57252835456ad90cf3193957ff9b68a8926733fcd875e84d1342a30abeaa605f

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.2MB
Sample260808-resqvsstdy
SHA256 57252835456ad90cf3193957ff9b68a8926733fcd875e84d1342a30abeaa605f
MD5 e47b96479b7efd210f57f60581066798
SHA1 ebe0b112008881bdcfe2ef7ea29d248f80b9dc71
SHA512 8d53c8d8d1065dae57647eb33144ff1eb6f8c60343f2b26f3ad9742e78e624ecb4dcb0a1149d72c441426841a653dd6bfbcbcab08ba42b2f3ce73954108d50d0
SSDEEP 24576:JxVIW5Ogp9vHsZ4kah3MWuGMF36YKN4B1Jdi5hbKFlkJtx:XH/p9vFFh3xu37BvdebQKl
TLSH
T17845CF12A7A801BCD0BBD2798A569912F776780603719BDF03D096672F277E19F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3192	elevation_service.exe
5056	elevation_service.exe
5372	maintenanceservice.exe
960	OSE.EXE
3832	PerceptionSimulationService.exe
4332	perfhost.exe
756	ReFsDedupSvc.exe
4256	SensorDataService.exe
6064	ssh-agent.exe
3524	AgentService.exe
5980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\91c26f5be05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080eab8743f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b382a0323f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e6699313f27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000701a37323f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000121737743f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe0ef6313f27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3192	elevation_service.exe
3192	elevation_service.exe
3192	elevation_service.exe
3192	elevation_service.exe
3192	elevation_service.exe
3192	elevation_service.exe
3192	elevation_service.exe
5056	elevation_service.exe
5056	elevation_service.exe
5056	elevation_service.exe
5056	elevation_service.exe
5056	elevation_service.exe
5056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	616	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3192	elevation_service.exe
Token: SeBackupPrivilege	756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	756	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3524	AgentService.exe
Token: 33	5980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5980	SearchIndexer.exe
Token: SeDebugPrivilege	3192	elevation_service.exe
Token: SeDebugPrivilege	5056	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 2620	5980	SearchIndexer.exe	101
PID 5980 wrote to memory of 6032	5980	SearchIndexer.exe	102
PID 5980 wrote to memory of 832	5980	SearchIndexer.exe	103
PID 5980 wrote to memory of 3420	5980	SearchIndexer.exe	104
PID 5980 wrote to memory of 3464	5980	SearchIndexer.exe	106
PID 5980 wrote to memory of 5328	5980	SearchIndexer.exe	107
PID 5980 wrote to memory of 5888	5980	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 064cffa8f8f91322e9585583d3d9c9da6645bc5f2856ad2d5e735b40b615ad90
MD5 dc407aecff39ac3b8df24a71317951d6
SHA1 0c1510fa49282454cbac2e951d65779cf2e450b3
SHA512 20fa2088d57a4133dad9a84a2d157cf9a241ce645ba3108a7a764829bb5fdfd954755b054f74ae2873ca1fdea7d8dc990fc7147422aa4b8d3f71fafa866f4e25
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKxu37BvdebQKl:33q6mjBQv8Ll
TLSH
T1E2D59D03F2D900E9E069D1B8D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9164f97a075e67afe6dd26a8b62e4ba0026fe04fcd6d089f4f066371c2fb0ac5
MD5 6ace85eeb5af4a0fb3b2646792f6f03d
SHA1 d9f1de156fd355fadd9ea1f9541e8fd0f379ddde
SHA512 aaecbf966ed00dbee9cf6eeffb93fc8241f25cd12e29ff891c925edcbc714af23aa24d690423703ed67fe9fde2c8a1b1bcafb6b4b2b9709b5efcf3f43b141879
SSDEEP 24576:OXYfDtczAzMWuGMF36YKN4B1Jdi5hbKFlkJtx:NtcUxu37BvdebQKl
TLSH
T1A405F12963D408F9ED6B92BCCCA28516E6337C510760EADB03E495391F233D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 590633c6c0fc7361d1c4b1e5261cd9c4c6af2b550fffdebcc8cc891e90b0d672
MD5 e7fac61a9b6be5c84554ebfd5f211388
SHA1 7689ce2cf098287adc738b66aa5a7f2cecc5bd2f
SHA512 8b1f86c92cca2ccf03d3c8a0e47307f95ebc24a4591ae148b3c29448a29f8b0d9226dcb528072c8e9149abc77d3f79078c66444388ebb83ec1e1c341e93a67a1
SSDEEP 24576:y0Le5ji0hmxhrMSMWuGMF36YKN4B1Jdi5hbKFlkJtx:yPji0AzZxu37BvdebQKl
TLSH
T1D6359E16F6748331D073C0B9C5D2A69EE97234861B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 485bee78a293f98463e8cb73d32f267a206c220e66457e6d0c3347cd5d3c8214
MD5 458f83bd8828caaafd17dbd45c01f03e
SHA1 1f421151d44651c057e8544121c5ed14edd1ea6c
SHA512 d6410ac50fbf57000190683641e5f987d1384dfb501367d81552f180c4747b333bb25ca6d1858d8ec0c96d34fb20bba837bb8c15e2dcfa254379f3bbf09b7ec1
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWj6q8wyukMWuGMF36YKN4B1Jdi5hbKFlkJtx:t/ezSC6vUzPv+HjyFxu37BvdebQKl
TLSH
T1EA755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d96868466c8aedad680c2d372529aeb24919194ff05f8a477b6c89114e71e95e
MD5 d76306d6e940b37a12dd2315e3af7924
SHA1 1b624b142fd18c42312cde7e53dfb75e6076fd20
SHA512 77334e4691b0f4d9880110d9f5e9b79bb6ae4a6d8d72482713542922850aa9f969891f76bc6768860b6fa74e100602ee40721acacf7b6b2d683a3b0b2cfd3f5b
SSDEEP 24576:wVbqPb88hv/l+BHMWuGMF36YKN4B1Jdi5hbKFlkJtx:wVO88hXl+5xu37BvdebQKl
TLSH
T1AF559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e698453b6bc650c7456492de2ac73292188d5d76d77b7bb640bda5e9dc350794
MD5 62f8acd51ee3a62e5d2a575c5c1fd3ba
SHA1 5d4a6f47a2ac4afb7e13ef7c726b50f51098fae8
SHA512 fa10a344dfb338a89b30bf18b0b762721b5b6382a67a18a54353c58a458a3612b9f8af2cc8c726ef64f1dc7cda81bdbb13a685f36243a0e14c34aece5c0d5d60
SSDEEP 12288:QGWyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:QGWMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T168C4234351C5A031EF2831F5AE7DA95E91351E200D20EDFBD690767CAC7A362E8C9A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 68a633559d18e6cae734e35b2d57ece1a43eb84c353e0e78e20d8e6524071ec0
MD5 85118cd4be5ab8da025f68d2f5b18f6c
SHA1 287534ea2ed00b7fa2f5ac69349a2811bf4128b0
SHA512 85dfc903533a70d89e70554022643609039d16e07b0502475e6449e0e27fa34fae917c3f78fb27f31a765ed2e138eb7049e6e307127946a02867f14b221b9658
SSDEEP 24576:vJIUvMWuGMF36YKN4B1Jdi5hbKFlkJtx:vJIUvxu37BvdebQKl
TLSH
T10305CF3BAE28FCE2C67E5DB95A91C600D77278304F61A3CBD164820EDE235E15D79C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ebafa45813bb3ea6ac0e4a71bb07b1880f5be098be4bcf028a9f8dbf793b209b
MD5 8d9569acb5389d289a06e7fe50be7620
SHA1 c33299a180b6c05530cb19ee2fe559bdb0319007
SHA512 456c8b9e7a627c7584f9cb67d2ff49b0afa9f19759ec140c2677ac360d1bf8f2fe8a33fc84c7b6685b7f5e3921e0bbf6f6b86fbf752eff27431a00e34d13c38b
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:4QvGAdlCEL8c/WRNw5Cdv8Ll
TLSH
T10F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2c03b1d366a45d9fbaa823a41ec9d1a91be7678d14d1863662d1245f70ee0d18
MD5 66dc2ba3d25991e6b1e3e645555e6fcf
SHA1 9ac32cfe508f10492b070b6d29a80b16a7fcc006
SHA512 806d540258e3f69ba6c393e50fececcf7fd46a733e620a6788190430b59e95769108bdf38ac1a201f23150e3f60785b9bc138f57651e50954fc930198e0b86e2
SSDEEP 24576:UfewsAjpMWuGMF36YKN4B1Jdi5hbKFlkJtx:mljpxu37BvdebQKl
TLSH
T1DE15EF31FA74E032C67B0DB61B36D71A543D6E200F611AC3E3E89A9D59302D26776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 223268857ebc38551a7f9e8de10794f6b1dc0f4ca7a32faa827947a1bee9e6a5
MD5 7a62736a1b59dfc608b1b1dfc6d4da8f
SHA1 60a1a5e7cb1955b38ad0b5b3c8aa08448a5a8930
SHA512 f67c7c7f46fe4ea95c747a1011ed3c72fc501e0ffcdb5064a45fd5a9ba8ec5f2e10c8292be09fe6e547ef271ccef5757787b8131831275cf2de35036ded544db
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+0L:VUEtQevvqc2W1cpV20I32+0
TLSH
T19A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 018fab7d55bc7f4b3ba89938acb861b08ac6df9bf41e7b9f9d125548b600ef7c
MD5 3bc6c08f25f05b2f14d5312256a30d6c
SHA1 4eb2b48b81e7146baabc67d8cf0fadc1fd1a3ed1
SHA512 52363c5bbc9687317cbf3b5eadcbc68c32083f118a478bcd9bff0a75962d9d6513b16f02aed88a6cd232c9c67429cbfb5e818863020bcb0145df45cd3c271d6e
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zJxu37BvdebQKl:xoqtVjnmhv8Ll
TLSH
T1BED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a797c9cb7294a7036b2d2da53651c024164cb4763b87d8111fff37fb075c0c01
MD5 d05ae4ecb24c34064c9fa51be39dc36d
SHA1 24b5379435d93129384bee0ae78e927c3121e45e
SHA512 4c2335c84caea61a34cb2f5f1e7172f10b035dde30d6a7ce5566fd7894d7f3cc28f3686143218aeec4fc021c88d12ac242f891aa3e4e9b6929dfdac655773004
SSDEEP 24576:AAhGL6IFoiwtA5l7S53QMWuGMF36YKN4B1Jdi5hbKFlkJtx:AAM5Foiq5Axu37BvdebQKl
TLSH
T16A35AD81E7F955E4F5B3AAB89DB69171EA76BCA61E30C20F2150D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7fbd67d750e061d4ce873e271e5933446126de05fd6449e1f6315f63d45642a5
MD5 f15cd4af31ea5b9dfc498d68e7b10e71
SHA1 ff71f645e08b90badd097ceefb887512f6468e43
SHA512 37f95dc24ccc03d20fb4493a66f694cbc9101cc9b27611e18759f42d497732f893c24264d42bd8363cfcf3df761ede8c83d03e805e425f8a3a279b7ca5243e26
SSDEEP 24576:lwuROWlMWuGMF36YKN4B1Jdi5hbKFlkJtx:lwSOMxu37BvdebQKl
TLSH
T1E805F14632E40CF9E9665278C957C536F7B2BC112A21DB2F5360C66B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9bae54281b887c0ad889b1407d61374682eca9abfb5e2d20c3f6f5a6aca15d7b
MD5 5cf55cba56a5bb6deb8a805d17acf86c
SHA1 989da36328a9340029d732f6eba7fa345de13c68
SHA512 b6dd2717cf2d59bb58a2654e9457e4ad960ed85b5fcfb25e7eca4a7059efad4969c9732290de170fc37e740b915b20db27e750698c4f9aafc35a550ab5fabfe6
SSDEEP 12288:cyZ1Iy5yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:hZuaMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1ECE4128632D460B5E66662BCCDF59A0AD3723C22173183DF566052782F33BD29D39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5729ab492bae3fd26761b0843e47e4a61576366eb3b4e9f491db549bba484233
MD5 dbc89f98ba5a35f18870f9df49b6b8fb
SHA1 38e80d10eec7ffb5ff9bab2b9cfb01aadbad2e42
SHA512 151e6b5d71d814a3b2e73dd20e764e13c8031a80807e820176780cfcbc41bd50b4c1b28ef9ec56f8718354305cd50dd7df86ae78752ee0e3aae1d193f6c6f1d8
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ux:uQRQyi36YOcPDLvw2gAf+PN3sv8Ll
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5bdd455771727ff493453a08c78b45d0a9398fa94949ea354c11b31563b56c63
MD5 fc514426c6d63c961db5cf840f9ee578
SHA1 909e57ff6af94cd344d9aec6f2f6f51fef5b3c09
SHA512 510d8eb18d37d5701dfe67229c9ac08dc0d62c9ff4e53abbd410bd28485c269cafe789232d53b239dc02e71572b4972d8d5cdb1bf4a89446b2df5cb0d559405d
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ux:xQRQyi36YOcPDLvw2gAf+PN3sv8Ll
TLSH
T16E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 12992fb9f26a10c57e00575825b298614ba69a18e233bff8f9cd616684779ff9
MD5 bfda862b9cb391df101cf1d75f639e2e
SHA1 9b3d63ac61f34d0602d2993ba4d6d80aac27c68a
SHA512 55517fdfcbc9214230d38eb6f5a9c8818c6242382280c0dc83aac89f8e0aec08800aca06db0a914e956b5f0aee48f4de6e120945645fdb9260bb28f5f1284a0d
SSDEEP 49152:d68Qg55nhkeWu7PNU3/Zxu37BvdebQKl:bthTRc/Wv8Ll
TLSH
T152B54A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f36e163ba9bdee9a131843ef74203122ed5137e05199787091b2e221354a0d5
MD5 0ecb5ac074e9f33f6f9b3e6035f1fd76
SHA1 6dd5c63e5653dfb1af61724bcd2d8ba97d98c6b0
SHA512 0fb00579e8823994b8d21e8a4480864b10f9e3a5985b424838e608e1580c7ec8fcde98a22c9157965fa032a7b36ad5113e864c162acaf0695884d2f3c72eb56c
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99D:py5112gYy5azzVvU69nLKnhZbv8Ll
TLSH
T1A0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 75fc17d605dee56fe099db4434c2f0486c7fae8d75c64ddc811aa67ea4950c70
MD5 a202a82975211d2fc98a5881cc40565a
SHA1 d0503dfe64f00dceac9db910d680de1d320a6866
SHA512 b580f2affd6c514e19de6640d716046630523daab89e582a4505193a9099f59df3b885c61e52999e2a1640547637d5b2f1aff0930516b49254d842845f71f064
SSDEEP 49152:SB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHxu37BvdebQKl:gu6JmIxd2dgv8Ll
TLSH
T1CAD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d1f525d1fd12b3c2d45936460330735b8cd088e886cbb5045e19de0d2fc0d422
MD5 fa9d96af206c490bab1ba90053a8188d
SHA1 6f26ff432888d5bd9618e56675f8eb9165987420
SHA512 204c4b51ea70d1e893bbb27ecc0f845f1c712c6c70444eb71edd4652157ed4a9069470f31de12f2337580d83fa23920a52d9657957ee95a8fb4613151a832d8e
SSDEEP 49152:f1hpsNoJpF1A67U44CwH7R4xPxu37BvdebQKl:fmifPqRhv8Ll
TLSH
T17EB5AE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 62ba5508e96476ef1535a17843d76fdbf566473916dd0e36f9b54c6c5be4a9cd
MD5 b21227c0e04a78daa0f5dd890f5c495a
SHA1 063e85cb39c335fb92eeb0ef5a2e424caa3cfab6
SHA512 af21601c3183c148c32fdfcfae81c26d2a57bceb7185afaefbf7e32699129a7ea090bd092280d8d8d0d30b03a86eaae42faa6218f0c4d13eb246e700c6864aec
SSDEEP 49152:QSuZQIY0Be2KkRVtOnks6NMHqaxu37BvdebQKl:K5dKqi61nv8Ll
TLSH
T1E1C5BF03F2E940E8E0BEE67487659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7e0838063a96a9e948b38c842e5491fa45879ecc94e856bc43b211805515c60b
MD5 c9f3e133f227b451864181a05913d4fd
SHA1 6ba735e016a06135ef161f7c59f8a9efa06a4e25
SHA512 07ebddd0ec0f84a363ef85634920975bc88dd655582976593517a93961ecd3696d871ac6d300937f839ab5009ca6021f7c4ccf8d406f1ddc79af680d770bc2e4
SSDEEP 49152:uhtSn8EApI0figjgiDn0AP5wzxu37BvdebQKl:vX2iWphVv8Ll
TLSH
T16C95BE13F2D900E8D05ED1B8C7568632E972BC150B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ca2c4255a5cf33a7dea06502b2c29c16d02944d9c5fc9c2457f3bc704c505ce4
MD5 decfed234a99aecbb9e4d751ca550561
SHA1 5d2a52e78a66563213c5da0b391149611d3c0a8e
SHA512 cce16d8d8d5babec8a733f9c52ccd3ae688299ed0450193375f57d6d56cf60199306eeab68e3b9be841039b63886e25cda61b9ef18c3e6afca80609cfc4aa655
SSDEEP 12288:y+yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:y+MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T156C4234360C69032FE1832F5DE79A65ED0351E251E2199FBE6807138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9181edc728783f5ba755c169f767462a04d0c7eb4cb84b75654558f473358dde
MD5 01133e6a3c9be5ad05f3b3747c7cce44
SHA1 249dc58b8d58da2e3fe9327d17cfdb2371f7c79f
SHA512 6c51f19c1bf0d29d61019bb1d22caf68819e3a06c0fc6dac35ac603bd6708ee21a1e51e4a5264eec1b0c4494f4544501b60745de64535218bbc412218a775064
SSDEEP 12288:8dyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:8dMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T121C4234360C69032EE1831F99E79A55ED0351E261E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2592a7336d009d482d23679b051f14bbebd077b7e7e2ade1a0457c6e65deca55
MD5 861b1ab22db768c6920660ca59da0cae
SHA1 97e68eb879a403a645fecfc93540e79e1020906e
SHA512 238b37fe322e308fe1e03924698060e2b234f9f011df6545d41c4aaf654fd4053928fafeeb805e35f7fa67a4d1212d1fb9b6fa39173557decc02f26277a8201f
SSDEEP 12288:l3yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:l3MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1E0C4234360C69031EE1831F99E79965ED0351E261E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fafbc7cc0c0c4e9a335b0c729d8cf6d113d22850d8198ef94761a65dcc66950d
MD5 98ca76220fe9b87fac76e5d620aba068
SHA1 9d3b916435748a95d15d2d8d2a2c714d85fc057a
SHA512 46cefa10b913aa337b4baa199b4694302a5b34f9094170080a30099b4abe2c7a678c480f2c394a914f0be26dbc940ae84f74c86b5a95bd78241cf669ef9c68d5
SSDEEP 12288:bVwyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:aMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T172D4234221CA50B1ED28B2F9CE79951EE1753D651B31EAFFD640213C2D723A1A8A4F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b0835e615714ab2d39a8ceeff56291fce8c18abb9e4b8d61f67520e702939997
MD5 a80ec1c8ab4a2397e99d7f89cdaa8578
SHA1 1a5b56a7ee6fe825455a44327994f7afbdfd0c15
SHA512 11c1edc011e4e79bf53e2e6e9c1a27df664225b9722f63f0685f1f41067e8ba4f7be03fd1a5c089c9f37b5fa4dc8ad0f723deb551b099ed291dff444ad0e7f6e
SSDEEP 12288:LoyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:LoMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T185C4234360C69031EE1831F59E79965ED0351E261E21E9FBF6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 4c2e1badcb3029a9c169163d155517adc5fdcdfd3f85dcde79ed4fa674e82559
MD5 62b4edd1ae617cb997f49e8f9f185160
SHA1 b34aade8879508c8ee353c9aa149fe729e78ee47
SHA512 cc8dc6b19088bc30110aa41efcb611595443d0bc79d73ca600ec77aeded73f9ad0c8bea802a2b048916abde1a5625db6329142eb671d51976e2b0544d96ff0d2
SSDEEP 12288:9xyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:9xMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T165C4234360C69032EE1831F59E79955ED0351E261E21E9FBF6C07138BD76362A8C9E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 af40ce3b73aae1fbc8b3638a29f2df8d3721b6ca4092908d27f6f69a5712633b
MD5 7bd7d05e92879bcd8339181e72a7e950
SHA1 8e3f027c92a3d3075ecf9e62c02492e295c170a7
SHA512 273315790594526de69223a4fc30c5a22005d2d4fc38d7943dc237bc001582e8f4ce3002da9a3c7b549c91e83a0ac8c4c7ca58248256ec2e1094ea28d7f47929
SSDEEP 12288:mVyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:mVMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T18EC4234360C69032EE1831F59E79995ED0351E251E21D9FBF6847138BD76362A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ca0845e0a29ffa1df695f1a07c0aba39520bd4911c4dca17eb14b6b320ca569f
MD5 f36abf56534c8b3fc74ee7074a4b7635
SHA1 82917dc692a49a76a34cedd8fde2d5d16584870a
SHA512 920b21b94ee99c2218ce35c0b841420a681af9df7d8f62f10eade0c3d5c7fe104a3d166b68bd491e736896451548b6c0c1c837c2fb6e7fd37e7a2e292e89c969
SSDEEP 24576:kZM3zFVSO9MWuGMF36YKN4B1Jdi5hbKFlkJtx:kZM3zfBxu37BvdebQKl
TLSH
T1D6050295739018F4EC67917ECD65890AD2B27C1A0B70CA5F13E4362A5F333A15C2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3e962fe7bd07e4a7880d5d3232653494661cc4de6fdffad7eaf1264fb859592c
MD5 533caffd66fec943dde7be54ee11ee3a
SHA1 9b6fd2e241b983828dfe3d8cdbaff81735d601dc
SHA512 329e39da496bbbd8ea9cbc37f1c74dfb6486addd7c2c550b495131accf4259b83d088dcef801ed28e610e2175c40727ce6e3a28dd1aedbafeca00efd9c840b12
SSDEEP 12288:pqyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:pqMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T112C4234320C69031EE1831F99E79965ED0351E261E21E9FBE6C4713CBD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9480927a7dc3e3a5d2857f24331b8530ec528b227e23c28e82223807757a49ab
MD5 0be0bb9ac8c423fd3d5f3d49d544c015
SHA1 0fe682c8153bcd382d2eebb157d48263f9880955
SHA512 f9abb54584ae84efa506b743602425c2d1c06327ad3496304382a2a3d5a9ad0890cca6a2a0e4d0123c1ecf6a3cf1c3458ec3a6839f59d3f48ba9b67f39023bb0
SSDEEP 12288:smyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:smMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T16AC4234360C69031EE1831F99E79955ED0351F261E21E9FBE6847138BD76362A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 47af91aecf085a2b6b5ffb5af3c9c9c1aad6f9f396c31803096c3974bee4a57e
MD5 258c4f407bf193562b5b13b2a0c1c633
SHA1 dff5d45fde3de3d916893bd7fa1f13418ad1449e
SHA512 73d6399fdf93fa99d023a0522eb8846bb9f081be9abf14fae470609f9ab878df1ed78f59a9b7f0c4b4c039e9e72df51ba4dc5ed9a5bf99a08fb0a524e3ea7e02
SSDEEP 12288:vyPz5L85yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:Czy5MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T158F40243729130F9D52652B9CD665A06F3727C320B208EFF53A0137A2E373A19D7AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8f122bcea87d0d1f083cc131ebff36bd5cdb7af4aae5a965b9e0f86ee912203f
MD5 5779654e986cdae9d68437c66ad967ac
SHA1 3e62b68931599e2e52ab35c39c27acc082d40eb3
SHA512 27cb79a301a0aacc56959fa21163bd2d698cdf41fd29ccbe63cd826be100cb8c7f63f1f8d7a1bcfd23dbba11aa727e6850fdb2d04299c202f87cd2a95897e145
SSDEEP 12288:HqyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:HqMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T12DC4234320C69031EE1831F99E39965ED0351E261E21E9FBE6C4713CBD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9d9f7b09aeacaffc269df806e339c0301d3ba17ada8d158db93bc4eaa411ed92
MD5 aabd53c9f8919e2ab30a550a92a58972
SHA1 656d43612986346b4ac6f257bb18f02a51774553
SHA512 d46ff0d4331e8ff3e8c84849177e2cfe0a54ed0ef05d6715bc83aab19375d1b838455d6396907dae8fd39f91965d36d7a3a444ec46f3a0283317272d1f8b45a1
SSDEEP 12288:jqyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:jqMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1C9C4234320C69031EE1831F99E79995ED0351E261E21E9FBE6C4713CBD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d52d16c32a43bff9419859cfaf8ce54a27e2adc8f17e0d45c9b62313a7580f79
MD5 4b0dad4f1685eed43a6e82e5bbd989db
SHA1 4afcdb390b4b16e4af8513694528f313d86f2838
SHA512 a5026f11a641ef2186f4b66b56f4efc532a54b42025095c977d83bc240b61abe475b8cc1b92228a2fff4b5009b639f0dae151f28575d5ed78cd74153499a7194
SSDEEP 12288:MyPz5L85yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:Vzy5MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T139F40243729130F9D52652B9CD665A06F3727C320B209EFF53A0137A2E373A19D7AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 78d43742437a6d459fa9037cf7cf46a0cbee3bf6ecc65f9c9ffb2d7f9a5bf500
MD5 8e6c32c024c1041f53f6bffac8a20c20
SHA1 73a60c0890db17dffa142e1ef50f8bf02a05a3ef
SHA512 3093b65ecb92d2ab1b7fb7812356a86f0c3c53c502f49e059746d590a749131f400cc04ef5c4d1a71db545059df9e4f0ef1672f5012b5be798023eb54edafeeb
SSDEEP 24576:nT8aLl3z0zDnMWuGMF36YKN4B1Jdi5hbKFlkJtx:nT7Lljkxu37BvdebQKl
TLSH
T133050295B39018F8EC67417ECD65890AD2B27C1A0B70CA6F13E4366A5F333A15C2DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b5ea6ef7b9e6fe6e173c1dc135598c5611e861d6832a30f1aceacf96a6f27b0a
MD5 f59748fdd84fd4be44f777b4085dc786
SHA1 acadad29de0de7f0eb5e3e063fff09fad47af552
SHA512 f6251522ec13d090054a36e4d31dab9893a15288924d2a0e8aaa86a4bff92264032ae6afcd5a4f70cc975cfbe13b47811a0ade832dfc1fe4c8e0fd2ddb5f7383
SSDEEP 24576:q3rd9CHKy7GZ7MWuGMF36YKN4B1Jdi5hbKFlkJtx:Mrd9CHKyaBxu37BvdebQKl
TLSH
T17225CE90B3E410E8F0B79A758D769512DA767C5A1B31DE8F03A4262A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d30bcf4d55d9febe112c25bb73f1dc30768f6e18562cbf40ae43d404b657eeb3
MD5 6e99ef44bf5e15bdcca080214d8a3ae0
SHA1 f514f553cb75e313ad8fe6a43c56092956c5b019
SHA512 9a4bd1e2e5f74c2ed8c25a9a3125c02ca54da45668cf45c99768622ab97c09b4d23dd92243481f480a65366ae022f28a9fb34bb13c69bd9db159c3087fe8d408
SSDEEP 12288:vXyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:vXMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1C6C4234360C69031EE1831F99E7D965ED0351E261E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 655d9df3924cba60ee824937dc16a1709fe754914dadcbb2cf0e06650121be94
MD5 c3b09f75f00b33b656c811006072bdca
SHA1 0606ea48a8352e99236466dc089f2fdecf46cea7
SHA512 02b744d9ea4b60fd63c1f16ca0e5b69aaaf5ebba0a9651a56dc4a5e330d43c8c6d3b1b632724cf7c880906e86994ea6d73443576640d3d9676ace3de224c3dad
SSDEEP 12288:FZyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:FZMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1AAC4234220C69032EE1C31F99E799A5ED4351E251E21D9FBE6C07138BD76362E8C5E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 be9a81383b07f717d377e3d4c1226d8f42ee88c3857a93797e500533e94c8c90
MD5 00e5a248e6fac3f5f8a86904d3b2c70f
SHA1 995aaa014fc65246c3ade865976eebb3e42fb1c6
SHA512 e3472350ee062b2e5aa07764726df802e5e82d24b86fea84bda0bae9d7c8680aefef135842d77612966662abf7ba0a15fa003c9d89479b3c629be01e9f835af2
SSDEEP 12288:s8yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:s8MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T18CC4234320C69031EE1831F99E79965ED4351E261E21E9FBE6C0713CBD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 466fbe2f11b5639d073ac392113f541f6c0b64f7d3329a2463b77aa758350aa9
MD5 07f8a1ec778d22bb84e139ce1d796945
SHA1 246605ab4d84d0d06bca5935ad33db1fa81e2069
SHA512 aebab12f4f3fb53d89bf3a4b2ebbc01dec68b7b26d9db766fcc431ecdd9eea649dc9fd03751fd3c27f6bf1dda871c4b911df826d20c8a6d377f3d693609bd035
SSDEEP 12288:7qyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:7qMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1AAC4234320C69031EE1831F99E79995ED0351E261E21E9FBE6C4713CBD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 65d048487341c875566adedb659d79ac68f15f6a12408f1a9c449048a8f9b04d
MD5 46819e93cb6e3bae63fa6fbe4095312e
SHA1 d69f96e81b010c744edb1d63c6fc0e88a639c109
SHA512 0bae23f3069d7d65179ec9370fd1cf0c00543489b32e5ca5bd99aefde51e4db4d674e922807c3bde3886a62954513d494fcd480bc44156ff290330b1ca4062e3
SSDEEP 12288:oXyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:oXMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T10FC4234360C69031EE1831F99E39965ED0351E261E21E9FBF6C47138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 88892fc4fce4ca2e83fc6c32315f4504268c4ebcb6ba589919bebf267c55a352
MD5 6a6a2665e090a18af1af1b436cc3ae56
SHA1 f06b3c10843d290642b228cff9e39fd280916815
SHA512 13babe6cc78e336ba34f68a87e3ef152116aefbcfa343b331d9dabeea2bffbfae93e3af8018792bba729678ac242e468f75b0ac8af9525c82e686826f648f494
SSDEEP 12288:UCyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:UCMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T164C4234360C69031EE1831F99E799A5ED4391E251E21D9FBE680713CBD76323A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 6fe38a742b4b1593ccfe69c1eee99942dac13117f54fb5cf1ac20596a96fd4c7
MD5 74559c996ec3dfafb743913969ddd17d
SHA1 cd1ca712e8b81b3f8ab07454e5708fa36b1d0ccd
SHA512 2fb4ff7e6e6e97491d8956471db8de1a88a2237ad7f1dcf53cb2297dff6f358fa167a2a6a565d948e2f5b488a9ccbbcdeeb7fe6c1bb9e541c82fdf7724fd7a73
SSDEEP 12288:4oyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:4oMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1EAC4234360C69031EE1831F99E79965ED0351E261E21E9FBF6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 dc301152bf6890fe75677eccb60b30e117704339a714980c4f609f040097595f
MD5 91a740e64be6b834c17270ab84111676
SHA1 ce8ccabc8869b772ebdbe659bce202d0ac956091
SHA512 cce641b9bebf7e8eb28463442a4f06b21b2ba3c7a93afd9aa5cadf5c9a6297bf3ad000e05873655ced815114110e82c5b830af86b535e3537d0c446ad5ec223a
SSDEEP 24576:Efwvzk9RX6wkyAI2MWuGMF36YKN4B1Jdi5hbKFlkJtx:PMnYI2xu37BvdebQKl
TLSH
T1E435DF29EBD844E5E177927C8DB7460AF2B178691B31C6CF029A536D0E33ED0AD39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5c87b2476a418c97593bcc6c56d463f561f67231189b5dfcdba87ba8743cd657
MD5 bd1f4d036598367c9b6d17f7dfd4accc
SHA1 138868f05319ddcce4a38537cd460fcb9140f661
SHA512 e7a4f49223316df5587a30af8863e491368d15acceecb4d45f7b65bd99ff9475188872c7ab58737ff9bb83b5df93d3852d681293668994f85d91871ab33de714
SSDEEP 49152:4YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Txu37BvdebQKl:3ySzPMv8Ll
TLSH
T1E5066C96A1A841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f145c1bae99c3eeaa9f4a22950b6c6c9ecc2b23f763214d62228c5c32d9420f1
MD5 3b236ead8cdcf8e29d44924aaf81d026
SHA1 8bd29c944b2ea72cb65131ea7c7e210e2a0ae87f
SHA512 0eea2b0185fc57cedb4bc86282c7a00a514fdbd620f87b493539507b5c53241571df7f0b4f391ca1321648b5d96d3b74695a13751f3eb5dec0fc73ee2346088d
SSDEEP 24576:x47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYNMWuGMF36YKN4B1Jdi5hbKFlkJtx:x47JUQjqirIhCnDHUPfF/jxu37Bvdeb9
TLSH
T1C765AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 14419f96ea327bffa4f0b3523abf59f65b6dd170f083d43da13e5f6656320ac8
MD5 295ada8748731298760457ddbd5e1d64
SHA1 97636598fc602c7a246c510844119151026ed457
SHA512 ca9a3174f63ab7933fe20ba080b7d48a932123103b163eca62d36ca2cc250c4dcc891088d98dd2a061dd7900bc3df3d1c18691cfc6a602ddb009f7cf48ff1062
SSDEEP 12288:bpsfayPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:saMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1ABE4F10AD28801E8D46E62B9CB668A45F3333C2547E1D3DB92C0F53D1F76691ADE9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 df560708fa3147c5ed06aca12d79bdb1bff3b65965792d6f9b8429daad5a3bca
MD5 02d7c570c97207542e06a6706b9036a6
SHA1 8b4b954d1b12f3cfa5463493370c6eb9bfbf0b12
SHA512 8aa19fb0eb80d2a0c14ec1fee1fee3dce7dba244892b722c8eebeabe420b8fdc2d22e4cd2b4f66701cd576db2f6746790a3b3719f06d37c97503129ca7e5bcc6
SSDEEP 12288:/pFZ+HU3fHuWvNIJdFqHXYMx/k8bsnFDxx1N:/pX0UPOWVEUH588bcBxP
TLSH
T110251710766AD75FC6AD40321E33D1CCA7707D41EE09AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a4e6f91d91342f9c973d247d80a6688a4721fe9f4043343d6c312faa26187ac7
MD5 0b259b845931fee92f6c2fc18b9cb697
SHA1 d1e83c2e95cd68e856b0ba35815262a334c66b72
SHA512 67b294d9837417097a7f35d5c047f7917ddc0e7b6457c675dd0f72aa26d392fd3f53454ed078cb6ed7c157ea0eaff03a8566eed0b2d122e1a0e17aa065fb67a2
SSDEEP 24576:6ISe5wn6xYF9gWHA3nhck1P3fwxZfbVRL+EmfxOit81VQCCfjO+:6ISe5BxYF9gWg32mP3YDzbyhZ5wuCCfy
TLSH
T15865D9815437E3DFD1F66032072A9B4CA774EC0673059F26B3C8553AD82AA66B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9749836fdae091a2be3c648cdbfed9a1145d16db8be13e2ae25e24ba74f94c0a
MD5 181b04f848fb49f9623eec86d54db461
SHA1 19e99f956b8edbc5ddcef0f47fe4c241ddcf1243
SHA512 6144d3155458cd3555bfe11ef1c3004abfb45dd0c4642a39332e68b19bcc5865a788ff2102217a687fe17934ca1bf128daac39aa70423e266269b780fafb0e6c
SSDEEP 12288:XM7yyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:syMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T18CD4225261C99431FD3832F45A6DD529A13A6E240F20D8FBE6407278BC766D2ECA4F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8ff2bfc3e5a2822389f1933a542e3a95576eeae915576712967f5325854850a
MD5 5495c2594561a9c05a92768c73d0c8fb
SHA1 8e446aef9904c306f469dc249938ec25e1212540
SHA512 e63990625e3257042b2fe641cc48bfc7e387bfce342e53158a6dd315ae8dc1c3d21728601dbaeae955f76668bf3035d79ca77ca3f1f6b9703adc1d15915467dc
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYkMWuGMF36YKN4B1Jdi5hbKFlkJtx:Qgb4mBIBhGFNxu37BvdebQKl
TLSH
T1A8659E1E22E802F5E0F9E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 45611cf72e8b011efcf09baa3fe4a8b280b5f1eafe6e9a9cdc68f3314e73185d
MD5 f23855ce41ad8e0c1b4e38f6dd8e445e
SHA1 ae4cca914bd5bc5213b09b1adb6e7cdb28ac17e5
SHA512 7cf7ca26c0582d6a7207ae4e1668517f623fd3b6c88ad0bf19fd2ab48eca93b4f9518088fee840bfbc5b7fab01cfff1555fb4194aa88d2a6b5f9793ba1dd2b16
SSDEEP 24576:1G88u8FpJqH1vzria7/m9MWuGMF36YKN4B1Jdi5hbKFlkJtx:47ZFPqVya7/cxu37BvdebQKl
TLSH
T16F35F16176E101F0D47BE1388A464667F6B2B8250360EFEF07A88B551F236E14B7EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 71998ebe8f9d2aced6e6ac8d6622c8aa06dc31892d555346a254531b3652c059
MD5 7c5035cc4d371d47bcb3d8b9dca9390d
SHA1 8298e6541ae143dfe341761b6955e0fe8c630d82
SHA512 0eae1702ae44732457bf3c4944d0ef6c5160baa597a4c5493837c18e0a7bf022703eeab6b818607e8793329165f732de1522a4b5afb3cf66efca57b6ccdc1b79
SSDEEP 24576:tPUr+NQBMWuGMF36YKN4B1Jdi5hbKFlkJtx:tJQBxu37BvdebQKl
TLSH
T1EE05F12F22ED18F5E67AA17D8986870DE77178620711D2DF02D0817E5E23AE8BC3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b72524afdfce9cc724c56c1eee557ee00a358011efeec4a78a4ac3e9eafac8bf
MD5 ff93685bd8ab9903460cf7f8c5eb42fe
SHA1 e1e64f30f0684401adac4b832f82193d703a5270
SHA512 cc5e60da6726a8b7043aa12ed2050f62e339cb2a21086981c761405a48517a780bd6f1a7be383a81bffc2ece4c9755904e5c55f5bc7a494638c98faa896c28b7
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxxu37BvdebQKl:JG05lO43bTv8Ll
TLSH
T190D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c8bebe4ec62aa196ad616e38d91310704e055e967b57344226e0f3273d3f54be
MD5 12fae5a3774c5c2a62f7909bf9af9dae
SHA1 9cd1af680cdca261fad1c2eeba4577e6af05e13c
SHA512 f66cce431d38f932d87311948df176905aa6a287f473f05c747e9cb7241f974e83f88da4154a0b2045392a955542c3b9e1f98f3f337e476db05efca132f28bc1
SSDEEP 24576:Cfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnTMWuGMF36YKN4B1Jdi5hbKFlkJtx:Ka5POZ3lJt2pasx2+mZxu37BvdebQKl
TLSH
T10565AF5EA6FC01D5D579D17DC583861AE5B1382213319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6d638eebd3bcabab16791ff4d4eeb6a1e2305f97111f905ae4f874d2a902f8cc
MD5 455ee895f2e17612d88ca7d89ecb4c49
SHA1 4ea194f3cbd4e2c8a65abbd20157121890156584
SHA512 797c90dd882c2cb3a9128aa11f7e66437816eb875f832bb97017ec948b663236e35e10a2d97b38d284ebbd128d161117f135480de9293da8c48eeb2b00837ce7
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkFMWuGMF36YKN4B1Jdi5hbKFlkJtx:LNc/zEOVHF8xu37BvdebQKl
TLSH
T1AE857B1622E901E4F5BBE1BE89779546FA71786517308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5bb446b792a685dacdeea53d3c71576177e19c8daaafaff1dc4a3acc865ddb63
MD5 47e342dc9ed9e1e12134f8df436f4039
SHA1 ce801fd89207b2b40b67e65fa93d3825eee36a61
SHA512 81afb078ea90d7db3c9b34f33f15d33bfbf0d0d5caaace010a9b67bcabc965ba9a12f23e253e55036575e8a0f0072689192793b2ef16af170335b677a5baca07
SSDEEP 24576:2zkNvNnaFeYhJNtmZBmrMWuGMF36YKN4B1Jdi5hbKFlkJtx:2zMwBtOmrxu37BvdebQKl
TLSH
T16455AF6EB6F846E4D1FEC6B4CD238512E6727861073293CB9290C13E1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 97f7f5725f142080c5849ef81957eedcfb922167afd9a68aa4edcbe979eaea89
MD5 910f21a904d1accf01457635e1c303f7
SHA1 fefd7f68be6eb24071a6511dd647819cb5c506dd
SHA512 f5478008ce8c30289345eded2b1d08fd61e9751a11a94187b3092a633c1d62a26c240d355e9f3df92622ddd0038a75b4811dd7c26d9a1a3767b5be41b55c5ef0
SSDEEP 24576:eD3FHshBIYQgAeMWuGMF36YKN4B1Jdi5hbKFlkJtx:eDVHeBIAAexu37BvdebQKl
TLSH
T19B25E17EE69C00F4E57AD1BCDA638A06E6713CA9032165DB02D091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-0-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/616-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/616-2-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/616-16-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/616-15-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/756-332-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/756-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/756-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/756-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/756-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/756-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/960-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/960-297-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/960-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/960-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3192-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3192-20-0x0000000000F40000-0x0000000000FA0000-memory.dmp

Download

memory/3192-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3192-27-0x0000000000F40000-0x0000000000FA0000-memory.dmp

Download

memory/3524-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3524-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3524-131-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3524-137-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3524-139-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3832-78-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3832-311-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3832-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3832-72-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4256-104-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4256-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4256-317-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4256-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4332-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4332-88-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/4332-83-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/4332-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5056-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5056-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5056-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5056-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5372-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5372-55-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/5372-51-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/5372-45-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/5372-44-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5980-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5980-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5980-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5980-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6064-119-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6064-125-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6064-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6064-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download