874136070f4a5da60f79831bd33221d41fd43e9324a0929aa276818fc0848b00

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 8.2MB
Sample260802-k21xeszclf
SHA256 874136070f4a5da60f79831bd33221d41fd43e9324a0929aa276818fc0848b00
MD5 172076b75bf0b658c0973ccb86d51fbb
SHA1 9d5a7b796c8352a5e463e8c7e8e60a8fc3bd3e4b
SHA512 5fd62fce82cc6b1fa59af529e5a53ff0a6f5cd4784f778e4c81bc4962737285bebb66371b268663162c597b08e55e0d4aad9d4a392af680cf86563aa060690e1
SSDEEP 98304:LFv06gy0fBGbWIkcRMjJnGaJKttRby0tfZeT007kxc7wRGpj3:Lcy0fBEdkcRMjdGWKtthT9Z90764F9
TLSH
T1A386C057A7D800E8D8B6C17CCA978503EBB2B85157319BDF06A4567A0F73AE05E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2524	elevation_service.exe
2628	elevation_service.exe
4152	maintenanceservice.exe
796	OSE.EXE
468	PerceptionSimulationService.exe
4332	perfhost.exe
2224	ReFsDedupSvc.exe
4116	SensorDataService.exe
4176	ssh-agent.exe
3272	AgentService.exe
2124	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\df3b67be209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070667e495e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084deb1485e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d88d40895e22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000268095495e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bff18895e22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b99aa84d5e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4084	2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2524	elevation_service.exe
Token: SeBackupPrivilege	2224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2224	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3272	AgentService.exe
Token: SeBackupPrivilege	2224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2224	ReFsDedupSvc.exe
Token: 33	2124	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2124	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2124	SearchIndexer.exe
Token: SeDebugPrivilege	2524	elevation_service.exe
Token: SeDebugPrivilege	2628	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1944	2124	SearchIndexer.exe	101
PID 2124 wrote to memory of 576	2124	SearchIndexer.exe	102
PID 2124 wrote to memory of 4520	2124	SearchIndexer.exe	103
PID 2124 wrote to memory of 4008	2124	SearchIndexer.exe	104
PID 2124 wrote to memory of 3956	2124	SearchIndexer.exe	106
PID 2124 wrote to memory of 4684	2124	SearchIndexer.exe	107
PID 2124 wrote to memory of 2328	2124	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_172076b75bf0b658c0973ccb86d51fbb_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 916fda7f6f47811dcbe7d291d3244c03749f14bb8998d2c632cbe8d11b234dd8
MD5 bcb522dd7639c6a80955a38ea014a34b
SHA1 375d4dac7bf40c898622e25f4ab284916f05abec
SHA512 7d2db3c220b7d59a6e3fe122c6c0687ba88a879b0f6887defd9d716f6202637fa596244389365c7e42340801dd7a04f0d438f1495d6d1ded627ee99a712e2603
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPLNiXicJFFRGNzj3:63q6mjBE7wRGpj3
TLSH
T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 80c2e1f88d204eeed228d4af27bdbabbd3ac30ae773a5a28c113f298c1f71705
MD5 e5a76944964aab9fbe94a4c71da989ec
SHA1 bade2f841454cf2ddaf2cf966b434a3cfbdd9d5d
SHA512 990266a24c2424a145fc01433f20716d40a9d7332ed588cb1f98d4f982e764a12c510e4dc1ff2b25b7a3ef2e04432faa2aef8d56debc2b637a5e82ad12ca381c
SSDEEP 24576:iXYfDtczAg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ptcFLNiXicJFFRGNzj3
TLSH
T10075012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 bf71a08b32d9f47a7a5afbea19452108c6b9d07b0b377f5a714d19262cef667c
MD5 5fcd11bba53fd0a442c52fe0671b4fa2
SHA1 130bf5cd7b62c0c3f9a9d18c440c7e1ca2ee2ac7
SHA512 38bb3995d281b421d1508578868648667630b9078f8fa0c86176d20331b589fde77fdb20d462827750ffb310c9c4a3cf99a5a7cbf3b4c7d135a5d7450466e7f9
SSDEEP 24576:H0Le5ji0hmxhrMg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HPji0AzNLNiXicJFFRGNzj3
TLSH
T125859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d06cb33bddd32703b9dd0893ce0b8ccec078a992ec883027089634a45e1c1853
MD5 0b29c993aa02b42dc04d023f83babd4c
SHA1 87d4332d8bdaa5ec6252522654ea7dabf7b80065
SHA512 b4d4b7f8474efba46e06071669515b5c55e74f9e6768adfecc1e693136031f63e1fe03506e2f1a39495f5435b3d4083a0020561311bbfb7fd771957583b65f06
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyui/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G/ezSC6vUzPv+HjyRLNiXicJFFRGNzj3
TLSH
T1BE756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b58e1930520e1e84d66fb38f3c11564acd792dc9b7182bf87ee8fc959e39b1d9
MD5 4dfae8e005adabd0ea8e81dfac01fdda
SHA1 91d41b541af1892b819670675c3f4f7126483d63
SHA512 d221d6928fa03fb58bf29daa1efead5d41a7c9282dfc52a4382eaed1e9e00abc80c0926a46dfecd7acbc72437d57a6a9b047dafa4208279355c5dfbfca59ddf2
SSDEEP 24576:aVbqPb88hv/l+BD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aVO88hXl+tLNiXicJFFRGNzj3
TLSH
T1B2559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 260d592403c80927816049314da1bba1efccbfae63480fcfe4be8f93412235b7
MD5 15d470ea456758e02bdb8d6535800843
SHA1 25c82974de9a2395d53b861a574bc64bd198fee9
SHA512 34e13f57361345e21544dd02aa90f2f78b4e75dee24e4ad4efffebfe5c1d360ac187838a3aaf2fe1527cfd15edae0c9f8f281a6d5cf2d2602225c4b466ae4b9c
SSDEEP 24576:EG8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULNiXicJFFRGNzj3
TLSH
T1F55523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 90196fe256fc81093c8c8a0387c6a377cef2c5527e0020748ff0199226b282f6
MD5 d60b606a10394d60ed56224b22ba7310
SHA1 fb1f0a597aeb3f4abe4868b600881821e9f787c8
SHA512 638eb9c6919a22a17a281e2c4d7d0ed607f5b54b4c01c6ba59867d9c42aba8e30c6a4dcdca698873b11da17d8a747c3aa46ac52184f17bb0cf665d8a16cf5dfc
SSDEEP 24576:fJIUr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fJIUrLNiXicJFFRGNzj3
TLSH
T11475CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b7f741fc31cdcd2bbc414187030f541cb3314189bea9944823b81dc32d9d9b9b
MD5 c39c8eecf7eccfb5c984050c264a14db
SHA1 a39bc201e52f4c60e09a8f5dec1087d41ef5cb3e
SHA512 6e73d9a8ede453c6663bc82ed487b8bcea187b0697cc2c59614d5a79b93ed60ccbec64f477e95e2a89d35648b8ba503f3ebebcf14c329a007652dd1c5c042dad
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THf:sQvGAdlCEL8c/WRNw5Cy7wRGpj3
TLSH
T135266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3d88375a82f6702d4c1009ba332fc121373ac32bcee427c6f89fe25f4d9ec914
MD5 1d6440c2c03500e46acb9c9907154a92
SHA1 adae34753c876327fa7c6c58a05c55de8c94b0f9
SHA512 61fa212b3426f03d09d8f27f06cf45b6873fe482bf4cdda2a2cce9d8b3eac8ec00f91a670a8e23dfdd018c80f998fac97179fc2d9d997a80c6e647c043ed208a
SSDEEP 24576:dfewsAjd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hljdLNiXicJFFRGNzj3
TLSH
T12675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7a4efbdb39ce7b9d859d028c83a4bb9a1747d96167a60004b832492b413f2a27
MD5 be30509bd344a23994f1eea6e4bd504c
SHA1 78c790657580e27d6c3fa10967b2381b7b81303c
SHA512 9b42cce530063697e42d29bdf9c27ed60cca4fb0c74fcaaa976d9493bce19f362fac388f061d6cb022cd6371f7d72da6184a4adb0f5347a2798a41b194817683
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpF9:MUEtQevvqc2W1cpV20I32v9
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 918d43581e892a280d5fd893c62457618fbfee177b5ae28e9b6186afcfeb5363
MD5 0dcfb6979ad9469d21f7f8c1dc75608a
SHA1 6e2d3963d8a0d0a4280224302ae2880695a2ea7e
SHA512 84ba9fe6c4b7ccbb465efae63e164d6301377b0c3a77a8b5055840fc3e3362d2ffc9d4bf9292a4f33dd3bbc10dee603cb8c9caca56878a31d0bded9edd32a89f
SSDEEP 49152:hCbRquA/m2yL5zLfFiV+XenmE3/z9LNiXicJFFRGNzj3:Ooq2VjnmW7wRGpj3
TLSH
T1EBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3f2b2235266f80e96cb3928a3cfa8c77a9959e37bddddfe195cc7ed3307ae798
MD5 377b8ce7ef77921eef4741367931a12f
SHA1 f17a16e4aff69f6918106652ccae4c8ef3b043d0
SHA512 cbdcc5396fd4b0fe607f20a9951340b5570934f059d2393383d704e96730406f56d22995b0594c7b3fc08fa6b84469ee9aba92b66930a8e5ee351c84252d94e4
SSDEEP 24576:UAhGL6IFoiwtA5l7S532/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UAM5Foiq5mLNiXicJFFRGNzj3
TLSH
T150359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d93d8d85fd5e64a940082b6ebefa5afab32aed8c401c472dbf10cdd6fb35b559
MD5 ac66e39aab4ec114c9c900213c00a306
SHA1 d86bbfbedb8ca4c832189a1ec70c746588065f58
SHA512 edb301438e5823687e874e7b0a7add505cf92946e3f14e31980c887e6af8fada6fc8793612e6094fc7ab4c30dbcaf6601362e1f2a19fd54391a0339274b317ec
SSDEEP 24576:hwuROWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hwSOqLNiXicJFFRGNzj3
TLSH
T19265F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c6c00b1972b46878810366b17f93a35c5de4f3748e5e0b331421f0f5c1c47f9a
MD5 4dd09f4b9cffc67b930c7058a4dedef4
SHA1 473155199a58072b2be90510b32ae4d87e6c3ce5
SHA512 01559f65accc681c17323310c9f1ebf151a9d604fe9dcf1ec4c12d93cc6868273277a41505abe12c02bf93faaabdd1ff4f55a1af8157444dd364ef69bdfc859c
SSDEEP 24576:vZuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VLNiXicJFFRGNzj3
TLSH
T19655129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 98345c4d64db5fdc10c10f2f8de01f6d089547a811dc3bad72a311f141760148
MD5 a732b1248e531467a2c006e11947a86f
SHA1 50448fbdf744f0bd10e0b303a16395453ed3999b
SHA512 bb6306438b583ccb3c2b5d77d09f5c27bd18b64073bdaf0e6bd5f1bc2ef470d304541e1f335cc7d5dcdc971bf515a383a51d73c12b8db92fc3720cbf4320978f
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:kQyiKanX+PNjF9
TLSH
T1F8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eacdc0f181e3856586e32a27702beac9beafeaff8692876ee7e375a5b12305d2
MD5 0e80e7ee642838069a87ff3b87a69aa3
SHA1 f1c3a8f83c58bdcfa65f7214a05762cd1f1ef675
SHA512 f39bd18f7cc471bbb804b6fbe6a69edac95f4af5c2e1e816751e8f1675afe95c52b0f4a36beabe255d0b07be98a774a24bc8680a475a1d79f399d03f0f56b402
SSDEEP 98304:dQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:UQyiKanX+PNjF9
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 30ca9540688162c6974e2e968c55c3b08fc2074d6615faab2fcd138166721cc5
MD5 dfe902b7efe85d3d10b2ea595f29edf9
SHA1 f3013d51506f28accde02bfa843f6213f511455a
SHA512 e6263256d227f41bffa4445bd5665af4bc4680450e51a179fa8fa9bbe98a1a5418184f708adc0cfdfa7a60e74f60a0923ac2d5439131ce1c80f766026b079ca9
SSDEEP 49152:d68Qg55nhkeWu7PNU3/NLNiXicJFFRGNzj3:bthTRc/N7wRGpj3
TLSH
T1AEB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6a451d81cfdbb2060abae73dbd27de8034cf5e1efb65da9c353f1d162516375
MD5 0e4c9fbe40cacbc5ca3ef6c5304ceaa3
SHA1 ea05d6ad257bffa36f7574ff686844e3905db21b
SHA512 dfeffce33cff5f595a622cb4ecffd98d838ee9367829f3900b3a9c7eea5c1699e69a28386edda1557e76cc6563b0ca01a57fa3bd1fc48b3951d2561540a50997
SSDEEP 98304:ky5112gYy5azzVvU69nLKnhZ87wRGpj3:lLIHRWhiF9
TLSH
T14A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 582970228487a89d833d2ca84ebdfc2471327d0b098b25f3995b9ba6d259e5f0
MD5 8780de887607b32cccacb6a6d5a2b01e
SHA1 31d99d82c284c3d13564bf469054114bdce6689a
SHA512 ab073e2332d14ed3ba5b5496cd243254db673d07e1fb7a3a6790dfe131a7eb73747927588d1c8ef091d4e96854a0b1132ad16cd00619eb112ebe4ed194c3153b
SSDEEP 49152:oB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glwLNiXicJFFRGNzj3:iu6JmIxd2dw7wRGpj3
TLSH
T103D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8d2f51e0014e0864d7a5142cb764f6820f924f810ef0c1fbcf12cfd9b0ac3459
MD5 d0f00ba2fcdbfc8ac7162da949e9996a
SHA1 57ead3233a4ea15313c1063ca9e1ec2919524bd2
SHA512 edfc0f5a5c47dd436e8a7181329b657c57d264c61f3124d1414b2dcfaa60931f5f0d1e1483afdd19a541ce6aa584c43d5952fd0cb21197d6713fad86607e2338
SSDEEP 49152:A1hpsNoJpF1A67U44CwH7R4xLLNiXicJFFRGNzj3:AmifPqRW7wRGpj3
TLSH
T188B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 15f04de39c541e23371f68b513bb325193255e419466fde1d9503d91f52e6be7
MD5 b3d08135af69f7e3d038b6d13cf80f12
SHA1 411c2d0ae842986c1359d11ad6306e4c585376ee
SHA512 56a376cc74aa4792bc4c26677fabf8c5280b432315fa0829b226d3a224b3398bb61c4404ad2e1b43c0297a272c2c8db0aa5fb11a88785171696f27575bc59a81
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqoLNiXicJFFRGNzj3:P5dKqi61o7wRGpj3
TLSH
T17DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9df4be198891d144ab6d0af946d6eed71ed9ea413d279ccdbfe88a4ba512f513
MD5 df56d4c06f45471a13d883d7ba9147f0
SHA1 1a1f004265b0ef01155d40e9464987d6496282b2
SHA512 ab9b30a7a38b423c812b8371a006747ba063c005ea9ac295a79cf401669a7b7c772cbc4a7fc19137ff27047557fa0c36f38b0c6a59916220c16145e07ea1722a
SSDEEP 49152:lhtSn8EApI0figjgiDn0AP5wnLNiXicJFFRGNzj3:UX2iWphK7wRGpj3
TLSH
T1F495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5d745268cdb253ae738dcfdd787636974b6ee53e23dee4ef8de3172342ea9861
MD5 7b7f374416d13b803c205a8c102cd677
SHA1 1be270718129ea98c2fd71461c40b20b1889799c
SHA512 25668e538a0cd32a8644d535bd34b2e84aa824c204bf732396bfab9daefdeb1025bc864187735a0ca0dc0e72b1db222bbec6bba3a5a2ac7ab25b54bb0dfb154e
SSDEEP 12288:DCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D354C955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4793de713d03e8f9cacb39da0aefc728586a9c4e63bd073273bb2b6d3bdee54b
MD5 0352d49a37dfb8c9a452e8a550d72c4e
SHA1 4b4b7349a5b35ff37ada51a8770e2a58deec8da6
SHA512 a1a6b3c87fbd61b769536fa2fb33141cffb7bfceb09b364800386f9a981e1748eeec0af2eab2187f5be81d7a96b65edad8cc21992fee05745f0782fc93cbcbe7
SSDEEP 12288:kFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3548955B1EABC003AC6754428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2a05a860fc37aee23f2607c09bdb6a72b0cc2063db7ac74306df11e804757ae1
MD5 ce55dca1f205c5d8ba9a3421323fdce6
SHA1 3dc3351a96a109b65e83cc8c08f4600f0f0e0f4d
SHA512 4dff50dbf3467daa3a302f4f4f4ec62dd369bb0f12dbfbba91f951369564d8889c162aac90eacc5d17eac875c7e0afa6a0849c50e1e45ea9caaa12d26d996742
SSDEEP 12288:xHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1F6FC003AC6754428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a720a152ac67cd286e42553f4148a27872b336356d0ca962ae7982443f3ba8bf
MD5 c1edc4baa087c11a6574e71681c0775f
SHA1 4df077369a54382ce3ea02e3ded14d6401525101
SHA512 ce1eeaf6bf6056a85d9e39a9fba20fc7f1100204b9dca98f5c2073404c03f1f0354dddbb2af15c8668a70f392c921859504deb4f04af722bac56d19ca7b623a9
SSDEEP 12288:qVsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34zi:5/TwSfVcYG3K/cJHlnFR+IGNe8j3Izi
TLSH
T19E552392168901E1E9FD803DCA764424F2A47D6DDB325AEBD3003D0E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 44b05835af1d66a454da5dc5d1c5fbdfbabba23f865d9c870147ea913b7566c2
MD5 0ad6670e52658262661d4bfea1a49fe3
SHA1 8b18edb882d901bf004b2b62e8b33181ab68345d
SHA512 a64a079b9200cef8d36806a54be283b3137dc9a77ab22b0f9a08a8e332e8597747ad9ee0970c65adba4a5fdd17140e422bc09265e3f949798815d2c3a31ae276
SSDEEP 12288:YkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1155523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 03b7c43183ac66aec1bb565c15397628cc07ef3382e7c65c68e16e5d15cb7771
MD5 899afef501ae6137d1f268a5765128b5
SHA1 874874a1e8bcc922b21c0dcc2601112b414348e1
SHA512 bbb0ed83aebb0fd617ac866c4414e060ad4656f02e2dfadd0c7f02b3d4863666c479b5d6c81ebfc70d82fd8257db5e480640823bf2ed12ad2a5b73c2a90620be
SSDEEP 12288:t5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1565523D3548955B2FABC0039C6754428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 48bd3f1af4216ce682448e5a7ff5c88629b3046ffede90d160dfb0e29d7b959b
MD5 10069590227a743defc9d0e8f82e6730
SHA1 b95a4c26c260d1e06d94ca46c55576912a7f7b68
SHA512 be18081315f865d30fca1ab37763debac375b34edd81cd7d58aca4c86c73b03c6256eea5429bb1aeba2b7e122a5e3ba02d8af796447c0cb7588943328e0fc2fd
SSDEEP 12288:n9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3548955B2FABC0039C6754428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3c0303b999fc0fc022a7e6f612911b1d8f6fceeb3374b2dfa576c640af1dc899
MD5 c22cda76cff88fedf282d47af0dfb36a
SHA1 8ac21b61f73283eedacb2f0c8ddaaca4ac65aa29
SHA512 ff440a4a6d44161f48a0675aa95b8f72e76d5240b61c21cb257df70ac82c28f8fb18eba46bb2b368df419aeeffe87ea890602ae37cf554204588024d6ed2253d
SSDEEP 24576:UZM3zFVSOp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UZM3zf1LNiXicJFFRGNzj3
TLSH
T1B3750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d1d2aca47a656a74ad2fa35984fa421e11794eb58454dedf2b6b623fdb7c4fe8
MD5 c6639b54c93a0dd63feccfaa74b5b77d
SHA1 514916d830c24e51ae652e1795476a66001189e8
SHA512 fe4090af3384d74929d2742d2b727c977308d765cfb7251dbfe82602a9ddb163d31a0bc4247e91f04baf0c9821ae89d8d71f02587627627d359816a49ec37995
SSDEEP 12288:ROiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1FAFC003E86754428F5881E2DEB5658E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 90994f28a9e2a61aea84ed770fe70c2f6d9323b1127684af4d13d34faff27878
MD5 db27d795419aabac7b7b1f0523633c1f
SHA1 242098fa6539bae14eeffed6ea6feb0b3488f0c5
SHA512 9de2f40d7ef66ffcdb9411b73bd68352eb6ff1a553ee2cc79b71c7c0454cadc258f590a1cc3c6954a11ef45656d7e2689b1d04edafcc37c6fd7d6feb5d9c5c3b
SSDEEP 12288:RKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3548955B1FABC003A86754428F5881E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5c47cabb29b0b9c9325426dd8cbfec146ffb999e8a1ecb0609e7473d216dca41
MD5 8fffd2067c362f028f84fea02c85e0d3
SHA1 7c57e0283dfb47003960fb72f5ed8a019670f2ea
SHA512 b60c83c4c5c3b7d6cfc89f0da20e9661cb8330a88f76d8ad2c0da84705b9ba730a7f70453ea5619549fef273354dd7ce14771f0e4a115a0dbaaadb5142bfec41
SSDEEP 24576:Gzyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GKLNiXicJFFRGNzj3
TLSH
T1EC650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6cecb8a613986418e1849c8d78625a42ce0627797aebce29b906a5a865613996
MD5 4f401eb5b460574c8c97bb4afe9ae2ec
SHA1 a166d13fcf191bd670382eb699819f5d370c21b8
SHA512 81d9f8f619baac17118b999235ad0355bfe7688728c048c8a3f70f0a54620ac365034f6de01499811a174599869c1508abc19d810b4527aadf73ebe76ff0166d
SSDEEP 12288:zOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1FAFC003AC6754428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 924d7d1cac33a48db556eb948968eb716ba23328f849abbef57481a88acf2439
MD5 1d9a35e387b6acb249399f6b83662fa3
SHA1 c1233af32195a980da4ca3a35373e2878f6c17b1
SHA512 0b22514587e40caa9f6aabb680ec9c662be741f806d04061a4f7dabe9ff9f9173954f34f9891b8f59619aac71e0b6c708a6cbcffbfa2543f59f41ca02d21707c
SSDEEP 12288:+OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D3548955B1FAFC003A86754428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fe6adf7fefea54d3957dc5f0245f5d3c5aeb6fec5a4708680e498e7ee6023f31
MD5 160374f013f2a699a3a540f9c4af0740
SHA1 1640ffe9a82e53144c9a64e6f8cbbec07345fb5f
SHA512 2065c53432b3cdb09b441da4f0d46cd7b79dd1348a64e89b7476efad3cb24039c994bcdaba6bedbdc985a236711488160e08e550171dc5aab8a176060ac10636
SSDEEP 24576:Izyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IKLNiXicJFFRGNzj3
TLSH
T1F1650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 67b553537474b7076708536b678435a67c772cc381704f75a392e63d8630e065
MD5 6e30c359706c56991a3abfa998402354
SHA1 49a6107e046ec6cc6013ec783393c05bef4584fe
SHA512 39fac7f9a3cdf9a43143c60a424332972da44ae03d34d73a613d1f7d71e9be793aae826a4fbdf9704b1d5b5345722a2fa5642ad39b166853cbe19fb0ed34fc95
SSDEEP 24576:HT8aLl3z0zDj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HT7LljiLNiXicJFFRGNzj3
TLSH
T1B17502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6fc1134a4ac5de977cf029b60945599e7745f846f793d1ba196c706600c6a1cb
MD5 8b6bbf336ad9718f4a9dedd190601d01
SHA1 581dd79f3e8f12eb5edfbad6ca2d4ab816fbcbc8
SHA512 be7b1ae53001c242d86484b0742cb308396a792aacc83b2b171b726254a6b701d01157db22125e2c6780851edfce3b9c823d06b21aff721dea9e44f27d1fe2a8
SSDEEP 24576:r3rd9CHKy7GZv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lrd9CHKya1LNiXicJFFRGNzj3
TLSH
T16085CF90F3E414E4F1B78A3589764511DAB67C5A5B31DE8F03A8261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6241acce264d8f4f783c6c4cdd920a7b0418fbcb4cabc979b0a0be9c04889fd0
MD5 698c87da2ef1a8dc22f6248a857b341f
SHA1 f39f758dcc276809e5b1ad4ebbca3257ccc1ca77
SHA512 cb74a0db613023a7d54c4990e0f4a18a470a370ff7f328a57cd6558b7970290def20aeb3fd244d1a2075b5f6eb83476a3c41d2c632d34c59fd95514cd8d3f81e
SSDEEP 12288:WniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7eb68207c8ecbcedbfff2ded8cd83a85c3fe1b1872ce4caa2669c687ba4b92f9
MD5 c4a90ce3c14757611ad5bf7f7b38f65b
SHA1 2b6955cf54c746c533cd97411edadcff0481d95e
SHA512 de517c6f91df2101db6db5452378ef881246e95f95504870b873c1540a1b54c42155ce0c28e3fe301900983023fdcdac78de60ce37e223ad46a7f44178edda83
SSDEEP 12288:qhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D2548955B1F6BC003A86794428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 43128df3916c5d071c5f91182f967d055a0bec9ef0566e2291accf67fdc2c372
MD5 19a98f3bd7a5783ad04eb39e48f5ab06
SHA1 4d1732cbf1dc6690a88c581f7b03446ccbcd0295
SHA512 42a08991069d74d131a65e4e6ee1b824eb7ad0c66aa3bf6ff2fcb5bd6901827989804aa161419646837a20ec05704962261bca086104c1795457da7984f08378
SSDEEP 12288:UoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1EAFC003DC6754428F5882E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 34c0978d8255cc325ecd78f9e93cd7aee2f3d3afccbb07604cad9d90cfbb90ac
MD5 db46fd349a3ceaceaf095178b365ab24
SHA1 46e2d0cda1d3f20a3984c1cf6c0b2631aa93a77a
SHA512 6fde6112a522ec134fba351df75506c2c6469f10a26e67e4b5ac9e0ea6e460558299639d35340220de9cdcf95ac60bbe5920e151ec9f98498d2a89865639a138
SSDEEP 12288:HOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523D3548955B1EAFC003AC6754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6cb74925aa7d30c3a676b7c40350c22f32562f56add9b325a3329aba60ca12e2
MD5 b25faf358bc502985f2f651d326bff5c
SHA1 11ae92b76df2cc8cae187fa472ff23d3e2802179
SHA512 73c5919530a2cd6b4b3407a56b1205425d129ecc1a707ec9e9ce43295f61bf49d9a73d6e7e2d9d7312441cdd4b63d244e844975a6cc06162e22b4f209a1f2e10
SSDEEP 12288:tniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3548955B1E6FC003AC6754428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0adc83600e5131e229b2abbe2283c6cc6bf976ada8bb18555875f0b69d0132f6
MD5 04143a19dca1986b66d5b322bc36b07c
SHA1 e0440016be6ee16b50d0ddd7335c9608ef91ef39
SHA512 a821613529da56339ac7eb4dc6292438712ae41681ea9365c1ba054b19aebe3593cf1c440bb7255529ac228eb97c40b443a9a4e74a0add26ee95e05819f3d338
SSDEEP 12288:DmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0c16c8c95e57a24a8deb3bb46ca0bb72816061585ecc953f1141933a78e06a4a
MD5 34dfeb03fd1321e1ee470d4585399148
SHA1 7a31a97f56cb313482586fec7635896c508bd531
SHA512 177727f3047097a85c36f740f7f0ee85a2aa0bc192a07c2305fdaeb56c4381e1b9f3e9bf749d23a561ce4d2f11f41796b2bab9e5f2d5a13d8b05c7af02261961
SSDEEP 12288:NkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c7e783832e3504265e16a73d2ba59e811d76de3a674d34b76abf3aadea62622d
MD5 218a7c7d03ca41227c7c4c2cc052b684
SHA1 25d8eec330cd25b2a8150cd5be5e8d753b93ebb3
SHA512 36206a479986e29d1ae35f7434cb75b6fec7b2cf674f9b90ac916812d4193d8ea0cff781822e744005cf09742ff06cf561b7e8d8ca1727fd8ba7913f63476adc
SSDEEP 24576:gfwvzk9RX6wkyAIc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zMnYIcLNiXicJFFRGNzj3
TLSH
T1D585DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6861ccbbd39ed47f45568f95a31fbba9cbdcdb729250a82a01c9c8289b70e412
MD5 ccf7715d93dfbabedba3a7d48295b7bb
SHA1 77b2ed2eafd70a9803d06a3aa78371c26b073ccd
SHA512 fcec7342ce6a82cf329599fd93d5b0ceecafc6c74e42f0681b67463a98ee674d0b0463f889277731104a5aa3847aeb0936f9696f07198b8345933d05fbc746cb
SSDEEP 49152:gYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HLNiXicJFFRGN:/ySzPv7wRGpj3
TLSH
T1E9066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 57a784c5117429571afdcc38e2d1dc3a271354047ed7ba57346041640c1ecb30
MD5 60ca0963973356f7f2214ab6558d9e81
SHA1 811fdb027bb5f5c96b82f0ffaeb0a5ee9a953b7e
SHA512 f5fcd65edc91a6646ab1700906a74d0114970f1faa4bff6a56c5969d7178dc6e86a6a743616d2a3cf691228e4586ebe5291d9ab71dbf8b40ac05e2b05861be88
SSDEEP 24576:Y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y47JUQjqirIhCnDHUPfF/XLNiXicJFFS
TLSH
T1D565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 589e7defbaa5b470b200d551489e39e0452935cf2c5b3da095119bf2214864ea
MD5 139f38bda260a2b6def1f47bb1ea1686
SHA1 ad5069e5b843d8b16b80d8c68f28baf44f4b820d
SHA512 a345c120181ebc68a34fae4f947d18f14a2a539024e28678ba4aa67a7d00a87b6d29c329453fb475b58c7fb3af3abf88c7affb94de4effa52aaa6358cf463d24
SSDEEP 12288:UpsfeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 aa1aee24521f0c8b4b5680565c1ff79500bba48e0b45dd8ebd853fc421362965
MD5 8f40bff8f314a11218b70aa7bc621bdb
SHA1 1c3b20e16e128d429bec2e3a55cbd1a236938205
SHA512 f898e1b1e3db250c3318c2ff82d6ff2bcaad1feb38480934d74e17281c832c5550644395bf24f4e4c252fcb1b6be3561d11da58b30edee24ee9c498a6f589d29
SSDEEP 12288:uikDU3fsLjJW0J3PlhyvoyH7JzTTPYDFRvhAw:uiOUPCjJWylhyLbJf0DFI
TLSH
T16B352951726BC75FC6AD44325E32D5CCAB703C41EE44AE0373C9873F9576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 67de51558a970fc4850153059ec5ed7d298bfe111aafd43184e8bea9049f7d5c
MD5 33846d630056ff98acd393a09332c3ff
SHA1 74264d86d26fdf1005d0a5a47de9b5e945c375bd
SHA512 7acd1273c8c14dd35aed82274b7d55032364c8389f89649e0e9c9f656d64ff588b94a3e46ac07e6a9d81a7abaee481a84425478af926a25fa25295c876f2705e
SSDEEP 12288:+MwCUxRsOZfI+EDlQBkD+wSt8hqZWsbP+ycr6GskRnmZO:+tCUv/ZfIWXGFRn5
TLSH
T12B65E9816137938FD1FB603207295B4CA764EC06B7496F27B3C8453AD86AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 91974e70078439f9b80b06e1549e01a18a607fc4791f1a678f8e9afc95c4708b
MD5 d097f138a2ed858d4ea255a46edd98bb
SHA1 fa8153ddcc34c4a331c0dc5338c9db71ba407962
SHA512 15cc3cc3108ef4a51ed7e39c9894c290d05a7d71c61c1aa3f93bbe781c909c757143866669b4aa0a90b72edaf5414ad5889c7e3e81e5de009be1ad5c06a79a7c
SSDEEP 12288:GF72iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T162552393568C59B1FAFD0039867A8434B5497E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1ec7370a4d1bbd6447e8a9567c10158f1e93aeb3edc38a7585e529c2e2ab3b4f
MD5 0e775d50f282a5483b64cfb1b951a0ea
SHA1 5c74115d53bd15b005c3808873b868e1665800dc
SHA512 81f2996e410a33b740d7b1b6abbedd72802e2baef51da454c3be2763169992bcd76e4bbe8f7547ab47849dc3961add6ad6b47d9ac68bca833f1ae415203fc7ed
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:agb4mBIBhGF5LNiXicJFFRGNzj3
TLSH
T1EF65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1313c599c35f90fa32edb96ed256852fea8932fdfb28227bb0489e3407cb2d5c
MD5 4116e92e8670d3f987c605140fa569d2
SHA1 6a0823a7cb1bb48159731a0126a70eadfc6dea60
SHA512 dff83b06d99ebd3ff119cb0830b0977c60ff16ebe0471a45e09d26e2310b256922fd2a1a08714bdcdf66b239697f7b0b72b6a4539124de4fcdccf554a77282d5
SSDEEP 24576:/G88u8FpJqH1vzria7/mp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O7ZFPqVya7/6LNiXicJFFRGNzj3
TLSH
T14485F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8564a1c52845c8ae07f91f08d26640af2781207942840f7390207d89df9e5a24
MD5 65c9aaac803e20f2a2d8cd407e8a4fdf
SHA1 e1e1f8f7762eada6923df089b971c3358617a605
SHA512 992f2b90cc29dc8a6f1acd000ed1977a6d766dbd4035951814bbef286ece8e2b13f629c7e4fa330d7eabf79b203758af6aaede0bdaf288835fa57e4410c24d3f
SSDEEP 24576:uPUr+NQ1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uJQ1LNiXicJFFRGNzj3
TLSH
T18065F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4d49b64bd5cb17da8926f23e47d22ff77e0a14f6be418a15235c10df060de829
MD5 0c640b352f3e300cebe4e1689b2206b0
SHA1 e2137fbb529b3b1b8cac5e834ab4955dda367276
SHA512 4ff4a6bb2847381091639b945b575a017a37d18eb3693aabaa6652c62c85af248c769f777aa600e947e40a6ee9ffc4c598741339c67ac84c35862ef93f526ab2
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlLNiXicJFFRGNzj3:7G05lO43bU7wRGpj3
TLSH
T14ED5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 be7a1b395a62b353b5b274a2cd55e87db5757be2dd1a4377fbd4647efda765fa
MD5 e3107e7e84805a352c4f10bcfc885dbe
SHA1 34f79fce3b894906a07fd779a6ee7f690f7d0eb7
SHA512 83bc984ff9b89b0f703f2a5b47a322704de3fcbe4199cefaa652f9ec17b203f3d516194a7235cd7352bcc13f33a46accbdd7eb73f672944835ffe298481b7771
SSDEEP 24576:9fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnH/TwSfVcYG3K/cJHlnFR+IGNe8jg:Na5POZ3lJt2pasx2+mNLNiXicJFFRGNf
TLSH
T1F365BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fd96fc027268a1ed10102c85e96bbab4d58bf562e6d10244c36a0b0dd212162b
MD5 b8c748eec9c79596aa8ceb4f0569ed4e
SHA1 4bec115ce824244ab821296fa998b218b73ee451
SHA512 b5fbc950f432891a0841e18ef70fb04143acdd30cba17a7de6fedbdd8b10c826bc3a966c8a34547a5e364e2b02a9d3c2902e23e80dc6d9f217b8a23790905b4a
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ENc/zEOVHFaLNiXicJFFRGNzj3
TLSH
T127858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 de37a1668bb45519b04a34cffa85acf5cb6232a1dd38f4768a2f0d48a6741e3d
MD5 935c9b7a1c8ec62565fbd19fbc9b89b6
SHA1 a2e9bfb75ea01d579850ab5e635fcfda6bbe803e
SHA512 8695af92c18e2d180c924687279ca2a8f4eb6d6bf013ec5da40715ba35f696abc0825eb30c49aabe04d1041c016303466afa81a14da5e850f9091f8c68c172b8
SSDEEP 24576:AzkNvNnaFeYhJNtmZBmc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AzMwBtOmcLNiXicJFFRGNzj3
TLSH
T1C355AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cd0fe6a2b66d7d1b9463dc066d96c86d1cbf797da70d0cff87ae71f8b146fe86
MD5 c532888824314808c615ea4378d96ed8
SHA1 211b9d26a2016b8ba048cf52f67f3359d73cd282
SHA512 c531cfd78a0843d7f5f9be8d15799922af3d07af791567a90909f0707fed6e655a95329d77277308af49a414bbfa13f6f3ecc739c285e1b9200ec0c43f1d6a68
SSDEEP 24576:SD3FHshBIYQgAk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SDVHeBIAAkLNiXicJFFRGNzj3
TLSH
T1BD75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/468-71-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/468-311-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/468-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/796-297-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/796-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/796-55-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/796-62-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2124-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2124-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2124-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2124-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2224-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2224-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2224-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2224-334-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2224-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2224-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2524-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2524-14-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2524-23-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2524-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2628-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2628-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2628-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2628-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3272-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3272-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3272-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3272-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3272-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4008-331-0x0000019D87840000-0x0000019D87A88000-memory.dmp

Download

memory/4008-332-0x0000019D87A90000-0x0000019D87C5A000-memory.dmp

Download

memory/4084-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4084-61-0x0000000140000000-0x0000000140840000-memory.dmp

Download

memory/4084-0-0x0000000140000000-0x0000000140840000-memory.dmp

Download

memory/4084-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4084-8-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4084-47-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4116-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4116-316-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4116-105-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4116-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4116-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4116-111-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4152-118-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4152-50-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4152-41-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4152-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4152-66-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4176-119-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4176-125-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4176-117-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4176-319-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4332-87-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4332-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4332-82-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4332-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download