d0dccdc370135ec38d15c1114cf2115bcb49363140027364c76601558acfdea3

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.9MB
Sample260820-nnapvsbl4t
SHA256 d0dccdc370135ec38d15c1114cf2115bcb49363140027364c76601558acfdea3
MD5 bc7b83c584c0da6ed0070978648c7655
SHA1 60b88b9b3b26c6b81e66e7455d26405e5bdc8753
SHA512 0f257f4970c5d7a765dcd5ad0540b3b6196d2841d623ef4f9043a553c8289b19c871bf41c690df4ff1afb99ddc0acdaa364dd3f39c382cb863d5c18d30000d48
SSDEEP 49152:Zi0BSWtOZvU0g8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqvR2TPod5:Rtb8qRFTauXr2Tc5
TLSH
T177167C06E6B940E4D0BBD13D8A979647FAB1385AC73197CB46A1875A1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2360	elevation_service.exe
2732	elevation_service.exe
4012	maintenanceservice.exe
2420	OSE.EXE
4816	PerceptionSimulationService.exe
6136	perfhost.exe
2964	ReFsDedupSvc.exe
4024	SensorDataService.exe
3924	ssh-agent.exe
4768	AgentService.exe
3616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c76c7ffe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-20.1132.2660.1.aodl	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f58afd999730dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099d58fd99730dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003754b6d99730dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016c831989730dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2660	2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2360	elevation_service.exe
Token: SeBackupPrivilege	2964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2964	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4768	AgentService.exe
Token: 33	3616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3616	SearchIndexer.exe
Token: SeDebugPrivilege	2360	elevation_service.exe
Token: SeDebugPrivilege	2732	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2712	3616	SearchIndexer.exe	99
PID 3616 wrote to memory of 5236	3616	SearchIndexer.exe	100
PID 3616 wrote to memory of 3244	3616	SearchIndexer.exe	101
PID 3616 wrote to memory of 3456	3616	SearchIndexer.exe	102
PID 3616 wrote to memory of 1092	3616	SearchIndexer.exe	104
PID 3616 wrote to memory of 1204	3616	SearchIndexer.exe	105
PID 3616 wrote to memory of 3800	3616	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2676 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2676 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 02260774ac733893a8b1cfdee3405723b56037db91eaa3ee5891364a21076e72
MD5 ce2a6db16779c2bfee642e9e2ebdd2f1
SHA1 c8f847c1f634c4a93d052ab87c8b88ad998215b2
SHA512 e6601337fa92902fcf695260f98ed63e30df95d326ae3c7f245c6693a8ea7260e64fd04c16ceb73bfc503c8b93e5e15bf4deecd68c0d80734f4f38b17058a7d2
SSDEEP 49152:vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn+R2TPod5:t3q60jBD2Tc5
TLSH
T13DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 15f863ba48d9737090e1f59789883573799f7ec798a58fc0f7bfa9a4a2ae6327
MD5 14e4c6902db60f93bbc3db34807e1827
SHA1 d8c0bb349b97709e15fc8a645a881a8840403bb5
SHA512 774c59e47602a51455c282eaf36f2b389b12349b8b7298acbabfb42e5e3b362f49685c00a922aa9996a5cfc7c65b2336e7fc916a87136963d38f7279b83595b2
SSDEEP 24576:uXYfDtczABPne87HtO/DF1+9codjeWyZxeCE5:ttccR2TPod5
TLSH
T19305F128B7E408F9ED678139C9F28501E6737C9147A4F78B03E4A9291E336D85E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f475cec760281c74afb90603e9e1a2638c39b7aa3df877c64c956039a4ca1085
MD5 310d76383cf71a1157f843c94db40b26
SHA1 2a74334b165f82922f35020a1425dce08aad7243
SHA512 cb44bb4c9244f4167d4da70470fb1f1081385b7be12f61ec165e4528ff1679005711559f59dfedcaf1f661e9a34088816a1b89d7346fb02c3caddd692d45f6a9
SSDEEP 24576:o0Le5ji0hmxNrM2Pne87HtO/DF1+9codjeWyZxeCEu:oPji0A7LR2TPod5
TLSH
T1AC359E55F6748331D073C0B9C5D2A68EE97230825B308ACB5286D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1e3b62530ee60b90b27546f4b0a2524da775945f386e75c6fa9b4b8a32b504ad
MD5 eb1b4ff52eeec73c2ceead6b8b664a00
SHA1 2248074ec329c6517c54629daceac08c7e7877a4
SHA512 48160234a57ef6d327ccadfc8c99c2218b178c6510c534b955a1afc3cc87a079a3a37318c895c94db2474508f71c408310742399000e6058699f9dcec096f42a
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWr6q8wyuMPne87HtO/DF1+9codjeWyZxeCE1:o/ezSC6vUzPviHjyPR2TPod5
TLSH
T1E9755C25F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fae9bf37988c9233bff3fd94e5868c96d17ead786261438900b97c9cc7762062
MD5 ddb995f34ee0bedf334b357133614294
SHA1 425eb10eef22e3e6d3a309ccfaaafe2f9912efa6
SHA512 4857bb9ab26fec7afab396fb8efdfd480a94a0668e7147c805757ab5373c3258bc3a0e7100b367e780a498a33d1aa0144cca11c888dc40596d084bef654bbc8c
SSDEEP 24576:uVbqPb88hv/l+bdPne87HtO/DF1+9codjeWyZxeCEN:uVO88hXl+5R2TPod5
TLSH
T11C55AE65F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e1db4f4828508fd5b1c5d17ee9a4becd728e8ecd3de0e4886e5cf699b3b25e74
MD5 491bbdc2a721ca0524e09a801cc30b73
SHA1 8d6722d0554f494c9d1f1ef4884a80b5e97e7a11
SHA512 7b097eda568f3c2e7bc1798f00d3c8ec09c642f739a3c1cedebdec7e855c9234ee89506b6cb65482d0712f81ccaf3096e148de7801b1d9e23732a9f682fd4375
SSDEEP 12288:8jiPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yQ:8jiPne87HtO/DF1+9codjeWyZxeCEY
TLSH
T1CDC42394EBA901B1F7B7063306FE894521B15CD0A8FEB757F5867E6D4038D28D68A233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 99570c0ffd6db7b6822c94a80b916c485375e8c73a176f6097e657cc2c4c973f
MD5 71968547e620c73133653a74ca678911
SHA1 1b90520afd1ace489e4ad3d29bd6e1308771afc5
SHA512 90db54f2a40db6c4ce3b51e4478bf683000f12050c87bc545226109624278e627b99d120b7e867ad7ed14ad189f53ab0aed782dc41b1135c97a8a037ec63a7c8
SSDEEP 24576:ZJIUlPne87HtO/DF1+9codjeWyZxeCER:ZJIUlR2TPod5
TLSH
T1C205C07BEE28FCE2C27A4D795791C600D77278704F62A3CBD165820EDE235E05E79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a5cf7a04553536ebbc26c6590ed039e2931a2aa63b90d08ef4de594349b47451
MD5 2785857c4273d3ca73aa763cfdb9b139
SHA1 9e00e9fbce6fb16271bf936eabe89656b0155752
SHA512 d0861c7f43456468c98e6e3d3b374b1a675aa8ed5fdc47c0ff0f168e9d99c793a52ac3aaf093c2a86a74261419c0a3243d5ffa31f611573450b730e808346b93
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THB:tQvGAdlCEL8c/RRNw5CK2Tc5
TLSH
T112266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7bc3c063ca73bf6d4aa3359816fd06d8df02eac4cc0634d1a2f165f6bd62f080
MD5 0697f5837854d06c86f12cd5622575ed
SHA1 8cbb0c79cd99b18da27810e9e86eb42fda13e6d9
SHA512 28d386ccbc8587fb02bc8904fa177f8c0e50d8f913fbed3f204ad7087891351703092ce01db7ab46ea3b64f20a760893a43e78af7d956c1f225a5f0a59365693
SSDEEP 24576:RSewsAj7Pne87HtO/DF1+9codjeWyZxeCET:8lj7R2TPod5
TLSH
T12215E030FE74E032D3BB0D721B76C706147C79604BA62AC3E3A89E9D58306D16776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8ece2f8a7f9b3a5c503016debbd21189ecb7224dd9ff5ac0405f393407876d8b
MD5 eacd767b142738ee10d402fa75db6e90
SHA1 f1c448fb9cd2a484f56c2fc63fd3c41382a79569
SHA512 4f2dfe68ba7f2fd424d3e2c9bcc5b60ca4346eb2e26aa3d2131cc8b378296424fcf5a5ab8075009f2458ad46032c548340379ba5f420e688eeaf36bc033ddfe3
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH0:RUEtQevvqc2W1cpV2RI32
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ff0582587d00a26fcfe5707bfdb7aebf6e8552dca8850cfc618744ac461bb07d
MD5 b81e7a2e58ca36a7dd3ec442b73feec3
SHA1 cfc744ecd7e4263eb8daaa9dde63e89d3348aa3b
SHA512 24c18eeb155feac962ce995a28de32f16b9c270be9a592bad4974245773c0fc67707f6c44cf49ae2fc33049fdbe4885c90d552eee9f7db4fd12bebf10588def8
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zbR2TPod5:Loq2VjnmW2Tc5
TLSH
T1A3D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266461E2D33AE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 afac444020233aa192d252744c7f2a1d6677c1a6ac6cb9fb7d395d10585fef17
MD5 125eaa45fbee0f62f5b375d6ebcb1f26
SHA1 bc89f852962f1938ff0b281f212b312513303be8
SHA512 ce43792524f525a64c213db05dde9081d1d6090270c51f5becd1cbca4c478476aa2f7528a21b4ce78193c0afdb7eb7228dbe419641102f769f8d527d75f88187
SSDEEP 24576:fAhGL2IFoiwtA5l7S53APne87HtO/DF1+9codjeWyZxeCEt:fAM1Foiq5QR2TPod5
TLSH
T103359D80EBF945D4F5B3AA7899B68171EAB6BCA65E31D20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fd99d7d6d8818a043734dfaa28fda507341c2c1c76ec6436395ce074befa7cd1
MD5 5fd718263e782ce7bf3b74ea6e928ee2
SHA1 ffb1d25275e75239ab2cbfcb0179cd6f7e4328c9
SHA512 5991049ec86bd6e329151b6cff489730021f36c7dac1c5779b68876b01e5401026fbe269948607d1085fd2ea97b3c39fc077f0cfce3bd063f181903548ec1df0
SSDEEP 24576:YwuXOWvPne87HtO/DF1+9codjeWyZxeCET:YwsOUR2TPod5
TLSH
T1F705F14577A80CF9EA67423985A7C136F7F2BC012A65E71F57A0C65B5F33220AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 1216702c1ef84974d45c961e5fb914b48734d6a1fe51f9d4c323e98bd3959fc3
MD5 76d5554f8bda2af7e8529a4cb7cf058f
SHA1 1652342d34986be527ead73e130f85085f26eca8
SHA512 c8209d94098f2877672c48f94691bacc60be5980cf3928a869e5a57b05cd411b09bad0334bd8a30c4ab0261023b18f40931d6d89a089d1152200b46d5c1a3d42
SSDEEP 12288:4/Z1IyrPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y+:8Zu+Pne87HtO/DF1+9codjeWyZxeCEm
TLSH
T1BCE4129833E820F5F3A3423989F58605E3B17C9123BA63CF655566691E32ED49E39333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6a75467d09cc4eedafe24c8d89dd2b5f16f87ff562059bd6461e1a2ce0915db6
MD5 b9221b7821c998918ac0152e6228020d
SHA1 2b281654c7db1640ce3c8878c328684c756415b9
SHA512 74d0730e780dfd62da0b2a2f9ee214b22282106131b4914fde654d765a76008c728aa1d759688afb5ef2e0ad81311711799d97cde9aaca7a16edd36284a11ac7
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U1:3QRQyi36YOcPhLvw2gAf+PN3r2Tc5
TLSH
T14B667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a346f963d8e986774722effcf6a57ffa0bd6d16ebb7b04d8266d2b459d9803e7
MD5 b94647c2909ce0f952872957654ea4ac
SHA1 797022419dfb0396132ea7fa8db58ffac5d28629
SHA512 6747ac6fec2c7b0e795e17f4f6e03313ecee772c000a324e1576c366308cdc2c5e1ab9e235ea9835a606cba14d6ab5479afe6bfb6be01c23ca5da7096f178397
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U1:QQRQyi36YOcPhLvw2gAf+PN3r2Tc5
TLSH
T1E1667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8a705a7c09d9b08e84f5750f9e15a7393fa19d267f0b33fe888e023418fd310f
MD5 3a57c02e79ce65afa07683dbdf39fb00
SHA1 0e7ffc56a650f0cca231f244973134dcc6923a23
SHA512 34f1b57a6ed2ca8725d3833495d6de7eccb2ff518541ce1d3efd4ea507e6718d1687b989c0d571981c7de4fe2bc3ce0d4162dac4151e7f53c315d421c31fe5a4
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0OPne87HtO/DF1+k:c68Qg55nhceWu7PNU3/LR2TPod5
TLSH
T19CB55A33B2F600A9D44DE1769F4A872196D17C718FE1E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5b80b4c40e9007100903b5e90bdd64a509010c557d3a187594ff783c9911aa6a
MD5 605e7189b881c38b269f8721c8d2536c
SHA1 b9cf458169bac1bdc2b6ff7256bda9420f8da1e2
SHA512 cf37fa0b7664d987e577ed1d86cf57e5a39658820aacc88a7d939013aab21dbe18260d7e0765464ea48dedfd54939767c2bc7630fe843c3fad09732fc8b8c22a
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99n:wy5112gYy5azzVva69nLKnhZ42Tc5
TLSH
T1AC167B13F29900E8D05DD179878A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a0d245561aa93572a3568776e004531a59d34477bcdb903b18884770fea6792d
MD5 964cc1a8752a107acec776915538efc1
SHA1 06f5e03103478ca56f7c0d23210dfcfad271dba2
SHA512 2eea79655725f7a2198f0da98c4e7244f1c7e93f88cd6d622d7be93d908592cfa477cda476d24c226536a7207797e6c790406df76220fc6aa4ee73a028a486d9
SSDEEP 49152:RB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl1R2TPod5:Hu6JmUxd2dv2Tc5
TLSH
T126D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073552A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 11d24d2540d4f9640b60e9344ec7b740b77d3ed14bcfaa26070ab552a238da47
MD5 3abfe90d2c9d76ccea777b91146c5111
SHA1 9abdac71d6ab9d28719ffa7539b0d12a1a66df8b
SHA512 d42eb69ddb3d12c26c44818f56fb4fd09e7800006ee658578737f0b5e450fba523a7c2f5c315f4c6109dec5a009c2e6f2b56a80d7ab0e10b82ce7007533a93cd
SSDEEP 49152:H1hpsNoJpF1A6BU44CwH7R4xFR2TPod5:HmifPkRW2Tc5
TLSH
T1CBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1c862e8d1980d530d20f5cc5c617dcf283d1ba9794b1e90c8f0d25c5b99c1c41
MD5 97eac9106590879b86cb4d9840d62583
SHA1 1818d5e439990cb1331dcbcac64c2ca5c6591813
SHA512 49271baa858db2274652235c0ce43e6e5566e1bdf05e638b6e95a64b7052766b88576d38610f2c916f44470359d822d2e403cca0c0c408cc1af837f0d251302e
SSDEEP 49152:ASuZQIY0Be2KNRVtOnks6NMHq+R2TPod5:a5dKvi61c2Tc5
TLSH
T11EC5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1bca9c0477ae2aec9d364f5e7bd42e33a9f755b4905b92b969385926a27fa23
MD5 1113e76480ead5112cf8faf5bb27c9a2
SHA1 065b0b723b4710f4a58168fe1960aa654c571a3f
SHA512 e3386cbadb0b4a8c02f614e75ef7efdc51e82bcfdca0b145ea6f59e46cc0a7775cf4cc8fe8ce4b1330ff50b67e78197ecd220393c6979a4384dc5cc59539b6e7
SSDEEP 49152:qhtSn8EApI0figXgiDn0AP5wBR2TPod5:LX2iyphS2Tc5
TLSH
T18495BE13F2D900E8D05ED178C7568632E962BC150B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3ba41c29ab0f299860d265c2f968f9eb7a46cf758aa8c082b83f31b8ee0c99e1
MD5 9a2aa4a89469294d013b4e7fec3b40b3
SHA1 d3ce14dc77e37f06534611cc7ba6ed127f8f34b1
SHA512 9d129501aacb1d71995196064282ccd7acc0469df6cf422745ba68e1454bcfdb25ed346f77e338353e99b128bf6b6746516b2fb8ea10ee1b147792b55026946c
SSDEEP 12288:LKPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yc:LKPne87HtO/DF1+9codjeWyZxeCE0
TLSH
T19DC42394FBAA01B1F762063306FE864961B01CC1B5FFB39BF58A791D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 652b44df1407b5cedd3fd9393f01b641023f5da0c3fc34fa815f15d970b861da
MD5 50e1d867472caf6ad1074d2be7f944fb
SHA1 665aad7f8b50cf4aba438c3d06ed26a2f1a24284
SHA512 b18e40e378915885fd6718ece8306a8ebcbbe6841bb2b51eac099b56401aa96eb2c693f9749d944ba876d2896f9d87f203ee53d19b49c1496ffdea9dbe9e5bc3
SSDEEP 12288:PHPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yg:PHPne87HtO/DF1+9codjeWyZxeCEI
TLSH
T199C42394FBAA01B1F326063306FA854961B05CD2B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7a9469c3be3121f40b629d9870bb16cb0d27d4d2711613780426cea311338cb6
MD5 bea5ab404fcf274748c58b876cb2b830
SHA1 ec3f820100e6df63daffe38e738e8dc3f7bf6138
SHA512 401a28475dab9422ac75a1eff4ee93fb0d3d1f01966e0110e0d0098d4e5c430c327a1349f7c8348a363fa39904a8c64f27b216845267caf68ceffc3342bd77b6
SSDEEP 12288:wtPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yW:wtPne87HtO/DF1+9codjeWyZxeCE+
TLSH
T141C42394FBAA01B1F366063306FA864561B05CC1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ee55d94153c7ead91ef957301075a4f60eee3e2f368bcee4e88d79cf87f48137
MD5 f78994d85613003d8201b48233db0f92
SHA1 87092ad14c85645d13fdf4eb1249d9ffa0a5d504
SHA512 f7e6c35c39a437e1cdd8aadfb91311ae81b2c91b4aa0ebc586838235eb6010e48daae3f1df4ca40b74200dee36b9d426f13e635fb5b204fa6b0112b750eddef0
SSDEEP 12288:vVgPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yv:SPne87HtO/DF1+9codjeWyZxeCEn
TLSH
T179D42354BBA901E1F763823685FA8145A2F17CD1A6BFB39FF6413D5D0830A24DA69333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0de627c4de3205280a569def873694bd5685f468d432dbae24fa777a5a242d2e
MD5 ce411282a31a8af15a48ab9af26941a4
SHA1 99a3bc45827f8c454686574f2dbcc7fbb71a9fe2
SHA512 8b99cd25e822a56d2358746be07b9d9adffe09897f5e7aa032c558843fccbe70359b3e172887328d2c5e561b8a7f095011a9e96b4378310f9d776601610476a3
SSDEEP 12288:vYPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yu:vYPne87HtO/DF1+9codjeWyZxeCEW
TLSH
T17BC42394FBAA01B1F366063306FE868561B01CD1B5FFB39BF58A791D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6c047e033288d9147d90ce8fe0680d3941f3919f9607a2fcdbec834370fa125d
MD5 5b05cea4edd29bd6241dc2c7e8f8a792
SHA1 bc426aab0fc041c2eea4af2b07d700b99fbc5f1e
SHA512 f53ebb313ad38b6d9351df219a1deb573159d06784af9024886ed215fa7dde1b8b6b8c8d1040c6b085a032d25931a1298d6d98d85f987ea7bf7208b59d5bdfdc
SSDEEP 12288:7DPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yu:7DPne87HtO/DF1+9codjeWyZxeCEW
TLSH
T146C42394FBAA01B1F326063306FA864961B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3d3f9afdbc5bfe911121155c5cc3817e5b4d8c7ba706d8e084d3485b12981726
MD5 094b479bbe4f928e44c890511d17b24e
SHA1 f9f33a4ffe2babbed525b0876652c2ca29fc06e3
SHA512 099df34ecc92a3fa22c13814dbf78b565496d186afd27e24ea5abb6ce1a4cf2c698b64e4f65ec747b9e51b0ff8bbdc1aab9e38aef1359351d833a6a605fa03e7
SSDEEP 12288:P/PNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yL:P/Pne87HtO/DF1+9codjeWyZxeCEz
TLSH
T147C42394FBAA01B1F366063306FAC54861B05CD1B5FFB39BF58A79195034D28E68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a1718d008686973a1c62cc43529434dd6bee8a838ec0a26d523a380f9e4fd0c6
MD5 66b74828da65cff0fc061ddcf5f05c9b
SHA1 3e3fe4592d796905da1fe3959f3a5c4033ab8e5e
SHA512 d8058f8d5ddc9ba27fc6ea85d1de7bcf6304b37d85705175a28e463bc68f26eee1abf23571a0972200b3409f26f8a1bc810fa30b87d4c5b69b667f838e1e8815
SSDEEP 24576:6ZMMzFVSOnPne87HtO/DF1+9codjeWyZxeCE1:6ZMMzfzR2TPod5
TLSH
T1B2050194B39008F4ED67823EC9A58906D2B27C560BB4D71F13E4362B5F337605D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b4766206344d60997cd41876980098d02c973bb908781154275c6393e846192a
MD5 6ebf27464daede2e718be0af37b216fa
SHA1 70e5e6e1ed923992e9deedca43bb0560cc78044e
SHA512 f3b1b37816da47fd6720044cd35e3842283cc5486cbb900a0d670a2130bf199d4cb8b656dde20b7b40fa88457befc219a39ba21b5bbcc246f9d67072d16efb22
SSDEEP 12288:OuPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yK:OuPne87HtO/DF1+9codjeWyZxeCEC
TLSH
T143C42398FBAA01B1F366063306FA864461B05CC1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 887d17e09ba0fd632a61bea3db0ffefd08820f1fef05527d6d0570c43c3ea21e
MD5 314158c54fbc4435fb697998c0d5fd81
SHA1 00db1db1fd601365f9a7f33666d8e0bcecfd65ee
SHA512 401f2b7eafd98480303101f14958a2ffdee9fa1f2ab494a7f2d907eb925a512f8cdfd23586c3111ab852bb0cd4f122d9cf1b42560bc1c5d9e9c29eff1256fc82
SSDEEP 12288:NSPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yK:NSPne87HtO/DF1+9codjeWyZxeCEC
TLSH
T146C42398FBAA01B1F726063306FA854921B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4530707725ab5f5c29821cd6ccfb9f08ba002190019cc9d9435732c368aa0b88
MD5 4609d975a4583637e4db7a15c425fde3
SHA1 841602f5b40d692ab1e0e0e5603c37d2f6eb415b
SHA512 f6b1bfb296ec37094e72cb8f7c8f98a8625a05f055ae391f082ae595c45cdab58f99a19c0ee7e08247e697955de20de64b500ba8804f353fc5545c57361f755d
SSDEEP 12288:puPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yG:puPne87HtO/DF1+9codjeWyZxeCEO
TLSH
T1C9C42398FAAA01B1F766063306FA864461B05CC1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a936e9cd658aa379f833536e1f11bc9b4abd2fbb8f4808a4487be6e3b0e344dd
MD5 3749a293896344c489105753d623f192
SHA1 1ee284711b158867a51c0ee3c70b51b1f926dc48
SHA512 004d2e047e002ade5db7de2dc1ff4c8e0abae52b438ef380327e315bc4a2534ceba8ef7f1ba7704f57ebd6d9bc8154b0f24f8bdd102c2fbd548313cb2ed270d6
SSDEEP 12288:cuPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yG:cuPne87HtO/DF1+9codjeWyZxeCEO
TLSH
T148C42394FBAA01B1F766063306FA864821B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fe698a939f5c29c5587c65e721990192c395dc33e7a525e6232e2bb3321ad51a
MD5 03dad819b12083a8e855727634a4605e
SHA1 56f2b7c8dbf5a8ef8722edd2a2c089521318346e
SHA512 c7586bcd327909e8cb78cbfa4728dc4f63322819e3cce75faccb857c34ec1db702fa192add3ca251fa01ad8c290acb414c341e6290c509f190580a0e28190bcf
SSDEEP 12288:/yPz5L8rPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yE:yzyrPne87HtO/DF1+9codjeWyZxeCEM
TLSH
T188F4024773A520F8E237423588E64A01F3B17C7217759BAF6394267A1E336A09E7E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a3109a0f85f6370a100519f08f440e94832b0478ba6d97855128440e8098e52f
MD5 0e3850d0481dd737b3477955803fefe9
SHA1 48714691e7ea44131290a636fb890ff5a48eb30f
SHA512 52b381e83ff28d7b326b48593e4c5ff86e94824d1fb318224258040f00c902a1f894d92a902884dacadcb21d05d3b0e4c8391edc1fef54518f21e360ea09341b
SSDEEP 24576:IT9aLl3z0zD9Pne87HtO/DF1+9codjeWyZxeCEz:ITQLljMR2TPod5
TLSH
T1E7050194B39008F8ED67823EC9A58906D2F27C5607B4C71F13E8366A5F337605D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ebc3641694a8f4ee2114b3cca526077df97aa763a132dfa7ad3f7c289fc1c3d0
MD5 7ea5c82031ca7ff20b68751a90683585
SHA1 bd78f819bae6273b1953ac9604c6a6b66165e72a
SHA512 b871a3193d0150e9bd4f62f56d2165d86e5195223bd5cdb3effb2119cc45e9949d0fc7b83f343486e6c21e99fd51ba07f440d3bb0e34398722bf0fe606a86767
SSDEEP 24576:63td9CHKy7GZJPne87HtO/DF1+9codjeWyZxeCEM:ctd9CHKyazR2TPod5
TLSH
T19825CF90F3E410E4F1B78A3589768511DAB67C9A1B71DA8F13A4261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e6af14e5a504c0efd535d4ec903323b5553b82708a475720d3d4817a71dc9d98
MD5 22a30bbe83d963e89ec3b727e9a9b053
SHA1 b1e054549a02494461d2b1e9296315f99a099659
SHA512 74ad08d7f3ec293ebf1a6735f9bf7e9bdad9cc3c7336bd33338d5fb4e0c73e9e872a1cf38f91832848eacf84934795b718f319ea2312ff293b84bc00805cce17
SSDEEP 12288:+NPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yJ:+NPne87HtO/DF1+9codjeWyZxeCER
TLSH
T1BAC42394FBAA01B1F366063306FE868561B01CD1B5FFB39BF58A791D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 48c5ab9ab9417bf8b3d0eb05afd8db853f3e3cafc5db6f83c5d2b543843c15f1
MD5 1e2bbad11d10be0ab85508b0b1c24089
SHA1 817730c51d8ecaa43770ee66e4d21b042aa6b1a4
SHA512 e55e0407bdc1c6d622a3a7670de021bee5e3777a069642069c054c7e7d86d709e08498ff71c899472e393b3431b47f612a17186b45557da559b2f08253f7d04a
SSDEEP 12288:mLPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y7:mLPne87HtO/DF1+9codjeWyZxeCED
TLSH
T162C42398FBAA01B1F766063306FE864521B05CD1B5FFB39BF58A7D195034D28D68A233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 8fed745e25dcc965b041e1388dd147bace88349f2adac75fd808d6d602c6a5b3
MD5 932c3ad0677782c503d29de7e95c0861
SHA1 057ceadb2c21a0eb5a21f81f3473d8efd9067f85
SHA512 ebb4ef937f4b8838df8bf799633859f5246eea654f53a50ae5a7ff154cdaff4895a9578beae9ffecd8c5a9c69fa22af4afde45ecbb1103e5917e7049148f949c
SSDEEP 12288:UkPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y3:UkPne87HtO/DF1+9codjeWyZxeCEv
TLSH
T1B3C42394FAAA01B1F766063306FA864861B05CC1B5FFB39BF58B7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 2956f766e66dee55c1ea16d43c85e31f43d2b55bb84ffeaed0eb465fbb5d4ffa
MD5 f6dfcfd2016ec5944d3c206421cfb59b
SHA1 7069a88e2c04a5898a67f23681c7a88f757cd2a0
SHA512 7f5e960a94ccf0320e230cd22b1d7841f3f52e117dc5b2db87b9996d95ba57f84c7008af67e3cd90f35acbf81c0310e355b29d626778a552c34f4335363e31b2
SSDEEP 12288:QuPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yt:QuPne87HtO/DF1+9codjeWyZxeCEF
TLSH
T1D5C42394FBAA01B1F766063306FA864821B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 993fa617af5a8305f95ea236ba2fc4cd96a2f26586b11af2bc63f24f826ce369
MD5 37c62bced063463454abd8aa52de94c5
SHA1 60b648d7441fbef06d2a572d4d8db165f5af8524
SHA512 ccf605e6cace052321dda5f32372e8e830772dd093fe7ad82a82ac831c6e6ea228a4b0d44fa0acb011ac353db3a63b3f8a9b02e3a16238b91e0583a95feb97f8
SSDEEP 12288:QNPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y5:QNPne87HtO/DF1+9codjeWyZxeCEx
TLSH
T136C42394FBAA01B1F366063306FA868561F01CD1B5FFB39BF58A791D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4df5dab83652ef4bbb4c0ed0ee79f1d44266565e7e7e55144140ce82d9f755f7
MD5 abb50634434a6fb850dc93ee32a1bddb
SHA1 31200bf3fa2560c8ffaa1d0f06c5847d3e8619bf
SHA512 d4c52088e3a53bc05eac501f8b6818db05870fc433e798f1d66e6f80cb29a0424e0f1341b8e1e1ab124d1ba0c545fed7d4c12cace48f5627470501b1278ecd2f
SSDEEP 12288:KGPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yt:KGPne87HtO/DF1+9codjeWyZxeCEF
TLSH
T1BCC42398FAAA01B1F766063306FA864521F05CD1B5FFB39BF58A7D1D5034D28D68A233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 f6bf453edb1b341672b1d873183e22e5d66befda6965fd8a0ecaf1dc37a84a86
MD5 d0f96e67ffa8c3f4a1cc35e8966de66e
SHA1 da2b0215418ec4c5674797fb8ead47189b58c1d3
SHA512 fb56e2722e4d862b2230e583e7a402727a66bf0cca1d48975846ad2294ddaa32474d36780b89c65f142ed488142785d3f519e7d0cfa3cf69e8b4ced52df2bc94
SSDEEP 12288:oYPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yt:oYPne87HtO/DF1+9codjeWyZxeCEl
TLSH
T1AFC42394FAAA01B1F366063306FA868561F01CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a70b4d4a12612bb9dcaaa84549f7ca530e244c34a23d7ea19e4227f26b734557
MD5 73c517edc7b1b48d5d9e16a4b665ed18
SHA1 8fc7e8c0ea652e6dc80f634856e3d7f2880fc523
SHA512 49a58583766d8ca5e40b7ad405dac768529917f576129eae8883ea7c525d45fb1d8510e77e5df1ef8eb2413d7332284baf7564013381b1ccac79c8fc123d2577
SSDEEP 24576:Bfwvok9RX6wkyAICPne87HtO/DF1+9codjeWyZxeCEA:/MnYICR2TPod5
TLSH
T1CD35CF29EBD804E5E177923C89F7460AF2B178591B31D2CF129A536D0E33ED49E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0dd98dab99c891a1419f80726320a014de6c631bbed0e4366e61db5f1ca584e1
MD5 960c912f3fa8a4cb283bb7264a7dbd16
SHA1 720ce4812a25fd40c2584e3ded6cbe23e116322f
SHA512 eac8d0a06a3d0a922bd5346d93b09468d5882569e93f3a55c3626895fc45115805ab4553fff5fd6456d96bf63975d206ae692595b4c7cb0e4281a2c1c1804842
SSDEEP 49152:9YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hR2TPod5:7ySzPL2Tc5
TLSH
T18D066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 43ec6c2b317d94c277bf8b55e9e3b69b6687fb4a79ec22de432c335214c9ae2b
MD5 fbb413f55c906b3c2e3432542cd36476
SHA1 7e1588ad7c2dfb8508aa53979d90493c3c60d93c
SHA512 c136b21f2abd79cc572a968d33cf1621fc508af696ed6a5463711f9073a74ff2f21fb96632fbd80d3ea4d2805058f65dd41e97d79c1b818c3d5ed076ee1e37f7
SSDEEP 24576:T47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYXPne87HtO/DF1+9codjeWyZxeCEi:T47JUQj4irIhCnDHUPfF/RR2TPod5
TLSH
T13B65AE1DA3EC01E5E1BA823885554A1AEA71782D1F31DACF2270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 b5d22eb180db173dfca4f5d5f208b28f907dc43ba1a652448d57d6147acc2c15
MD5 f0327b5e2a849c959e551ab7514364e1
SHA1 84d0f1e00dfab54fb6803a0cfb53956f6fcf2828
SHA512 13bc4cdc3e8a48460f091c6deca96c92f7d1ec2f1dbbb72631ece5727b02fef71322681f9ad8471637095b6e57094d266204294ca8a610dc993922d2f5ab8ff7
SSDEEP 12288:XGsf+PNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yP:l+Pne87HtO/DF1+9codjeWyZxeCE3
TLSH
T1D3E40158E29802E4D16E5135C7A68641B3737C6197F6E3CBA2C0F93E1F35A909DEA313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 04971106bcf774eceed29a47bb98a2f2813a998fb5a5364a81b85e7276b1bb1d
MD5 e577f9146172b6d87345f07cea92e068
SHA1 58228ac563244c14a86617339bed7940d7bf95e3
SHA512 ceadee86deb77c307d11d5370c5eb2ba42469c7aaf0177f5d4c363566d8c8fc515d37dfbd7caefc6137eb76649d483db1c31867dd2705e1cda4aade2585370f5
SSDEEP 12288:EF7WPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y2:YWPne87HtO/DF1+9codjeWyZxeCEu
TLSH
T109D42390FBAD05A1F776063205FEC11421A56CA06BFEB3C7F44A7A5D5030DA4DEAA327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6598e85229749354e737d18836ff8ddf428826b6fc63cb425f94130dc243205c
MD5 45f7b9bfbf56554f894fb2f5acc18ca5
SHA1 e299fa2a3320c9c080ab113168b90db01b097758
SHA512 380bc44f761be5bc17114af41bc36752c1bdc14426581ed04a1d8fd5efdf9ee820d53866be710dc8f1bd696ac6a8e076baef63f9045885810f956a165625ca98
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYMPne87HtO/DF1+9codjeWyZxeCE4:agb4mBIBhGFXR2TPod5
TLSH
T14C65AE1E22EC02F5E1F6D2B88DAA4417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 132a3257703100afe5ec89ca700709083d6ae339e6a5a2867d75fac53aa1abe7
MD5 22e0dc616767d98dbd15a6ab2b1d5b50
SHA1 3591a24f2bffada75b2e1284f7e0df56b4fdc9d6
SHA512 b09a8a228279310809e46ca0df69b01433c94673c3b1d619a4832a07eafa7c77f95925e1776ada304532421814d97d03f1fdc724bec7bd02401e388a534614d3
SSDEEP 24576:1G88u8FpJqH1Wzria7/mnPne87HtO/DF1+9codjeWyZxeCE7:47ZFPqVha7/ER2TPod5
TLSH
T13735F165B7E101F0E477D13889964663F6B2B8210374FBDF06A88A551F33AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 635c8fb69423e9e1231ad6ec43fb9513e0f544512bc4b0bbe3c77b98da14b658
MD5 f66c01429c67737aeb7c293cb1312bc3
SHA1 2d74158d717365f77c1245210f0d1ddfd0f6a26a
SHA512 6776ade12a77d45b66f67f5f31ca5a23044d51286b6438bf6a8086ba8b1f31af7beb83e422d7b944b297581277f74533d2f5fd04af2a3c75c5fc3db2ab0198e6
SSDEEP 24576:LPUr+NQzPne87HtO/DF1+9codjeWyZxeCEz:LJQzR2TPod5
TLSH
T1CC05F12E62AC18E5F676A13D85968709F37178621352E2CF02D1917E4E33EE8BD3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7285167424c22ca15af84955b1f46dbe2f33199881ef142fb07dca21bf2340e2
MD5 056943bfe0591dac70e55ac76dd09b1e
SHA1 10809e80f9b7524831d9522372df818381161181
SHA512 ed75e0711561b23a9abe56d41b6879c90c4b1509ef93f35e45e06920e5fc681d9f20cbeeecfce41bdbcd787b9c13307b1af41a210f5048d45f3a2d71935adab8
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDR2TPod5:kG05lO43bg2Tc5
TLSH
T1A8D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 705e9268527dd8b1717c3727666ec647c18f39016317d022ea4d28234068c907
MD5 7d20f617806cc12bc760a8732725b320
SHA1 45a743ed6f28463c689e85730d17c0005b5d2f9c
SHA512 4e7c34bf0e2987e51cd47e7319b33a9b9cef1dcf746a76c02978893d9bbe663c3fe15769a8b286d70612584a8d5517600a51d02e62f24734fcf4f4e236e08dc2
SSDEEP 24576:Afa5POZ3dpqWVM50JicR2hG0lasx2+47eidnhPne87HtO/DF1+9codjeWyZxeCE5:4a5POZ39Jt2pasx2+mLR2TPod5
TLSH
T14365AF5DA6FC01D5E1B9D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ecfe905267cb26504ec0a9606eb60722f02bb24fd13b49a1070096946d8513de
MD5 15b25ce785403eb54f556df1371d7783
SHA1 4b925f1d9f451314eb8d40f9fb51c34dd4a25b91
SHA512 f19e88be47f203650f1f682c237aec8f216bdae95993719a300e21b3c0983a2250624577a732097d863762300caf43dba3c109b8f78c5bb08224a918dd071b37
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkPPne87HtO/DF1+9codjeWyZxeCE4:YNc/zEOVHFkR2TPod5
TLSH
T1DF857B1623E901E4F1BBE1BE897B9546FAB17865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fe346b61e5ca270410f631ab3e9f422de010164b8628cc383625e2880fa6c6c7
MD5 ea14931df017a95974c0bd3f0353b0c7
SHA1 04f6363d5b226f9d31ec9b008e7239d6d41ac911
SHA512 78511b1ebfababc1123d4511fb115df7fbaf7ef980337929e3a93bf7c6417c12b5fcac61fe0224a3f714912733c08de5f20b3d9eb9a23dfd5bfa1cdf6fa2368d
SSDEEP 24576:5tkNvNnaFeYhJNtmZBmJPne87HtO/DF1+9codjeWyZxeCEj:5tMwBtOmJR2TPod5
TLSH
T19755AF6EB6F806E4E1FEC6758D238512E6727861173293CB9290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ebe56d913cd6c807258182218d08cd7e6fd93275456c2dfaa8abde29260da367
MD5 013e59b439f4f880f4bd43aa00142414
SHA1 9d31f50027dd1d1742a6421d99cd696acfc678d4
SHA512 d136317d54b050f30b4fde372bcadf21e5f3071deddfc17950e7e8e913b6eba31b3d815d46510107f3801413e9d0919f587b56b1747abebd61334176a7984498
SSDEEP 24576:8D3FHshBIYQgAqPne87HtO/DF1+9codjeWyZxeCED:8DVHeBIAAqR2TPod5
TLSH
T1C825E17DE79C04E4E57BC17C86A38A06E77138A9033666CB12D491B91F2BEE46D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2360-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2360-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2360-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2360-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2420-70-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2420-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2420-64-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2420-302-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2660-0-0x0000000140000000-0x00000001403F4000-memory.dmp

Download

memory/2660-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2660-9-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2660-34-0x0000000140000000-0x00000001403F4000-memory.dmp

Download

memory/2660-31-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2732-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2732-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2732-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2732-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2732-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2964-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2964-338-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2964-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2964-97-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2964-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2964-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3456-336-0x000001D0CB610000-0x000001D0CB7DA000-memory.dmp

Download

memory/3616-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3616-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3616-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3616-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3924-129-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3924-321-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3924-122-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3924-123-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4012-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4012-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4012-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4012-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4012-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4024-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4024-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4024-116-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4768-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4768-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4768-135-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4768-143-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4768-141-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4816-82-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4816-76-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4816-74-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4816-317-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6136-92-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/6136-87-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/6136-86-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6136-318-0x0000000000400000-0x0000000000497000-memory.dmp

Download