898a2e03844bbe934a90ded2417315a0cfba1328d4ab559ef8bf9975cafe1b02

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260809-te77natydz
SHA256 898a2e03844bbe934a90ded2417315a0cfba1328d4ab559ef8bf9975cafe1b02
MD5 c8b2fbd462433df8669bb1afa9dcf9fd
SHA1 c444c3ffc6cde89858c03c2ac41baa84b2df8fd4
SHA512 fe8c27713dda124e86876d6e1e378354d795867199e8dc920b3102e580d506812f081fb82218b29a00767c784cb46aad549e1a1828fd412d138a5ee23d227f3a
SSDEEP 49152:F7mZ5UxCNBjHYi3ScakzEOyq+VPRT7uGAc9e7ao1d8bSTJGJCYtuLNiXicJFFRGN:RO2sGJeDF7wRGpj3
TLSH
T10E167B07A7B940F5C0BBD13D8A579657FAB2785A877197CB43A0861A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2356	elevation_service.exe
4372	maintenanceservice.exe
1092	elevation_service.exe
5684	OSE.EXE
4924	PerceptionSimulationService.exe
6100	perfhost.exe
4280	ReFsDedupSvc.exe
4760	SensorDataService.exe
2516	ssh-agent.exe
1540	AgentService.exe
1912	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cbcfc73683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000993599171828dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083117b181828dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5e22c171828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4820	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2356	elevation_service.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1540	AgentService.exe
Token: 33	1912	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1912	SearchIndexer.exe
Token: SeDebugPrivilege	2356	elevation_service.exe
Token: SeDebugPrivilege	1092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1472	1912	SearchIndexer.exe	99
PID 1912 wrote to memory of 5288	1912	SearchIndexer.exe	100
PID 1912 wrote to memory of 2056	1912	SearchIndexer.exe	101
PID 1912 wrote to memory of 6052	1912	SearchIndexer.exe	102
PID 1912 wrote to memory of 1224	1912	SearchIndexer.exe	107
PID 1912 wrote to memory of 3096	1912	SearchIndexer.exe	108
PID 1912 wrote to memory of 4048	1912	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4760

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2848 2864 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2892 2880 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2848 2864 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2892 2880 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0b2a4265ace3faead04bd420da1acf0f041a5989724cbcea8e13ac8bc57551e7
MD5 b72e34bf189e8b35bc7ea9502d03f872
SHA1 b15d2e913ded96369f33bd451c4fbb4e7709031a
SHA512 847018c3d8b0c8d0f7f455ccab086be702ed692c83ac8151a074dbcf728b1a036030df263ed64b0f7549a9c2f2a9fa1d20c78a98d3475e3e27d5ae3a0d17c7b3
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPLNiXicJFFRGNzj3:r3q6mjBw7wRGpj3
TLSH
T1DCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5a4fd42d89567aee322e2abe40feafc7b26d7d33dc3ce3ec95efed10b97d7df8
MD5 81cb10ff227906ec06a6a9dd23820e37
SHA1 67bccc08587c4f99a7212c29284699625989f81e
SHA512 aa2231f69ddf8fd67c11076c9a68fcd162b6a6aecad5647e8103c2cc41a1fc165d178eaf804a911d81f780c524baf1227f2f7a61e50f693c7c805da08c366ad0
SSDEEP 24576:UXYfDtczAQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TtcNLNiXicJFFRGNzj3
TLSH
T1BA75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 03b9e73b79c0a26a178a9e90b99b5364f7518922e2960397d40536918173a465
MD5 c9f5db8587dc4464015a64cc9a829a79
SHA1 192d8549444d3951c33d28e1930032d21eb5013e
SHA512 de68117adcf1735d1099124526532ab42fdf8a76c7b6b6b0a1488237f1a492615a8478bdf593da620133a552213c5aa0e57d2ee9ef40cccc56a19ccc6dba384e
SSDEEP 24576:t0Le5ji0hmxhrMb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tPji0AzOLNiXicJFFRGNzj3
TLSH
T131859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e3d59d792da068bba964b4b12ef6ae423f40c5be167fbdef19fc12093a367ca
MD5 69c9304851b932bb5cf6e1a0ab32dd22
SHA1 d86bd20430319069c921ba6d42e9ad691b2c4ae7
SHA512 188ed6d9193b835772ee63e799d21d6ec0ca1c168bca5f2def3a65c37ebc63bd2be22cac93fda724205bac599ba6084f34cd71392d57316637b67cd9e5f6d587
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWj6q8wyud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f/ezSC6vUzPv+HjySLNiXicJFFRGNzj3
TLSH
T1E3756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d43f7941dca974bb32a9eeb345e4301d0cf8fe7397460624c6ea4d3303cb161c
MD5 ea1d83c9574b430e39f1498fdf9ecd7f
SHA1 f5df266bacdfbb8fb21605b86765219bbc6822b8
SHA512 6da1c527cd2fbc01087db73b3030972dd669bc96bb4534d7dc0932284a8c4617d570f372473d0ac59b976bc047e7a120a022510f000caf7d3f5e7bca952aaac3
SSDEEP 24576:MVbqPb88hv/l+Bs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MVO88hXl+uLNiXicJFFRGNzj3
TLSH
T12D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f88bc2e26035d3e5d5dd4d7f330196105fc34d0b262db52158c700fee0ea53a6
MD5 40a7dbab4fec30ca5053ce62ae7c4f69
SHA1 fb1902d931b7795402751147d410de617cb3f823
SHA512 3f73a7c945cb77adfe80f15312acda9aeb61b284051024e080b41b37e0cbe4338ca46844a346dafdfe1060eba1f677782158fead136b2fb9f454034e3b9c33bd
SSDEEP 24576:jGH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T1555523D3468854B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ab5dbe12a6274ac73cc0cae65e9f032c9d93e4cb420620d625cc9437c404ba27
MD5 665b4ac68f6413b52bec16cf783b387d
SHA1 658c56085065cbb288d272e3b109bb23762a1bcc
SHA512 be639da0911c24d3c922b2a839eb560965166525de17df05d81ac7f0ddfb4dd9b9170ed842e12f4a44ba5109e9c5aa9fe02f07f73bb11d5a950aabd1ad6efe67
SSDEEP 24576:sJIU0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJIU0LNiXicJFFRGNzj3
TLSH
T17B75CF7BEE28FCE2C27E4C7957518600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7772696bc85e41999b12280d1c2c6dba7dbd9ec190a82ac8250dd095d8c69e7f
MD5 6425458f5d41112de232dfe87817716a
SHA1 3c9f557a5a82cd1a2d900c5ffc11382634d334cb
SHA512 d794d1ba7f7cce2eed009b612ce0de4248e020411bb90c1e88794aba3bc0a5bc35f5d70a261005704a70c0c35dbdcdad76c0eeaf70f7f7685a12861788d8151b
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THa:mQvGAdlCEL8c/WRNw5Ct7wRGpj3
TLSH
T1AE266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7d2d21fd0a9775fc2b00f2a3518dc1e4dff640a53e9a1d16831688a966d7433e
MD5 cdb946a1c843c514bbc3da40100b478f
SHA1 72cc057feaed60641d5df695cbbf7cefd646d9c0
SHA512 daf53df99694cf68fe5d4bf74fd8802c5aa36aa368c99df2ea32de87d1637be28ce80e506c7260b8893a526590413b12a96db823ced07a310be5ee84af16cf52
SSDEEP 24576:QfewsAje/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6ljeLNiXicJFFRGNzj3
TLSH
T18875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6cc93700aaf1e661afd30b6ca0a0832cc5465b05b67696f0e1fdb1882ac80041
MD5 dbf3f77cc2b190684f4da8665d360f7c
SHA1 9b83cef6a3f46cb49dac55c217326a9cbb514f13
SHA512 35de949c35ff4dd1b11098dee923d6dba85df512c17f8cf69a0987fce92b9847904aa23343118f0a3230fc92339706be439a3e58b0f495df93ed39300048591e
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6F9:WUEtQevvqc2W1cpV20I32+9
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e5e35e6b8b91b009b528f8e59edc716e432946a33b7f7ba6c6fb81bf8756d977
MD5 51bb34be2fdfc2c352d33cec034ec2e0
SHA1 c96dc7a5d938c11ac6da246c5785e942f5bcff8a
SHA512 3665a8ceff5bccfcfe03adcf12728bfcecde5bff6b5de9604728466fffa60fa53be07ada6dbe02fab6c2cf5f6b31e167b07371a73f11410a42addfb6183c5060
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/z+LNiXicJFFRGNzj3:hoq2Vjnmx7wRGpj3
TLSH
T120D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 006049923c505040851add107a864f28bd95a606e8c7f012b369cd252b780cb1
MD5 45a791b33f46a930078c0b012cfffa14
SHA1 80d400110c9227adfac0c0705a877953637d50e7
SHA512 1a1f03f0b327c6d9d38aca9e14055ad0df468d47b7bd6959b22d85b2e6d13f1cd921c04248e866cae012e72204fe5ae6287a25f91d038c31327d3630d900593a
SSDEEP 24576:zAhGL6IFoiwtA5l7S53R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zAM5Foiq5BLNiXicJFFRGNzj3
TLSH
T134359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a44b53a6bec65a6646146c1247038ac8f12ac551b27688a585155c82eb7b6306
MD5 52df518819c49d08c469e087ca247162
SHA1 9bea082b8f86049218b313cb2cfbd00c92c97c3d
SHA512 7f89a8c697b9e805779ab215d9f8f105b47c8d8f446bcea2951becb296d06236fd52c67b87c2e62cdd68c1cdc2839ff0a66e7faab3dc38ed435387c6c0eb1358
SSDEEP 24576:iwuROWy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iwSOFLNiXicJFFRGNzj3
TLSH
T1B665F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 aa004d163a56c91c45097ee4235cb73adfb990dd5caa71d3842ba80bc91c7928
MD5 ca8358e97a7a4c37e891a09a376d56c0
SHA1 03e2dda8063ca802671dd3d24caa1ad3d6254e7c
SHA512 0a897b9ca3ca657a960109f05730bd6b6312e8a2dbe152998fdf1057454e104b61ad4da141e53c08bfbac3abfbc8c1a86a3d987fba6f1878408d85076392c157
SSDEEP 24576:SZuD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
TLSH
T16055129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dbadb97ab9656252dda493c7970c68a8c7e0dcb879e8e293f46143c7ced8f779
MD5 4d234f75d993957ae3d58f758dffcee7
SHA1 2a41692129271030da0eab74175197ebb97d17fa
SHA512 6257e3bffbcf08d2c4f793954de76778f635f6344085eeb252694165409c1b8ce0f58978b44ac4f7e7f437df4ddacb9c6a64d3d20d8540555d7f503157022c2e
SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN347wRGpj3:gQyiKanX+PN0F9
TLSH
T132667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a88ff004d6b24ea59a394ae4d180db11d112f52214de940ad6e75fa80606b9b2
MD5 4dc54f3704e4d85be38d5acdd49925ea
SHA1 8d4e3ee3b9de32941398bc318c420b1d0d2be1f8
SHA512 b96b7ff5eae1f7b94035e8636dae177106330570e66b40bf6b9e9547fdbd2a91996ff8ff5dd47a4301dd4e28b397485710e919038b75d8df968f0483f599f441
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN347wRGpj3:iQyiKanX+PN0F9
TLSH
T19D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7763c1b902e50b8bfd2d64fb39bbde89aeda64bbdc357ca19633f25c04f792a2
MD5 d91a72184a93e98f5c55284d8233a5b8
SHA1 edf790d71cdee56d076c127ec4e25275aa04cde6
SHA512 7205a3d5287abed3caf11352bc8da86bf0f79da14bb22ff13315c260f3a4816d8cc5245abd2da27d59b1ff70f95165b068dc4ceeeab508e0ef99e40e20e0b7a4
SSDEEP 49152:168Qg55nhkeWu7PNU3/OLNiXicJFFRGNzj3:DthTRc/O7wRGpj3
TLSH
T163B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 da058c9ee61f51c4a35d8e31c791f3c90f594c952953cff43f13c51acc54741c
MD5 79e3c87af3dda8468fca3f030e0eb900
SHA1 cedd9d33d3a8231ff726e6229325e2567478976a
SHA512 502176d0062a11654f934938da8bae99dde2d5a615e6078fbfedf89d0dff014b18bb0d34f7c51564af5e417e3ffe8f50c3100b65ec0664bcc23804c969ea4193
SSDEEP 98304:hy5112gYy5azzVvU69nLKnhZH7wRGpj3:8LIHRWh9F9
TLSH
T1BC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 019e1896ad4fe1e617aa0fc1c77d6ff08958bae0176987feefee172fd09c4f67
MD5 3fc2feace9c0449ef777926bcf10786b
SHA1 455ce98b0d106edd1b366a5ad12051bc9bbdd350
SHA512 d90be762ecf9d4f870de612aa3240950b7fe79ffb48f8ece55ea2fd2b401659bbfe1727b7437cb13ec62402eae54fb8cc69345455dbb1d745d98deb046a2af9b
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:6u6JmIxd2ds7wRGpj3
TLSH
T1E9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6da729050ac8c84f61e67896cd9205d0ee61781586f9dcdf41deda9d444e0467
MD5 b08938a26bc1846317fbdfafe9f9ff9d
SHA1 49beda29077293bfb1ff59eef0d6cde336fbbfb6
SHA512 be3c5bd3d5673bd7b997b221e53e7f155de5e7758158311781d11ff91a26648b85a5b41bb5fcd054752049068b837d4979ee93f57864c3d5f08905a60f14f10d
SSDEEP 49152:q1hpsNoJpF1A67U44CwH7R4xULNiXicJFFRGNzj3:qmifPqRx7wRGpj3
TLSH
T10BB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0fb290303fe96503f5dd9896c3931a5d0c632151fd5869673c92b53e369f1247
MD5 68cafee7f7871ba7e81347776664d9ed
SHA1 d0963817e40c2a308247fb18e421fcf88f914388
SHA512 ef611cc27a9d5de917b2b1431a6faf0d08c63c8313259a0b127d01bbbc1744eaffcd070adddc14df880e1e4fce3a7392440b1d1769a24134ec166a485fac91d5
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqDLNiXicJFFRGNzj3:A5dKqi61D7wRGpj3
TLSH
T1DAC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6ba79ec77dbc6e4b75b41a3b09c30583346d8c1302e22b5db4fdd929be1912ff
MD5 a31ec7bc78509cfd5ef09ede4944f368
SHA1 eccc40a12ad626436ba494fb3e98798b5da1da21
SHA512 e4deca4a41fd4bd832c6b93084da6f77180e87c3c7a58f5d6d4599c6e7e896262b5a1de1e21f054e316afcfbd68fb10200ae398f7b5c10e0a1338a9fbdc07714
SSDEEP 49152:OhtSn8EApI0figjgiDn0AP5wQLNiXicJFFRGNzj3:PX2iWphl7wRGpj3
TLSH
T11795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e4ef498f02978455e71c97a6a6ac8ace26a0d3f85681dbf76a0ed8760647c33c
MD5 7f10efe61e5170b6e971ae20f35a7b27
SHA1 b3de9760ba803f5309143fe0a7028c36cdb6e653
SHA512 9f5edbe46f5c291aaeec4786215c7747ba14b147d639be4068ec69e4713e2af78341a77344c3f5c96ac7c9ee5832a45087f3f3f541ef56aff24bc3a83a9908a6
SSDEEP 12288:F7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1FABC003AC6755428F5881E2DEB5618E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 60b3b9830f8a71fd0332f4608e3c22a90fde96aacd2a70517210c3f85a751cd1
MD5 06c510c93891a16d823b762a91cdc961
SHA1 e7d33607ab74c5512ce5f69a5b1bde7988acf7a7
SHA512 c8ae26311fd625fb554758e2560da19ae3ecb4d5883b63ed32449eaa7bb94084f0a3d0e1634a21dac99ad4b22756873669d4c40b72e55ba0e13bbaffd099bae4
SSDEEP 12288:rYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955B1EABC003AC6755428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 53d15f75697439e86b5234cb007527fcc71902a00632017aef1a2deda60c4c9a
MD5 5f87b32403662c5d69265a76b160d4c7
SHA1 e9a8a1aa7fd2482ada5b39d753f15abca6401a62
SHA512 0a63e0bc671faf272e4d02828e5412835b9528833a51959a52e5ac5366c2e34789b0ecba6d1844db277c28ee1da38c4e53f8acb6ae8002445a98e9fa06d94ec2
SSDEEP 12288:p6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6ebfeb993969521c4e952bdaaa365a1502cddb40c226405349d000bd9859e32e
MD5 ec64748cef272ca9eac4b8af83c0d6c1
SHA1 93cb05c8c8a833d4c8e320db6bc4150f282983e2
SHA512 25151d5613f018d769ccee7e6eed0c8d608b10110540ecc5c2423733a616a6e396f8d60d6b1b5c7e959530bf04f082596f01c8837fcc5385a6852fb363a3d365
SSDEEP 12288:UVtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A6552392168900E1E9FD803DCA764424F2A47D6CD7365AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b4bbf3688b5de8b2361a22beeac7dfb197715b5f6ebdb61943561383cccd54ee
MD5 958afcd499223f1d14731f817c73b192
SHA1 c63991a9011d76ac80c355904b44e4e3f153b1ad
SHA512 a3bedcd211ea185c5b1d9bc99a6a72fcea0ec463d840ddb7b953fd306815a18153cbf99de5e88b62fa246ef36d9f238222632f61c360edf0ee177ac7d2a02d00
SSDEEP 12288:yliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cc523443b7598df76bad5def676a3f66d1a0a941ce571f94b87ca6dfd5157bbb
MD5 f0c7af3c1d782cd974e8f1e4f8eecf39
SHA1 6b018590ad8eadda1d8d46ddde987d2acf3efe60
SHA512 91f99f4c7c65d13a402ace2adc33d2dbbdc3e73c5ef0762eadbecc2b76438cd84d95a8360792797bb2d3050c6dd1ebc216e4df8bbbba48db01851954a703dca0
SSDEEP 12288:S8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9e560391e98d6fccfc9d06bd3f0114f7602be931ab73ea25329f12d7d69faa4a
MD5 23d208d87054da02cb9b13be8c0bc285
SHA1 ca0199c01c283d22a22fe27f492494d67bf1737f
SHA512 ea2d3cd964545009d0bf6bf10c3455970f374b89deac7e42a7938d2c73574fe14aca22c98cf311f91eb7ebb0030b67d791b09ca0cda30cda4595295c9b558061
SSDEEP 12288:RwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ri/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B2EABC003986354428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ee42dfb2bf3d12fd8f4009b4beb627f5cf66019e60f9f0a3bd6ef7fd3a844f73
MD5 21a4971eb80f8709cce61c4cbe4ca50a
SHA1 f62633e03bd185179906ea2cd224ef038eff6bbd
SHA512 e3ac652a0e762806de4c0a68cd999cf661ce859c502b3b3d70d630a98954ac1bf0ab2b2aef461f829f2ba7c1f389a156a89a6620ef291319ff7c09a430c86ed4
SSDEEP 24576:aZM3zFVSOK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aZM3zfWLNiXicJFFRGNzj3
TLSH
T184750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a56630273b4ad39205ca8c1ada40fa141e1ff6c234d3d08aa57312320d03a3d6
MD5 f8245cb2f5a6c0b628791c8532ec16d6
SHA1 a755b73ee413e50e086001a0f911c4010e2a1f52
SHA512 2d51670e86047857bf1ae52d802ae11b5f1a2fe1358ed7511e943f84e416937119ade0aebe27f23d6d387ab8648302d1ba06ee6fd84abda1e542577e629bbe34
SSDEEP 12288:fniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1765523D3558955B1EABC003DC6764428F5881E2DEB5618E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 418cead7edc2a116a9b63c8fa128a9af43ce0830f9205f420782fb5686417361
MD5 b295d20f8181a8d95255f8d44cb3877a
SHA1 4ea7de3d410300a557fa968d3ed1591a5b1f7f8f
SHA512 9085d8f1444b699bde43199a199d632f1bad29dd9c5b2d26fd8aee7f046a855397731ffd9aa29923985f6ea905bd51c80862c0b80ccdbe616b79ddc02d1220a9
SSDEEP 12288:TjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A5523D3548955B1EABC0039C6754428F5881E2DEB5619E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1719f6e57a6fa9f76e3dec26f3083c9b39a4a3d51bdc435651264aff02b72a38
MD5 f302ed8f53abc2a5e898f9566247c1f1
SHA1 30eba562b723f6078d1a20c9dc13aef539a69b9f
SHA512 fd37a02fa70ee2e3e664a9605e82523b4368d53934ded10109638d22483c41346b4dc7db4d373537cf4a688bde2563d259af5a297468c4df5df4e6c945ca7194
SSDEEP 24576:+zyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+lLNiXicJFFRGNzj3
TLSH
T1AD650247629530F9D17A8139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 34ef7cc0bfc50aed5e30074f244f7dddbb9a81d5df5dcd3195062a1f694484d7
MD5 76796a38590d1f41c1b02340974b1e37
SHA1 579c14dd5de0e964965d7e6a69aca26ff0ca6b45
SHA512 1ee86598d02054ba182338103b2403369e57994fd0cf8f57c501dd91eb11c2fa8b5ca08fb361595f1a7afc912e94a9c511faa7692b599124836cd8d23fe67ff4
SSDEEP 12288:zniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bb70ff7fe61405ac207c0403d2c7adbb50f4452cae9d2c6e35d85e49ea5a4ecf
MD5 a7b00ff7176b12e68e19c715a9e8596e
SHA1 681b9b12392bc5588d44136c05eb45d8598b9a5f
SHA512 dab0a3a0ac81d4d0f758b0226462652aeec181ca410b65c158a83140f9f7538ad4d3ea5e7c0d2439a91ed60c59ba8e782f367ea1ba9fc842a977fbc8b3c46b9d
SSDEEP 12288:fniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3548955B1EAFC003986764428F5881E2DEB5619E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 45ae15990d2c1a2507c21c9bb50e6b7a461b5cae00e853c2e25c92932ff217e0
MD5 8f63b4e990c6c0927beafb4bae08c7bd
SHA1 b8c7192d261356775920ffbc140629c9235c4b1c
SHA512 e5fb700484ffe7b94410bd6b3836d09752bc15a7b0717182b6d0864d3db8dc36fa8fa47353f3dfb495534184de2b2bdffd95e9560991d44575f099baaa7d73e4
SSDEEP 24576:nzyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nlLNiXicJFFRGNzj3
TLSH
T1DA650247629530F9D17A8139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ca403ee413ab4ad38f626ce646a8e915c4c43492fb1b9fee0dd0c08c024b3811
MD5 ce097b70893a3cab1e2effddc78b51e9
SHA1 a09ed1ef617b837bd9cc895fc694989b7e85cff1
SHA512 996a82a28203dfa554dc4e6f7c849f804bafbbea482038ad63ded5f2d04cadaddc4b894c52e8ccc31a41d25b831e754d086f857699355da4e9cc359e1de71705
SSDEEP 24576:1T8aLl3z0zDM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1T7LljdLNiXicJFFRGNzj3
TLSH
T1D27502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ad6b1b3afed25f9a7fd5d470d608e7585957d60fddcaf8c91ca98ee81dbc600f
MD5 50b42cbfb9266608e03262a3fba78bd3
SHA1 35a7b908dedf743ae201a08a213829da5b1fc463
SHA512 446a3d9a8a9821db728b28824cff0f51036e3982cbfff67da9d7874d1d5d1f6ceede609641d2cfc130a589adbe65ff902889a6d06da0903a63c96b4d38cc2ca0
SSDEEP 24576:D3rd9CHKy7GZY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jrd9CHKyaWLNiXicJFFRGNzj3
TLSH
T1D885CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ce767c1b6bf2fc3c4dda59a2b32eb693620c12e1b0ab55d1d8597c87e9f99e8d
MD5 5f5f358db33b915c5114f32890b59157
SHA1 042accea5b478b1f1a9834fc36289c71c2173863
SHA512 59b48bda1cc0da341c680ab9e66bf755585cafd8e5c784ece4d9f8df548102653babfaeead4c20e23d5b940f3525681fdc3c55514c0e076b85d8b8d0ca699cd8
SSDEEP 12288:0aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:08/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 55bc01d3d46ceaf4c1ee0080b263e6b76ea4ea5da45f12752f83adb29fe8216f
MD5 43d1bd03cf4a4b01efc10b884306b48f
SHA1 a7d4358712893667cb6f0e62b797fdf97a4962c4
SHA512 617abdfea1c6f3f5f0a4f4c88949324d13b5e9a6d260e02771f67a4c61640ec97f02ce58dd7269126707d03555af433c29ec97cfbdc8c0b4048a1cbb1a7a8b51
SSDEEP 12288:FEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D2558955B1F6BC0039867A4428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 37e26da9755248872a216ca365c922a2f925a4085a08a6a73c6bd4384a61861c
MD5 75dcc04706f734ff59491c13e5c53758
SHA1 25466938f65848c03448de1757aaa5e58d802f27
SHA512 de9be5933f393e1ecf650b27f04cece6396c440d02288bbbd5137802190f1cac46d73ff9cae2c6ca55be3b1fd57ddec793f405b99bad5daf1b35db9e575745bc
SSDEEP 12288:WpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:W1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0d59f80ae203db62f0be2ab49c40d9ecb83adfeee19bf820d81dfe36c9da44bf
MD5 f3e8d16f74f52dbefb19b81673dbb727
SHA1 c407bf69e64e5e460d9610eb9d65070863a2c353
SHA512 00c7f570520357730a8918f3fcae4cb2ce43f81ccb6fb8e17d15697586ec7f85a43bb6575694a0077263c268f895460f0e4afd7dd72ac3a88c975cd9881e81c8
SSDEEP 12288:jniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E65523D3558955B1EBBC003E86754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8eaad7941a1cd53a3869656f500286c8d8a58f95c3ae9dabbdb644a5ca1b48ae
MD5 109339aa17480e33f77d480964bccbce
SHA1 81a410f343d05b0e188dc37c1c85be1b2c45523a
SHA512 a8481648aea725fc1f77d74d5d48d0661f8b0dbbbe42cba8cdea922f0afaf0409565e3ddca8993aa219157d32a5cbfa20072a2fc547a9454d2e907904e764145
SSDEEP 12288:5aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:58/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17E5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE238FEBCF38566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fb45cebfd371abca734c1e7c121df8bba37a3661dc979d8ef3e82f67e8fe96c3
MD5 c0a81044ed31e66afd3058e205540b17
SHA1 02107db6a1bd7a567bfbc0a84344731ef8b7b2ee
SHA512 9729fcd5e22a1ae73b554acf692f889c2e008108ee0584f746aa58553400e4e8adb08c17f579abcb7a44bf7446ff0637951dbbaa4b2bbd7ceadfac272ecb4349
SSDEEP 12288:W/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D2548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7012908746dc59deea4a5964843c151826ff635a141ea79992c114ec1eb33a49
MD5 ca0e51d1c737f2bcf26fe0a846893456
SHA1 dfdd01d2a9dc0125cc56395fca91f8b4e149278e
SHA512 08dc354df543869cf54b0a5a9d6f0105f144af91933dd4c2fb4ea2afa75254001e9668883ccd30f3014e8951e6d5f1834e8cd336b0a7b539f5b92f514bc8cbcc
SSDEEP 12288:7liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF5523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 436b1216eeb2f31b985892e14c9a4dcd5ea49c0b2956d7e3d71be24e66572bc4
MD5 421249424b8b7be52a23eccb092be1ac
SHA1 cb321a098e2f4f43dddeba2d097576f53e6950e6
SHA512 316fb85d222ee546c91d063facd240d585aed4d41130687a632a4f1779aac1030b242b5466b9fa4f48efa1270be0534e50dc776c1987cef35e2405bc335bda3a
SSDEEP 24576:pfwvzk9RX6wkyAIn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IMnYInLNiXicJFFRGNzj3
TLSH
T15A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 18bf803d3507063a960dbbd4a9b6690b7cdf916983baf7a8a114c2b4ed1983fd
MD5 5c4e6fb6c4cfed9029fd67a975b18624
SHA1 82510a5e2587c3cfc9f171703a86f9c7e6ad718e
SHA512 de837112c8745d62031dc3daefb6a4f57172d24f80397dc6fe7e30201d67882f13fba0a9575bbdfb4cb0c129068a5aa3051dc68a9d79f6e87c3583e773e59804
SSDEEP 49152:4YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wLNiXicJFFRGN:3ySzPY7wRGpj3
TLSH
T120066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c37ad45a830056fb151bd95f45a922850cf73bd2ee0a8c5631d75a158b8d5511
MD5 13cb725cea9fc38245027b1df469df8c
SHA1 9fffbf161ce8473f54033cdca1fec15154b29d33
SHA512 dbf0e7f4237ce6d702554d13da42ebc7e8f106083603356a4e74079b64d1144e54527b25741d6b7623005fa2026778dda64abaf6c7d74b33e149746af8dd5851
SSDEEP 24576:b47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b47JUQjqirIhCnDHUPfF/ALNiXicJFFS
TLSH
T14A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 53a9cbed21df63d95a91c73fb313f731b2018d13cc638bb94697d5a8c5075a56
MD5 056a867510092b94f13710771fb28c47
SHA1 e8920ba85bc76db8edd1bc058c2927d8950563b3
SHA512 0f4f96fb8a83ffec0a5495f67f35175519bc197057d28292c029c9a92088477ca4045e34214238dfef1fffbe7bd1036e114abb94c64c88a1620ace138014fd4f
SSDEEP 12288:Upsf3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F39AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 76da294c54631375d80787f08b3223da3b0c91b0cffc1e5ebb46e2fe2b2ac315
MD5 b9311078b9d4463527850749e83722b6
SHA1 70187c8285c3d0c78cc58802cc9b717688e3f15d
SHA512 8e30675a25e90d4c5c047490d0b108224e4dd63b5ff1e540780ea071b986a1ae2dd88d5187638972bdd12b7a9306ba989254ee5999619189e2af46a77a789aff
SSDEEP 12288:FkqTU3fg2bt9M5u83+TiPmQyR8bPth9t:FkgUPpS+TOmp4PrD
TLSH
T1C4352850766AD75FC6AD40321E32D6CCA7707D01EE05AB0372C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 453ae520906192aee39dd675f3553bf3f58d7f4955f688a069e46c29ba964a15
MD5 cf612b632b416cf25f7bad9deec5cfd5
SHA1 5e5ffb88b3b68a3cfa8dd71a4db0dd2beab5b8bd
SHA512 5b58c38506a113d6c49f5163f9df429861b091641bb02f67db5261985cc54063badb7a21eb1289ab894fe1fbcc31ec2d08a7910bd88f8479e7df76b831f62280
SSDEEP 6144:+oa2RA0IYCHMD9ioLcpXqcbVtMxTkq6nwtL97+cbVtMxMSUiS8MJqYkLBFE9:+oD9akQVL/E9
TLSH
T16055D6819537A38FE1FB6071071A6B4C6B64EC47B3095F26B3C8453AD82BB6164F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 edcf88a53ce3054f82804d6c721560d707725aed6972ba92ab086ceb3ab62c8b
MD5 7789303714f00e50cb327882714d41ca
SHA1 d54348b35d4e956c891c8d2c1999315bbd5bac71
SHA512 dc74723284d89c19b8c532d0be218e76c00902f2a699bc91f5b9d571ac77d850ffd35da65a4f15e83f83d2fddf9fa72cfac2c7580ebd46920ab510a1a14c4158
SSDEEP 24576:N7/TwSfVcYG3K/cJHlnFR+IGNe8j3IzM:N7LNiXicJFFRGNzj3d
TLSH
T1EE5523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1797525f5f89d54aac597d3c9842ed9888385ca7d59ed0795b3ecc7f1e3440e0
MD5 d96605faaccf31a2a2db040b5c4deada
SHA1 0b82895e40124f49c6af058e93740818ff6ccb18
SHA512 e714c5dcb99b1fefdb0a459a313094c58161ea8d38ab652be143f2ab326151a4e9716a351dc69bf6f04592624ef9e8b2e821cd82551e6f18eb9d5553a74ed9e7
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2gb4mBIBhGFaLNiXicJFFRGNzj3
TLSH
T10565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9f05073cb68c5d4e0c7e0a1b6b1eb1d6f7b21a7fb7fd28a2ea5be68b2a840019
MD5 5c375a21ca443d1837939f8dedb9f89f
SHA1 b741fe61e1db8a89219e2c46f46b4154b8743abc
SHA512 2b17ab34968375ef01a84fefffa3a53a0b4192b16bc3e0362fa087c662d56628f30c171b6c5cc0bf146664f8d9b5a81ad5ccfb29bd2c83898ee89f12f7f66a39
SSDEEP 24576:PG88u8FpJqH1vzria7/mK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+7ZFPqVya7/VLNiXicJFFRGNzj3
TLSH
T12885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 454ee149afd8da3dbb2d0e0a4c2ee0fe62b71b79897cd807933f773c86036229
MD5 1637484794d8220d1724e55d38a6331a
SHA1 1ab459ec47f48d8c6db9f8adfb66d6216c931546
SHA512 cf8d581e5d98ea6c5765d68e1f99b076cabee22d1d47fd0672fed123dab30fc16ea896f9272ab23c0994c743f0b49209ce13af44682b32023e11a0c67ad4577e
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGLNiXicJFFRGNzj3:vG05lO43b/7wRGpj3
TLSH
T112D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fbca79f7dfe06c8cf9a4b2eb71aab3470548a131e2fcf16dac92c56cc0112db8
MD5 6702e40118bcdf22d9a39d0af0c7b887
SHA1 c31bd8234f5416531c470708f70bb15bd2dead8e
SHA512 55db9787a56fb9baaf20d971f9bd425fc106e83b923222c8be358eb11d1476234871d4343ec9243902aff4d2656c04a5d53503a3143cd60fb2c5f97ed3dc5070
SSDEEP 24576:4fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnw/TwSfVcYG3K/cJHlnFR+IGNe8jg:Aa5POZ3lJt2pasx2+mOLNiXicJFFRGNf
TLSH
T10A65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e148615c64d18244e73da07f55b7bbc6eba2b9ae67114d391cd89d72cc792d6c
MD5 df91dce63342434701aecdfff852dabe
SHA1 c19b8e8a8b10fbd80d041d6d2cd72b7a7a03a56e
SHA512 919a24f295874aec33c3e407ed37841b2e4adbdb3b80afb51ac1f3ee6a41767e21277b67a65bd22aa4ca4a434fbd3bb72853a3d164e0dbc7bd78a5c0f2cdd84e
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rNc/zEOVHF1LNiXicJFFRGNzj3
TLSH
T1DE858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6dbe7cff8dcbb927be8968709d27daaf82b1a64d78b2c4b04f814dac5108ec76
MD5 dd3935d5ea755f62bf622722f111054d
SHA1 c6b5cb741b87d554c7e3965990ed6910a4886903
SHA512 e67ea8f6f1afa2159a6b5459b62226ee41a907da67447f2315e59a9c7cdfd822371cd226bc1857ec6c66d36315d382e298931d0b4f3ef63f6ae484d9a445fe2f
SSDEEP 24576:XzkNvNnaFeYhJNtmZBmI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XzMwBtOmILNiXicJFFRGNzj3
TLSH
T16655AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 fdeedf99426d0b8951b3d851dd06533aac4ceb3f6a3bd95c4a87cf028655a587
MD5 bb0315281178b7707eaf81b5cbb63c18
SHA1 be9e92bb76750bdb661b03e9e65fb9d948405030
SHA512 9daf87deaa50be936eb41bf27250259ea895cf74635af9ce3fd351993b9d9ef4a1fdec3eb2b33430868be54db39ecbc13d4161ed6d68d06b39cb9fad9eb2c7b6
SSDEEP 24576:lPUr+NQW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lJQWLNiXicJFFRGNzj3
TLSH
T10B65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 83ff81a3ea6f8ca602eae70221ced6806aee09578d5bf6a2ddbfd5c65a963718
MD5 4e6081782abbfe8640a95060031a5367
SHA1 df110a57f0af6d4f9fd4c645eac737d0dd0dafcc
SHA512 c68bb01c71a70d9d30a108c79d7b3cfeecb6ed90a1fca548e5f534d8595f4dafbb78d69240ca424afa0d6320756acc962c44ea85d12d8cdd7e4cebbd002d809f
SSDEEP 24576:YD3FHshBIYQgAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YDVHeBIAAPLNiXicJFFRGNzj3
TLSH
T14B75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-52-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1092-210-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1092-59-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1092-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1540-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1540-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1540-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1540-144-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1540-142-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1912-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1912-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1912-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1912-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2356-23-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2356-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2356-15-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2356-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2516-125-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2516-124-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2516-131-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2516-325-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4280-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4280-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-339-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4280-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4372-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4372-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4372-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4372-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4372-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4760-322-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4760-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4760-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4760-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4760-117-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4820-0-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4820-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4820-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4820-36-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4820-33-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4820-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4924-78-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4924-84-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4924-76-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4924-309-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5684-65-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5684-66-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5684-72-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5684-289-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6052-337-0x000001B823DC0000-0x000001B823F8A000-memory.dmp

Download

memory/6052-408-0x000001B823DC0000-0x000001B823F8A000-memory.dmp

Download

memory/6100-88-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6100-94-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/6100-89-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/6100-319-0x0000000000400000-0x00000000005EE000-memory.dmp

Download