94359e25b43b919fd28224b021df03012b2fdfbba4752d4ef77c252c05a864b1

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.2MB
Sample260809-wvk36stbkh
SHA256 94359e25b43b919fd28224b021df03012b2fdfbba4752d4ef77c252c05a864b1
MD5 c09add8809099b6c465a725afb17fb58
SHA1 175b84d26a483956a361f4540f1a12570365d0fb
SHA512 81d7698fcb4939b6ba6393880e629d17302529f3bae7152125da2db21a011d8b3196487725454a08f475a8c49c2f6bfe9960a27379a0c485bdb88de4b2e19e1d
SSDEEP 24576:wxVIW5Ogm9vHsZ4kahCatr0zAiX90z/F0jsFB3SQkq:KH/m9vFFhCaB0zj0yjoB2
TLSH
T1D045CF16A7A901FCD0BBD2398A564902F776780543B19BDF03D09AA72F276D19F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3432	elevation_service.exe
3504	elevation_service.exe
5880	maintenanceservice.exe
5884	OSE.EXE
1952	PerceptionSimulationService.exe
6032	perfhost.exe
4808	ReFsDedupSvc.exe
3388	SensorDataService.exe
4500	ssh-agent.exe
4396	AgentService.exe
5412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5ebd1aae05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\InitializeAssert.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efb60b0c2b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f14274a2b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028da0a0d2b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c780db092b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc39210c2b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000945f124a2b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3504	elevation_service.exe
3504	elevation_service.exe
3504	elevation_service.exe
3504	elevation_service.exe
3504	elevation_service.exe
3504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4060	2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3432	elevation_service.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4396	AgentService.exe
Token: 33	5412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5412	SearchIndexer.exe
Token: SeDebugPrivilege	3432	elevation_service.exe
Token: SeDebugPrivilege	3504	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 3884	5412	SearchIndexer.exe	101
PID 5412 wrote to memory of 4840	5412	SearchIndexer.exe	102
PID 5412 wrote to memory of 3324	5412	SearchIndexer.exe	103
PID 5412 wrote to memory of 4628	5412	SearchIndexer.exe	104
PID 5412 wrote to memory of 4980	5412	SearchIndexer.exe	106
PID 5412 wrote to memory of 2660	5412	SearchIndexer.exe	107
PID 5412 wrote to memory of 3144	5412	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c09add8809099b6c465a725afb17fb58_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3388

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 195d5b2fb8edd42dec1f6d1f57aa2d021ec583d25c1f7613c6f439078c09c0e1
MD5 9306b2a443ee258a728c093a31a2bfe8
SHA1 4db11d6b3d26ddc7ca6e5ddadf597c78884a6a7b
SHA512 dea771023fe7ba13f5c35194d224be9191e1baa7761366ecd74d8b9024f3af6c66e572d8a226dce607527d460e5745de7a614fcd27079f673ab49ba0b3965469
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjaB0zj0yjoB2:l3q6HjBVB2Yyjl
TLSH
T1D2D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 102798592472c916580540e2ff7ca61b325a95f9f1bbf0eb9293b7d77a572984
MD5 e9e322613f4cf33ea65f353e0abed18c
SHA1 b6c0a84eed0914e287faffab8af4d955008509d9
SHA512 c2134e65e140a15078f921a65ade5822047ffc8e187be174c9b9b36e3386f3c1ae037bd39ff74b513ea4551d210c1988fcbb48df0d66d57d3664955e665469be
SSDEEP 24576:lXYfDtczAGatr0zAiX90z/F0jsFB3SQkJ:wtc9aB0zj0yjoB2
TLSH
T1ED650229779504F9DC67823DC9A1C506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7f5205d3ad7b889f50142e31c054450cef26b1e47746a2a175204b7d513e2867
MD5 65368a46bf3430e77933dab25d73afa3
SHA1 be0c95dc3a77aa97e8364b834e85665bcac7f6bd
SHA512 a97c8bcc49bc55921e4fbe6921d2b29e3d4a3292737256c01507aa61d77050e69b54435fff26267308474122edc6882f8209a457e8b026ddbc9a6e1364835a1c
SSDEEP 24576:j0Le5ji0hmxirMLatr0zAiX90z/F0jsFB3SQki:jPji0AcsaB0zj0yjoB2
TLSH
T175859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d9455302baaf0d806549ddd7380c7929e01ef2d8c79dac43c583717b7537707d
MD5 21b5d1d465189310cfb68fc8352e7e7e
SHA1 6ee7c9aeb540949f5dce5fb71194f791a0ba274b
SHA512 6d90261b09e224e07ddf587a1b89a303b5e59726d48c549a396ceab8d90c3805407aadb022eec6094658ab70c7ca910d0c8b4aa655b0a0f2abef20afb88bd8d3
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyutatr0zAiX90z/F0jsFB3SQkU:M/ezSC6vUzPvxHjywaB0zj0yjoB2
TLSH
T1DB755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 889f3f211372b6c8d407e1b5a2b9b20bb934848691311bba6401704621d4fd42
MD5 427054dc98bb8415f46e72d17203600a
SHA1 039dfb28508889e18a5b904d77d941adeab93c02
SHA512 667265b275e7817a1dd2055be7c58e1cbdea5fb6c093fd58231c3de8c42b6bcf407898469bb83c9d9b6b40dfeb755c07342180ebd183624ff1f745d3338bd77a
SSDEEP 24576:oVbqPb88hv/l+6Catr0zAiX90z/F0jsFB3SQkM:oVO88hXl+vaB0zj0yjoB2
TLSH
T1FF55AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0683a47a5c2a72c1abbb41128827d8b6fe7fdded0badb9629e41d268e20d626f
MD5 508661f1740f1a839e76d7391b794aa1
SHA1 abbb7c0375d1e8e8e9d1c28416b04585ed9270ec
SHA512 8438a12fc03210f91595d852a61b500ddb886d664c4d596dd59089b58093acb6d2d6a1bec6c14420ed557e1dccfcf1c1f9dc5ed7323282967f7d0f1b6100b19d
SSDEEP 12288:KRnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:KRnatr0zAiX90z/F0jsFB3SQk3
TLSH
T19845230B341E80F2CDD31B3526989C4B1ABA9EB065E2AF45A2D13F4F9D3C1C6D1666C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a0a80c9f00805cf291353c6934eed1feded5b5dca1c4e4f6ce894b8b7e856f3b
MD5 cb981724ba3ac23c2028c7d54fcdcc36
SHA1 afc43656a3cbe16ddecbd367a579d1e66a5363ff
SHA512 09da233172cd48c1edf81f6d01158b32f78af86c0cf7ba0e0a75c8e928315832cef39f7d3a1839dfe2c0f20cf935d65bca53d55f5f0cb31ea6f3fd646ad51b1c
SSDEEP 12288:heBNUbTVO86UKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:hJIUKatr0zAiX90z/F0jsFB3SQk0
TLSH
T1C065DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 62c31fe6d659fe8b5154e9ac47d6d5d3ae4c1176e7365e4e08a870ad42b758af
MD5 be232e8e2c2a11ab20d681a5649da617
SHA1 86be3bdfcdd674f5d622880389ea942fdb380ffa
SHA512 b8bd5db1a3b65ad4f9f93dccff02920588d97a337b9cbb552314f7341b2cd6093d0fcb91adea49f12621cacf1d84cf482f72e7aaee3fdc63c3aaaf678ea06a9b
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:8QvGAdlCEL8c/yRNw5CMB2Yyjl
TLSH
T1F9267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6d84f8abb1e66e9db56aef2fc9583fbb7026a6ba53e4d8821b607743f4b4e7a3
MD5 860624c22a6a99e69735ad56382305ee
SHA1 8cea88de0afd835d4ab4a754454e5f833d9f90be
SHA512 76446ef2d77e6f3dff0848aafddd6f2f0d4ed5080b4304199fe69a9b63f022f39031a81f6ec661a4ba4605be3dbba3e120ed587fe4a4e4636b9dac6f007b7428
SSDEEP 12288:8AwSfxL/2Dc34DLLmt0LDQewsAjcUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHK:hdewsAjcatr0zAiX90z/F0jsFB3SQkC
TLSH
T1B375E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ef5a5134c8953f5f9084c0adfe92479db5a2f4567abea5a470bf224375659b7
MD5 e61157d248332ee33b09473b6b37fac0
SHA1 030d87f4ab85d99b86d0bb32ab6d59edabc8312a
SHA512 19fc6d7a2890aac72bccd4f8695b9c2cf945f1820debb648c3ea68190d13e22018760d849c03d3dad3b087ff6edd3da9ca35f2b83b1114e74fae4209aa70c2a9
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrZ:QUEtQevvqc2W1cpV2EI321
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bdee151d94ffc2ce5f7a48fce81c25ff216c7734825163150061ef1b0916aae0
MD5 a563ed1e76cbf95dc850a9f85b3a60c3
SHA1 ca8dfa4d8e540f8708e498a65c86bfbff6fece10
SHA512 54119658f531e5e64fdbb6f4349a18e46c36f7f1c39d8163e32cb687b5807b0e18d25b40c9dee83ed9c7531cf86908084d4aa284656eedc8c55bb899ac91ff26
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/z8aB0zj0yjoB2:0oqtVjnmoB2Yyjl
TLSH
T1D7D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 82e28eaa194fffc4131e59dba15b2137960ab6de5197c9857ffdf2b02c6e7dba
MD5 b6a6bfe72fb64837bd7dd8cfb1454c1a
SHA1 482290fd83e1181588d31386d3111c8c196ebea1
SHA512 8d23b09716d84ae4f5413db9fdca2b3d643c1d579811bc929b9143abf79f9778fc91fb20c117901445f7f370a953d4fc5c7f3498a0d033fd29519be7edf88270
SSDEEP 24576:sAhGLJIFoiwtA5l7S53hatr0zAiX90z/F0jsFB3SQkT:sAMyFoiq5xaB0zj0yjoB2
TLSH
T122359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 72cbe8767a148fd6394d2ae48ca51f8f1733b37cfbe16f85fe0c224ce692078d
MD5 2e1389871c4ec1009ccaab996f62f70a
SHA1 4ce8dc77107376e83276925b9931a4b27932868c
SHA512 fb840319d65575b5c4be62c4bb869b31e990d9fc0fad4748806437168f500deecd455115e9ef74cc3fdcb6aa48d8ab9a19f8e273a0a646f78fe93f76f29c8be3
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:owuoOWQatr0zAiX90z/F0jsFB3SQke
TLSH
T1B265F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 573171a2e28e6bbfb099cf967854410c6f24309d1b8c4c33c9c82b6ca252f8f3
MD5 5e068069b94d27e4d87c5a34a68d7265
SHA1 41fccb5305b47044cb09dc78de6f0068b6f41934
SHA512 61411d775d58165ffeb346a2a8e5e5fdde0346f8e8041e4113a2fadc575940591307f8641de61dfdb11ad838bd69cfbfd7a74928835a763e8a96788d5561ac49
SSDEEP 12288:RBZ1IyMUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:/ZuTatr0zAiX90z/F0jsFB3SQkS
TLSH
T11855124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 39829bc1f2cd18badce3a7c6fadd8c7a81e63f7504deec90448f4497c8b93359
MD5 0a9f11c17d6acee2f4be9eaa862a375d
SHA1 903219609c06ab363b95057bfe1c738fdb346ebb
SHA512 a44e75539bd2b00937f52256d275b0cd8ef7f155dc4cf183f6fecaf21d8b78ce54c4a876f7e76a066e049ecdaa5c75856e0fe391c221a7417bcc4bc7f77663f5
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:KQRQyi36YOcPQLvw2gAf+PN3ZB2Yyjl
TLSH
T161667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c658114f7ff0d82228bec2cfbfa564fb1337c6a1d8b1eac7ce77b7620b215636
MD5 72bdf2635afbf525ba6d29b1cbebbf5f
SHA1 725c0b67a64db8724f44b98f1259ea711f29beff
SHA512 895d5f082452734cf3d9f523b63e48ec08aba981f5d1c5b2125767c84e085efbe41fd77eff56e5b7f724e19e12c74fa198da6e589bd57aacb9c9ffcc76440d05
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:8QRQyi36YOcPQLvw2gAf+PN3ZB2Yyjl
TLSH
T150667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 600d77b2d31965ddb255696fbbdec874689db2c82126752b4948d7c3c2941bc7
MD5 c401e672aaa798e1ad5c5ad19b90521e
SHA1 cf3278d49b89385c2b75fe786e89eb283422283c
SHA512 e355da5fbb3e0c06576c3cce70a7ecd0a9d525673e37b3fa659b653de52015270935926f81f5e1895b381594030d3f953080f5d1f02c83bda1bd7f1afad907c0
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jatr0zAiX90z/FK:l68Qg55nhheWu7PNU3/saB0zj0yjoB2
TLSH
T123B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 da111d31c4b7dd69c16d05077eee7bed5292e1b321cc761d0920726ee7b45bad
MD5 1d08bcb89149ac647b6c0039396797f3
SHA1 00e5259b1c3356e657e361d5df764734ca920619
SHA512 8ae397b51b93a9092947d5df44e8ae11f39047028d7adb01ec36cfbfaed75e84c40102fd704ae5c8f826e9e39e07a622074301014d6a6bb65b1f010d86877fa1
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:Ly5112gYy5azzVvL69nLKnhZaB2Yyjl
TLSH
T1AE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 258a37bbc5c6512fcf620d38557ccb603ce66870625a1c55461cbb157f247be1
MD5 b3040f1d6445470bc0ee0ac63f508972
SHA1 3d22771d00ebb7cc669480fe923b2708a4431ad5
SHA512 da69127ceb868e2a9570a6ab353c945778dd4b3d21e88d6ee215e4cd3edbc425205a22504674deba35e2db7d45b1ce6f5d66cade0c7d075c1b32791d7c906cb2
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gloaB0zj0yjoB2:Vu6JmVxd2dnB2Yyjl
TLSH
T1F2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bb6916e2a58c70f354d3440e19731c3aa58860d9bcecc73b7876949a0e2b3562
MD5 fae2815987d71c53bff633482d62700c
SHA1 bfde3e72591aac01066cf187b3cc122514266836
SHA512 28e224bcf8035c374d40c477461b35dfeaf4814a84c385f3b242569901d2104f7b6430ca9b9fc1f36dc20666afd40f0dca2428e44856d0e604f4c4b1184cc2da
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xqaB0zj0yjoB2:qmifPbRoB2Yyjl
TLSH
T1E7B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 675e6017ed3018210c23d4c17509e6641137282321f04200328bd2b99d341022
MD5 206fc1beaa38d664c7a4a16a094b3908
SHA1 7877bfbc67d2863158edd147526c08adb7e68b0a
SHA512 bc3a5484e982846fda7a3ddac05c79a26d73bc70e66b96458fe1e48021607ca32136b6ba4f86806b1c7b6b953d32aabfa9ceecd6f99a0ed41cc3dd47aa9dfb69
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqTaB0zj0yjoB2:a5dKTi61eB2Yyjl
TLSH
T147C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 44947fcbd0401c5efb1e4a89454030c12a02bbe165155e1b21a801639d09d0dd
MD5 af2ac6fb1bf67bd92b8b99d6e7d8c8a1
SHA1 61bbac2bcc142b1bd9df1f0238c156d28421d3ed
SHA512 0b050a7f7cba94e8412aaa709bb6d2fbc8a24207d99ebb00a3435e0a69ef6c944d66c7febf11b80dd1bfc7ae87550bd57bdc3ffec52a3f31f5d7fac191086a8f
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wGaB0zj0yjoB2:0X2iyphEB2Yyjl
TLSH
T17995BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c59cf30b8ba0c2041ada64237630717c38478710530bc846966bfdacfd1597a2
MD5 9ff5c9927e7ddcf38722f52d2210e4c7
SHA1 57b9d7ab64d6439ad1051a6733fb83728c5bebd7
SHA512 a6ecd028e87a53c4a44c4402b634f10abe8c58e5efc32e9e8886e4d2a34d90902f0637e0c79d1f936b9e329c9d7abce1258e1f6af0454a798ecf81b7a9c6250e
SSDEEP 12288:lvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:lvatr0zAiX90z/F0jsFB3SQkd
TLSH
T1BB45230B381F81F3C8831B755284984B5AB96EB072D36B85B2953F0FDE382C71565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 22f44476a8ade5998a65ccae32209ea01b7bfc4df780a8aa408d62b11da42d2d
MD5 da689bf2edb4439c18a2c20c42a87c11
SHA1 d9ff1a5b951d6c169855008478d43c1d8d4ee6a1
SHA512 2a23bed94f3d986bb0ab5475ea35150fb4ebac8e6603c00bee43fbb820c20643f09b4102ec7bb2688ce7eb7fd902517522795187347b408bc6cbd125cede0973
SSDEEP 12288:vIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:vIatr0zAiX90z/F0jsFB3SQk+
TLSH
T13D45230B381F80F3C8831B355284984B5A796EB076E36B85F2957F0FDE382C71565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f4a81c851eb70a36baad0e807013d4c00b3b8f2be2a260217e9c0ffe87d152a3
MD5 86a8fbf720de9fb7a896c7556bcaaf1a
SHA1 aa5eec327eb57f4f7f37a6e69f6d53cc9b1dbac2
SHA512 929f9f434e25fdd77dd64d767fd0d6532f9d8828466dfc92405061e68bcc635e97119c8c30ce262be2e4027c5b364f0ddd8ee12817b654ba377b74aa45529caa
SSDEEP 12288:kSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:kSatr0zAiX90z/F0jsFB3SQkA
TLSH
T12545230B381F80F3C8C31B355284588B5AB95EB476D36B85F2963E0FDE382C71665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 50faff1d1f7fd6731292d7383be6ccb38164f491f1c9c517e262ccdba1219ded
MD5 f0204bc54a038a11cba629f866e14e0b
SHA1 8cff90b0c9b4ced514e42b74b03ba3d91ffc5f60
SHA512 1946ee993d5739fb6214f4d05a62dbf38d2888d0900fdd0434cc90eed867b1f2a32ccd3b9e9914e142877571b620faa8b00d9feff270bdafb8f63ebb9451d536
SSDEEP 12288:63VBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:0atr0zAiX90z/F0jsFB3SQkK
TLSH
T18545230B352F40F2C89397358694884696B5BDB0A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 720e96ba6ed655244c0f0f33b0b1bc0b5dfc865dea0427df2678accdda770164
MD5 26bc2304394a902c71a8fc0fe82b6117
SHA1 aeea61155263c669be01fa7aef01df1d1ecddeec
SHA512 e797b117522456a151d1173b368663c9c24855dd0938fd4d16f455447f19a80fedb493648130b69c944fa03ac9663059b6cc21d2a3506462b9de735154c64abb
SSDEEP 12288:U5UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:U5atr0zAiX90z/F0jsFB3SQks
TLSH
T10645230B381F80F3C8C31B355244988B5AB95EB476E36B85F2953F0FDE382C61665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 25c46e4c37dad0ffb63888184b588a1cb1c6d781385064b32ec0dc8dc2e841b3
MD5 8baf8adba5710a7af9d65d69093b1634
SHA1 d1f716b9826a76f1b2f54db6b6e0b7fd09aa87f1
SHA512 0217484819f2a5183db9b91fd9bcadeff38c420c647dccacb2fc7b5a9203d54da15a0d0e2b8dc8695c401d89ee3d39fc02254ab46e85daaac00fe2c0b5ed7cbc
SSDEEP 12288:/kUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:/katr0zAiX90z/F0jsFB3SQks
TLSH
T19C45230B381F80F3C8831B355684984B5A795FB076E36B85B2917F0FDE382C71655AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9c6203920f52873a2555bb57f7b7ad2a583389846a03f01784668193d7b2c699
MD5 a6b5bbecda1d67de3a77deb870c523b1
SHA1 fa2a91938419377e131fc39661b24e90fbba8cb0
SHA512 10515d22b137293559ca36f34da0949d2919f51c8a3a6162bd7e448eeb2df43d43a20a7c7e7bbce3940db87b124cb2a51b1a39084bb677c8655fd2263b9e5983
SSDEEP 12288:4gUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:4gatr0zAiX90z/F0jsFB3SQkI
TLSH
T12445230B381F80F3C8831B355244984B4A796FB476E36B85F2957F0FEE382C62565AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4b55de80d73b86592a5ce24a1eaa7c134ba97a338c91bb927aa95362b2a751db
MD5 a38d82ff1c5940af2d66e10041239dae
SHA1 d8599a44c54d669c83936ddb81a988f6bef68052
SHA512 0936cd247c15d1d4b5a687105462593338e9aa0a5f74f52010918e5bcfd784a34dfbd51adeb07a4e102cac68c6b351211abfe6177aca2c77059efb092226c7ba
SSDEEP 24576:cZMSzFVSOoatr0zAiX90z/F0jsFB3SQkL:cZMSzfUaB0zj0yjoB2
TLSH
T193650196735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b44168364c3b25834ae7a4dfdd0a067e942d49db111b81a44942ccc606f91a64
MD5 7867c92ce2814f2444d7ccdcb512c5cc
SHA1 d0df27ea7de049c4175b7069555dab93fb75185c
SHA512 1e9dde37adb98b94eb813b77859fcec9cb06d572d8b3448db199812b28d4ebf49c6bc7cc1705e4b692232f48c9d9add6bbb25e68fbd95c245c60ae5be5e5c878
SSDEEP 12288:RDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:RDatr0zAiX90z/F0jsFB3SQk7
TLSH
T13D45230B341F80F3C8831B355284988B5AB96EB472D36B85F2967F0FDE382C716656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f44320cfc52dd0d260fb711fd351cc875d01f3a0d29fc007f325ed98e1066faa
MD5 500dd19f39a494c61ab2d7b7cf4df4e9
SHA1 da88d3807f2f8838baae22cb63244c46a0920060
SHA512 dba5d0f375141684dd0d6579c87ad46926f3a71fb8cf789dafe91013a671dc72c4dda8e7e26fd1c9faa48ff225f2050280cd0138cfa0767125da7e06f908cfe0
SSDEEP 12288:AXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:AXatr0zAiX90z/F0jsFB3SQkn
TLSH
T12245230B381F80F3C8831B355284984B5A796FB472E36B86F2957F0FDE382C61555AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6b5e72f65f4faecf1ec3121fb8017766351113a0a2babf113819da2124aaa306
MD5 3c6532a893d6bc7c0561e3871cec0867
SHA1 3492914244531a792f13b887ea98cfe042e6bc4d
SHA512 a05be9f89058d5b74cd8a788b90432ee4092d3b70c131ae45b59d0fb573869f9741cff69b1cf099dd5607d62460f4463542976370dfd4880feb54be1b581eea8
SSDEEP 12288:TyPz5L8MUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:ezyMatr0zAiX90z/F0jsFB3SQkz
TLSH
T1BF551207326620F9C4635239C9901906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 79a68c6dc1ed1beae17ca32d23466bd9cf552b77c4eaff2a271c9a5b0e158389
MD5 99d43c3bb8a196f994728844abd2f8b6
SHA1 e51ebd944de70a47b44ca3403ad1dae9c6aad0ae
SHA512 3eda4aba7fcbb66610094a0f2a0ad54fe092ea1772bf82b02d6e14ccbff5b056043ba055aeddd44c593990d44426b7684052ed49eec805077869750fb99923c5
SSDEEP 12288:5DUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:5Datr0zAiX90z/F0jsFB3SQkS
TLSH
T1EE45230B341F80F3C8831B355284988B5AB96EB472D36B85F2967F0FDE382C716659D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f19fdbb217495a8f145dd4e274ec1be6a74c80a613ad88e8f299fae57dc67cd9
MD5 c37ed743a44fe085b0136325ccfab7be
SHA1 8a35106c80d5aab6ad37dd6e5410964d8cdafcd6
SHA512 8b218a9513885ba3432e5e195fd5d51cff6692e19b99211e8cb9c9a05193c93ed9a7450118a0e67edf0f68291822be7ec818e28b1216125b0f466b6c6159b817
SSDEEP 12288:JDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:JDatr0zAiX90z/F0jsFB3SQkv
TLSH
T15745230B341F80F3C8831B355244988B5AB96EB476D36B85F2963F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 524df482595fb709f59e844bd64e9fa4253408734b076a36e269c2260d9ced76
MD5 1a85fc23b0ccedb3badb6c3d1e2d1997
SHA1 1338ba78f2656c38f12d12b48b3c90c5d5c179de
SHA512 6531f2cb86206dc4e3116bd6b46e7081bb20a0329daac8738879c3840072dd046c8ca602b804d01261f4a2b563f91c8f7e175acffe41792b470464bb2c838f96
SSDEEP 12288:qyPz5L8MUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:3zyMatr0zAiX90z/F0jsFB3SQk7
TLSH
T176551207326620F9C4639239C9901906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 22d5700a5c69698eacc2efd99091c084558b13f195628af888daea229cfc8452
MD5 883a7ae525d5772b69ff099a7702a9a6
SHA1 db2d537814d374776ab95bc5d7bc6de2786add98
SHA512 4ce0e11cb181d83b46169ad1425a877926851769a47b7784545cc021917a2571ff7aa9ce15c1ce3dd633d8eae9e760a4a7e4f8d486d1d57043fcf1081f0f991a
SSDEEP 24576:ZTHaLl3z0zDiatr0zAiX90z/F0jsFB3SQko:ZT6LljtaB0zj0yjoB2
TLSH
T168650195735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0de4bb9be6dabbe44bca855b1cd480dcc38d864f8d7a449f9d03f59a68d56170
MD5 a7c732d44196d8e66f9119accfe8aeb3
SHA1 92d0cf418ff20beefebb4ef54b7bf1280318d37f
SHA512 594fd02f0bfb96a0b3d6ded8908910302958b00cce48c933c2622edc90476b0b6e0b87aa5c63f8277dd99b08b6be8d492f1afeebe7b32fbf71100ffc8497b6ac
SSDEEP 24576:U37d9CHKy7GZOatr0zAiX90z/F0jsFB3SQkg:e7d9CHKyaUaB0zj0yjoB2
TLSH
T16475CF91F3E810E5F0B39A3589754512DAB67CA91B71DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 81d5985bd4bf70de599c0e8358a20d025bf22effcfc96b16a644cf02cbec261d
MD5 e58bd749da328376d4b8b571db0d2ddc
SHA1 f447f8eece3cb381a50db2742269ca19955ab170
SHA512 1ed1d7a3de373207baa23e48276b8ad5c142704eba3585aff0a31536472229a8be16485c9dc74d222a5b8818696daa8b0494456c8eb9d3e10ee8cfaca8726f7c
SSDEEP 12288:yyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:yyatr0zAiX90z/F0jsFB3SQkx
TLSH
T1E245230B381F80F3C8C31B355244988B5AB95EB476D36B85F2953E0FDE382C71665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d769bab9392861ead4fb984275e4b8b22c7c9c91c1ac0904fa09d0df49eea654
MD5 37c773db5b7c414d6033d7b49c61e0f1
SHA1 ca5df503e18e09934f3d0684b2781c87ee230b87
SHA512 03fa49ff806382ac7f91da32e15596fbded7beed0826cfbd443e347fe16c6da6fd27e1c01e11b313991361e792b1991ae9a105c3aa5524b962b9d5999e8a1fa4
SSDEEP 12288:csUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:csatr0zAiX90z/F0jsFB3SQkp
TLSH
T19D45230B381F80F3C8831B755298884B5AB96EB472E36B85F2913E0F9E3C6C615656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 da74e25e384ecf66501afe663cdbf9c0af065fb736a10b78eb3865e7c5ed2321
MD5 ab8cbfd263b3311ea864e0df36dc42f2
SHA1 729cffaf9e65557c6834be6dae80a3f25a62dddc
SHA512 05b10608028261930d5b0f20787c7b7751742e7abce9f7d6e17cc46b9cade86209600a198932626aa796584a230905bd268dd8462b68b9e3a916c2205f321722
SSDEEP 12288:6FUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:6Fatr0zAiX90z/F0jsFB3SQko
TLSH
T10345230B381F80F3C8C31B355244988B5AB96EB472D36B86F2963F0FDE386C615655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 beb842dc3e60d9b4498c2abd2dc319c865d6e2574d0827870c290bb16cf35409
MD5 63e2c322420fcfc5e982a8e43924d0b1
SHA1 db20a61fedea83d605d9b1b7c85c34a68b9aa1dd
SHA512 f47916e3f0b8f4ddb06a84e99a36b9dc93e24e1ddbbcdccf38026394beec05a81c0dc0964f4e98dda2c064106369d03b4176007ae322a098e3ad1b16a90a07e3
SSDEEP 12288:aDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:aDatr0zAiX90z/F0jsFB3SQk8
TLSH
T19545230B341F80F3C8831B355244988B5AB96EB476D36B85F2963F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f6e5370ae705fc2a3dc4f8cf96f4921c0c74273532cc8ca1af9dfadfc9dac26e
MD5 68fc5120a1c5e4b613da76cf2e6da38f
SHA1 4d205d1812e6b62064838a095ed1f3c4d6607f2a
SHA512 239f8c1a5f4311c238daeb44225d88c3807afd7099bce6f6c0efa4a7b3e5bc5180cb023f898363fb7a64b6523d7127266abfd8890e4bb6b15520a6b653dc7201
SSDEEP 12288:fyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:fyatr0zAiX90z/F0jsFB3SQkA
TLSH
T19B45230B381F80F3C8C31B355244988B5AB95EB476E36B85F2953E0FDE382C71565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 193f082f6da2f8db458574b6f8f622d4933b2572e74f87ea2ea509c484ea121c
MD5 455ae848d67cbcc52ae47f4b75b0ede9
SHA1 1ee2cf573e241a2881c9e7da041d291fee385df3
SHA512 6b57f9ae0733d6f23b9df350613c898659604c0ba79d2cfa58bc1e36e487c18306023815d35fc74522549fefcf3a72e56ce9ae3d3585b2bf901ba4b44d9c73f5
SSDEEP 12288:qbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8T:qbatr0zAiX90z/F0jsFB3SQk+
TLSH
T1A545230B381F80F3C8831B755684884B4AB96EB472E36B85F2927F0FDE382C715559DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f691feeee18068369aee9fe4d4a9faf3ffb6ae5ba23bc5442425c211b98049f7
MD5 9c3f1a65be6094d47a83512be9ea8e33
SHA1 77b4bcf0573919f2ebe24d119b793eeecd2d4847
SHA512 260f7c34eb48657a35063644d64a4e5e176c5959e2bbd0f410cc0c2e64078a53c75e7bfb940914c8f257fd67d5b684c6c5fad742e25cecb7be5ae118c082fd64
SSDEEP 12288:Z5UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:Z5atr0zAiX90z/F0jsFB3SQkW
TLSH
T18A45230B381F80F3C8831B355284988B5AB95EB476D36B85F2953F0FDE382C61665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 638e00571d45daf073e9f5ffbd2c085c9b54b72fd80df6beba03d6f9ebcddcc9
MD5 49a1efde578ce1eeb1c581372f99d51f
SHA1 203d9d36c019d16e183d6f92528b79a9a2bc54a7
SHA512 ff661bd32ad413d98a34f8d814ef1673ebae6b2a2939b6b4a26279d4c0ff983cf9cfc13c33b1afd04d010c35bb7521c892db046798ec2d9fe69a625085797119
SSDEEP 24576:Nfwvok9RX6wkyAIHatr0zAiX90z/F0jsFB3SQk4:LMnYIHaB0zj0yjoB2
TLSH
T11D85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b167d5f48ca301d2452a8f980937c306e85ce8c47144afb3d4b54d94055a5150
MD5 8bae88dfcf43f7c9cad9331176f0d5d8
SHA1 df6f9639d658429a139d4262afd77baf24ed105b
SHA512 fd86caa587467ebd9e78e415c4550d4e67bd435849066b9cb22a1d781c19a01e3904233e8b7c21789e2bc497424e405f3abe10badf19a33ab3e57265fc6f165c
SSDEEP 49152:YYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0maB0zj0yjoB2:mySzP5B2Yyjl
TLSH
T187066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d9489e57890bd78ca6fb2dcfee30d7408192bcdc61a6dc25dd293497ce79d8a9
MD5 e22af5cabdcf346f125afbfd5a1464c4
SHA1 5ed2cb9b7cefd8ae574747ac43498bafcf061a62
SHA512 4c4212608fd2567952a9d3a9977ba36a97acc1a1e35d89499e1644a8f176ee4ca00a710077f88e2177f49f5821cc9e6ee12725f492b57fbd42c73288874dec52
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYatr0zAiX90z/F0jsFB3SQk5:M47JUQj1irIhCnDHUPfF/WaB0zj0yjos
TLSH
T14A65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3b89a3726df2c47c02582735db70cca91ee1d7721a1d8792111b4e0230506763
MD5 c79a6c5e773f3f27f72acd864d68de6a
SHA1 8441a85a6426d8c4bfd6e8a1f5e3827729001c7c
SHA512 788676035ae2f479e56d746938646b8c9c04e64d2031e21d58f3ad4fd46c769fcb5e2b1f61c8961eb1145089f67e9ecaf3f2ef0516bd6525beb97e3812af0baf
SSDEEP 12288:JNsfTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:OTatr0zAiX90z/F0jsFB3SQk7
TLSH
T18755F00AE25802E5C4AE6235C7544A41B7377C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d7c774861084481a0f941481f1d0a55b4e6be95976eb480d7222aa6809f1ee29
MD5 97427df4120185a8277b0775712335ce
SHA1 59822b0acfb69c6a8e420012b10d91ea0b8f14ba
SHA512 d7539a2eb06eda2d40e65c810f37220f863a6abde9c653a51e86db16185bf8280be103b08b33be499ff9bac65b38eb192b5e7e23fc393645c5c2110c3662c68e
SSDEEP 12288:iPW+aU3fOo1CSsgoDjLZX48DYinRpBJD7tjR+RuTif9zgLia:i+ZUPv1js9bZX4SYuR3h7RVTq69
TLSH
T1D6352850766AD75FC6AD40321E32C2CCA7707D41EE05AB0372C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1f8d65ce9549d10ffecf3c08cab62429bbe7fb76166ec75d80c264e01c6ef103
MD5 f2fe44ef9e5104276544a5e4794f2a4f
SHA1 69d8f6aae35d81be667a6ebdc75659f69a907879
SHA512 2c2f9edb560f9365f3a5b2135b36d098f26e7daf19a3adfd8e57c61419f230acd06e07f9d51d34a6e22167ec46ecd186cc33e988492af006ec714a909e52c6c1
SSDEEP 6144:0T9DyMnHh0Yykeqs+UAicwq98XhuR2Sln5KTMUU+26tMx026tMx7Oyhu2SEZudo/:AGYykBs+CuR2Sln5KTMUUAEZudo/
TLSH
T16765E9815437E2DFD1F66032072A5B4CABA4DC1677096F26B3C8453AD82AB25B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 aafcbf0d0edd29225b5350cac02eb68ae371f5984aebd690292b9e5e890d7751
MD5 7b72fc1b7e68a289f646aef6376758a5
SHA1 8c62f065fc5a0fc53c123cb1126e3d5c376f9207
SHA512 c72bd82cd13f3d49a62617f4604e64bb4cdf6087ed6845703eea2cdc5dcacd7660ff4b83c28556d1a5387f9b5db73eb23603255c560e578f0f154f9d89eeb242
SSDEEP 12288:SM7rUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:vratr0zAiX90z/F0jsFB3SQkj
TLSH
T1AD452307351E80F2DCA31B3416588806267EBA706BD29AC7F1813F4F9D386C65E75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5c233b828b39ef30832815675dfba1e599b011d54458d411af02d9c1e1c8a7bf
MD5 de8dd8cc6b53fefd65c9fb1844f4c7bf
SHA1 d87f60a31ec2f0646dda0a5746bdc4d2c171d80f
SHA512 17538b2e924d0644fa2b2d3aaa210fceec0fda3062908c194370ff05199418eceba6e9beb8575e732aac07aa7318afd422ffbdb73bc2230040e6d0db236c7217
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYtatr0zAiX90z/F0jsFB3SQka:egb4mBIBhGFYaB0zj0yjoB2
TLSH
T1DE65AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 05969a1fc52571da93ef9283e82f7506df175d84ba44c1d816b6307463d78916
MD5 24c5bb1e7c21ba900502612eb86ecfcb
SHA1 aa435c9fc1fab8c540c35133692465253e95b95e
SHA512 af994b1ae867b0eb814ab0a7449079c4387927cf8532e03e713c5281de85fb01eaf8242339e9034accd6789933608dd892b40d196cf88c60efadd99f26d5744c
SSDEEP 24576:xG88u8FpJqH1bzria7/moatr0zAiX90z/F0jsFB3SQkS:U7ZFPqVea7/laB0zj0yjoB2
TLSH
T14185016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1dde42c3cc4dfa666d836cbc0c9e6d18985e1e50a188c9d1b3f2e75b27172533
MD5 f12d78e64098709156ba44752876e459
SHA1 e4dc385e78d49b1a3a6eb9de529a28c6d6f18b51
SHA512 a6b5d14fbe715accf36741c0a892822823ff22451090627d070d011c03f868c182f1585a573dae7201b8697b2d55db1474fe9cd0d78292772a3f0fd9db7f14ac
SSDEEP 12288:ZHvUrBFrEjwaQUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:ZPUr+NQUatr0zAiX90z/F0jsFB3SQkH
TLSH
T15965E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6b20055962ca5894783d75de35b0b9065f1a0577729ad59e0aee892925374591
MD5 7807be13d75f404bd5e25e19cab2cec6
SHA1 9ea13b43de3d1229de5ec3d0c25f0ddedfa5f746
SHA512 829b261249b736b2c1e80aba8d5327ba4123869b7b9a2c215c8f8d29df604b5914d152c07640f3c9100d737805cc48233f0798e211e4955d6f6a59db9dff77b7
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkaB0zj0yjoB2:ZG05lO43bSB2Yyjl
TLSH
T1BED5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c5a72df5231321408882181896695cb44617f8ed4b46454159e71af8ecd83de5
MD5 08093883350295f923b5fcbaa1cdc118
SHA1 71760951fca604ca7f095e6c7d89f550a3bc3278
SHA512 b1c70c7bcc043334e97bbef0e7e4d6415444c24c53f935fc62af65d62b565799abd8f0ba4496cb83596177eaa834b5eec7e341dd326309ec649bb7ec41528055
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnmatr0zAiX90z/F0jsFB3SQkc:Da5POZ3+Jt2pasx2+msaB0zj0yjoB2
TLSH
T15565BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 41f700c6005bd7d7c441499f76e74a8b72da55cad1c4ce716e03a98c77d70e30
MD5 c472d833f1612d1f1e431952f7c6558e
SHA1 5fe4538b3d64ad5292d9116be95e8bc682c0ab76
SHA512 e4df9b2c65a581dc726425a7badb5605019c91079165131b404de78ca8355c889f036e55008c97db279eb2d33861202feeed80cde88b75fb53646c835212c2fa
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fkwatr0zAiX90z/F0jsFB3SQkg:iNc/zEOVHFFaB0zj0yjoB2
TLSH
T12D858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a39a6ade225bdf0666d6c1fd348fd05376a9f00a80d767a523cf1500bcbd9e43
MD5 70aa25f2de3e217bbad0d6d261e1e311
SHA1 4399d109ee31661a03bb0229067a5049b2a5ceb7
SHA512 3524f76befada94adf90a9fa1498e99341641a127017c13e87d5b1247d39e95462656014477b3a7f345776a24f6a12a98a815cc6b13db37385a2baef36304692
SSDEEP 24576:j8kNvNnaFeYhJNtmZBmEatr0zAiX90z/F0jsFB3SQki:j8MwBtOmEaB0zj0yjoB2
TLSH
T12455BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 62b75364b7b05088929e0556e1dec06ca0a79f9199b46ecbe41578b59ecf8440
MD5 70355a26aa58a90eabb43fda60d5b389
SHA1 3d17d0b6795ba317657ea699e22d024d0a72d0c5
SHA512 427c7c9176c8143f311b42f6466527eba51d41a5ae04611ed587ccb96eda91debbf69a6bee8375af2b901a082989d8957d9a2b9b0bcb5de5dfbb3d3d32efd9b0
SSDEEP 24576:tD3FHshBIYQgAPatr0zAiX90z/F0jsFB3SQkJ:tDVHeBIAAPaB0zj0yjoB2
TLSH
T1FA75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-77-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1952-248-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1952-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1952-71-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3388-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3388-317-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3388-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3388-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3388-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3388-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3432-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3432-23-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3432-15-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3432-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3504-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3504-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3504-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3504-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3504-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4060-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4060-0-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/4060-25-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4060-28-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/4060-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4396-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4396-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4396-130-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4396-136-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4396-138-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4500-122-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4500-125-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4500-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4500-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4808-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-332-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-92-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4808-299-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4808-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5412-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5412-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5412-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5412-319-0x0000000002F80000-0x000000000321E000-memory.dmp

Download

memory/5412-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5880-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5880-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5880-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5880-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5880-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5884-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5884-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5884-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5884-188-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6032-87-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/6032-82-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/6032-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6032-282-0x0000000000400000-0x00000000005D6000-memory.dmp

Download