483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8e9a6455e871fc4e12c507ae8543a228a458e1ed58d0e40a9c346a005fcf7293
MD5 0a34de2e50474847034443bdc6ccf824
SHA1 8aaa884907d9a1380d227305367d59d989439eed
SHA512 2b5c617008bd6124add0f98b0e88531dd879cd86478501f34fc9448558bcecb771d40dbd8e6f0ddd72a96188783f52d5a0baf7dfe1a02e6acfcf16e7b31b9593
SSDEEP 12288:gniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3011de986ccd0c7bb6747dc6420dad82ec4c90dd10b9570959f34eb2266c745c
MD5 36fc66342c29e969ea009ba50127112b
SHA1 73ac9f5a6a4d91afc1a74aef8430b886e5f2b6fc
SHA512 9bc89f732e74b72d8cf2045176f4e64f435ca2f66e301d916eb30116563421b4eed996215f6522c415bd16d809cbf6d03cb40d57ed9afd3e1fa6007d03a7b764
SSDEEP 24576:sfwvzk9RX6wkyAIl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3MnYIlLNiXicJFFRGNzj3
TLSH
T15885D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bd2ec41968926468aed66b1feba1a9568b74bfd0e3b55a6f0fe326cab4c791e3
MD5 d6a70950f0aefa2634ef8187a9961428
SHA1 976ecd995ca8f1f4ef8b171afb6d34127d843816
SHA512 b7ebb363757db40351b014ea3a4a95df891d19568d827ab1dc0a1c9763e36ced08a9ee56eb42117982546042cc9ac95885670ebc7611277814d47c4f01741028
SSDEEP 49152:rYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qLNiXicJFFRGN:2ySzPy7wRGpj3
TLSH
T1EC066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d201ca753ed69840e5eaeeacd99ea68afc56a96ee18b0690bafc1bd78bdc2920
MD5 9b46f5151a24ccdb7d93fdada909705b
SHA1 dfaf7c3c2d3fbdbf459a23b9568d75df8eef56b4
SHA512 1b371e604c70dde5c15f78d420648a329721783c3a5f4d3e24474fcffc92ac6d6a859821eaa13e46b9363ee7538bb673f9bb34df981c8801b3f66cf1ca725314
SSDEEP 24576:947Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:947JUQjqirIhCnDHUPfF/aLNiXicJFFS
TLSH
T17965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1afcc3639d01e0beb590098ea05006766857164be4f9e53a8c622e6d7fb08634
MD5 f3fa206dd910d8b675b8475127aef03f
SHA1 7c6d19e680fd4d8770b1660af34561282f3493c9
SHA512 b846bc73b2f25089b39bb5b700f89ea0ae12736a296412f7a915228819c21e5b807bfa729478eb095c23809c2ea24b4d33539e2c3180bf27e134199145e737ce
SSDEEP 12288:DpsfdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 994f1137fd440f24098ffceeb77edaa6b4dbca06f1aafd9fa7ccf5acb7b7fbb1
MD5 30abb1f227af05c5b4114a563f71c38c
SHA1 1aebc37e44c6e4306bd2ab2cb5030b1f64dcc95e
SHA512 5c2baa74f8d3e94c4fc09116bb2f96bae1ef0a5614293e5bf4e7dd53e514b0a43b3a2da92b98aade24fc7dd893e9b9e2cd1a839d35b6ca5c3db2a0ec62e7892f
SSDEEP 6144:r05sBC2naWAAUErkKI7lPzotMx+gqoU3fDkCSC8WUxy2+7fHzV+e8I1APWQa15jg:r9Vprc/U3f+Ks+LTV3oDV5Mi3piBmpx
TLSH
T1DF353841762AC75FC6A940325E33C6CDAB707C51EE456B0372C8873FC57666CBAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 db6974ea2a6f35b983c0d87b9a0e97327c79b24dd3dae1c0dfaa4f96d1dbdef7
MD5 658d52a228f8724925e714d9bf96fad4
SHA1 ab7902b1d63821812a800420f43a709970816029
SHA512 ca198b978386f3b6926a28637f81947c57c7570e46523d73b4e6370b52a18029e4690964940612d8831265b0605f3f56314db775354aef00cb209bd285796f01
SSDEEP 6144:p33ljed6flE5Qg2eRnUd1P1iI1iAvI1EUk27cdAlPetMxJiKxNetCjD8nhFKyLC3:p339egUQg2eq8jxF04Mw
TLSH
T1F865E8815537A39FD1FB6032073A5B4DAB64DC06B7056F23B3C8453AD82AA25B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3c0f2e6c230dccc92724ec0aeac0684a1ab918772afbe18e1484e38920251561
MD5 c2dd117964eb0f924c245fe52e9d3c79
SHA1 d5b9ba7dd99430ae2af72f25e38645ec0c231fbb
SHA512 41df746b40b49d13855d17f4f89faa5dfe780feb53ac3f4aebfebe6b82e34f36d8a4168d4230e323c252fe49631a98ed523fc049c86842f3e69f4b84b2ad778f
SSDEEP 12288:wF71iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c28f223ccbe4b4260673416980369c1769a37dcf26ed141e4069f042eaaab969
MD5 d80ef3446f49fb1161d6440760f608cb
SHA1 39fd2c7032202c3ba6e429464a5ac6045b7513a8
SHA512 0710733eed112f7a0360b32f8cfe3189f90a00718afe43402597523707800a92bcb4ac3465585ce6c0e8aa051ce91ec40d9d3dc30033e49c74e39b0c2af8269e
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ggb4mBIBhGFoLNiXicJFFRGNzj3
TLSH
T13F65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a49041b5a21f758054785ea070ad7f2fa81bf967881e4e1fff4479309f5a9ab1
MD5 e9e18249b5017daccbade36bd76e43d5
SHA1 8797e0167ff8ef140ab8ad250516064459d492ed
SHA512 a0fe0b5dc5283f00d24ddca34838f29bb249c5b2ef5ee09a718bb0958adf8bee8dfe4bef76639ee7d326d2def7e3053f75e374ccf76e1312224d8786d5a507d3
SSDEEP 24576:/G88u8FpJqH1vzria7/m4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O7ZFPqVya7/vLNiXicJFFRGNzj3
TLSH
T11585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d2b806e79ef04d5494d23dc18abc3819aafe125e5969d9790d027299b48b1395
MD5 fa7f8e153daae5ff6a4f756373167f2e
SHA1 cec32d027cacef4edd6f9f8c1b22c573bff073dc
SHA512 0084496618dfae6d472a90a2f57474114d0d624a60b0b498790fd01eb7543091c0bca4013123528ab7773aa1e3d847dfbceac0f3c9d0e589ac781e0427f06017
SSDEEP 24576:wPUr+NQU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wJQULNiXicJFFRGNzj3
TLSH
T1BF65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 51e0710bbd49490e6a5d9c34e5bdb764c4cd61d7e4b311b6a738328647a4946a
MD5 ebd354c6be790a7bf8e04ab878a7cc67
SHA1 623ebbe4eb6a9c67546eab28d998f8fe4f8672e5
SHA512 a6f8ee9797cf42969dc7e0be38422545690ac35ea68d7c867ff5db9cf68100e8d72af2929d9e8d50bf881176d5bbe5c47ad13479af0c6859474407241e8080cf
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkLNiXicJFFRGNzj3:RG05lO43bd7wRGpj3
TLSH
T1ECD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 88dc88ee8c938095c5a2a8c669c91960ec75b246908792b7451e718e144d45c0
MD5 636242a7dad1775aac908d5f924636e5
SHA1 9350c0485ee4672d30e50734c3913ef3b122b344
SHA512 56fd95ef12e0775c5d562d0e8f4caebfa1649eff148cae81492aee5f64c4de0d1dbe3856e3b1b21acd96fac850030731b2897c24cf141e1a7e43b5d2d4046bf4
SSDEEP 24576:Pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnq/TwSfVcYG3K/cJHlnFR+IGNe8jg:3a5POZ3lJt2pasx2+msLNiXicJFFRGNf
TLSH
T13D65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3d8f9b64b42fe956c03538df5d0634380a4c6a1950fba862fb189f31377396ac
MD5 6c792f2152e2b6ac345d741e46bc3e78
SHA1 d54f21ffc32fa39ab3ecdee68774503d98db2ab6
SHA512 bdea5914d221768c9acb3b7d9022d88af28ac775829155f397a8f03ef8ad08cdbe0cd329bb26020073b09b5a46cae34165e8f41f579e0914f5e22d707a12a52c
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fkg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TNc/zEOVHFPLNiXicJFFRGNzj3
TLSH
T14B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9adb7a8273303066a8c48b65184d17d17d291ee62510523ca7f2ab82c2e97ddf
MD5 72c828c873480e925099013feeaa8af1
SHA1 cc79f82ed1052e9bf2137e1ba888ea05d93b9538
SHA512 d22e23315febf383391371fd5b1a96bb74bce01e961b0362c66cb27969d0b9616195da31876e2d6d095ddbd3c950f3aa3ba758dfcadc53df20b3768f926ad3e3
SSDEEP 24576:qzkNvNnaFeYhJNtmZBm0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qzMwBtOm0LNiXicJFFRGNzj3
TLSH
T17F55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 37a74793f63ad7c5f4d6822067120613f144b392e82d21cf55c0a3cb7586bc76
MD5 ccf7f1830b8c41ccb4e68f44f5ab59fd
SHA1 5e5d322b8ff075a107359ebd77531d106985c21a
SHA512 48d4121f1174b96b00cb4abd96486e4b84c08ad949fcd1cc89b7a3dec29fe57388016c6f716d370f636c833fbb41fd991e90047786262122f2baf735408f3f55
SSDEEP 24576:+D3FHshBIYQgAN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+DVHeBIAANLNiXicJFFRGNzj3
TLSH
T18775E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/820-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/820-111-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/820-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/820-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/820-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1888-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1888-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1888-77-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1888-297-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2464-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2464-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2464-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2464-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2464-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2764-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2764-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2764-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2764-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3192-281-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3192-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3192-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3192-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3216-1-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/3216-37-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/3216-40-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/3216-0-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/3216-7-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/3368-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3368-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3368-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3368-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3368-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4320-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4320-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4320-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4320-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4320-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4488-118-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4488-124-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4488-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4488-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4952-331-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4952-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4952-98-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4952-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4952-92-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4952-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5000-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5000-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5000-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5000-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5000-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5664-82-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/5664-312-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5664-87-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/5664-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download