2ecb9ec26e7c0e44ee118f7ee46619d5ab8d9f005c9b1d0f21fe4a05269284fd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 4.4MB
Sample260804-q7cdxayvb1
SHA256 2ecb9ec26e7c0e44ee118f7ee46619d5ab8d9f005c9b1d0f21fe4a05269284fd
MD5 dea582e0a698bb5e7d7392320c5c27d2
SHA1 b0072c93e1b2787017140e7283651d7e53e20a21
SHA512 4a8d02ea531f57e7a43361e64975171c13b99d82784473686878605dafe9864a76cb8af4365289a91cf715d01be1949a31ba1de0c67cc0d3adcc98b4cf742918
SSDEEP 49152:LnsRKknJLiYjS7f2SnOmP3R4bn6B/c5KgGRecZb5+Pl6bJTIZ5jdgp:T6xiYG/chKgsPslgJTIZ5Bgp
TLSH
T137262B12F7660DE2C9938070CD776B22CB96BC780BF007B76B724ACE657A6D0352A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2544	elevation_service.exe
5868	elevation_service.exe
2004	maintenanceservice.exe
3712	OSE.EXE
3324	PerceptionSimulationService.exe
5248	perfhost.exe
5772	ReFsDedupSvc.exe
1444	SensorDataService.exe
1216	ssh-agent.exe
3432	AgentService.exe
2528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3844b865238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a54aef81824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d2e75b41824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e42b3eb51824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f6168b51824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2256	2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2544	elevation_service.exe
Token: SeBackupPrivilege	5772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5772	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3432	AgentService.exe
Token: 33	2528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2528	SearchIndexer.exe
Token: SeDebugPrivilege	2544	elevation_service.exe
Token: SeDebugPrivilege	5868	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 5324	2528	SearchIndexer.exe	101
PID 2528 wrote to memory of 1580	2528	SearchIndexer.exe	102
PID 2528 wrote to memory of 5788	2528	SearchIndexer.exe	103
PID 2528 wrote to memory of 3676	2528	SearchIndexer.exe	104
PID 2528 wrote to memory of 4944	2528	SearchIndexer.exe	106
PID 2528 wrote to memory of 3424	2528	SearchIndexer.exe	107
PID 2528 wrote to memory of 3528	2528	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_dea582e0a698bb5e7d7392320c5c27d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2816 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2712 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2712 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2816 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 08509be35eff19f3a5aedafac7f4489bd73b26d89780de9da3100a2c6f5bf2bc
MD5 f09961c87b99d71b8a0c303505610d92
SHA1 a6bdbdab85b01c7a336312e65e5b9eb90fea6912
SHA512 c7acdb5ac6cdb1441f61d5489b6ed57f73236b232424d6c2071073780160cbc4b212dd0d072c4abd9f92616e642dd3112d08fde4deb3b88fa06ab58a4c43fb33
SSDEEP 49152:Lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnob5+Pl6bJTIZ5jdgp:Z3q6mjBnslgJTIZ5Bgp
TLSH
T158D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 facb7cdd33d50d47e3e882946724a42996dcd5f2d0c8d9bdc493580ed97eba49
MD5 56c5b7a66a3cf3ef3b1a2657504ebb6b
SHA1 4d6b157eeac1f24156b4106c2fd0fe639c8bb188
SHA512 89846f4d25af732c931a0f5bc2210ceabe5ef8e92dbed0c7542b554b811e18e66ed62638c30e523325d88bd3a4b0de6aa757ae199e6acc6557a8e3dda2d85019
SSDEEP 24576:/XYfDtczAgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ktcyb5+Pl6bJTIZ5jdgp
TLSH
T12985F11967E508F9EC67823DC8E1C601EA73B85587A0E79B03B499265F333D86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 d949d808179a6c086ba050766716cfdd648ee5238a44791e6bb691e4a9523d38
MD5 939a12cdfd42d63127db27b8e89a0db9
SHA1 60ebe0f469da16920ef99e5302764ba705d77a55
SHA512 8dbff2531864440936f4ab10c48b6d7eb704c0a2cdc594b8b0b7370d1a3b5be8f380745c6ec29e0b1ebd4ec3d321bfd07c0be74f56d06f6fbf800c77c73ac20f
SSDEEP 24576:I0Le5ji0hmxyrMhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:IPji0AI9b5+Pl6bJTIZ5jdgp
TLSH
T1E195AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 77714d6ae443db3d78c6cf78a3eab1c2dac69c75aa41e69b390a6d617fba9d62
MD5 8f0b973792b52b56a429b5fd598bf057
SHA1 b3c85e53cc1bc2e386917df54d05ff4d70be3fca
SHA512 fd451691ad8bc375fe759e656495a20451b80a65a8094135857b28926ed1449f59a9ce12a608f024c9ad156de757ee3191b44151cabb9391309e58a03916e385
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWj6q8wyunmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:d/ezSC6vUzPv+HjyBb5+Pl6bJTIZ5jdw
TLSH
T1E2756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 955b985610fcb84e9908b42538335d806e9e2927cd7bc30e5b74cf64acddb078
MD5 f9e529bad25a91004fe0263607e77477
SHA1 a2db462e2f13583df9c325c818add11590d1958c
SHA512 5bd3875d96714c162be2dba3b629adc78b402eb5a1b9593d5b46360d7fb3a06af67528e26fae9fdcd422f148188bc7ff35ba77d20fcc980e26868648eea71c73
SSDEEP 24576:JVbqPb88hv/l+BUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:JVO88hXl+db5+Pl6bJTIZ5jdgp
TLSH
T189559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 83a6e22cd910afa20dd7dedecc927bca7ebb64962b51e5eaea862298188c4b9b
MD5 95c19190020b3bff29874e99dfa993bf
SHA1 dcb8c34a3b0f33bbeebe6a5e899717129915f606
SHA512 8de118f0d27d4496cec3ff8dc66f0d4ee3df9809660019aef38db8567ddbfee0ae4a74110c96f1b904de3ea1838f200fe71d81f1e8c7cf234d8cbd9745f79b37
SSDEEP 24576:CFFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
TLSH
T1816523438B6A30C5E5AB1739D9CCDF00B87AEF55CD862B76C5752C2BE034249B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 ae5bc507d86225d8cf1e94029680bfad962408a10b4e81cce669168f79e67f8d
MD5 587132567c73799ee9adeb0c51c98bc2
SHA1 5e49a223944ab29eb922f065514fdd1bfbc81201
SHA512 c54cd963db114d299e2c1185f4eddbbdc8a21563e5c3b5fbb6b0b3009c69619138bcc5c10e35fd45c3615de7f0ba5dd345f71ee4909cedc6c495c121ebe9ed9f
SSDEEP 24576:3JIUsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3JIU7b5+Pl6bJTIZ5jdgp
TLSH
T12E85CF2BEE28FCD2C27A8DB99A91C700E77278308F52A3CBD175820EDE235D55D76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 237b4a262009871b7cf32e89d9694928553d661f0500dd67d5169ae058d29c3e
MD5 e8070248b6b9e68ff90fe85b95e81654
SHA1 7858312339b732cc626777483429f9c5a75f967c
SHA512 2a5d41f32979effa657675648f9dcd3fca6df1293cc78cbbc49cfc1f094a4a410e92879f7881cc21b56732fbc305eedb6c804692d8a8b88dd5bbc1beb6a9c3fe
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THx:VQvGAdlCEL8c/WRNw5CsslgJTIZ5Bgp
TLSH
T1F5266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 11a7f1d5b44c8ca0dbb7367b355961204dd0c08b39e54115cf2e622bb0ecf749
MD5 c1354ffd46117037e1b4b08d8a159588
SHA1 52caa522904f9734a5f1182297ada58422d987ee
SHA512 15342f15115e4c82f873fe9ed72157112440bc826946f275393a8090d093d8b625408b986de9f0c33387c6a8ef00841686f9e86e68637b2b6f38f9e19f35cd6b
SSDEEP 24576:bOewsAjimb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Cljtb5+Pl6bJTIZ5jdgp
TLSH
T17D85E031FE75E036C2BB0DB65B65C706643DBA208F511AC3E3B84D9E99302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a905fff0a6843c8aaab0ed9bd733ad4b77fca9b8eccdf630371ca4247d902d39
MD5 f14ebe05c3df3f90c44f6b6b3db9d73d
SHA1 1ffdfbc9400b11a4ee65672f8310a0784fdcf999
SHA512 8c0fa44a0837aaba7e0f4f11b27a6244b7f718026d295ed639f019500a1c0fa9d3fdf14928dbe5c3eaee985814985e3dc99846f8f988447cde5bb35e060796db
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHxsT6p:MUEtQevvqc2W1cpV20I32xs
TLSH
T17E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03fe671a23094e461c7ec28f1dc8ef4617dee9c11d7bd3f99b33f0d23d315306
MD5 a35295e79bd8220198e28338296153c7
SHA1 17053af897aa22a8d224ea53ba1e7e39795990a9
SHA512 4d37278e7026aa358d18b7d1198631d362addf52844bc093cad15b541fe194b5c5386f44b64b17596ff2b28ba7da8deed8eaa70ece88265f21e5a10d2a97c060
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/zNb5+Pl6bJTIZ5jdgp:ToqtVjnmQslgJTIZ5Bgp
TLSH
T111D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1fb0e1b732091b4caf9bea21f5881ea341137d806d91563a7210ce44530e794a
MD5 168f1cbc218b8f9bce4a4b167f2a4063
SHA1 50c77f5e5d539a259f04d9b2235e13dd4a09f831
SHA512 43b56c7de1fff7a35c191b0d87a8ffe5c1cd415467e5d18ee4115daab9bce49a9e5897c1cf0720024e30709cc4096ac6cd85e8cb2a00cc9eabca521d7e1d3363
SSDEEP 24576:XAhGL6IFoiwtA5l7S53Dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:XAM5Foiq5qb5+Pl6bJTIZ5jdgp
TLSH
T173359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8bee0b7aa6831337d09775d38bab72309a8d26ae901451cbc6a65d74108ee369
MD5 298f90edad48c2f198666a09bf992590
SHA1 18ff16e8ee6d0482edaef0193914e1e130975123
SHA512 437ff490ca4eee57d0befdbcff4eeb650f51a20b5c4a16f7053417dc7ca0a8866ff330059bbdee9cb33c49d0e8a3551493ca9869d4d40cf74a35222cc8a8bfa6
SSDEEP 24576:OwuGOWWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:OwNOab5+Pl6bJTIZ5jdgp
TLSH
T1D275F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0b87aceee6a90ff0e99f94dcd829e6b14ac826dfdf2979adab0a862322cde7fc
MD5 7ffd9b01e9f8dc5971793088637ae55c
SHA1 4cee2fee801e73df8ef62dd52fa496c023ebbab0
SHA512 c34d92fed0b2c5925ee2f4a3896b6d91c6b9854fa69f571919c47ddcd5bb54be2d08571e38378bc9265870a1eb82064c1f0ff475f956bcc7d5dc915b1aae2f0d
SSDEEP 24576:CZuZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:kb5+Pl6bJTIZ5jdgp
TLSH
T18365128617A830F9E1A7523DCCE58B00E772B8529B7653DF4674056AAF33BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a0bd90f774ccd426cd6663b04167cd6a121c8a70f6b77d77bdfca98e264a2912
MD5 26d0da387151210385a793a1631b9cd9
SHA1 b91c53713a973a3eca2c79006d164cb7b7b597ff
SHA512 49509bd73583662a9281ca514af266471499cbf77505501529ad0d277b9082713c4011f93525b31327b5cf1b8266c48c93e98dac1dae99e7e6b5fbcb2963ed45
SSDEEP 98304:AQRQyi36YOcPDLvw2gAf+PN3TslgJTIZ5Bgp:XQyiKanX+PNDsT6p
TLSH
T1B5666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1dfb9e0b285b8ce600aa5263c4b6997fe2c6e32db6dc935d2bdde23a3d9d336a
MD5 7feae72abb1fb7332d6fef284036a1db
SHA1 ff8c1d2b473d09890c097cb5c4e6920a7fcf6d3d
SHA512 dd5080dac714295e71c79940477a7c9d88f79cc28a7b84fc619129e7a5614f49496f84c18ca3b7e7813a682871c401c87a4b8b7906de18d31c7286d1cf1d5abe
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3TslgJTIZ5Bgp:9QyiKanX+PNDsT6p
TLSH
T1C1666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2bcd5a8db1dbbe6220655274da4365c72f4d5f9adf8352ab001a0d750cec8ffd
MD5 c1082511f864b5fef7d98d81d0cb90db
SHA1 4cb65054941644e362757e0b26241b2cdbb132de
SHA512 07b439333e766e8ea37dbfa491874ba8a00ac418fe542a6522475eb20d05e272591ac312f5da59ad83b23f34d37e445db6a2dbb01cc60b63d758ff2237895575
SSDEEP 49152:m68Qg55nhkeWu7PNU3/9b5+Pl6bJTIZ5jdgp:EthTRc/pslgJTIZ5Bgp
TLSH
T1D5B55A33B2F60099C44DE1769F4A872196E27C71CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a23e2843f63f632574dbd17b015a9b39e0f6f2cfa4a9c0fac78b9b9e538fc5d2
MD5 90f9b9f5220aa189692cb9c1ce133ad2
SHA1 bc3c174564488b3224880037a3eea84cb3509bd4
SHA512 a113dfde6b8db28727cf0fd8069f683b288a2fb7dfd4fcf6b307e401c1163582a6e7ef5623230ad266bf383518ae8e7dce5174dfaf7dd697cd7bce2e200dd5f1
SSDEEP 98304:ty5112gYy5azzVvU69nLKnhZGslgJTIZ5Bgp:QLIHRWhIsT6p
TLSH
T129167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30cc476cd8a516b3a1286ff41f02bc5b576b487017575201dd1e7049fbddad1c
MD5 87ff0dbce640eba0b12a823ed784f637
SHA1 e239fca367424a248c93b2a748c9e10de48a763d
SHA512 ec6d5acfb9c67f0b061f47a0d4b9a3375a2be46bf9e012a9c9af79a582819c760e255bf7c7f05a66bded1800ac37dea9e3aa2c69c632539d67d49729258514dd
SSDEEP 49152:DB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnb5+Pl6bJTIZ5jdgp:1u6JmIxd2dbslgJTIZ5Bgp
TLSH
T1F3D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 30a8b877b9e3e96a886835d28381d1039f6a4cae873bbd2cf2a7ff0551b1a544
MD5 5def17ff371b2d3b05e14b9ebce1cee2
SHA1 9f250a2cb15afa46bd17d5688db538bdf3e8428f
SHA512 09ca6ec73010576023cfebe12902f630bb92aa9f55339bce61e69b1ac666c48502dd89d729d48a529acab6c30813bc63a9eedb7931c244eeffad4c0f93e4a731
SSDEEP 49152:u1hpsNoJpF1A67U44CwH7R4xbb5+Pl6bJTIZ5jdgp:umifPqRQslgJTIZ5Bgp
TLSH
T165B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 02fd462c318542dbfd4006d3506935d14c6a9bdbc2e8ebb7586975fb50c8597a
MD5 9942c67bdef00c20a6e532b75284c0df
SHA1 c3c18bacbe6354346113e0764a2ff8622a6ca563
SHA512 b08732be6345b3a9d7c593da253d57015617b71efbc268d4d08352f349a6f4a3770708c87e769780967c84c3f06e5aef1ee2d53204ccd6e99f45abdf950d978c
SSDEEP 49152:/SuZQIY0Be2KkRVtOnks6NMHqUb5+Pl6bJTIZ5jdgp:F5dKqi61CslgJTIZ5Bgp
TLSH
T1FEC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ce3044ef6f84cffee7a3fd6a720ff7679aa0c0e1715e7cb0cf2380625cd864c7
MD5 367a71916a35df78c162415dcf54e4e5
SHA1 60c1c4c8e89897bcc6bfc785b71c9055f004c70e
SHA512 460f42842006189cc336aac4376e195a4fa6ae615a96a304d8d37b3acaad93b2ed41999912d5560a5cd4dfabcbdca262efbed1f930aa2e7bc7d27eb57ce4e16f
SSDEEP 49152:7htSn8EApI0figjgiDn0AP5wXb5+Pl6bJTIZ5jdgp:aX2iWphEslgJTIZ5Bgp
TLSH
T1D495BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6df8f4179c5bfb51e20fad6a62eff5c976c18a963fa89a5a1606a210385b1ca3
MD5 8d4771f1f7b2b378a7bc7ec4a8e9615b
SHA1 d8db63638223bec41cb9e91d9c8bbd8b1dfff2be
SHA512 f5388ea185d5189b50167a396b7013162bd31e6a2c4a1fdabfda42052b7dad1217b911c3c306fe12d54a30b8a994afd647db3e8e184967a15ca5406c4a58b2fc
SSDEEP 24576:Ldmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:cb5+Pl6bJTIZ5jdgp
TLSH
T1446523478A6B20CAE45B5739D9C8DB00F87EAF56DD8727B6C67D0427F131389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ec4a31004fd229e2483e25ff2783fdfa0ca9786427ebe137d3a14fea4c49c22c
MD5 ac9d3ece470a7ade2c0fbadf333aaf61
SHA1 61d75ea6fc9030d771df55c904ec9c03a9e4e919
SHA512 7ee3762f373358581b0ee18448baab64633aeb1be08ef443f46d2d5d579dcd9f74dca964ba3ebec7e7feb85c6771e6dd1b456d70b9e0dc89594822d534be2d83
SSDEEP 24576:Vmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:jb5+Pl6bJTIZ5jdgp
TLSH
T1A9652346896B20CAE45B5739D9C8DB00F87DAF57ED8727B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 6f70f3dff506ba067f3d77ec985c18c7cbb5d7d1a959928d80d266d6631ded8a
MD5 be81330b09e775fea97716ad3e7ec942
SHA1 295ffe11eb2092d94752d3f212ce35e79ceec96a
SHA512 57ca4fb73aa1a860e51f9beeee5d2207155c901d6f84b6afc6660bea3f4416f8718b625f838ec23bda4985afd6a0149c0bfc891b35c562398e9fa132adf42268
SSDEEP 24576:Dkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3b5+Pl6bJTIZ5jdgp
TLSH
T1B6652346896B30CAE05B5739D9C8DB00F87DAF97ED8727B6C67D0827F131389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 89f9ac6e33f2d4fc90aba5c7893addc40b91d1687dc5bdd125a1501ec5053be7
MD5 8518f26e3b1b733dcc5ece6b8638cdc5
SHA1 9727d9a0003a9ced55e78041bece00513f0b1a42
SHA512 f2636bb867756538e1250a433b0dcacfca606a04d34e0f171052fed3a23c9ce9afa9f7ddf4f0510cedfbb150d90ab6fdea7550140421d5fa70cb3eae1dfffa06
SSDEEP 24576:Imb57GBiOl6a8JTth/RWZvR6wQQ92pN3:/b5+Pl6bJTIZ5jdgp
TLSH
T1466523424B6A20C5E4679339C9D5D700F5BAFE95DF5267FFC675082BAA31388383134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0c8d8d889c747d589725fbab53b7b4e0de1d0dc86f6f571b6d83f31607657bda
MD5 fc6d21dd9e034c986b12b092216c3ef5
SHA1 062a66138dad9991861e9e4ba6476caab0525b56
SHA512 f61b5230edeb19484ce82e62c381a279710687df63db05cf0543f4197ebc1ca7dc00690738741d9b8c36ab1e2f817c55e3f46114e168989cc548d66e9bcfb938
SSDEEP 24576:Srmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:7b5+Pl6bJTIZ5jdgp
TLSH
T1E46523428A6B20CAE45B5739D9C9DB00F87EAF57ED8727B6C57D0827F131389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9044dec9d409510bc43d8c2bc4f098803d3ade73a4f9e925774c81a78e620392
MD5 8cd1cd89e18a194c3b53623c824e948a
SHA1 8818d548a6ae7f3089a445d61ab69cde62da4d61
SHA512 1c0626454c5b9ebb6ac34e465558e5c87e51ef4cc891cd876d45233c64354df2539f927dee2999a31c40674ab3ae5b06be46c69f1c0cc95fa8dd6f3672fbd812
SSDEEP 24576:Kamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:gb5+Pl6bJTIZ5jdgp
TLSH
T1D96523468A6B20CAE05B5739D9C8DB00F87DAF57ED8727B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d6f3b7e40e5defbf14832c105a0126b365a67fd312bf64d7ded1a25d770c717f
MD5 52192470f788d2e1f44314c416a089e4
SHA1 2d3852312c12ff0846d8c8dbf4653c80fea604bd
SHA512 17b6ee6ef57f42b800fe83f09a1414a1954c0068550c91d4e97378a7c6578e8b48549c3639b5a3768e9dba751ec4faa986158a5bf2595b22d91a6e95a98a2526
SSDEEP 24576:rOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Vb5+Pl6bJTIZ5jdgp
TLSH
T1E36523478A6B20CAE45B5779D9C8DB00F87DAF96DD8727B6C67D0827F231349381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 6d57228070b49397b8f9cfbf64e7397e8942de8f8d24af27eb34988a2d4fd51c
MD5 77bbc47d5d4a8d7c459bdad281472f1d
SHA1 2bfb4057e8d565e9464f0b794076ba77ef1a3376
SHA512 b487273d9f771acf14989b4c41d63d0ba3f6b56b0a2a91e9cd88903391908fd68c8bfee61844d823a0fcd4b819ff578079935fe6615735e405eb052006937bcc
SSDEEP 24576:DZMazFVSOGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:DZMazf1b5+Pl6bJTIZ5jdgp
TLSH
T1A885F295B36018F8EC67823ECD958A05E5B2BC5A4B60C65F43B836275F333911C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 deacfe178e2e10bd8b8b39edd725ad0bf052713c2e435f9ea74714e4497b25eb
MD5 556adcc6983ebfb5b1c00c6b20f6cd51
SHA1 ac17fb81687623998def1122cc88000163b19155
SHA512 92815be51c4619037ebaae1361c63bf6e95eb14330b096e38fe442db178a69e275c7c0f83a373ea13d4f8fe8b663dbc2847e4a3e7464d612fbc6fec57382aebd
SSDEEP 24576:hJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Wb5+Pl6bJTIZ5jdgp
TLSH
T1FB6523878A6B30CAE45B5739D9C8DB00F87DAF96ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3b21ead762737e782c2e7561f32903aca4953145c5a185bc4305aadbe57b550b
MD5 2c6d6a9cd4e2dd492780ec111437af07
SHA1 8f814d4497d7cd7b0facadf1675f49107931ee40
SHA512 49ba44efa669930556eec83eae9d67e08cc68c615e5cb60359469611d305b6a869b478b9ca7786595229c999365f583450f6c8a689f24b1dee4477ba879c096c
SSDEEP 24576:e1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
TLSH
T1AD6523474A6B20CAE45B5739D9C8DB00F87DAF57ED8727B6C67D0827F231349385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 585b1f11a4ccd40d5812a04e6e9a1600e2b386adc32fbe990fd28f672a4c80dc
MD5 abb4bb16fd6ccef6c54caf79fa6c7bff
SHA1 2363ab3b5adbf2d2963d30c8b16b74151da34dc5
SHA512 5f9a2b1eca51ec822a5974d6709271c73afa62c3c886fa2accfd273939cfe2118a34e0f48d07caf7a48d64eb02b7033760a477aad204c89005d3289b2eac8556
SSDEEP 24576:NzySmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:N+b5+Pl6bJTIZ5jdgp
TLSH
T19375024767A630F9D0679238C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 34a262c94e0590b966653cee6b87498051f9137d8a69f46708c6994a684afd1a
MD5 f2ad6323545da0697448102081f7f9fb
SHA1 06ccf54a1906f999b58eba418469847fdda5a855
SHA512 f63cf1b6856d9e8cd7ed30066863590d447a02d3214ca8db4728c577cbcd1c9c2a5a114b700c73deb55efae7a618452ea2fbb7e76ede6b1fbddb434ce751f261
SSDEEP 24576:MJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Db5+Pl6bJTIZ5jdgp
TLSH
T1E5652387896B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 22d3ed06536b6d088f675732712777e86b652a8cacf3e0e3184ee062386eb57d
MD5 38beed82d8bbc0b5d39d621fad270c2c
SHA1 d51469ac649a906ad7eb6dae7f3fa981b3b0dd16
SHA512 f776d35fe4a330360229d4c263b5a77173d9068133fc560df6c7e528525daf8cf3791fc9d8fc596ad6ce4e864fb6e3f6ab770ca982be9e38d04b00ec8b81f234
SSDEEP 24576:/Jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Mb5+Pl6bJTIZ5jdgp
TLSH
T1A5652387896B30CAE45B5739D9C8DB00F87DAF96ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 8c2a9574f9d2a9e35d173528cbd38ab935774579bbad98e2f60d6cd0b3b448f4
MD5 14011f1738da36b26c096c4d8376fd0c
SHA1 0300bd3d2ba441420e39cae5f9012b1a93da5ff5
SHA512 4991075bb0eff2bbcb1286a0282a6a46c28a8a9e457d9af4177c5012fbd66049f2fbeed58232e1b4472125cf46c7275c4a2cfe9c28b1e8e0754b4c8edc6eb26b
SSDEEP 24576:9zySmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:9+b5+Pl6bJTIZ5jdgp
TLSH
T17875024767A630F9D0679238C8D25B01F776B8328B619BAF47B406776E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 368be89abc64f959b478d01713022b66abaac20984bcd4a39632127ad6289597
MD5 c10eddaf6a1ebcca94841fb41f96d203
SHA1 1d92788fc5fa2e1d9c2afc6117ea8da27fae495a
SHA512 d81b40d8272aeba6463cc9876ef4de0e725bff4edd0f9ae49d76116430c83f8d9c81929c4f08ff303d91c1b16e9e2ee2800858c44f3e5526b5501aec58c6ac00
SSDEEP 24576:/T/aLl3z0zD0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:/TiLljmb5+Pl6bJTIZ5jdgp
TLSH
T1F3850195B35018F8EC67823ECD958A05E5B27C5A4B60C75F03B8366B5F333912C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 65614b73970612c71b5292495065f8cc955ed71459c6c057129c25eb4f4d164d
MD5 72747f348fdba5f8d737eb8b9e0ba933
SHA1 910de7cfdb14e850bd3f31f88685253c8fea8569
SHA512 49328de1915fd135ab830f9a3438157d8c3d9f7c90d7f10bb7f161057696ac94c331511fb4488884e02240dbdf2ce53bc0e7fa2cf2f01e32068ca219d3eb571f
SSDEEP 24576:V3Ud9CHKy7GZYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1Ud9CHKya1b5+Pl6bJTIZ5jdgp
TLSH
T15995CF90F3E410E8F0B79A35CDA68511DAB67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2d4b58a9eafa641646f07e2ce5e4b9c186618e378d2303e6155074084da90a6b
MD5 d8a2422ab11a458238be755520777ff7
SHA1 7c1f6d3192828d211bc76451599363917bd7c1bb
SHA512 47347b5a93feff35b9e4612918407cd27dff1fa14a202056c50a908b6f9fc92b24468ce28c6ae74153d5e417539391c11b94befd2f57d3703d1599f860068e19
SSDEEP 24576:bEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:vb5+Pl6bJTIZ5jdgp
TLSH
T162652346896B30CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ce3ac7421471792d72457e507229e5e48009e30003e5d70727e284babe00a103
MD5 4763456be5a080eb65900e4dd26f2da9
SHA1 a7a19a4348d75accf6e0465c470a2b1593ba6e37
SHA512 47c7fdc63865cd383fe101c4f39588906391ebc3b4a44fbc0058306fb8f4857f081300a82b3645eff5b4e4c0026470623202424342916851088b215c751af1da
SSDEEP 24576:Cymb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2b5+Pl6bJTIZ5jdgp
TLSH
T1306523868E6B20CAE45B5379D9C8DB00F87DAF56DD8727B6C67D0827F235749381220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 ce3dbcfaf14cf1fedb363d9e9bc572a1da09e3000519ccf15b5a323cc688ac16
MD5 8121693b1d54dd4dc41b0ed038e6db7a
SHA1 6ae8ee6f4b95ee770e7ae4a5caeb22a87a24a8b8
SHA512 bdb87d9e2a7f8f474bea64c0dc8bb5b26b60fbae5ca73ab81d25a0280da8ddaf45efe6b58284c0aedb823b18e619439770c777cd8a2eb4923dd4529634585191
SSDEEP 24576:/vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Wb5+Pl6bJTIZ5jdgp
TLSH
T109652386896B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 067e2b91c57a92250c2a4554043a2338062543f3dc978ccb6a9e46b6a6c398cc
MD5 76db832a72a28f98beb80434a0181f49
SHA1 41c7d9fbe84baeeb15c5faefa6c1d7da6198cee9
SHA512 06c6b195f2da62db903ee7c83a416de33ab24590bc5a1ce85a65758fe4a35b52ef33ef7de4498daa20537821744982583cb2c33065519e9056632f3fdf77cd17
SSDEEP 24576:9Jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Sb5+Pl6bJTIZ5jdgp
TLSH
T1C5652347896B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 21c03e32973065bf5d0f5061d931fae15894321cde331b96496581326a2c5369
MD5 74f9e00681b30fbe377d73d2bffae500
SHA1 a18e4351812467d0c2b3d849393ac194962bbb20
SHA512 366ddffc0aa6cdc2e783f559d63a96cf3569be1bb2c837694a03f3868bb203232f970a691ef3d92fe3742391a9492e48f2ff320c645b742a43c6ba7ab3912eee
SSDEEP 24576:sEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:6b5+Pl6bJTIZ5jdgp
TLSH
T111652346896B20CAE05B5739D9C8DB00F87DAF97ED8627B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 3a982df6f106807e4cb5423dead773ac41cf97a703639bc2aa0f2c0601c6f482
MD5 8e669f292638cad386001c8f5cbf9370
SHA1 9d0aa793aeaf13d35ef7d8a5424acb77c6e0b200
SHA512 a2e445f67ed36adf80e5a9ae3ad98476cc217174e5ed94eba72228a32ab43e55888de5b0547c257c8567578e120dcf7b7d316dee9e2ce633a95884115bbc9c9c
SSDEEP 24576:rxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:wb5+Pl6bJTIZ5jdgp
TLSH
T13E6523468D6B20CAE45B5779D9C8DB00F87DAF96ED8727B6C67D0827F231349385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 69443a1084db0ce7ea08754dabba787f9907b89480749cd7e704adb44f4f47d8
MD5 7d6def1914ca20b095e903ff284603d3
SHA1 f36cd471c11f7f64b2c72c3447b12428d982d563
SHA512 03b44e61d492e3cf85218da05d6c8542addbc3ad6601ffea806a013f854b2f4d9d3eabe4634108bf98f400e78e7e9ddb8447d75ff4b196504c71b1cef546028b
SSDEEP 24576:Urmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:lb5+Pl6bJTIZ5jdgp
TLSH
T16E652342896B20CAE45B5739D9C9DB00F87EAF97ED8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3e41d67a5ace32246db9076f576db250ff72a20eed14c188424a00a10466df66
MD5 cff9ca8d4ffab85c064184421a3c73db
SHA1 400dac83fdb8c24351546317b67fc0ffb91e73b9
SHA512 0a605922d26067b7bf6d3c15ec8221132b5a05fbe381cf81b46410dc9d9f1d8f93f4636baafef3e2f921eb09a18a635c958eb0b11353df3aff981705ddb19f86
SSDEEP 24576:Ufwvhk9RX6wkyAIlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tMnYIob5+Pl6bJTIZ5jdgp
TLSH
T1EA95CF29EBDC04D5E0B7923C89E7460AF6B178595B31C6CF02AA536E0E33ED46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 00a6397cc3e4e6eae9f3060b443fa845f4d7632500313a566f7fbc12897b2477
MD5 151ca22db8a3b2d79c5ca7c7b310e9c8
SHA1 9fa29b08428926202522af4c046be87a236dd2cc
SHA512 b06d86e253c0124ae28232cb93772670a024e4daca1560d65dbc39e8c9659473a68bc4528a370a25b69ca195ec71b7d7d5eeb2b6c5037c8c5b9a524fff503fed
SSDEEP 49152:bYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03b5+Pl6bJTIZs:mySzPzslgJTIZ5Bgp
TLSH
T1F2066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 723f30936af3f1979fdac15a73bda5798d56ac6ee48f386761ac53705ff27655
MD5 7a218d5cb7e55164a8c61f7afd781155
SHA1 fa9231371dc7f6c3e081a589618b292bf72b7ac9
SHA512 5c80fa2f498dbac78d1c01a3e1f0e1105587d34516a33c7699cedcc637df684eed553dca62bc3631b5c5643855db3f0a3469713a79d4f0a289528d262250f02f
SSDEEP 24576:e47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY2mb57GBiOl6a8JTth/RWZvR6wQQ92X:e47JUQjqirIhCnDHUPfF/nb5+Pl6bJTl
TLSH
T19965AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 67e97db0b4c9c7a8328643203c65554fa3cbfad32ddfb4c169982089bf14cfeb
MD5 32f36ae5673b38d81abba8c0a155ba79
SHA1 f6365fa973b2bdadc323a19990bc5ae61d5a4623
SHA512 b49153f357da089c95d6100c843c894887bb4e591fae7c8ef62625d86d8e98811eb720a3e6105c7afb96d5b7d27a2c6cbbe95561a965cc26712f0d2726901d63
SSDEEP 24576:zZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ib5+Pl6bJTIZ5jdgp
TLSH
T12E75F14AC29811D8D06F6279CB858A00F7377D658BE293DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 5d291d06a001bd99d9f12b8721ad84a5d90f40c48940bf04262dec48ca61ff19
MD5 12f9744c79926feacedb0cb403196f90
SHA1 be558dec0c66dd4df8fb1cbff3b7d08c75493fd9
SHA512 8dbfa3999c052b9430e6855869103545a229fbccc4f411a43016c807ae238736fa36d7acedf25d64f4f069ec5842b750506cd87352de1f5dbd6fc04b41621418
SSDEEP 6144:isBC2na2oze1rERmfKDexHg4gy5UG+CSIJaTVPIQ5H1srU8kLcbp2MF3q08sFCqj:Xji9Dy5DMV5HcrpBF3gshpD9
TLSH
T1C9452810766AD75FC6A940325E32D2CCA7707D05EE056F0773C88B3F9576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 519KB
SHA256 5ed18482686097caf65c134b90302e8e6ffafb7fcac83dccb61ad6c399beadbc
MD5 d6f2f3a7636a799dd0bb1dc1d36d508c
SHA1 9db59ad7f907aa7a9e948f522446d2ac1090d962
SHA512 49ab6733d56ae3f4f223d5c7f3da502fdcd4851d004ca7291630818b1c836250bac27ed4e030abe656626605da2907ffe93e338c680cb532cc11130e7baec89b
SSDEEP 3072:jC7w2/hcC8ZM0IwzEz4LzXz7wrLarOIyuK3S6f9fN86W3t3:jCh0IEQ4Pj7wsOnPlNdSt3
TLSH
T1ACB4F741A236E38FC4F690720A316E8DBB78A917AA016F0577CC0C75D87634AF5BA3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7efa4b6a10ea56a08f69509fac817631e40cb8fef35d6ece29e9fbb65d3f6a81
MD5 0a30bb91fb435dcdb91c526c0935ef6d
SHA1 b7e967134a040feb5bce48abc09ffa7e10501518
SHA512 80bf307a2dff5f3e2a2fd5cf6bb9230bba9e342b9bf89baecf1b1ae5bc647463e18598ce1b0a79f27b9b12df5ac68e1edfdf040fd8af28b430e362344ef91ea6
SSDEEP 24576:ABmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Acb5+Pl6bJTIZ5jdgp
TLSH
T15C6522428B6A6086E4BB5738D8CDD710B83EBF65CF8566E7C539146AF1316C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 111d54fb77c517d6c2737a6d6854f5fb4227b4dbc376287047547d5154a0c78e
MD5 666f388a6cdb51de9f3b8a347a3fe94d
SHA1 4b9a0523cb392f81fe8da96bf2f7568f9d8b8002
SHA512 ec296eabaf5f47f0eb802bc65b06a96e99bf1444278d6d4dfcfebd4be96bc6d29fe418ae53e9e570ea81709a2491d2fb813b879cf5266b91f0a6de48dc5e0b8a
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Igb4mBIBhGF5b5+Pl6bJTIZ5jdgp
TLSH
T146659E1E22EC02F5E0FAD2B8DDAA4417D6B278165731D2DF0151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 8ad35e674fe5fe0bb00110d36fcb7e685337f3fc5cd58672287018084f30db9e
MD5 d64e611c192199f0aa163066bdf171be
SHA1 3a82ba88842fab9decff9b72942787039d3fea88
SHA512 1084138bb69f163908d6037e536d304b3901c928a62a98184d989b6cf2716c15683ba9376102be1e213e0be3f8e12179b4f522de1b995e8903460c6090023198
SSDEEP 24576:lG88u8FpJqH1ozria7/mGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:I7ZFPqVXa7/Ob5+Pl6bJTIZ5jdgp
TLSH
T1D495F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 7852e49c9603ce09ec45e704707d07950955aeed70aab71c176571f84f15b7e9
MD5 5aa0bda7c765a3310add159bebe628ba
SHA1 33d64ab1252df34f671798d643d2f48ec267797d
SHA512 afbcf7fca10ff2df9260251cdb58a61b5d86bd48c058e9da6e8565ed6b5189323c4d86dd24eee92bbd6acf62018170a56fadada0ca79e9eb7fd5a38baf10ec18
SSDEEP 24576:UPUr+NQimb57GBiOl6a8JTth/RWZvR6wQQ92pN3:UJQtb5+Pl6bJTIZ5jdgp
TLSH
T11475E11F26AD18D5E67BA17DC9C68709F672B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 44889c24342a1ee3908e8d8703257495a9b8da207f34a24efbde940b5d12509d
MD5 680e88f9393a78ad059b1ac794a4002d
SHA1 6b889eab2670d4ee30f6c639c98f6b10ad453bb5
SHA512 3a1705060137ad4fde9de58de30c1b59f71fc4d932515e8c5dec97a1faa6555b7ae26a20ff6badbaa960fd534529e377fce702f1163aa2ef5faf819a1528c3db
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFb5+Pl6bJTIZ5jdgp:GG05lO43beslgJTIZ5Bgp
TLSH
T199D5C06E62EC11F9D0BBD17CD9C68A0BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 87c0ff9b8070480a63cc6807970962ba4021851400e23286391f8eeade70a5d4
MD5 d47f7d66f937fec177190e24bef54d0e
SHA1 f585d87ad75ae339cf734bcf6382728d9186194f
SHA512 3ccede2debd31b0a8da7574e39e1ee6a68e724b65b08836d242f01b3149efb8a95d5c7062431549cc9a53f0627ede051c24d495f80f1c520ce4ce8b4899ac778
SSDEEP 24576:3fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnAmb57GBiOl6a8JTth/RWZvR6wQQ4:Pa5POZ3lJt2pasx2+m9b5+Pl6bJTIZ5G
TLSH
T15765AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01cb47af8a3ca8611573223d7a272dbb043e49663852e8d789b0fa7ec04b552e
MD5 01b054e676a8f4d97d176111ad8639c3
SHA1 8a617063def01003a43b70109888adf953ab8858
SHA512 de9dcc8ff251c54ed63191a84375b276e07e391152779fbdd14a6cbffbf47bc9ce7f9907dd12f241d679970a62e6a09370f4afd602b0d6bace1a3f770fce9bb4
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7Fkemb57GBiOl6a8JTth/RWZvR6wQQ92pN3:XNc/zEOVHFub5+Pl6bJTIZ5jdgp
TLSH
T137858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3a65a1e49c46bd3d90d0af570fbf3a301ff5229671f85efdb3208bbeff23db31
MD5 4434714d22ca917dd11fbed787b14630
SHA1 88f4ace7e2a78efeab06e230f0b778ea3d66b64a
SHA512 8b1c2c3d87bd8d8deac91d924f32a1979be1c9942ae56341e0cc5177fcf599dba497496efd7041581724201c83b75bbe80b894b284001510ee07d431685c9139
SSDEEP 24576:3zkNvNnaFeYhJNtmZBmsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3zMwBtOm7b5+Pl6bJTIZ5jdgp
TLSH
T10855AF6EAAB805E4D1FEC6B5CD238512FA727861073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 f2ee97630e5758876a770273f3a93c64d7e939130e136ec022fad1f31c3edc80
MD5 4afa8e2f2851477d4b4efea2c75f654f
SHA1 fc7a4ed3f07a780eec18e45cfc53971e30542578
SHA512 bb7a9208da7aa76b4191b081b0b0e7874c628d9c40979ca126c9d76aa586ee0c65632960a9c5be1124e49629d3362cd9627e7407cf1249eaadf64a9eb2104ac7
SSDEEP 24576:oD3FHshBIYQgA9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:oDVHeBIAAAb5+Pl6bJTIZ5jdgp
TLSH
T1C385E17ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481B65F2BFE43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-315-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1216-124-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1216-117-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1216-118-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1444-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1444-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1444-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1444-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1444-316-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1444-110-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2004-49-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/2004-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2004-39-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/2004-45-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/2004-57-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2256-68-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/2256-63-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/2256-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/2256-0-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/2256-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/2528-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2528-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2528-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2528-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2544-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2544-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2544-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2544-20-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2544-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-80-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3324-69-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3324-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3324-298-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3432-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3432-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3432-130-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3432-139-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3432-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3712-283-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3712-53-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/3712-52-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3712-60-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5248-82-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/5248-87-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/5248-312-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5248-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5772-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5772-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5772-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5772-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5772-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5772-347-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5868-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5868-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5868-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5868-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download