9ef16d98fb0387f619fd1305441e53b9a0964a150d3795c2897797c5f81ae38b

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.9MB
Sample260809-nchw4adr91
SHA256 9ef16d98fb0387f619fd1305441e53b9a0964a150d3795c2897797c5f81ae38b
MD5 0f6a15b47e3c826dd953adc3d840eff1
SHA1 4751c1015fc6bad39891cbea8f091933c5674a91
SHA512 0bd44465217c41aad797fe00b925964cb51d2ab955d5a140835551fc41e72a0ab4759d53d9783c9933d7ca419b2e3e9caa24c709fc589745df42b0d388585929
SSDEEP 49152:xi0BSWtOZvUmg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTq9Dmg27RnWGj:Zt98qRFTauXrD527BWG
TLSH
T115167C06E6B940E5C0BBD13D8A979647FAB1385AC73197CB46A1875A1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3936	elevation_service.exe
4136	elevation_service.exe
2876	maintenanceservice.exe
4696	OSE.EXE
120	PerceptionSimulationService.exe
1224	perfhost.exe
1876	ReFsDedupSvc.exe
1108	SensorDataService.exe
6068	ssh-agent.exe
4684	AgentService.exe
5816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\49b1c3c624febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-09.1115.4736.2.aodl	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3201f5df027dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed28ed5df027dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006354f45df027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fc02e5ef027dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dee14a5ef027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083b2835ef027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048eb60a1f027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7456b5ef027dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096310960f027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000520f6ca1f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098a2455df027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
4136	elevation_service.exe
4136	elevation_service.exe
4136	elevation_service.exe
4136	elevation_service.exe
4136	elevation_service.exe
4136	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4736	2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3936	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4684	AgentService.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: 33	5816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5816	SearchIndexer.exe
Token: SeDebugPrivilege	3936	elevation_service.exe
Token: SeDebugPrivilege	4136	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 6120	5816	SearchIndexer.exe	100
PID 5816 wrote to memory of 4504	5816	SearchIndexer.exe	101
PID 5816 wrote to memory of 6000	5816	SearchIndexer.exe	102
PID 5816 wrote to memory of 4756	5816	SearchIndexer.exe	103
PID 5816 wrote to memory of 5968	5816	SearchIndexer.exe	107
PID 5816 wrote to memory of 4216	5816	SearchIndexer.exe	108
PID 5816 wrote to memory of 1136	5816	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0f6a15b47e3c826dd953adc3d840eff1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1224

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f6592e38ec3196dfa7cfb299c1de6b130e03d2a05cc772b0d6e3f45f996d5884
MD5 730999236e70a41ebea5e23b0bc1b272
SHA1 55089705f97a1ae77536db81217fcd308f0bbc0b
SHA512 ded2af80fb4772df36bb18e2bf15c63012f8f660ce3c67ab9c2ed5f2ed1c086e24a11603d88a5ae9e4febe7568239c77a7749606161cf1b9ec0a2ab4acacec45
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqDmg27RnWGj:/3q6sjBZD527BWG
TLSH
T1CED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e03087494a6be8168605ea7ee469c88e4b74637e2410347c69b81b0c463844d2
MD5 2ae58aa2f8f349d550a4b724767ca716
SHA1 7251d98dbf5945f9b72b4b9c080eaaf070c113dc
SHA512 4a247f2e60f6c6bc0b599749a4a52d0cc57d7951cacb93ff1aac4ee5d833ee38deae3f481d260535feb76ddb7f5e2277ef7cdd32a72f99fdd715a13f834d124f
SSDEEP 24576:gXYfDtczAGsqjnhMgeiCl7G0nehbGZpbD:Xtc3Dmg27RnWGj
TLSH
T190050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b1d74770c1490be8ada79a5dfc2895132df2c76d5da76143a73306e782bc3cd8
MD5 aa8593dc2a62475c67d788eb7bd1840c
SHA1 a9958db25fdbbbc1942352fb133fdc6b87cfab13
SHA512 561a32ca1f4838321d9e66d53710dcaae62e2f02e2da8596785416e2d57fef11b5a198893e73c96f003ad70be5f38571f539705f7fe3c7ac1d67713e5b8d61df
SSDEEP 24576:Z0Le5ji0hmxxrMBsqjnhMgeiCl7G0nehbGZpbD:ZPji0AjQDmg27RnWGj
TLSH
T191359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 62da8bad22ef8af1e3d80882aa244d8c54fae6a89a3d9af85db3aedbdb02782e
MD5 158591c1450972297fb22cb0db1c4916
SHA1 32289b3a7debc229ccbe532a2ee2ef2ee76d8759
SHA512 78d99a6a3ef17432a4cf443d287040b78bf1a7fd75960bafa95f6f0435b153618ddeaec75cf60e19a0035e29d4bf66b3a2fe3ec1931821a22bb822a9990eebba
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWn6q8wyuDsqjnhMgeiCl7G0nehbGZpbD:y/ezSC6vUzPveHjyUDmg27RnWGj
TLSH
T1ED755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a130077ac386bfd038843d84324a2b991f330eecb573cad6c40119befc151d4a
MD5 ea5007880bda37810a682f531efea191
SHA1 43b29f6d0e27c3f53be768901d33fe33b8564202
SHA512 d1ab8b08c62b28e1a8fac5cdb44cc39d46ea026f068bbd516c5cde4cd8b2386ddaeb950c6884ea9dd23670867d0feea2802e38416b28d30389232ac6f9e50c80
SSDEEP 24576:AVbqPb88hv/l+YysqjnhMgeiCl7G0nehbGZpbD:AVO88hXl+/Dmg27RnWGj
TLSH
T1EA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 268b3b916bbcd04ec648521ee4ae9407d93498646c5e125cdf60cea547388991
MD5 e733f2ab06c93fda9e0d560d6d70eb34
SHA1 2bcfb51d0763e4da80ccd1ed440e25efc00754e9
SHA512 2935771a811322e968fc91317a5b9d5b6a99334316d3b9e8ec6ced899f668cd8234d6854e227f83c86763ee9dab7bf4edc0ded022f2d75da615781debd59324a
SSDEEP 12288:ZLtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZLtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C0C423BF874C50CAEB7608B583E9F11EAC177E56982008536AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 54a2ee178d32a891449336285ff3990c2aeb5cba56fb02cb50e0c93859fc955b
MD5 475ce60337d7a5cfe6bfdab9a1e276df
SHA1 c0489e8778323d5b1e48368e531dbeb33ba47b0c
SHA512 53acbff88f923b71b1a26601ee24dcdb3cd781c9d3db33e30eba26990fcba459cb114762426fbcdc4a3a242a2a97899196471614dfb4c352304c442d7b127da8
SSDEEP 12288:meBNUbTVO86UqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:mJIUqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17505CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e4fcaefb4f373094e329d46607079a018fc5e917df96da6a18594042c743dc2b
MD5 69111cd6637fe07cb269ff86097ba7d7
SHA1 69c4211221d82837051ffdd2decd0d9b8616a850
SHA512 356e234f68e58448e09fd0cfd3f9fe2c5795da3c9693fa365cd1fb90f4e702af3d390fa2746aa6755230184482b551f5753e0f09fc734ca8fe510e082434d65a
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:WQvGAdlCEL8c/DRNw5CXD527BWG
TLSH
T16E266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5bd74c5db9e2a658dc4e82567b034dadad43ec263391d068630b278568bb9c10
MD5 30266a265a548062666f1b7c1191a988
SHA1 1cfdd23646783c9566c4cf39ae11b6edf3df78a0
SHA512 a9d5ec1aca91806cc284b4d93939ee7d4dc9ec31da6b7a5d44b823bd2953dfad75cfda7fdf8307716a04de8755815168e576bfaef9aecf3978ba9ef27a3e2754
SSDEEP 12288:lAwSfxL/2Dc3RDLLmt0LDQewsAjEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:G0ewsAjEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19415E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb7533d5f97d62f53b970382da631123c5add278695e5fc2d143a3d18896a6b1
MD5 12aece08b6b64cbd911585cf613ec12b
SHA1 bd949a0d8dfe466b8c9a7908660105863961fb2e
SHA512 2c75c8e39d73d99f1c0cd5059352bfbd29aa17ce8a830b1d8f1862f7ba140fdfdb22e71c743081d5adb9d19f8320244f1be64039499c08ad65e26deba5181943
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHYVQBWG:AUEtQevvqc2W1cpV2tI32fB
TLSH
T111474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c44da7d25ef5eb78465f955a8e660eb40ac070e38df719600da7829c083a0122
MD5 567c208a5e3d81482a7db90ce83154fe
SHA1 5f121a19da5a61edc0e4a2c3fd20a860762b46cb
SHA512 1a631ba5a5e96778af8748674dc9a3d7caf01bd00671c8f3843e7ff9c861a394d472c5bf0f2f40d027cb9e7611a9e8275176be437e4a30e4f1b2787f4790bfee
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/zADmg27RnWGj:doquVjnmbD527BWG
TLSH
T192D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 87a250c011c6ded261ac4d8f1b8efe1f085a2c38a3346f37046ae8870241bb26
MD5 65affa28cb433fbae85dcb018b1d6124
SHA1 ea5c34800bbadc22c86bd4b59fbb43d8aa131caf
SHA512 f2ae370d902d9fbd95a3605eb6808075b157a97f7fe79a987fe60c82edfbb52ea2a638176fcbae0d2682b52d10e8affb44ec1f6ae7c616f1605b33612cb01392
SSDEEP 24576:+AhGL3IFoiwtA5l7S53nsqjnhMgeiCl7G0nehbGZpbD:+AMUFoiq5rDmg27RnWGj
TLSH
T188359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d589902ec13cd9affc2daf1694bd3d0d38d5375aca77dcc1229dee80e5979da3
MD5 f12754ff941150ff03365d1bb2635c8f
SHA1 814c4d3464ba441803b9fe658d243780c36c5d21
SHA512 b184397c270899c337f4bcc2f762df1ebcfbeb4a445656f1d533e0ef623b085350560d6e15b31612f6522d06c3f8c6cf24cc7ed33d880689c21a646e273174ae
SSDEEP 12288:Smw5HEjsChNVBFgl0WDm+CjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Lwu4OWIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11305F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5ceea57ebef8eb8e4f274c45bb9b9ab8739b94b459d64e0def811c6b17306fb5
MD5 553bc4033049eb89b233f9394929d7b8
SHA1 423d0f461c1c1a8c006dd5bdc235a5ed9ae71aa3
SHA512 0c8ea66c7f30b225a0b068ffda6fa989a1b4d859abd6e5769c5df60938f7533a467c3f5fdf5acc81f2616e2f08b752f3a73726c4d4fc287a080a075ba962e085
SSDEEP 12288:GeZ1IyUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bZuZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D7E412AA239820F9E163417CC5E5D609E7333C62673043CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a180aebc7723fcbf68b913f83c8b860c7a503db86635dff5165b4068d43ccf94
MD5 798ee6ea73519d046fe92b8ccb919aa6
SHA1 3507b9fcfb58ae7daefbc7eca84a97d449f21966
SHA512 6b168fa116c31fef5e41fda34464fbb89798b892ac5c311c8dc7c09e0c67ef54422502733108b620f60819959d8579c17ee11ca0fee214fff79990860a1ad481
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3yD527BWG:aQyiKa/X+PNiVQBWG
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0d9787119fa1beb20b1ef756309b540ce8443aa0436b1cb6b7eb837e00d14acc
MD5 317397c6262b62b5a892dc77b0ffb7d9
SHA1 1d99a9b52e513a73488efaf311e709ee94681c2c
SHA512 92119f921e83d204388c861ee507f73ac0b08b9aaaf74924cd6bd26bf4cd747b06d26462e48bf4217710607343e70eac8db00d0c9ba95672efb2081998246d22
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3yD527BWG:oQyiKa/X+PNiVQBWG
TLSH
T13E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 42f67336aab4baf690718642fe5f94924c4b3290b149ab8720fb4d5a1c3a7830
MD5 5292ea9bb20ab2d389e6cda791ae9648
SHA1 4a82ff5cd266f3b25d23fadeebfa42f02e5b340a
SHA512 300ff0c60ba1dc2aaaf647d386656267ef78e1e0876ec9c84c649c3635b2767e95e6e5e78acc58b4c02701716b8ec0d775dca3a35b4aeeaa2a6a9ccc818d5fad
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JsqjnhMgeiCl7Ge:G68Qg55nhceWu7PNU3/QDmg27RnWGj
TLSH
T16BB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 87503dd29105089efe3939a3615ada1c8090fecb241304a3476f0bf147350bd6
MD5 92fe78c0dce368a2d3d0ffb043ff67d5
SHA1 fc21259e1bc90521dddabfb9e003470483e1b2f3
SHA512 bc00997238c0c08b68bc549424bcc8f18e5f58d9459fd3b159846324a0492a3076c6b5b1e5d02b90524f9eb18cb55e1c863a8c8d9f9345278bf72ae704fe954b
SSDEEP 98304:fy5112gYy5azzVvt69nLKnhZRD527BWG:SLIHEWhTVQBWG
TLSH
T1F2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8fec21c6ef2162309c6a12ea96edd3147fa1d7a77f77662b95db1b2aa8365171
MD5 3f322384fcd2f255e681895a877694ba
SHA1 4ca4d891bf517f142cc5823493965bc6165cc18c
SHA512 a232fe8eebb4631090b129f4418d9dbfed1d6d2551d98b50c8ca9c5e5fccac8d5b4415a02c88f4318ee0f38c6acbb5f49bfaf294f62b7d9c9acf3a9c182ab8cf
SSDEEP 49152:rB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNDmg27RnWGj:9u6Jmdxd2dND527BWG
TLSH
T1BCD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e6103b86222f52d8788010ecea35a7ba069656691547dd3a97ba7dbce5e8d621
MD5 ea018bc77d304351c3a9ee76f44accc7
SHA1 cc6067e5391d1f2a6a5478812e002123f179f818
SHA512 fadbe22ecf6d3f6f325ffd50e44b456892c9316fb486c2ce06ea1045b58d8f7341ba89751be3fc188facf89528ff99ef3e4e73b79ce75916f08705a659fa199c
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xeDmg27RnWGj:WmifPWRbD527BWG
TLSH
T126B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 47c4786966a9ad1780ec060c01b936fb761ef0c6c9a858adac8309a73bc90d76
MD5 a92f42d5c3dbf215ff96e8c9e8170803
SHA1 70c15d8caf4e153a74655da72a60af815e7a4951
SHA512 40de045895f481f8ea06c8db455c5a1a5d07325d0fea8a332e13ceed2db5ed08ab9b793c622da5d6e4e5514342db601eef4007c7263ffb47fe92abff51381a2f
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqdDmg27RnWGj:25dKii61dD527BWG
TLSH
T118C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f5176072caf2f20b79e2337b7ea7d7ceaa407d8675f2dd1208133a1686ab8e9c
MD5 301e88a746a47416c50a88a17eb40171
SHA1 ac5a7c21b06f06f45e15a6deea3f7126d8bca62e
SHA512 6c186a39e68436f97816101d7f4aedb6c612c1484b7ad030c9944b4269e74e63f198cf72e414b842a6282b0f587d95be2346c143e582c6da8673a4be6439576a
SSDEEP 49152:6htSn8EApI0fig3giDn0AP5wKDmg27RnWGj:7X2imphPD527BWG
TLSH
T19595BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6a53854e65304967b78591cff15f5e9f97f8f821eda3eb025a49274d530ee7d3
MD5 b5ced49a56546f4c84d463417d6cd50f
SHA1 b98adb356ff20348aad8e75398f2c8a1ac3ac5a5
SHA512 2cb38c88e2b327f9562d5586198d7a541f35850984c14283b7f292cb434498e69616d2e6095b7fb836361a3071b9b72d90e1dbe136ec50eee318f7407e1d3411
SSDEEP 12288:RlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T152C423BF965C41CAE52245F5C3E5F10DA8073E5BE92004937A9B7CB9FAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 85004434ddccbd16032f8acf2bd6b5170c7fe4b6832af93a5d4f11e450def173
MD5 f545be51dbb5200a85e0696aadd04ed3
SHA1 49e26cff3d826a9c661f19ede6d00525e6371100
SHA512 c7c70ec9d6d4754b68f40d7124ef6a7a663970b30cfdcbbddaec2456cfeb8d70a76a5de6fb81376e10759655832f94943236530261bfd461af950a4b49fbfbec
SSDEEP 12288:bQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FEC423BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 80b3a841bab957e7560973bf0e0505d616b2003428762d45e93597cf1c154361
MD5 37af9ae289906958621662082d2f1e43
SHA1 0a2b50e31b2f45c4ced555fb9fcef71c32bd45b7
SHA512 a03758e3a85024144dd1b8b292bee02f22281678639a28e90025bc818482ef5ab4279796eba8fdeb9beca324868fb2d2cb5fdfb2dcaf23c651812837762c1c63
SSDEEP 12288:ziXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F6C423BF965C41CAE52644B5C3E5F14DAC073E5BE9200493BA9B7CBDFAB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9ec8738c6f77d9881c9b72adb8310d0e9bd05feb317e48e6daf3e5f3aa48c588
MD5 3147332db5c174c8870475256539c31b
SHA1 92ae9876290a29675c7b707e8a14a25535865158
SHA512 e0dbe0726cab366e460e0130e95a512e50be4d9cd201e9a0963844c9be24ad5bc33f53c87c79bff88029920a207b2230303fa285628e138b66095da093ccc130
SSDEEP 12288:LVHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B0D4237F675C00CAD83285B4C2F5E11DE8277D56EA3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ab2bcd0a5397b85b1b55d25ab45ac919c850442e98a6f0000d547a23064f8476
MD5 1620faae5a686a6a9c831868cd01ce1e
SHA1 f0132f1e00a114e76f8ec1391b9e1dc21721c4ba
SHA512 5d8f51fa4cd839edde5909230b904d211b16e83b7c0ad221e236056a82e7d200dc62d9498a79cd81a13e056d929a10991dc4d8ecf80ee702399329f2465f15af
SSDEEP 12288:2PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T191C423BF965C41CAE52644B5C3E6F14DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7a31abbd8e4cc0bef312ce98b33497385f6dda9b3433a0bd48feddadb48e76d6
MD5 ba0a9f3017a13dff40de994c7559671e
SHA1 0267d6f5fd66f61e97a6324abb811d427e34f464
SHA512 bc151751c061f1a10e3ea81f70c44ec5f9a50b32887ec9c81e81c02ebcfc7d2847454ddb3500e45a578d020de3831e2398f98e7587c0151c7335b7cc3afa40eb
SSDEEP 12288:s8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14BC423BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 933ae11d09dac6dcaa89761e0e14c7b54413da98cef7d88beec55506bd3b74a1
MD5 86b9bfe30cb75694061997068d9135bd
SHA1 9b4c328ac9ec7a0321bf9c2dec5618b23849aca1
SHA512 d617ddba2fdae28f9a31c57be3323abadb23ada656df0ae9f2c3c4f813745575da0ee6bbb9766a6433c28e805df1abc978baf5e08c45f56e29f6038755c72220
SSDEEP 12288:E4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16CC423BF965C41CAE62644B5C3E5F11DAC073E5BE92004937A5B7CB9F7B24684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cd4515dc7c09abc4cd83920f97da376d65967c1393847d56e94ffb95a1384dad
MD5 2e4e625996ba4bd30d28b5f688eb0c99
SHA1 e563e8e8fb578f8b870589b4dcfc737acf9c2850
SHA512 65cd97177f53aee9b5da1ec76c3dbbf54c298108f27a98088524ee1f19a7b3041c0a65a6da701e34758d69658545435c3256882c5c6581cfc1261dea031becaa
SSDEEP 24576:8ZMRzFVSOwsqjnhMgeiCl7G0nehbGZpbD:8ZMRzf4Dmg27RnWGj
TLSH
T12E0501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c30fe42d3ada4c7c7fb556de5312673ced2b83f5fa73af514b4283c21b467a2a
MD5 c33ea8323e8a3116a893e33739f6b0c5
SHA1 0fa424c5dfc1f0a5a3ed3033814b325223e10019
SHA512 fa9c9dfbe00b60f5266b5aa57f35c8de79f236cb3a9523842732d993863ce2b420a5343ffbec013883947ccc890656ec0ad645a16871d9f5aff6d1a9c03bc44f
SSDEEP 12288:hpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T145C423BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 553d3b4184e6ec408baa6addfd1caae7ca1b59352eb9c487228f2ff14fb609ca
MD5 41ddcb4054ba35140925f879acf5e77a
SHA1 67c5ec2b6413ff93c9372ac9001e3c1303d0810a
SHA512 77e09f4ab709f6a1df404f04932195ff543ae0ff696f78e98a8bda0aab26dfdbeaac6e4781cda1e5a563605c4bac6521bcf4a5d07e0a509f44d851a35554d16e
SSDEEP 12288:u9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T110C423BF965C41CAE62244B5C3E5F11DAC073E5BE92004837A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9f95487bd6d416533607869efa901256aaf96a98e9ca4c149c7384f3a48b7ab1
MD5 3857cb9bd0602d5d84c32f730cddc18a
SHA1 bf18c6a681b3a44c5559f616fae9414585de3479
SHA512 bec246996e811c8d2faf6c0e1ee737d6f7a9dd1525cb6865c21942f39b5ced9d0d6de7e0d516abcab8e3c2b9b9d228a57a4e7f4c91254596393f0314a2c39898
SSDEEP 12288:yyPz5L8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T140F4025B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 894435423232a1c22e9d78b127aa3b46265264d66e7e10e1fbd94d3f535de743
MD5 6fef80205fde145c6fb725d07a2f0a9c
SHA1 7c260bd8403b4ae1fb23384f5f809acbd6f92666
SHA512 e38d4460fe2d0beee21539b7c8b20a98000d3383b3cbc517759b79a4022e2d94bf18dab4d2c27275192bdc7d1e62bd003fe929fd2ef61cca2d5bd2b0e32c18f5
SSDEEP 12288:CpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BDC423BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 28448945d2bbc19eaf965e0a36b5db0d4a6139ca9065aaa3761237176e89104d
MD5 df95c85153b9a91e2c172952d1f0b020
SHA1 b0d904b9b932435b1df035f840bc11fb7cd948a0
SHA512 7d32903dc3fe9bd6f1c27c850b2f0b6c799e20bb0665a04e83b28516291a4b16d451da743bd8c005a82a940b249640a7941d392ac491307fab99ae93568170b6
SSDEEP 12288:ipXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ipsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EC423BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 35b466242cc4084c5bae3c32942a2defc7b62b02e5b1bf33ddf6f0b6f398f0c1
MD5 16f4544b49c7ee200debd55ca9b2b881
SHA1 edfcf956cc7801b050767fcc6e566e4d2d710d28
SHA512 eb21a7094cd2336c6f0a9bac5748ef52ac1b33a6800e1ca806450250fede9f4f9b2b93b95a4c590224bb618fb45427a13c9f4098c194ab9ddc9091cbbecb78d3
SSDEEP 12288:5yPz5L8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T172F4025B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ce6693f90c38d60e19ba2041caebea46ab5c51808675eac3818ff3f34904181d
MD5 da6bbd19dc053429118ca96642523f91
SHA1 af405e16fe9688ab5dc2a17437d507d5d2dd4791
SHA512 531119a510e45cb1a51896a0bbb3cced1e08818fc5de3962a629058bc4e67bad8512b646468a709c1032ec39b90a3978aead821d219ed2d6c7fd4b70088f06e7
SSDEEP 24576:nTDaLl3z0zDSsqjnhMgeiCl7G0nehbGZpbD:nTuLljHDmg27RnWGj
TLSH
T1780501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 fdb420dc3af603750d673613067e26ed7fea7174130c32d19daf394a8da417b8
MD5 5d6054facf89c78450cf58a65454be6a
SHA1 941df2d7a21d0180fa02b688332be6b8179cb6c4
SHA512 a7ac1cd0d6201c37daa8c89df50d77a9251935ef8ce60f189197a7b5fec37958f9797e2b2ad705433894cc1373ec43258f874362dc7efd0b97a0f19ca5b53930
SSDEEP 24576:D3vd9CHKy7GZ+sqjnhMgeiCl7G0nehbGZpbD:jvd9CHKya4Dmg27RnWGj
TLSH
T13925CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 56f6e628450c5f9949349c82ae65dc4a8f0c70e5fab06882705cfb412ad2146a
MD5 575bd71d4b2dc6bfe915de7e0d8e521c
SHA1 5709a43a6e1a966ce24cc8ccae25b46187ce8336
SHA512 9a0769c03b11e9e42d98d06731b15deac6d32f6754903fe3089407696cf404289212662a6429df8f50ab45ebcaf9829024eaaa745e4495f81552383f979be45f
SSDEEP 12288:2CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T129C423BF965C41CAE52644B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 9cf53997d6201f8f24105d324a2b33e88331cbe59a8bb23aea25abaca6c0aede
MD5 8fece90426c95a80182d75f72bf7ba82
SHA1 cd6474b574b3f7114e6505e04cd229fcdb35f2d6
SHA512 085e71c8cd5c03188b41a5b1bcaa39f6302aa710003a1ffb4724e49c8d05274f49e92375bb62071469259ad2e4cb9cd738053185369f4f3119deb65f03f08326
SSDEEP 12288:f0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T108C423BF965C41CAE52644F5C3E9E10DAC073E5BE92004937B977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 8dcc67f1283ed0201630b6e25c51ec1d207faa74dc55fe967d78825478d8080f
MD5 d99fed1c5cd13ca9f05584fe8803ba1b
SHA1 52c362dc77db76d62cd3fac546ef38feb75dcbda
SHA512 3d37439100d9da7ca3464e7a38c7d6b8cb5a18eb4167114dc50f3e6f94ee0756941bd83c3339710585f049142789a741af35d05f7348ab25b9522d052bd683cc
SSDEEP 12288:CrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11FC423BF965C41CAE52644B5C3E5E11DAC073E5BA9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bdf12e55ab4f9fb4985120448eeafec30c6d09d93a902d2c8d7b4922d8b316b1
MD5 64593d442707d3e9584ca6981ae5e9c0
SHA1 5db5b9c3db1df546a0d6b806eac676a4e52443c4
SHA512 7b2435fbcaf967037d4d93e68af3029a0b84b3937403f431719cbbcbe840da1a3ccd089f84c2b72304906024f11ce738ff2bae5673934bccd3e23a2065471b06
SSDEEP 12288:JpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B4C423BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 3e9996c6f0ff137c5bf76473d39082f7d4fd2d834e44eec05ad70f9e5fafd18d
MD5 01baf4bc77707d63e4810c560647c2ad
SHA1 7e839d3904faccda9e674e55463e23f4ba8a04ab
SHA512 2ae5412fbe28ea6e328b8bd27d58a171905e6574e52a9c5fdec317fd78ed51e4c839a8f2499e1fce56f4b165e0794edbe300ee764cb2f7285d51080a0aec4ffe
SSDEEP 12288:6CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T119C423BF965C41CAE52644B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 bc2f217a241039465d909e9d0a492f1ae57804cafd45e0e69a5f971381d5bba3
MD5 1f0afb7c87c86350cb268ef8385ef8a5
SHA1 2c34c577422866fd1833d6d23082a5f4e8562072
SHA512 8226d81394d4a80061f7b3ae4b08bb60c77ddc7618b12158fcc4d044023bc63d92cc41ade94b1ef75fbdd2b0c1b274373f1e01f02ba0e19bfc4d477b5ce95596
SSDEEP 12288:UxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C3C423BF965C41CAE62244F5C3E5E11DAC0B3E5BE92004937A577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 730b45fa4f126577c16d24b5854b96ece83b5b596a784053d55bbbd5f7d1d7f0
MD5 dab91e7f8926d58f244bdc0c848749f9
SHA1 9842c833ee0cdcf6781639172d044c6ea50f9c0a
SHA512 ebfa550c551631161834beb3d276a22e1f541bbfe33d26572622681dbcb8e92e61e3b07ae7ae6556c11ada8c8c217116437e78821104c6759bb13b29ddd5f0e6
SSDEEP 12288:hPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167C423BF965C41CAE52244B5C3E6F15DAC073E5BE92004837A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 45b06a8af20cfa51ceb4387ee5a00c3a78b5835cb7cf294ac2dfed815d685f78
MD5 69dbc3a45e690b5680b0dd0a68ad8647
SHA1 e76b8c39ed57f1248bca80418b2b57b82d4f016b
SHA512 faba33918c6e3333637fefaf0913fe44253c76b5d6e7766e8dfb2a0987bae789c1cc3f11346b776192a689da62b82741da3f01e8ca431c69e9ecbde49dc6d2dc
SSDEEP 24576:tfwvUk9RX6wkyAINsqjnhMgeiCl7G0nehbGZpbD:/MnYIxDmg27RnWGj
TLSH
T19735D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5ba04262222ffea7f462d9292e1a0573554ee96eafe68aa6391b9c82678ead11
MD5 9282b5c9d2137caf83ad42724e61af63
SHA1 c387a6fe9308181818c84e594edecb7bafc66464
SHA512 257aaedcb14d35c9ae3431583bb6f97d8dfd10ef82bc1a7dca83cbfacdac8992387334e5b7628ec55db1aa80112e26bd68f304c4d3e65742920bcdac45f5363f
SSDEEP 49152:zYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qDmg27RnWGj:GySzPSD527BWG
TLSH
T1F7066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 233a49b4391f0b12174c8cd1ff58ba08b27a576f0d83ff8119a6b02d448911f3
MD5 d436a936f09b683ee29f169993e3eaec
SHA1 00d742257224f2ba6f42919420c2f0d53c93fc43
SHA512 6fd9db3094d1b684f6b7d89d42223a5fece5ca8350adadb7fbc06bd476d367e2ea2e9c7b3ed9e46b29aee9564f6e660637db6b9a5693442ac3566be09350e8eb
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYAsqjnhMgeiCl7G0nehbGZpbD:c47JUQjTirIhCnDHUPfF/6Dmg27RnWGj
TLSH
T1AE65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7090d50f21799faebd196209a09986bb0043b12e75a3babd5d3ba9e1fe95f992
MD5 48d4ceabab62b7e735a07fa8ec4971e4
SHA1 0d321082953ca6a62e4e52606465393a645a531f
SHA512 1698b7254f2f18ac7b805e4558c25c59944476a5f0ea1b5c3a7cf2a374eea0e457e3441733c436e28d61e40f50476b346e1faf1c9970e4f03c55c8be7ffd9a37
SSDEEP 12288:KbsfZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B3E4015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 874a7928c00dc569d4af2b3680b9d0e32264ca5a29b58cc7f3b9670c32ee86d4
MD5 4dcd629a12ccb307ee71f5a087917f80
SHA1 31c72e24212854015bb0e3ad34dc20629f7528c9
SHA512 549a112d22139aea2c908b1fbc8e52f997dc2874f9cde21da43a60aa64fcc738faf064c49edf6db1feb9ebd74ab580ddb96bd2f4a705f376b7e69dac9a3bbfef
SSDEEP 12288:Cg/UhDvfU3ffZl8jfwwNPQ+n3VF092DlzOnqVgKPv5+l1556:Cg/MDXUPfIjfwwNPQ+nAgzyqTPR4b56
TLSH
T1AA451741762BC75BC6A950321E37D6CCA7707C01EE49AF0772C9873FD476668BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5fb7f0dd59c439336cefad13e9aee4737dd01ab95aba87c68b8d516c82929973
MD5 cf153a8834a5b811fd86f32217793d01
SHA1 361a033b00f7551f80576fcf8cbff377718597d1
SHA512 7fa7a7c70a2af4d603a9a819ab3dd998551bdabd75a4b680041d821913e03b3281afcea7660ae84f980bef3a061ebce5be1b21becbe0e23e83852eccbe4d98e3
SSDEEP 24576:GO4asb5qDD5yElRmyRfwwlPQetFqrU7EyhMlImVniPVn:3sb5rElRmyRfwwlPQetFqrU7EyhMlIKM
TLSH
T195552A41A5B7E35FC8FE50374332868DAB746C07B7492F0573848A3C986797EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3ac228cae0d214be441d4da160737ab2c0903adb61f2493d94911855188cac02
MD5 68116827c38e1b17472c1190fcf8c854
SHA1 58232d4870bee5c99a192915110ae2dae478fd4c
SHA512 10b436f8013fd446deede05d4d36c3b9373dd0a5378e7b7da1ec7f16b8653c5835f94e8688f798c0f9305d593d6478c4888d50286f811e2492e48923a3765b45
SSDEEP 12288:r07hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T197D4237B934C508AF93605B482EAE12D680B7E669F1044C3BA5778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 addc6dbe3d2968da1f18873d79d9698a386d44d702b0d98755d8849fa4b4f285
MD5 292cf2485aab23ad8b2fc3882771a9f4
SHA1 2b58a4f76b4a96b405541a79d24a592cbff429d6
SHA512 410c64da476ee243531f0274b9e9a24f4837e885be8313c1520aadbed66f18b8494224dc5cc8e8aeaf478b02511375506f00dc96be066b03a74d3f8973789b1e
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYDsqjnhMgeiCl7G0nehbGZpbD:Lgb4mBIBhGF8Dmg27RnWGj
TLSH
T1B0659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f613e9cf6a07df13b1c700154d206381ad77ff11431029fa5fb18c5f534e05e8
MD5 87973e95a6f2b8294741cb64a760d59d
SHA1 9cb6e8bcbe3f41b060ce040776c8d8a359b3a3a1
SHA512 1bd5ecbff798e7c3466f620c37658cb989bfd2c8511dce49f032bbf800f86709a11742615a1fc17ad4388870a8506dd684b5ea998f0aa4d6c5a93b222eddabde
SSDEEP 24576:3G88u8FpJqH1bzria7/mwsqjnhMgeiCl7G0nehbGZpbD:27ZFPqVea7//Dmg27RnWGj
TLSH
T13135016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9bcfdf4d17234f739c4f5fefe85873fd339cebfd94c22393e243b26488f61f31
MD5 e445f366238393e6d3aff88dce8894f2
SHA1 339d669dd746b6a3ce603d86922c9bd02c54a69f
SHA512 72587bc1eeae7b5fa5d731f714a749dbbaacc1dcbf55ee0e181c79a4773b55e1e06e412af523d530a7cdd1d4efff12a71f9696e0b994932f18185ff4a8a6a485
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoDmg27RnWGj:JG05lO43bpD527BWG
TLSH
T1A7D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9a6625eee0c75de7ecfd7bd1c0c0c9ba1489d8d34e834a11a4a46a4daa70f883
MD5 cfccbed37e13f06c099dfa4d638c199f
SHA1 85d8d89d07e7dddbcc0315ddc449e3b7822a10d9
SHA512 113b9e5667fbc60eec0dd90212beb34c152b929c092ec365bae0632c55c74052caa956eb6f296a79c052d39debbad21da70331982e8eb72ce2065c8ae17ef945
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnmsqjnhMgeiCl7G0nehbGZpbD:wa5POZ3BJt2pasx2+mQDmg27RnWGj
TLSH
T11B65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bab32355c130ca2b3a07d280d22f33aa46c3b16358d896ce8ce36124b9a8d8a8
MD5 2bdb98aaa6b7b877d98711eb440ac477
SHA1 34e3d95283e7909f67101a5a95c49b63f0a675b3
SHA512 a5623510cedba11fb4ff675c990b0f50d853df5b888f76f4b4cf19753c2edc069fa4c3e00b1a4bcc2b838a2275e7198275ef74dec407d843b688618c7b36287c
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkosqjnhMgeiCl7G0nehbGZpbD:qNc/zEOVHFfDmg27RnWGj
TLSH
T1CD857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 99c253d3d9cf9fd8456d97bc29a8cfd84eefaee62dc2a4d6e6edb74c50c2800f
MD5 62a4961d9cacde918ca9801ba2614b56
SHA1 afd0d4a7b850b9b362ef3e802bd990564c4caea7
SHA512 295ffa72e439995a1db84758c68b3c4da3da9deab910cdac60f444afb40624ad4ad7794ee6adc4a31b5707b4f4e36fd9ddf3a88ca101d5c5cd93590b93a15729
SSDEEP 24576:DTkNvNnaFeYhJNtmZBm9sqjnhMgeiCl7G0nehbGZpbD:DTMwBtOmhDmg27RnWGj
TLSH
T17455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e6e7128730994cd1e440a1ced05242a02e763aedbdfd995b4a640d422d4c7d87
MD5 4cc316beeca198ee425727baff2b3057
SHA1 75541aad8346abe37af3e555b5051e10943ec092
SHA512 6c5345997f9bebd5237129a7ec709ff72308997058157b208c02929a774b45bfeadcaac2adfe0b1cbd0af3fcb6aee1abab566e730391956eccf41e2a3f5158aa
SSDEEP 12288:RHvUrBFrEjwaQMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:RPUr+NQMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17505F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a348869bdf72d3cc30854fb32894806fa0b7e53cfbd23df36ba8fb42cc046b02
MD5 6b4d0bf2c78f65e6ba15a881370176d9
SHA1 8c0c898b00407d0e5d3050cfdc5fac0bde8ad16e
SHA512 ea17ad60d24ff59dcc7290b020e492e9cfb1a59146816685afa816b9b64f5ba87bb238dbdcb842c53b51e6702f7155c98ef189b877e98432a31a9b7093f7e5fb
SSDEEP 24576:6D3FHshBIYQgAFsqjnhMgeiCl7G0nehbGZpbD:6DVHeBIAA5Dmg27RnWGj
TLSH
T16525E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-76-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/120-74-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/120-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/120-82-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1108-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1108-103-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1108-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1108-315-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1108-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1108-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1224-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1224-86-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1876-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1876-333-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1876-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1876-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1876-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1876-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2876-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2876-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2876-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3936-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3936-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3936-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3936-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3936-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4136-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4136-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4136-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4136-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4684-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4684-134-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4684-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4684-136-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4696-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4696-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4696-70-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4696-291-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4736-45-0x0000000140000000-0x00000001403F4000-memory.dmp

Download

memory/4736-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4736-6-0x0000000140000000-0x00000001403F4000-memory.dmp

Download

memory/4736-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4736-42-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4736-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4756-399-0x000001A1ECD40000-0x000001A1ED3C0000-memory.dmp

Download

memory/4756-329-0x000001A1ECD40000-0x000001A1ED3C0000-memory.dmp

Download

memory/5816-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5816-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5816-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5816-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6068-317-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6068-122-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6068-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6068-116-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download