7b3f1f368e593c4518029199628c1ea6d4d065940b087c0037b926bf8837cd23

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260808-n2n5eaep6z
SHA256 7b3f1f368e593c4518029199628c1ea6d4d065940b087c0037b926bf8837cd23
MD5 4407d515e853428f1f049ef1a01eadec
SHA1 f20c86b23dc6806d2912273ce766d52db476b61b
SHA512 2dbf39e7131c9229a5be9adc87811f8684019f21f57a280f25ba8805cd377363bac4b3b50f2a7fecb4edeca16c6d8a5c8c132aa159ef8d4526d491f52ada77f5
SSDEEP 49152:ssdvj/TCkU9+pmsBU7130yAXLPsnon6yPt1zkczQQExfpT5KmAzJ2EZ:Cgo+t1/Vm4J2E
TLSH
T14C167C07E7B941E5C4BBD13C8A57965BFAB27849877197CB03A0865A4F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2484	elevation_service.exe
5420	elevation_service.exe
5544	maintenanceservice.exe
1356	OSE.EXE
4972	PerceptionSimulationService.exe
2264	perfhost.exe
4364	ReFsDedupSvc.exe
5380	SensorDataService.exe
1980	ssh-agent.exe
3168	AgentService.exe
4880	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\60011c6f763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e48d41a02c27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e53b9df2c27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007596dbdf2c27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007d31efa02c27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
5420	elevation_service.exe
5420	elevation_service.exe
5420	elevation_service.exe
5420	elevation_service.exe
5420	elevation_service.exe
5420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5212	2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2484	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3168	AgentService.exe
Token: 33	4880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4880	SearchIndexer.exe
Token: SeBackupPrivilege	4364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4364	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2484	elevation_service.exe
Token: SeDebugPrivilege	5420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3880	4880	SearchIndexer.exe	100
PID 4880 wrote to memory of 5644	4880	SearchIndexer.exe	101
PID 4880 wrote to memory of 2300	4880	SearchIndexer.exe	102
PID 4880 wrote to memory of 1144	4880	SearchIndexer.exe	103
PID 4880 wrote to memory of 4108	4880	SearchIndexer.exe	109
PID 4880 wrote to memory of 4836	4880	SearchIndexer.exe	110
PID 4880 wrote to memory of 5716	4880	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_4407d515e853428f1f049ef1a01eadec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dd2220a90b5c406d916aa0646857d9e0474ca0a24694633deecb0243e4c36702
MD5 757c85e3266c726bd5cb8a62aa8b4ec7
SHA1 a91432f2733dd6ce19b9e4dbeced57b72f407a40
SHA512 9f04cf88e9fd28e15573ecb160e3b63e5e150438dcfdb8e9c2fdcf36a61c109d55a37e0e4834fa05c55c0cf119dbe9e86fe73afd6f469132344d075e68a2cb4c
SSDEEP 49152:ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxnKmAzJ2EZ:E3q6sjBhm4J2E
TLSH
T191D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9f94f2a3fc0e34c09b46ee8e5634dce955fef00c01bc35941dfa9e5d4bf7332a
MD5 492282d3929342441cf0e1b53d53141c
SHA1 118d00692ebcd8a5f4d4b2458ce5216fa1219a61
SHA512 218419420fd1f37c5eb8da12b6463c191dd52ce90bc8327e2002bac44983f66351fd1ee3b554c1cb647798655b02b9fb3e717e335e88e6605563d3b052a954a9
SSDEEP 12288:c1XLsswWkxy2lRq2czA0AqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nG:qXYfDtczA0xtNIxFaZDRLJ2oslgZSVg
TLSH
T1F375F12963D408F9ED678138C9E2C511EB727C914764E78B03E4996A1F333D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 976d8eddd7ec2a6e70d332a1b8164aac07efbd41dba9f19178c1a2c4fb856bf4
MD5 b3e4e636d8a63744bdbd4dd2e67094ad
SHA1 ea72ca1bbb749963e17fcd8ec88f40c90f8d6845
SHA512 f3c534a66b0f1236c84b520b13fd8db6c87c4978422fb1bffe06e4b181961a2837460ab8aa725fe0b92c212e150f900a796a0c24b68f9d91d98123f618717473
SSDEEP 24576:90Le5ji0hmxxrMHxtNIxFaZDRLJ2oslgZSVg:9Pji0AjgmAzJ2EZ
TLSH
T108859E16F6748731D073C0B9C5D2A69EEA71308257308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 48ee4e72aebe42a69e3f9075165778e91d2f0d4c0ee6b036c562dc8dc30e0bf6
MD5 155b9610afa90a9e19f2210bc241f633
SHA1 8d2eaf7b076103673881ec5a760e024efbc8a163
SHA512 8cc4ee02bd87a74ac98e1f09fce9b43cdaa82719f884c89900069b0590fc13a25559ad72bc19216f1421e11ffb27bbbdf7ff0c703527333ee91040bc6cb6fef7
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyuZxtNIxFaZDRLJ2oslgZSVg:N/ezSC6vUzPveHjyMmAzJ2EZ
TLSH
T12C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f5ecc864596fe3efd2bf941e6f4acaa9dd942d5fc2479abbcdae757f0707507
MD5 f8068556ed85bac6b8dc35ced67168fa
SHA1 b8479348318ef3cb2245369a3f9534e73066c389
SHA512 318436c04b163812a8d2b1d64ce2c9af4531590b827baba7d511caa95999482a23352d05971c80a4df7687640b96f8165a5a97636d7e1bae89d10b2fb45c001d
SSDEEP 24576:CVbqPb88hv/l+YgxtNIxFaZDRLJ2oslgZSVg:CVO88hXl+bmAzJ2EZ
TLSH
T1F855AE66F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ff5629e0f0d20e8e7c9515caa0451f1315f6b34b6119bb4de1912632ddd89a9f
MD5 f93690e66d96dd08a9a8ba1272b51beb
SHA1 b90e31523e91a16e3fae6759c1d806a291e01045
SHA512 4db02b1d28525fa2949643543dfdde4903e1d721e6a3b58823afcb3f63a91add0bf6196d16e2112ac4ae2a3179baaa633940e0a7c66ac4f5ff3ff78ad6284530
SSDEEP 12288:ALjAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:ALjxtNIxFaZDRLJ2oslgZSVg
TLSH
T1B855234393C528C5DBE7283066F5EEB567A42DC2577C98029CBA3A6A0C7E700F636D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d44bde0b8189cf41ce8d21854a0ad9181b00ef898bdbfecea8496333d6768b27
MD5 dd81c1143290a3421047b88842c03d1b
SHA1 e5d0f0e4521848b972680e84c9871b66a7ef06fc
SHA512 b89877dfc48169d17372aaa639889b46a174771f01f38198d6ebc5a2cce8b88c590d8e2c7ee05177f0f40074a5ade05114244f1c2942c849d276c9521ba49c1c
SSDEEP 12288:reBNUbTVO86UoAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYy:rJIUoxtNIxFaZDRLJ2oslgZSVg
TLSH
T14175CF3BEE28FCD2C27A5C785A91C640E77278714B61A3CBD175830E9E235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 77981ef64563d9e209644b223627a61e7b369b040ee19259dc92f9743862285c
MD5 02d3997664fe8d665a3233538ca97205
SHA1 7c81f7fa53bff7c9ecf79e7da3c6353b84f9994e
SHA512 7cf628154f19d702fee4baf72ed23a874b304e77150ee41a8e8d59de8a28c49710398686db49a803175743ff8b85926623e020848ee544e18830c26b6811b699
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:/QvGAdlCEL8c/DRNw5CDm4J2E
TLSH
T1FF267C656BF880F5E0A7E138897AC5B2F7B678420D31EB4F0291C66F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 93cbfa056d9a96008e351b9b0c2b4def8b4ddd179ab511af97350857471f47f0
MD5 b1393de17e16bd301d15d9823e3388f9
SHA1 4bca57332c32e2ed1a65ac4583e5aa414dd60558
SHA512 4a8c33d06942288f47339fcdf901b806ce3c7670951ceb77f1ea7f29c2203b10967a269bdc84b777595caa1dda6cd16b5f7a0d3aff6bedc7f3d5000eaca4cc46
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjiAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp2373:E0ewsAjixtNIxFaZDRLJ2oslgZSVg
TLSH
T13275E031FA74E436C7BB0CB21B76C716186C79604B6519C3E3E89E9E49342D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1f5237bf1279624923b451f1f3c6da9a72838cb0398f8f7ea11911f4704a3f82
MD5 56512b44eae9aa91e1a3ba0487b3825e
SHA1 25f74ad891833af622f2f21313448ea650e86e9b
SHA512 7eb87002e76749e310b64368e4c9e2a212afa8eac0b390cfbc41d32a83544e357bd7a400dbe2b49fc762e6081efe4e6d9d1d543811c6322b7bfbdd0adb5ac772
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH4m/E:0UEtQevvqc2W1cpV2tI324m
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5106d408e88bf46b1515419b486a43aba9961ae9752ec524a26d673d1e06a96a
MD5 2a84f5b580d76cc610177d3212205368
SHA1 f64738d92d93d29166a4d302d886e081528b025b
SHA512 a3d933336aee521d48ff447e930609c54c19f0ef5cf25916ebf66960ab0590da922ea32f04a36c6465224b200c50397399ba50184d607db697e212dfb058a7db
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/zwmAzJ2EZ:WoquVjnm/m4J2E
TLSH
T1F0D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4b7ef9e3a6b0e1926acb373dce818559cf7c6f1a216d05d912c84b087b664a60
MD5 08ab6268284e2b4417ec3aef2640e7e4
SHA1 ddc9f3dee0d86bdc9781722de0223095cd1c940d
SHA512 6b496879e58035985f8ddc84526b873b393bc93983656b8a7e3b877ecb34de6b009a99ffa2cb3820bf1079aad95007a7ae1c158e86b7f8f52dae54579717de6b
SSDEEP 24576:BAhGL3IFoiwtA5l7S53txtNIxFaZDRLJ2oslgZSVg:BAMUFoiq5vmAzJ2EZ
TLSH
T100359D81E7F955D4F5B3AA7899B69570EA76BCA65E30C20F2160D11F0E33E40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f73bd6448176d26009b5a4e13b1f223245182bb842841b4f75e45a6d815a3fc2
MD5 5559edc19a4e0fdac816d78fd6dab9ec
SHA1 f620d81305e3123f27bc1b54daa680f4b4eea774
SHA512 71627fe011277a4a815046154b928319a0d2265ff77bfaf027ece22790d7e6a681c42b6a1f42eec6a12e875f7546c16a9038da4b49fb105e8557dffb80eb27b4
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+C5AqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBx:2wu4OWGxtNIxFaZDRLJ2oslgZSVg
TLSH
T1F565F14672E41CE9EAA751388697C536F7B2BC022A25DB1F0760C65B5F37311BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 82c73c994a3e5f5af81783146d2e76b83eec2b62918c19e44c2d5a142d7a4301
MD5 29648ba61154b4f7e5965f2fda03bf7b
SHA1 7e98c842ed6702547916f7db8ff29990159e0143
SHA512 eb724adae4802f874d0e174d6fea326f20384587b00bd514b16906b651f8c866783883061e85f0efc723a9e34d31c0d19f0ccc06fece1e66349d855be6753c4b
SSDEEP 12288:peZ1IySAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxW:MZuvxtNIxFaZDRLJ2oslgZSVg
TLSH
T1AC55128623D424F9E6A3513889F19A55E7B13C93233943CF1965126A1F37BC17E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3f9d7a7f367710812cc45747f04bc77636afa8513a8cd456ce4304c1fdcbf61f
MD5 1340c3dc6c658112accf09f4e79ae372
SHA1 1a389c47e58650f04f0b0a88b86e5170ad0ec9f7
SHA512 3db658b3f5ebebb37f72dcb8eaafe7cb933781e3749e7c7bfa6a79211ca7e8fba712e3d29cc8b8d958d4143ca5f0ef0e378e4d21cb9d3b5c199fd1a70b8dd822
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:iQRQyi36YOcPbLvw2gAf+PN3ym4J2E
TLSH
T190667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1f0c2fb16fbe74be11aeded1a96c82bd3cfd8947c72ce7f7c8f20e9b1d68e4e5
MD5 e0a2f21a67c756b293e57d48ac800744
SHA1 55f1f0cdd310c49404566e6429f26415d803fb17
SHA512 db05fba0d831b39d3468636221495c2000ffc5b7871aa20a9ad93a581ff59030968f7314e0b427a1a8f77e3f9e93a471e897a8f325c4832ce960b5c65026a3d9
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:RQRQyi36YOcPbLvw2gAf+PN3ym4J2E
TLSH
T132667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 418e424f485e50278f6817d3706e1310ee76ff8d4a88fcabd62b0a07b072aad2
MD5 9a695ee8d8f4d23eaae316adc7bc3e0d
SHA1 2a344744ea33ae5669836b51ab4e6caedca7d31b
SHA512 20effe9ad71f1dd6e797676b1107d16d92a2fd282cd58b28d4148fd73db292cd7f5825b084adf36b806883bef9097e2608ad96e7570115d9ee5026bddd261df8
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0/xtNIxFaZDRLJ2u:q68Qg55nhceWu7PNU3/gmAzJ2EZ
TLSH
T113B54933B2F20099C44DE1769F4A973196D27C718FE0E3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 34c4c47520e6f5b710496ebd3910b9a79b8cfea621a71d04b19afa44f924e63a
MD5 4fd08b0b8711a2883c4ede788df77e4c
SHA1 839b062ba719b727e98be8370e0d66811a355189
SHA512 45b00d4f353c04d6e339c2e1f5681d76b4039e88ed47a1e5b676f2f965d5c4c9e04b15ac2fab12d6b7b43331156660ef41278d919187020595b34aa85882e3c3
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk996:dy5112gYy5azzVvt69nLKnhZFm4J2E
TLSH
T1EC167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e7988fa4764a8762a3f357ee84d53bd3a8705916d109394f605fb73c02ab7429
MD5 e48b9cd0071bd838205e6789b7230f0b
SHA1 c7cb3cc34c2846dd6cc797d11ea3bfb69814826c
SHA512 32882133c11ce1e93e1f8b77e8c2349a163cd91567eb2e5c1ef42d9687b7a7db7cff704b0863bbe808ab656cf79a79c2b0d996c556a18c4d02af4d36375b005a
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glVmAzJ2EZ:Iu6Jmdxd2dVm4J2E
TLSH
T1C9D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c60dff139828d77ccffdd4530e86f4101dbb037c675c5069a25a5c576201b5ef
MD5 7f3a760a869ed9f140dfdf52c43857dd
SHA1 b75f277a23a2b2ec0b7d78c434b7c463ad8b3c2f
SHA512 c3327523ed834b93ced38061e0e225f7a9314e823d11f071a99ce6a2398c2055c38f9171a4b8b8c050965c08efec95d8f061842a799c118bd8cb91938eaf065c
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4x2mAzJ2EZ:PmifPWR/m4J2E
TLSH
T16AB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 21ec9b1a45e23cde306d4874d2de94f7a2da401f37f350ffaf98bfe8e3aa09a2
MD5 1a71445c132d63fa3490255d12b5a0f1
SHA1 cae3d14d1e2ed2490da1fa6af5ce0d911ca90eaf
SHA512 3da8ec804283f90f83f203e0e8634b786971cc536b9bb8e90008184ea2b0cbbc9f18768b4eef453fc9f3abad00d87a90ad768f6d7d38a786ba380e2883268cb5
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqpmAzJ2EZ:a5dKii61pm4J2E
TLSH
T12CC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 72e923e3cdfb3e5d98a9201e9c295570b5eca20fd337532f6486b77790ecf705
MD5 f8fe193ac4c4deba4a4d266a169ec233
SHA1 28c79dec178ad7f4d3aed4ab3956d22e37d49dfb
SHA512 d8594f6a6c1c8508f7fd8c8bb254edb7910ce19b10a040ad79f511204dd556ff6e2b744aaccb2f55fdc3752e1e5ecf133e9d1acc9765ecdbe8a2423a2a7d56ac
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5w6mAzJ2EZ:TX2imphLm4J2E
TLSH
T16895BE13F2D900E8D05ED174C7568632EA62BC160B38A6EF0A9077561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c9a67b1a8c9115d518b2b51ea215fd476c195edbe62819d1c78d9df3711527ba
MD5 c3e1c371ad9fc6ac8f367ca4bb626a73
SHA1 76a81a6cb625a0fb805ab782d16066bc584db1f5
SHA512 d423ac2277a88cf4bd9d7d8ae27371fb2848eb47cb648070a5d738e3a553a2e2c4bca567808ebc9269a613f103f01d763134b195fee9cf432be8db36c6f9b729
SSDEEP 12288:8rAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:8rxtNIxFaZDRLJ2oslgZSVg
TLSH
T1C255234392C61DC5D797283096F5EAF4A7A83DC3B33C5446ACBE222A0E7A7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 02a235b90a237eecaba6cd6c88baec9df535b3d8e2c6b1701fff2052ba93ed1c
MD5 d035a7b96b344b3cfcff4c403c2f498b
SHA1 832f5ab6e598ae4b9e412d4e673aa8ac18587d25
SHA512 a800e50d10b842e55118fd55c1812f63ed8f92de03aecd5bd5d972dde6958cda8739c4242e8df70b0224644bd00cd970017e6d0b70bef0e536ac89bddddbee00
SSDEEP 12288:a+AqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:a+xtNIxFaZDRLJ2oslgZSVg
TLSH
T14C552343A2C61CC5DB97283056F1EAF4A7A83DC3B33C5446ACBE252A0E7A7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 98ad57eb8e9e7456c838df572d0cccdb654625e1ea4f8b4c9293814c40b9bb3e
MD5 7369bc3ed20e8db4d72f24f916bbec49
SHA1 4f6a5423c5b3df140edc9049762fbc10609c16b9
SHA512 93b5ae6a336a438371cd9cb48c2d5e6c7145b4590d08d7626f178215fc4ee82522375c88315b355d27f25200297f13eb906579624ea0c427fed8eb698ff78664
SSDEEP 12288:IwAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:IwxtNIxFaZDRLJ2oslgZSVg
TLSH
T11855234392C61CC5DB97283056F5EAF4A7A82DC3B33C5446ACBE252A0E7A7007736D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a81ed78662dbcbae2ad6a49948a92466d8aec66e4823324af1de90e90c1300e0
MD5 1e4bbb9d7f50377e754b96f84031369b
SHA1 03a518cb3eb303861f5f88364a0c797dd95b3c9f
SHA512 03d15ea1b1904caab44dfa03a1bf5b796dddc7ff096d33b6202ab3872a01bc730667594a27f6b0669ca228a58c97ad0f48de917293e729cd2bf4bef6d160028d
SSDEEP 12288:pVNAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:hxtNIxFaZDRLJ2oslgZSVg
TLSH
T15855234363C618C5DAA3A430C6F1DAB4E3B47CC3A33D969F9D65162A0E76340BA35E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6699a321e33fbae475c01c159c1abef8a48703c5ff87e43cb75ec190dcc30d32
MD5 2342080099563b1775275f713afab10f
SHA1 f7b8a711124ea900ef2b99121c0dccdcf64ff92e
SHA512 353a041e3690b921c99dc9f21e938dba424ecde05fa1d4df3dafd41f2a2b6fa8d1c8cedc2efb08db30bbadcde90a29aa839cf9af98cd46c54c2a2a7ebbd33d3c
SSDEEP 12288:TlAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:TlxtNIxFaZDRLJ2oslgZSVg
TLSH
T1AA55234392C61CC5DB97283056F5EAF4A7A82DC3B33C5446ACBE212A0E7A7007736D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0bb1c477b0916aca2ffb72517c6ffadda9f4bef5ca396c4ad4e0278d0eaa88b4
MD5 76c7b6b94bb36ae4fa3d0c400e4b2bcb
SHA1 c8b585b1690191cca26be5a1ffff3df9ccb0087d
SHA512 0505a5a16b1a53ba33569a4d09edf529103d60d85decd016c3df23658dfac2d450f10e293d36994eb24280504b3b4ba0c6c916c8fcc11856082100c58c501c3c
SSDEEP 12288:mKAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:mKxtNIxFaZDRLJ2oslgZSVg
TLSH
T12C55234392C61CC5DB97283056F1EAF4A7A82DC3B33C5456ACBE262A0E7A7007736D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 760684fc9f59a09d89515b1e9d3bcf1d0de2b581a914aa9162cad8307cc21306
MD5 cef9d3dc3562d03d43647625751792f5
SHA1 17d818360e0ccfc927c70aa35e2b4c8e06b82b98
SHA512 849e372aa8f008c2e258a8f1165ac2dabc91a016a754a406688be4cc70e8d88687c34202113d51f79ed7bd7bfe7a198a12a1b454f82b8a1a70d5baca0debee10
SSDEEP 12288:HWAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:HWxtNIxFaZDRLJ2oslgZSVg
TLSH
T11B55234392C21DC5DB97243056F1EAF897A83DC3B33C5456ACBE262A0E7A7007636D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 84e2b7028add2adb68c8d7917da6829b6d4b366cfc30cc32307c1ee0624cf7f5
MD5 f5eedd4140ae1bd4ad54b50c8a9e5180
SHA1 03d074c5fa388dfbe468f8188b978700fc0af979
SHA512 607da9fdf5acdd56b7ff428cc11ac284772f0cbb76ba11522582ef3e860ec393db7df850675e14542fe140b9a49bd9da485da10a7aa7fe3c5649aa211a5d55b7
SSDEEP 12288:EiZwbVzzFEoS2cPvyeAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRG:nZMRzFVSOextNIxFaZDRLJ2oslgZSVg
TLSH
T1EB75F195B39018F8EDA7813EC9A58916D6B27C560770C61F07B8362A1F333912D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bebd1f6a8d874963ee93f6748a3f5355f421af4a84fd6a9937dfe7344093a823
MD5 7d65d5d972855f04bc8ebd08801278ad
SHA1 a9f98201f86cb6824d7dfc99fba3a0ef627a9ecc
SHA512 326bac35830305880988e8a14d0cf92b155ab4afbb44c0eaef468b2797ae1a9c869b0196fe65dc132bb8c295564823c8c76c392e0b7c4f2ddc80f7705df33402
SSDEEP 12288:jfAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:jfxtNIxFaZDRLJ2oslgZSVg
TLSH
T140552343A2C61CC5DB97283056F5EAF497A82DC3733C5446ACBE262A0E7A7007736D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fa345d0c93c78258547b5066657356ffad269bf6001815f32472265ae39ce6b6
MD5 c02698c3326a75f884719a2c256d5609
SHA1 617730b22064100f8dbabe99e1c63c5763969e22
SHA512 ce09d0f0cff0c54adee58a12a5a08184be8268c9eebafd14be31b0ca6937c04ab759d57dbca95ff8175fc5e2bcc361dae19ae3870b0ed66ca3633569938741e6
SSDEEP 12288:MTAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:MTxtNIxFaZDRLJ2oslgZSVg
TLSH
T134552343A2C61CC5DB97243056F1EAF897A83DC3B33C5446ACBE262A0E7A7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9f0133c262d39adfc91d06053a0b7d2a52b107b2bc451ab04ba80f11699282d7
MD5 adf2652035003097fd275ded142274fa
SHA1 8985be299a694d7734e916fee19511eff4ebbb4c
SHA512 8c1be30d71ccee8326943b27e0861c1ca8232bebf31d13a14ffddcbd2079ac6d2191844201b5d31bedf454e65c42b375b7bd4344a1d7c80d27ec167cbaea5a0b
SSDEEP 12288:dyPz5L8SAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSeva:UzySxtNIxFaZDRLJ2oslgZSVg
TLSH
T1F565120773A130F9D267913889E25A51F3B17C7207348AAF57A4077A1E37790BE3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e169c8583e694c85827eebbb47b2a2af1227b57730d4ecd19995462c76899a8d
MD5 b304dab958a9bd31f53e651308c7d0dd
SHA1 e01193f43643cfae8a868d4718361154c9bbe725
SHA512 204f65ea530e64c48a9b7f2651a9cc5111db90bb11a8c142dda1a6b38d8c98111787cbd06bc76fde66b31398119943d09bc463716195ace274428a5b92c7b421
SSDEEP 12288:1fAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:1fxtNIxFaZDRLJ2oslgZSVg
TLSH
T1AF552343A2C61CC5DB97283056F5EAF497A82DC3B37C5442ACBE262A0E7A7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 984729d725b51e3476dc680d0e12b1ffeb99ad7ffbc4ffcec4c3af5974668236
MD5 3af53fd259287b8aed6aae624d311ac8
SHA1 8a032605537be08205b61703d6652cb357a613d8
SHA512 fe94b9e74f15ff3aa90f31edc4e11c49346f3283592ea22069b7e14b27b7a442ff9747cac171175fcf8e60b5aad2291912386651fb13eaa1e1d35ceb7455d86f
SSDEEP 12288:HfAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:HfxtNIxFaZDRLJ2oslgZSVg
TLSH
T1E2552343A2C61CC5DB97283056F5EAF497A83DC3B33C5446ACBE262A0E7A7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5d30a5cc0b0fe4a1791be7ed14ab7a7ff46eea2cf2f4316e5dcff6bc56c68cb0
MD5 bf15a810ac0438e06551f7beb851d53f
SHA1 609ec88d812d7e31599a051ef61afe4a5274bd74
SHA512 8db93d4801aa70b4baac41de7cb8cf54a4b55d8b6943528eff910bf75b3c80343c71a960fd710db4765d2cf62d1fa1d6c2336665c818336d3ea059ddcf57cf97
SSDEEP 12288:uyPz5L8SAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSeva:zzySxtNIxFaZDRLJ2oslgZSVg
TLSH
T1E765120773A130F9D267913889E25A51F3B17C7207348AAF57A4077A1E37790BE3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 286b18afed5b34509ad17866a7bcc6cbd61773a51b5be2c44336ddd995e43bef
MD5 dd60d48566e395cb87b355766863e5ec
SHA1 d4e2231a45e86171f2219d7966d2dc4a5ecf948e
SHA512 070d975376104ce09729160cffefb80259857a19236ca7949bebd8ff3d98f98ecb997f2e53dbcb20a72839a2b228fb24caaae85ae4e6bd10e3df164c7faf506c
SSDEEP 24576:YTDaLl3z0zDAxtNIxFaZDRLJ2oslgZSVg:YTuLljTmAzJ2EZ
TLSH
T19075F195B39018F8EDA7813EC9A58916D2B27C560774C61F07B8366A1F333602D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2e6f2bdfcf0cc72f9196a3e1a5e93f6f151a93a48c947d52c40651660c0c2265
MD5 d9acb1006fc44eb3f2a0f5677a1efbaa
SHA1 df5a56b1d639a5f348619b25637d5bc86ac6f839
SHA512 d40a74c6478d6b571c65dcc05689b06b78aa62df1889ccde6cb7746e55c75e20dc3adb826f304c30d63ad661facb63b03784006690d99158071dcc2836b176fc
SSDEEP 24576:g3vd9CHKy7GZ8xtNIxFaZDRLJ2oslgZSVg:qvd9CHKyaYmAzJ2EZ
TLSH
T11685CF90F3E414E8F1B79A3589768511DAB67C9A1B31CE8F03A4261A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e8775319fef8ebcbef54e0bc343633551fe0f093d25001dab01847f25461bcac
MD5 fb937c42cea1d0d09df432785b8a86b5
SHA1 287988df4ff283074578a466aa5f7deff90964bb
SHA512 b695a407056d9401e44110d9dfb906cc3f1718af82ffa5e3f8806b0b5c67bfe11f749b6dcbccfede22e95d0df534e5fee675c18ade9fd005e6668c359761ea27
SSDEEP 12288:cQAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:cQxtNIxFaZDRLJ2oslgZSVg
TLSH
T15A55234392C61CC5DB97283056F5EAF4A7A82DC3B33C5456ACBE212A0E7A7007736D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 06e4fb7d25b39b965eaf02028c106ae9408a473424de46f3dc6470bb4796a640
MD5 3c0276845ebf81006b9e41d48bcc9c52
SHA1 13952c985b5e428251d0a71b5b0479658feb6090
SHA512 85f4b56d5174b4c2491c76fb04259d22c6b1b045fe7229eae60e1596b1154797af05c12fe63c60505a0a3e7b670b4419d453d15927276ea718df60c8342cef0d
SSDEEP 12288:gyAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:gyxtNIxFaZDRLJ2oslgZSVg
TLSH
T1AE552342A2C61CC6DB97283056F5DBF4A7A83DC3B33C5446ACBA252A0E7E7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cd34f0ef203e3ca5581dacd0b8f2b63f4c0b00fb1ad2cdbad8e1745aa71a9720
MD5 6ac34ff0c5eeb051f5294fa276a31790
SHA1 e0732d2cfcc88d36b5cd68d3396214977793d2d3
SHA512 803c8ff01e3de5e45df45ebf48e10d8bac1a881b94f3f37a20e3365c7fb2620c6305afec67545960a2e12666e6d4b15c79fa008b674f6de7975cb7d596e59b8d
SSDEEP 12288:nRAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:nRxtNIxFaZDRLJ2oslgZSVg
TLSH
T17F552343A2C61CC5DB97283056F5DAF4A7A83DC3B37D5442ACBE262A0E7A7007636C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c90969fd0d9c31c8b8f1b7e3985fd4d5c0ab62913abaa2b846e62ca64d4d9717
MD5 39d5a3c807641f08e8120795764f8eb1
SHA1 3def368aef087e40c1cc5c25b374754d1fd37294
SHA512 b4f7bddc03db02e7f0850369f3278041c93aa4952dd26d3deea84dce09a2837071ae7abdfb2a5ca86a3b3898b1ccd3b460320bcff2ec7e9cba0218c24efcc029
SSDEEP 12288:FfAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:FfxtNIxFaZDRLJ2oslgZSVg
TLSH
T16F552343A2C61CC5DB97283056F5DAF497A83DC3B33C5446ACBE262A0E7A7007636D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3c7932b759b4d44c59e068664b843400440f63c79562ea5a633c94266f1f460d
MD5 c03dce3d5bf1629bfb7c725573303404
SHA1 250dd10e989220e558b44de47e99d324ae7ca364
SHA512 d5ef50ae2dace1d135ad135b4f3000d8c1c3d4959aae136633440f070ca8ae9d73df1014362fbab5d56681a68e63c66078450336e66befaa8cc0442cf7916ef6
SSDEEP 12288:LQAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:LQxtNIxFaZDRLJ2oslgZSVg
TLSH
T11D55234392C61CC5DB97283056F1EAF4A7A82DC3B33C5456ACBE252A0E7A7007736D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5bb6fe82f704ea3a8e900aff31afad2216a968b1198334947f67a601647f02c5
MD5 2341db2dcbb5f54981fba73c4a6deded
SHA1 5e7026d0f690b83348f63ee3139fca68634f78a4
SHA512 d36de720c517db12cb7e55536553fab2c02254fc5b7faeb9bcd24f8ba0114ccf2f3cc8299a30957f96fa9656e6fe19b912cd44d622c884f75b1fc3925aa7b5ec
SSDEEP 12288:nXAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:nXxtNIxFaZDRLJ2oslgZSVg
TLSH
T1CA552343A2C21DC5DB97283096F1DBF497A83DC3B37D5446ACBA262A0E7A7007636C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 77648de187d6672f861e237e059d258feeb2bf94fe1ca65f941c9bb0a7797e9a
MD5 9895be7c548576880c1966bc62788a5c
SHA1 04b3671060fa08ee2ab48161ed5e6c7264932b23
SHA512 8c4ff084db074b3e45b2215f105a0d23f0d0c8df6117d8818d4b29ba7ad994e0f582e67351e5fb1437b0dced97e4e3c77fadcb2ed77ab61aae69e3e63190ab7f
SSDEEP 12288:elAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:elxtNIxFaZDRLJ2oslgZSVg
TLSH
T115552343A2C61CC5DB97283056F1EAF4A7A82DC3737C5446ACBE252A0E7A7007736D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 df22897ef662311f1864dd6a5364de11b236a10783e0af254335aa89561d53f5
MD5 36f3f3cb3a152f1873d3db2fecf5f25f
SHA1 b6abb33a391051aa889454eb164a92d23319c523
SHA512 23cc2fb4c5ee4b0ece6b12447c00e93eb9cb145bdbea7132370f84d8ff71446fef80506889e536c010cb65b75b6272ae993c7b302a71beac1fc6eaf5ecdca8c8
SSDEEP 24576:hfwvUk9RX6wkyAIDxtNIxFaZDRLJ2oslgZSVg:7MnYIlmAzJ2EZ
TLSH
T1BB85DF29EBD804E5E1B7913C89F3460AF6B178591B31C6CF029A536D0E37ED46E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f5e1a4229e9379f164d1ffe5d1fe2bbecc18ea6bf697bb281ebb5db984062d4a
MD5 9fabfd92cb2a16bb0840baaccc17ea94
SHA1 acb5cb763e8a2396a21307499a10b87921903687
SHA512 6f5f608bad4f5ea1d0366877613afdc03a6289141e3b491d0d667a51bb1d0151f48a1e803cbfcf3a4d8f7ef39fe3a0a07f36e018909d824de15e3700c7df6a48
SSDEEP 49152:VYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0amAzJ2EZ:YySzPSm4J2E
TLSH
T123067C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4babd007978897bbd46ad8f242dd0edb29a387f65f6963d9620521e043062f9e
MD5 4209db3305aa14dbfebe79cc83587b84
SHA1 0fb995948a197d1f5181494a6dc476bfd2a0aeb9
SHA512 83e55d3d3327a92ce09209be498b120a4f75332623fe6282aee694af270fbc1e4fc872d512f9dc6f7119b362729e3f018bbc47ffce1e385b15dbbd6c7361026a
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYOxtNIxFaZDRLJ2oslgZSVg:c47JUQjTirIhCnDHUPfF/KmAzJ2EZ
TLSH
T10565AE1EA3EC01E5E1BA923885558A5AEA71782E1B31CACF1270437D6F23ED45F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 35f53eb1a6f8a3c361f56fab00b29d985a8b308481c005cf1775db5c5f302ee3
MD5 769e14739808ef8915c4b1c93729de50
SHA1 781ef1217b771049fd951a786cd3e97c2e06f9bd
SHA512 6306659098c1e7503b9dfbb00cf16323cba0c8eeb5612cd63c169bd0432049aa760ec5b51360c22e2cb5a27db5fcd0239741b55e8562a6181c344e7851e0d747
SSDEEP 12288:UbsfvAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:LvxtNIxFaZDRLJ2oslgZSVg
TLSH
T14B65F10AD29412D8C1AE6135C7959A51B3733C6293F5D3CB56D0F53E0F7A680AEEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6229da3246d4c014afb45295da8702b94e8adb9714fea4df5523dc8c83b9baf2
MD5 10881d4d190acbb99a18f2dab19f6db8
SHA1 742a528f250b77f88131be7decbeeac817a3bc8e
SHA512 7809cafe4df420068cc79ec29a9d99f2bd46b97eaf30502942a18768a76346e61f7957f6c013ed785b552bb0d148009aa38b9659771708a4f75d4de2a9c4a1f9
SSDEEP 12288:aHyRiU3fTtq9AlD+kGhu71C8En45PSw/0eaRMjwEBgdVKlT:aygUPTM9wCkt1Ht56I0eaRMjDBgWl
TLSH
T136453940766AD75FC6AC40321E77D2CCA7B07D01EE45AF0373C8973F8576669BAA1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 047249e7c6e57d8c213a507fd31a1a67a2398f4f70785767943293a602867b75
MD5 92a21e4ffd998b31db551860de5ae9ab
SHA1 815f6e61426b656f718a4bc8945f78392caaa944
SHA512 b1924fa939d006fb3110d337916087a8d4909dccbcd7880e4a99b222e48e3fd94d992d8cc2d8e777f17a3c8e6e7c32e179e7ee218395d98ca4a6bb381e844c7c
SSDEEP 12288:lGL8p9LCAYMGsXMkDXMXRFQyqFpvi9uVy1IvEMZvCZH3FJwgZ5K+xXxFex:lCacAYMykr+nJNx0x
TLSH
T18E65E7815537E38FD1FA6072032A5B4C77A4EC06B7095F26B3C8453AD86AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 10667f8d78f53768d95b45d7ffdaff4178f719675a2e12527380e0cf21162e6c
MD5 76fdca198cb3b81281340b68bd82af33
SHA1 5573ae5bd3304097b20595caebaee181aa67be5b
SHA512 9adb89c8185e9178610b5803beba781a9a8c0812bbf01884795a03190193c77b830e9d33c4772106455512e44af4e588aeb2f16f1897d07323e622fb5c158ce3
SSDEEP 12288:p07nAqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwYOSevaxgx:6nxtNIxFaZDRLJ2oslgZSVg
TLSH
T1C255234393C51C85EAB7283045F9DA74676D7DD2573C94C3EC6A226A093ABC0BE36E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f567d24477c33e6d0847e4c24cc51980c8affad557770c062e6c0d1858d8c361
MD5 c778808003d8b5d2de25a58f7e6b585b
SHA1 df2ddc3b41b185f15b57cf156ba6df3b665fd896
SHA512 b65923f4030a16c83da6030a647643bdc1dde6276dc9589584c26a951df54a5457b270022d84ab82c91553fc51b61837efb3179d6ca3ea06493cee965e107295
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYZxtNIxFaZDRLJ2oslgZSVg:sgb4mBIBhGFkmAzJ2EZ
TLSH
T1CF65AE1E22E802F5E0FAE2B8DDA64417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fbec9c5fed1d7bdcacf606d3d37998e594fa8a8d0b2833327129c45dca8aeffd
MD5 34e59cfa16da2df0abcb84a124cf0f52
SHA1 812ae9fc5db337a5635672358a7be4cebf69f279
SHA512 dccdab359cfae3d80dedbb03862d13f77e2c7380dd1532bd5666c85599bd2dd0f99567028b3de71f2b28062b52c5728f8b0fddf78a6785357d99d4fd67d146ac
SSDEEP 24576:8G88u8FpJqH1bzria7/mextNIxFaZDRLJ2oslgZSVg:/7ZFPqVea7/bmAzJ2EZ
TLSH
T1AE85F16573E101F0D47BD1388A924663F6B2B8211364EBDF0AA88B551F33AD55B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ccfa144c3afcd37cc6c47c06cc0480c645ed7a5024bf860fcf9e96a9b07bed77
MD5 a0e15c9dc1d2adcb42014b6516e6013c
SHA1 7467776c61b9576a6886a343fbf79c7d6e479056
SHA512 1246dcbae6c46a6eb2ee0a1a2d2880bc425f2efb70a1aebfbca1ab81c4fe806032e37574a940dfe5d263c21fb734667ec4c3268f5a098d09a0c7c9122f0ea128
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjomAzJ2EZ:pG05lO43bNm4J2E
TLSH
T1ACD5C06A62EC11F9D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1b70bd3adca859231a9646df438794a24ba64f218b2d24b0cc69eb164321d92f
MD5 bbea79d9c9b39ad64350870c2a8437ba
SHA1 4cb7f9af84dde330247911dfab4d18779adc04c1
SHA512 368fd5ca73d8c6fcd723521e42b719dac45efd0daf494f582a85d2e38340a20c0fe02533361129c54d6fdd6d54b75fc8dffa4d3adc6f846802a9ae550555f7d4
SSDEEP 24576:/fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUxtNIxFaZDRLJ2oslgZSVg:Ha5POZ3BJt2pasx2+mgmAzJ2EZ
TLSH
T17165AF5EA3FC01D5D5B9D17DC583861AF5B1346253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d57985c064ef6757107e4087987bd503a48506e5b7e2930507233694bb148a45
MD5 c921d63ec1f1b88f871083d0a71c2b9a
SHA1 c1ca7cafda95416166ab45eeed5ce64eb28a47ab
SHA512 7f29dd2a55bee65d1dcf9490e9e6110af53090d2d439865bdc4ddfbfc5f5961f1c2a2126716e2c8cdce8ad1687f29813bf842103611f4056c6f94245c5df2698
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkmxtNIxFaZDRLJ2oslgZSVg:6Nc/zEOVHF7mAzJ2EZ
TLSH
T12A857B1623E901E4E5BBE1BE89779546FA71786513348ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 560bfa0a21ed9421db111c9fe6b953fd187553f7c73e4ff265a5e39dd94662c1
MD5 5aca7c9df16201f6b712ce40132d20a0
SHA1 0fe34a67ceaa7b9370134d7f897567fb1b0665b6
SHA512 d90a7f5cf2cfbcba9bb3c1feafc68032da4d0f70fc4c773fe0fb6c1c5dfe047b7f08cb3156a47965eb7b33511d2a084b5fa33bf542267725679b9620e090f792
SSDEEP 24576:LTkNvNnaFeYhJNtmZBm/xtNIxFaZDRLJ2oslgZSVg:LTMwBtOm5mAzJ2EZ
TLSH
T10555AF6EB6F806E4D1FEC674CD238512E6727861173292CB5290C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 4dd873b27e2fba8caf4483cd6d1b19a4d92112ba327f8707c155699b79b686f2
MD5 48d2b0eea1c9fdcbdd9f3b6d8db478ed
SHA1 0c5190ab2fef7619b130027485e4664cdce4b640
SHA512 0de0be7c5d2eb915927063b4764a3118bd1e06361d79f692fc62ec58dac2c29eae80de1ecd2ae56041a016a09978175f758d9bb1d8cdc28fcb2a911c301e75e2
SSDEEP 12288:9HvUrBFrEjwaQ6AqGbyhVtNrt84ByxxPz9XmMjZRSZ55Kp237t/2oBo9nNRluCwn:9PUr+NQ6xtNIxFaZDRLJ2oslgZSVg
TLSH
T18965E11F62E91CE5E676A13D89828719F7717862131192CF02E1817E0E77EE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9e6e0bbf9373668a3cf29894bc78aa148149303529e3bf00f84493070146a093
MD5 cfcdcac6134ef1d8d794d29e5b626655
SHA1 f6a48888c58a9903ff65deaee272cfe4fc03e0ef
SHA512 73e29bb3f6362f69d3dda354fdc3a8618c167995f82b13f334669b0feed8425124ce4eb6ef8734fb88fb93e71a42b23cc9f824411db094478c04cc4880ea2810
SSDEEP 24576:aD3FHshBIYQgALxtNIxFaZDRLJ2oslgZSVg:aDVHeBIAA9mAzJ2EZ
TLSH
T1E075E17EE69804E4E57BD17CCAA38A06E77138A9033165CB05D481BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-329-0x0000022D60F60000-0x0000022D611EB000-memory.dmp

Download

memory/1144-398-0x0000022D60F60000-0x0000022D611EB000-memory.dmp

Download

memory/1356-295-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1356-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1356-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1356-64-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1980-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1980-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1980-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2264-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2264-87-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2484-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2484-14-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2484-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2484-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3168-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3168-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3168-129-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3168-135-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3168-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4364-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4364-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4364-331-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4364-91-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4364-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4364-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4880-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4880-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4880-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4880-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4972-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4972-75-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4972-77-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4972-83-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5212-36-0x0000000140000000-0x0000000140409000-memory.dmp

Download

memory/5212-6-0x0000000140000000-0x0000000140409000-memory.dmp

Download

memory/5212-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/5212-32-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/5212-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/5380-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5380-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5380-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-315-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5380-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5420-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5420-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5420-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5420-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5544-49-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5544-50-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5544-60-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5544-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5544-56-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download