37b25b9e4fd64d550acf2e4d22700d48621f76e216f9a8e21751d7e370ea3541

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260820-sd17aael6s
SHA256 37b25b9e4fd64d550acf2e4d22700d48621f76e216f9a8e21751d7e370ea3541
MD5 964a4d672125b558a5e6811932565c82
SHA1 c79cfe163101e992c2dc020ef4454430a2676a0e
SHA512 3aa7606cc33f48fe93b63681f43ad1ad2e5c15ae4ed08936a0f618e9d01e793b0a3a15366219fabe0d0d21ffe8c9c68d6362b62bdf13b029873021620a70e68b
SSDEEP 49152:c7EE3hXd5NHfrPqx0AAzXfuyaU0CBedbQ/dBZchqmb2BqZTd/d/54K5QTdqW:xjB89/dBa5d/542QTdqW
TLSH
T103167C07E6B941F4C0BBD13D8A569657FAB2785A877197CB43A0875A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5984	elevation_service.exe
4944	elevation_service.exe
6596	maintenanceservice.exe
3864	OSE.EXE
3428	PerceptionSimulationService.exe
7148	perfhost.exe
5996	ReFsDedupSvc.exe
3240	SensorDataService.exe
4392	ssh-agent.exe
2332	AgentService.exe
2720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\65519630957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-20.1501.6464.1.aodl	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005bd460d3b430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008233ded2b430dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1f76d2b430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054486a14b530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
4944	elevation_service.exe
4944	elevation_service.exe
4944	elevation_service.exe
4944	elevation_service.exe
4944	elevation_service.exe
4944	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6464	2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5984	elevation_service.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2332	AgentService.exe
Token: 33	2720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2720	SearchIndexer.exe
Token: SeDebugPrivilege	5984	elevation_service.exe
Token: SeDebugPrivilege	4944	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4588	2720	SearchIndexer.exe	101
PID 2720 wrote to memory of 4496	2720	SearchIndexer.exe	102
PID 2720 wrote to memory of 4688	2720	SearchIndexer.exe	103
PID 2720 wrote to memory of 6328	2720	SearchIndexer.exe	104
PID 2720 wrote to memory of 2696	2720	SearchIndexer.exe	106
PID 2720 wrote to memory of 4580	2720	SearchIndexer.exe	107
PID 2720 wrote to memory of 4388	2720	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6596

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3864

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2720 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2720 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f957df1e753a0a73a476332aa5da2abc7879a58478776fda505a160a0d2613bd
MD5 be9145cfbddd71142f878d65af678e62
SHA1 c6b454744d3669ae052267da9aa2eb37bfb63945
SHA512 61497bb381a85ab32ce4e5f54d978e0157bb631aedfb6592ac86f4ced74c999a6f7ac47c6d7ea358ca1603ff6b8de8429a03ab16bac21237bdba89820720aa58
SSDEEP 49152:Jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnN54K5QTdqW:f3q6sjBy542QTdqW
TLSH
T1F4D59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7103da71a869ed17c56f119beba06e26189085309d2370944d63455106cb843f
MD5 dc1eb7c35ee7b33c813f2ea6d125863e
SHA1 a0c3080d9f8f8147aedd7fb3d433dbcc80d28920
SHA512 9e7d64237fd5da4a8e8eee2a87d0e63db6b6ceb448517846bef953a8e524fe1620a069a30e9c606790a5caa93926c6a0c879d2c378080d06f3e17fcef9ee70f0
SSDEEP 24576:AXYfDtczAG2i4/y4rs0vx+Rj3he3NIlW:3tcT54K5QTdqW
TLSH
T13E75F12973E448F9ED178279C8A28511EA337C918760E7CB03A4AA354F337D91E7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c73f09d4082fe6f651a722b66dd72d9517e756aac04f64b5c9d72e350c4bfeaf
MD5 3e4bbd7cf7460f025aec7be6dd3e6522
SHA1 63c4a44ca4b8c89e0c355ada3115a5f4d9c844c6
SHA512 d8fa9e44fc77827066509d06d402d78dbc96dcbf1788891d794ce72a2cfe7b3fcc6272e21bfc6ff95724cf9c909265d70f55dffb0688f130a90155b66453eccb
SSDEEP 24576:70Le5ji0hmxxrMV2i4/y4rs0vx+Rj3he3NIlW:7Pji0Ajo54K5QTdqW
TLSH
T11F85AE16F6748731D073C0B9C5D2A69AED72308257308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 77274fd6f38e5c4468bb005b13f7f22ef0f8c0b492c7be59cddd0b23d750e750
MD5 69ecbea33377efcd2b6a63f54cdb6522
SHA1 b4727b4eabdf430f2dcd244b44031f0305585cc4
SHA512 d3a89990498c2a7562008ec6597ac0ca932ae741685ea231f8036b23d885e6daa56d64bbf45166ac583a101586c293e6fb5ea02e47d607ea1db3fdb776d35c3e
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyuD2i4/y4rs0vx+Rj3he3NIlW:h/ezSC6vUzPveHjys54K5QTdqW
TLSH
T1F8756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 906b5301c87ba3ee426e7b0975c71f79425ab6869c644158e24956ebbe8d58f4
MD5 25334f3fbe3cf242088c555027e53ab8
SHA1 7901fd8864eee6421a67b022b56096eeed77aa41
SHA512 6e2e2d31e73dd5ae11817d7eb377182c94f47504ccc3141f1e6c1bd3c59220634930ed96c05cca47df89b7d4b04fe6af9d55a7e7a1e2848b34bcaab7fe15aa12
SSDEEP 24576:6VbqPb88hv/l+Yi2i4/y4rs0vx+Rj3he3NIlW:6VO88hXl+b54K5QTdqW
TLSH
T1AA559E66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b02d05a08af9fd4e41ed0e7cf7f5abb399abdd417e7ad189789df7e1a265dd85
MD5 9fe303e84bdf2f8978dabe3bb87a09fe
SHA1 13cff1b251dc7a424baf7b6c9dbe80695f27bbe2
SHA512 530aa4f27539ccf33684c852b483828b12c0ab3b083a7d2b56fce9571a9a23382e2a86a561fad1aca9eb48f16fe459e4960157aa51543fd29018feb8841eac34
SSDEEP 12288:sLB2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:sLB2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1B955234F67B4A8A3F6060F7334BFA8107962ADA0D5445586C113BF35807867B6BEB336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9bc6f9cc749283572bc4213890c26c4db2d3eab9692a4ba8f809c64083e73269
MD5 8d2746105a0006524583891356e33d06
SHA1 5731e48ee0975e2fce35c5b3c45efba145c6c548
SHA512 bd469f194be4f7da7d56c7519c9c3c16ca976f1644cd4249ca111a2744e46a55acb653586d7ee87d504f6fd3ac8e6a93ebb23cfd11f3339e3ed54143c92e0897
SSDEEP 12288:PeBNUbTVO86UK2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:PJIUK2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1FE75CF3BAE38FCE2C27A4DB956918600E77278708B5193CBD165830EDE335E51E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ac21e28f6e66f34889490322c99e6c8c2d0349d74c3d92ac97678f2c2897b1d9
MD5 e476a307225b5d6e2099496aa01019b8
SHA1 29bb91d9bce3d3fe5d1b767f4b148e10def860a9
SHA512 d225ac52661bb55deba284be2266181058ae116dabdbe62a762a202464dbcff38f22b6f4ac32dca4c7041fe159a271458e91d8a04d03f5216e0b203b5142ad11
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:vQvGAdlCEL8c/DRNw5Cz542QTdqW
TLSH
T11F267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 68c9429512bcb37363e65acf8f22c0678a518cb8f40daa23f16d6b6e512747ef
MD5 65d9c75ad1d2111a897f78bd5dbb6e58
SHA1 c901f6960ba51c30e64a3b205e1890a36a005df0
SHA512 ad24e0405bd89ddd4634941113e4b2fb31024fc1ff19cf902f54a1fcf7b2bd882c1e1def6919d65c31ca6140e06a9851f90ce625579cee5e7cd1be28282f2fa7
SSDEEP 12288:AAwSfxL/2Dc3RDLLmt0LDQewsAjY2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIru:V0ewsAjY2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1A075E031FB74E436C37B0DB21B36C716282DBD604B5119C3E3A89E9E49742D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 742d93a573e68d264d9224798fdd314eb13743dbd12c0ef99f02744a21809026
MD5 825f0d274af3034cdaa68c3ba420638e
SHA1 f508df39b35b87ca2677499766b096e2c79a6971
SHA512 7f6deb58b5225d7d4bb4ea0e1038717b90a08323d9f34a85a700e729211c2bc683df5d2f1ec109fec4ffd5156bf31913b19b5d5d6dcd2964627936f16ecac537
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHw62:CUEtQevvqc2W1cpV2tI32w
TLSH
T18F474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d200529545b9a238d20ea600c0d8f97766d000a740338cbffbc56fd218ad00d
MD5 3e2fd0c507710001f646a9ddf8143833
SHA1 d8634b58f6114b91eb22e7d6e6ddc8aae5a67f9c
SHA512 f178a246d23a3fe6c10866cd4d7549aa8110254ad96fb254e3421a198a2706c512d9a392910e76191af473f0daba33bfd8c15eceaed7f9cd3e0b4880567b5dce
SSDEEP 49152:7CbRquA/m2yL5zifFiV+XenmE3/z454K5QTdqW:koqHVjnm3542QTdqW
TLSH
T104D58D0976B8C1E4D1F6C77896A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d422bd77069d32036547f2be92558d645d40715438cc7cf524697a78509d4caa
MD5 e2c186b176c9a53c1079046257ea48c8
SHA1 6ca5461d1a5a4638003b6b0da23f54709503e4ab
SHA512 9946be114be29f0cac5099bd0c8224a4fb91e57cf46f99bad25defafa4236c0ad623b0c1b9a08a584ecbb86271f33441ddfaa5af99ebe80f465500396de5de03
SSDEEP 24576:mAhGL3IFoiwtA5l7S53X2i4/y4rs0vx+Rj3he3NIlW:mAMUFoiq5n54K5QTdqW
TLSH
T1CF35AD81E7F955D4F5B3AAB899B69170EA76BCA55E30C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a7485eb1c75636670df27f98622b45d7b77b0daed6a25722b9f557d6b259f157
MD5 a84b2bf46efe01bc3611501046c5166e
SHA1 b493a03f05f4eb12cb5cf44455e9f1b78a45c8d3
SHA512 71d646f7bcfe94ba3a89472aea67dc89414612f90441734a0bcba6a6445fe2deb22910d84a3d7ef33e902beb6d285447c1ddc09d05d337eb3e1f59ec8dcb8df0
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+Cj2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:kwu4OWM2i4/y4rs0vx+Rj3he3NIlW
TLSH
T12765F14A37A41CF9E96786398597C531F7B2BC512A20D70F4360CA2B5F373626E2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 659f5f166c4a80b88c896c1b03946c1f81725feca5d9f98662692ae15894ea12
MD5 7351e955f3c4463535804ae927e0d028
SHA1 a5d681435b19d463b0914c6f16553c032d562e21
SHA512 1ed6ae862a85f341bb70cd131b4c357ffa2aade9467985643d980cc7499150fc74f2e84c406718164742872cf7506bb211daa6d4ad848400ccb14ca6dfe7f4a0
SSDEEP 12288:KeZ1IyI2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:HZu92i4/y4rs0vx+Rj3he3NIlW
TLSH
T1D555124E33E474F6E1534A7998F65500E7727CA1A33043CF41216B6A5E72AE72E7A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7f157a767b651ff0ffaa05eb14d941bb2745de316339e5b5e1d9a95835a0f308
MD5 47554989e865e8f28eb55fd1d14eb40a
SHA1 e6a272c0a49d47f16abfcd77ff3d039d0c917783
SHA512 4c781977cbb42fabde4c41d1101e30b4017fc738961f6845cec3107d4298d69e24503eafcad53532c6e8d2e108507572d48eb247c44fb1bec39f8321692b2a88
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3u542QTdqW:UQyiKa/X+PN+62
TLSH
T109667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 47137b3bf3b4c9c4701ce3e28818894757e74864388339786470dfe2432ff21e
MD5 b462bc67b4153517402d73671232d613
SHA1 9ba952cde3df6cb490b778232d5ad2ef8117c4f3
SHA512 c00657b7c4cdc624e8c4a4207b9796b89ef18bd0bf175f3285f2f24ca9d639d4ddf304075a67195f3bcd9a57166cb66c8c7f360bfa73121b15b0d1d4faf16665
SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN3u542QTdqW:KQyiKa/X+PN+62
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 928b966164314ddf98a8a5eeb6a11361fc7b42d20b65ae6b7bf7971d938488c4
MD5 fb5edc3b32909cd0c7d1ff5d5c561473
SHA1 4f6f8f120ee4d06bdab4a914f7ab805c9b3932ef
SHA512 431273c5bd0c8faa2e5d402632626a60890df85012b62ac70fe81dcdd7d80b06023f805094aed9dee598b39e2707394e703d6952f62f2b0cf656803816380ba4
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0N2i4/y4rs0vx+RU:q68Qg55nhceWu7PNU3/o54K5QTdqW
TLSH
T116B54933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2aaaebf7fc08da2584f256b830e80ad104d06d85dc68e67a05f2b61ac3d8501e
MD5 0013bfa99497b69564b3df1ac2270cd6
SHA1 505027e6d8d036c85d31424d02adb7229f95e341
SHA512 b9cb225c61ac5ccfcf46ab8ad7a31ca5470f7ac0b3e9c31078f92e211b2c348ecf65d3f9a23f88218bf5e172b9a6507a6e18ce21fe49e5d5ec2eb9925e69b715
SSDEEP 98304:0y5112gYy5azzVvt69nLKnhZB542QTdqW:1LIHEWhv62
TLSH
T120167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 153eed1afb7918eb83155b79a7f0dd2ecdae8253160f9738c4cb5f89612d550d
MD5 34a4651b9fb91fe6217e13be443a77fd
SHA1 fd52c530a78aed0b2c263c014a837d590ca5a860
SHA512 3eae5fd89d2babd1da8cfff639ad9531535413b89750a264e277ff2da830e4b6b9ad01aa83f32ba278858242bf2bc10bdce6f780742322b68c1712a40a0d3b40
SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glv54K5QTdqW:Ku6Jmdxd2dv542QTdqW
TLSH
T154D59D13F2DA01E8D05ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 14d9633033ee9c6ff1ccf9da712b25e8489463ae4ec6b11fed6fd4de65034dce
MD5 b0f2a89974b0acb0886cc8370b94e745
SHA1 de9cc7cc8a51a39157baf6d77ab0299c17e91bf5
SHA512 20c68bf84eb97ef18c45b3fd43ef7d4b6bcbe598586d3b8a3deb7d6f8b2418851de67275275cb7b2144715ce4c45e0b737608aab9aec70443f31cb0a4e2f7583
SSDEEP 49152:t1hpsNoJpF1A63U44CwH7R4xq54K5QTdqW:tmifPWR3542QTdqW
TLSH
T157B5BE13F2D900E8D05DD178875A9632EA62BC450B34B6DF0A90B7961F7BBE46B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d33cf177b8641d96013b48cc9c00c25999696f5ae3529f560f7fbb6ce76a36f
MD5 2559155c9164b6196ce389cc2ea3d104
SHA1 60aeeee6f8d216488160b6c0ac0384bd87e9cc01
SHA512 99cb5a75ff4c129ee1fd12191b66bcef0524f40f87725ef81c167c4f878b918c17637cf6c5be97fedc10db91bf59ee4b08f08bcd91252bb2fdd4ce342b6b4a40
SSDEEP 49152:lSuZQIY0Be2KcRVtOnks6NMHq954K5QTdqW:r5dKii619542QTdqW
TLSH
T135C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 adee53b49f5a59cc750d65ffb106716fa5e11ec1c5b680d0623d2bb2dfdc0dee
MD5 fcac0c1b372c0f7fa809e9878cd83f52
SHA1 c476501f5ad82b423a8e0cb1be93dd8ab0038744
SHA512 be18bec1e51396926642a4d65a96633099dccf43c93988b2f4ae5f4bed2da793ae05d562aff6b5384e54a77bbfc4b7bec394c8c9ce06e79a8d4b9d4bba7b9daf
SSDEEP 49152:vhtSn8EApI0fig3giDn0AP5wG54K5QTdqW:+X2imphL542QTdqW
TLSH
T10995BE13F2D900E8D05ED179C7568632E962BC150B38AAEF0A50B7561F7BBE45B3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fbecbe8f13a40a2f9ef88573612684431c53ba63141b95550f8da7732ebe984d
MD5 c18c042172a0f3205ab6f63a7576c907
SHA1 1da34a5d3fb06014d0abe664e526646d7b0dee03
SHA512 2fa811b937840c1c938eea0a92828b9dda1cdf558817eba2a87c81e5f3131875f324044103caa351545915ddff44c8659da250cf7db09beaa66e5792dbe39f92
SSDEEP 12288:AJ2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:AJ2i4/y4rs0vx+Rj3he3NIlW
TLSH
T18D55234F37B5ADA7F1014FB3646F951078526DE4E604418AD113BF3680B86BB2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8e278653006c1b7771ac66fe7b1c35f8f9e85df0fe7a0f23d8a93961338fcc0d
MD5 f0740a24622e4bff90e3dfdb01fce6af
SHA1 83246ce88425c3bab2817fd4758852281902a67a
SHA512 22e1439203c75d6da419dad64f742ece5693d8d99d9f61c6cad1cbe7bce3005658bc7ea5bcd06e19b3c7df1ac0ad02108cf35f959d8d46dd8492d6d61fe2b809
SSDEEP 12288:sE2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:sE2i4/y4rs0vx+Rj3he3NIlW
TLSH
T11355234F37B59DA7F1054FB3646F95107812BDA4E604418AD113BE3680B87BB2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f0a08da3f25d43b5448e211745cf72a6d5f3c08db73873b5b58ee4e57526e0f7
MD5 c54c6818c4c0bb3425bc061648dc1312
SHA1 571235f44874d299ab99b91616c07a74bdad0354
SHA512 4fe627108cd8cb3c9c6f314a882b286975dbba4fc465b42d389fe8cf86c5f127bb2c240b64a69b297426e886c22d4648f4f0bbe7c6184e825573e60e31ac06a5
SSDEEP 12288:5y2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:5y2i4/y4rs0vx+Rj3he3NIlW
TLSH
T17755234F37B5ADA7F1010FB3646F95107862ADE4E604518AD113BE3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 79c8038a5d08aa09c311f20d4a60a39fecd58c0c1ae5cd3fea55357f4873e886
MD5 a97355b9b8e5fdbb4f253443f22183e7
SHA1 9510614ebb18aeacb9fe337ab6ecd19bc6c3b452
SHA512 392715d740673826e8a91723aee733e8009f74c2b5ff645fa0e2ecd6aee012d0f496e445093de950b912b8262f5862cffd348c820aba75e11e53753640c0bbf7
SSDEEP 12288:GV32i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:A2i4/y4rs0vx+Rj3he3NIlW
TLSH
T14D55234B37B598E3E4118F76947B9410B572BCE0E72052CFC2127E2649747BA2ABB335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8a2fa7b831c60bf6bf8678fcf4cf9ba6bb84442f79beaed602249484c270b137
MD5 56a03c8c17a0868d4dd3a55f1d1a1284
SHA1 53d7a5d3d6031f74bb654062423ecb596045a82f
SHA512 d6f20069c664cf5e6f9720c004dd5c839c8bf8071ef5035ad9a2ee2e5362ae8b4409807d53d286c4403285852acb587fe8a922353d5f97b8267da9d4cb4f0558
SSDEEP 12288:uP2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:uP2i4/y4rs0vx+Rj3he3NIlW
TLSH
T11E55234F37B5ADA7F1050FB3646F951078226DE4E604518AD113BE3580B877B2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 777e54768dded471d82981872cc8f42e8e49a0ea581ec9974903cd96a44a4e72
MD5 4a911c844c910837ad8a20bf0629c9f1
SHA1 53e257b8d9bc4928681229c1fe92068bd141141b
SHA512 fc64327a2adbace2ab619365c9cb4a928c7854383eabadd782443f65549fc7f3c136c3f5ea07103b1f0accbd2d35211194a14905e5b9baad8a40373da9126c0c
SSDEEP 12288:ag2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:ag2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1D255234F37B59DA7F1054FB3646F94107822BDA4E604518AD113BE3680B877B2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fcea657df3d5f6e9a259a3d87e81329cb89b7c79655a988e2a0ddf5e7c154aeb
MD5 2333672bb5b8eb1580ea6746ff0bf092
SHA1 5702074579edf0a75d854df9bc045ee97332866c
SHA512 7b5ec6225517b319829ba98200faebb338b470f5de2815090c3563b287c728c5cab8b8afe366fcf4dbf6f91fce239fc4411688b9bd47c24c272a1d8169a7e13d
SSDEEP 12288:kc2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:kc2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1BF55234F77B59DA7F1014EB3646F94107822BDE4E644418AD113BE3680B867B3BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0185e99e29904d90a7c1d145366f32ec68ca8c997070fdf8b2416fa6316c09da
MD5 4af2583fd0e9180b477f588f36990eef
SHA1 e13b20f95b9937183f47bf72ee2ad5b0c019f0ca
SHA512 617c2d2935a2b8a38289cc1738ba91b048ab29d4de66aff87fe2054197d36d95d4396a37e03b70044e17f400000c6b147a6fbcd82dd9539e4209f833d971e9ae
SSDEEP 24576:DZMRzFVSOk2i4/y4rs0vx+Rj3he3NIlW:DZMRzfQ54K5QTdqW
TLSH
T13475029973A01CF5EC67863EC8668901E6B27C694760C64F43A437275F333A21D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2bd1c308e6a01e62d12c1f39b6e5771171cc7d07ebfb18ac0646c24237f13abf
MD5 7a2006fb5cb67b438847ceda09e57264
SHA1 c3403dc22f2a7c74445f3ef92f71ae58eb93a8d2
SHA512 71ed39a454a60b1ff9c6119783675af2385bb098f6d9eb6a6236d7619e1b3adb06f0b2f839f6705fc2bd2584f2a6896cec7e22c573030c5a66700d699b1f059d
SSDEEP 12288:at2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:at2i4/y4rs0vx+Rj3he3NIlW
TLSH
T15555234F37B5ACA7F1010EB3646F95107862ADE4E644518AD113BF3580B867B2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 76783779021fed517d92823e76bfd0c6be235845d802e9a0c629d959deb37bd1
MD5 9d36861281c77c4eb2ce04da911ff7e9
SHA1 0ed1f0f8710ce24a90be571b110040aa7a2bc034
SHA512 8f14c395ae21ec3ffe966653629f4d827c20ece5c42d0a63bd3e6643194c5c02a52e443e6cc42106dfce29e0b3102bb93c1961d0a104ac67be7be98364b3d5f3
SSDEEP 12288:wx2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:wx2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1C755234F37B59DA7F1014EB3646F95107822BEE4E604518AD113BF3680B867B2BEB235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 73c6e8ca902501d22317bb673351df984cd9cdb04b30bae5ab674f9161827e31
MD5 a5c88ffb5b90165617df6b3ce66c84cc
SHA1 a09f0f5f90b18469207e64b0e1db7c618357f40c
SHA512 132ae77f01443229f526d2684df5e63bf6bdfb2c14b260c82da8f92f6c01092ef3cddc02d6aba89ad5c82a7ebd750ed4c07134a1e1741005f3c0b9da60564dc5
SSDEEP 12288:IyPz5L8I2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:JzyI2i4/y4rs0vx+Rj3he3NIlW
TLSH
T11F65024B73A130FAE126863588661901F772BC7187208A9F53606B361E377E66E7F730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 64911c5f0db411ad632242a97e0d5d1d93ee176b97ca25305c33b9abeb55eda0
MD5 cd98329884cae6fe402ef526bc0c8cbf
SHA1 462e4fe1504da0b9ce7f87820f2848d563829271
SHA512 91e2d8276c74bdab386982b623ead5346e2642e1fb8599a5230f5bbaa028ba436eec59f551d537245db1e9ca263bb5b10fe6d24eab4a0b9fd770091a1b4675f4
SSDEEP 12288:Ft2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:Ft2i4/y4rs0vx+Rj3he3NIlW
TLSH
T16255234F37B5ACA7F1010FB3646F95107822ADE4E644518AD113BF3580B867B2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 51c5e0e45c671e32d7838bb32646540dde355e1896bddbf83e80b55c20252bd0
MD5 40015b20d48556ad8f2f40c5237f763f
SHA1 d7f7312ce65e079f63613a85b470d5aab4c1fc34
SHA512 dbadd8e7577bfce145d51a09c4cee87f6798a3e086eb1469614f111ad8d2089a78286b079d3e8cc39f7124830d6c35b190de37e7b4098097328eccbd7c0ebb15
SSDEEP 12288:bt2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:bt2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1E855234F37B5ACA7F1050EB3646F95107822ADE4E604518AD113BF3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a27430a22cf94ad856666c90dbe649dfe44e7afe023a4d16aec787bec68de9ad
MD5 58200a263cd5fdaaa7918483013a23be
SHA1 07a4b74764af6d4dced78a80e3ff85cd210426c9
SHA512 0f062e47c0eb19a7a34a897d75504c29bc0674aa9c3d95a9f82fcb9e4d27cf7c25c791713ca8c22f7ac670f0f946da561b13cd56b7c3374b439b5dbabf1f5664
SSDEEP 12288:LyPz5L8I2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:mzyI2i4/y4rs0vx+Rj3he3NIlW
TLSH
T15865024B73A530FAE126863588661901F772BC7187208A9F53606B361E377E66E7F730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 fb1eb876f3fb59b42125d04d07f4068507590580294e44861116ba524bd9e770
MD5 ee188ec15e35c765391998e8bcc83aa8
SHA1 e95b74a24af73d3dcec50acf8fb83b9ba8460f40
SHA512 0a9a830989177bbe53e12bf909ef77ef62db309cc10682bf7258095bda6e3501727b016c3309adc648b47564c04aaca32b661f81a579a04ed1ccb265dbc538e0
SSDEEP 24576:sTDaLl3z0zDC2i4/y4rs0vx+Rj3he3NIlW:sTuLljD54K5QTdqW
TLSH
T1D375029973A05CF9EC27863EC8668901D6B27C694760C64F43A437275F333A11D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f6389d7f7417dd5f285dfb9a885f78acdc6ae494aac6d4488783fc03b157e68e
MD5 c071216481810a376850901332c113c6
SHA1 07eb4b8fb8bd4692c6812d9f854e6b6a6daf889d
SHA512 565013bca88c3120118600250b86764c8fc236a0377da8feb4a361e9ab39465abbd9a661493827c1262a6a1357c5d0b9381f5f6338c4de73905328baeba0e0f9
SSDEEP 24576:p3vd9CHKy7GZO2i4/y4rs0vx+Rj3he3NIlW:5vd9CHKyaQ54K5QTdqW
TLSH
T1B285CF90F3E414E9F0778A3588765511DAB67C995B30DA8F03A4661A1F33BE18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 53e37c579c1d25b90fe0f5d6be4f0abfdb50febcc89bf0a6ca1e499f16398e20
MD5 c043920c110df992b49b6ecfd3c74b72
SHA1 31f2207d1d2197d17491194280ff32d8765b0462
SHA512 5e203ef8e4684158a81d488ba01db4b155f587ec70e19a0c427a9f008f86a2812f5fa32a36b206d925d892d65e90247d1e909f355dc4668be56a7de344fc8de0
SSDEEP 12288:jS2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:jS2i4/y4rs0vx+Rj3he3NIlW
TLSH
T16255234F77B5ACA7F1050FB3646F951078626DE4E604418AD113BE3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4115b35fd76ae69375f45308bf051b21ff313c7b85d4a8a7c18b9ac6451d2146
MD5 e4b6d9e649127264806a4a80479d960d
SHA1 5e5d64c0229e88ec766702984caea715e5975c00
SHA512 4fb396d47cb70661f4843bfb308b20b1dac4e99410596b8e793070b5f91d0ea724a07db73e4400543992c22ed129913e175dffbc54c33e48e3c27cc65e796660
SSDEEP 12288:ro2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:ro2i4/y4rs0vx+Rj3he3NIlW
TLSH
T1B255234F37B49CA7F1054FB364BF95107852BDA4E614418AD213BE3680B867B2BEB235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ef5f7930f12fe769db4656309c47902f92b98010f470a6ef113673d21b71fd00
MD5 c10e54350f6b0d742d4ed086daa36cc3
SHA1 73ad75c1a04e25cbcb4b40488beaa9ee3c936a90
SHA512 5b4e562fb4a24a9164547e033337c5ff2f0b607b2157d65d1766d0500cd7e6068c2383506be0ed38f3d0827dedebed427edcbd10255090cc75f880f69265e6a8
SSDEEP 12288:k72i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:k72i4/y4rs0vx+Rj3he3NIlW
TLSH
T13755234F37B5ACA7E1010EB3646F95107862BDE4E644518AD113BF3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7bf71abe4a24a14061744f3006e996e6d0be4dd44f93bd67596c3345a035e72f
MD5 e64d9c3146259e126bed203a205646ad
SHA1 c1a072932a882887d159941b4a811978c26fc693
SHA512 f927d79c1ee4832061fdbd0297c8e7c5fc07c5c111c8b26617cf3bb713a890745a03737d7a3252bd79ac3dc8b5b8cd14ea7b762688d0933312c3cf1ffc5a48cd
SSDEEP 12288:bt2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:bt2i4/y4rs0vx+Rj3he3NIlW
TLSH
T16E55234F37B5ACA7F1010EB3646F95107862ADE4E644518AD113BF3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ca5d28659b98d0e15071c363c1a95c9f8ed6068758e8ff029cc565de604bd55f
MD5 e891ad4e4d0a22e0c4cc45ec0bde1d40
SHA1 73261bf6e111d4e022566b1067ae69896fc63c8d
SHA512 060da46585824c5df1ee044f97ffe15ad378bc01cd5865f2de77cc29abe143f6d9852f4501684a26aed4c374b89cebf45b12262ca8aa0db07bbee07357782bac
SSDEEP 12288:bS2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:bS2i4/y4rs0vx+Rj3he3NIlW
TLSH
T11155234F37B5ACA7F1010FB3646F95107862ADE4E604418AD113BE3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6926ad2922407724e7d5605af9c0f66b003ca7f54ff4d1d57b9c11a91450ac07
MD5 42eaddb938b3eb330faba83178bb603d
SHA1 74fde9fc13e1124c06d31839e9a5d93bc3d88c10
SHA512 73fe11ba8734e3f01f8426a0c3c55c3882a1e9e3113c4b790ea5dd0312d7633f5dae28c2abe7a10bbba24a37700abaeba01658d9091ed406e68cb4ac0f4ce49f
SSDEEP 12288:ml2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:ml2i4/y4rs0vx+Rj3he3NIlW
TLSH
T14555234F37B49DA7E1014FB364AF95107852ADE4E604418AD113BF3680B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 336557b93ad03b6cb21389f1b52ab09e44f41ec1fa905517e3a1a76be049d171
MD5 c6be05e5a4646438472c9820c460a154
SHA1 dc2e63e7d52f1297f84a141128b387d94747d607
SHA512 6d73f821f419e3aa92c7403ac85e02094132f9a242c396b3c8aff8fd32e59d899803b6c753e7fdd4fedf8fa1d18192f9ac34b87e1f1e60f047343aecc320dc58
SSDEEP 12288:HP2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:HP2i4/y4rs0vx+Rj3he3NIlW
TLSH
T11255234F37B5ADA7F1010FB3646F95107822ADE4E604518AD113BE3580B867F2BEB239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 338d912f6eb7d450655c7569464a2fccf88b33d1ff761ca5c53c4445fac06c65
MD5 33c300300c05c7beff3f3a4a50717c8e
SHA1 fd0c0866b15142108aaa8076bf416a022d4b1b88
SHA512 c905dec7a6ba086307f974490c994ab49e81d193b478cc883f0ccbefe6348248502b66fb96efde9cb49e6b80b62d50ca15584145442974bdc9ecf2552d5bcb17
SSDEEP 24576:LfwvUk9RX6wkyAIh2i4/y4rs0vx+Rj3he3NIlW:BMnYIh54K5QTdqW
TLSH
T15685D029EBDC44E5E177923C98B74606F6B178685B31C2CF025A536D0E37EE46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8d67716bc51c25f035ea6aa12e0aed814f94f239bf8add2a28b30bad8d4dfbb6
MD5 4818cca7c31a9dbab99153900f23a043
SHA1 2b7922eb1cd501627fb49da4a60a0e54e398d4a4
SHA512 096a8a9a42b4eecf964deffc7928122a8ddb853d460b1c26d192c277e2384e9e596a1b4653ba2013a320ae6f350506b5b36a533ec672dc1919725efa32dbb25d
SSDEEP 49152:DYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0m54K5QTdqW:2ySzPO542QTdqW
TLSH
T1F0066C96A1A841D5C1B9C1B98F1BCC17FA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e4993e4d2acb81bfc21a638aa5ed92035a78da2c374395423ba2dcd1ba5db2d1
MD5 74aaf451cb5ae272f7975eaf0d44728a
SHA1 7c0b4c7f7e8fb41f156ed58e3bb4759b96c021b8
SHA512 5c1294977fcb2b5ba00f63805563a7cba23662fa6376a82ac489263bb5b48176cb27bd086cf650dcd83000a1a65f911020d539e2f3fc4b31b5c5dd80dabbd4d2
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYU2i4/y4rs0vx+Rj3he3NIlW:m47JUQjTirIhCnDHUPfF/W54K5QTdqW
TLSH
T14F65AE1EA3EC01E5E17A827885154A1AEA71782D5F31CACF1270937D6F23ED45F36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 cf3c8d57206264cfc2f424dd259f81194d0f24d081a5e81ca2680f01f5aaed5a
MD5 78936b5fe96dbf0596ed41ff011922d9
SHA1 bbfcd040ed7b44168ce2218dc641fd0a47f0aa48
SHA512 8690504796d355697ff8f0991b8e8699cca72fcd98b1d95b2c3d3317efdc43f365c3303dc0e6ec160b14f222d29f7331760bc4b3e4f66961d336188a3e9f420e
SSDEEP 12288:tbsf92i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:I92i4/y4rs0vx+Rj3he3NIlW
TLSH
T12A65010AE3A851E9D01E5676C7564A00B7337C6093E0D3CB92D0FA3E0F756A56EEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d93a5e33ff50028aa32b2eae407ced2d537a7acc37235a48fe3a5e900fd93be9
MD5 c8757503dac53e5a5fc4ac82dcf81d7d
SHA1 4737f3a2b6a69bf6525e365ac8f55f4d03d0ef7d
SHA512 b5b4a613bedca6f22adb6d96c7669a436ccc82c507d6186a160de49aab57a7dc26683e09eac9e184cceaf391b8eef935d64eb854b7cd6704f164fcc96bda0d6d
SSDEEP 12288:FzBf6U3f+c107SwB5oKD87771MEd2JVQrS8Ok7wcXg57A:Fz56UPYpAKe771MVJGrS8B7wyE7
TLSH
T153352810766AD75FC6A940325E37C1CCAB707D01EE45AB0372C8973FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 265de4334f3e02aa9b862f6d3370bc08e4466a1806e4c165a5e9bd4a135a5890
MD5 392b5dca0e932fc35e2e42b795adf5e7
SHA1 28e6ad4289d44ad56c1f42558735878749ba99b1
SHA512 b13f3dc279e83631126dc82d04b23a4db502b2f61e9e7accb8410d47174a038af0f5e5e87bb56607b7cdb71a3597dbc2414f8cad22f23f046143d9e8c15461d7
SSDEEP 6144:WYZWQAt4tnt7Ap4ygLsvISGjst0tgtWtfPptMx/izt7tItctXt/PptMxu56bFg7B:fmO1Cqvg+eYK81iaxzlF1Muc7w
TLSH
T1E865E9815137E38FD1F76032072A9B4DAB74EC1673496F26B3C8443AD82AB2565BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 77def81c2d57722bc7b59fc61718af808194e06ffa63bf39ec6107436c5b2df0
MD5 1a959b9d75f3269e1ea1e225d496e3f0
SHA1 ec7e252d804ed3d09ad2dbe41b6ebfc05bfd7065
SHA512 04d79cf5bf0fe2467000eaee1ac9d01f989f95d0fd52fac3f3a39a9494e330d6d057fd9c5fe7ecbb88f5ef635b9751dd6460bf7141bc42debc3ab3f52a377df8
SSDEEP 12288:Gz712i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:E12i4/y4rs0vx+Rj3he3NIlW
TLSH
T18355235B67A89D67F5150FB2246F95203916BDA4DB0080C7E1027B258074AFB2FFB33A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bf2624df5beb1730ba3e1e525268a4bd728d19f077b1a8479c21c3a413b0f1fe
MD5 ee866078b899cbd39b0ffa592d4917b6
SHA1 1d0841629e7a6a158eb814c7865a960a47d6999a
SHA512 79681b808a49b42fecd97d79626a605ceb843117f460e070be440272e237ab4a5d06f47e10b7c8488fcbc5f6897c7653747665689d1efded39764005eaa648fa
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYD2i4/y4rs0vx+Rj3he3NIlW:+gb4mBIBhGFU54K5QTdqW
TLSH
T10265AE1E22EC02F5E0FAD2B89DAA4417D6B278165731D2CF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 80ad7010f939676299b579a78d6e1cebc7e517cad683de9b5a343484dee70cf8
MD5 778f098cc95802e3da2c25b4b8ed4275
SHA1 82b0ac2f4dc2d32030c8667eae58826fcb27f5d5
SHA512 898658fe785571bdebb564ba98376a6013d711ca9ba74705985eab33d5e06dca0dae64718dbb43bd8209b079b63b9f9d3974411837c67b6867df25e3d324ce1c
SSDEEP 24576:SG88u8FpJqH1bzria7/mk2i4/y4rs0vx+Rj3he3NIlW:J7ZFPqVea7/b54K5QTdqW
TLSH
T1A285F16677E001F1D47BD13889864663F6B2B8250364EBDF06A88B551F33AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3b440b572d697454f61fc98acd9692cb4686048c817cfe063e9c7d2c25f65924
MD5 b9e78b20920c0eaa3e27b2e1fbd54fa9
SHA1 68c9d397a1b547af357996d49899f434b58fee66
SHA512 3530e05608a60405719689d6ded13ecb2c31eac5198b0893bb86f3674a64f24c0ec280d67817027647b6089cf2d2787b75b82e461d1d5ed1ece228bf19a20a0e
SSDEEP 12288:oHvUrBFrEjwaQQ2i4ZxWqy4r0RyTndIC/RcO+PZj3yUjS3NIrFzWH:oPUr+NQQ2i4/y4rs0vx+Rj3he3NIlW
TLSH
T16765F11F22EC1CE5E636A17D89868619F772B8615311D2CF02A1913E4E77EE87D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd4e0f4e1fb4f20b547fcb1464332a79c9b722df2d7d099121eb7f3b8c06cb10
MD5 0b633623026fbd3618d47bb56c639c5c
SHA1 0ff8b230dadb1c3ddc83b455a53e1374ab77d6c2
SHA512 23fc8406d2eb59e43bb263a9d8139a4b4f8c2a2e4fbcba27a11207aabc4f3a58b4759a29c78b42e8e8f14f5eec71ad5b55bd15b061a83f7f1906655b3b3204e9
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjg54K5QTdqW:5G05lO43b5542QTdqW
TLSH
T17BD5CF6E62EC11F9D1BBC17CD9C6460BEBB23815032556CF02A486A91F27FF46A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fb7d4c53ae017d95202bb325296679a90a11b2acb04fd9e05472cc8b70370236
MD5 d6d8779aab039c6ca159d1234de912b3
SHA1 dd376dcb66c1d66c4205b106f01da0765cb7a3cf
SHA512 ab9c0524634432701938b5d54262a038b238a4105c70eb6753676754ac84b2b7fb9ab2b54da5ee5b050694fd24badac752ccd87f0e45cddd3eb92b6279f1e687
SSDEEP 24576:Ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnm2i4/y4rs0vx+Rj3he3NIlW:Ma5POZ3BJt2pasx2+mo54K5QTdqW
TLSH
T19A65AE5EA7F801D5E579D17DC583861AF5B1382153319ACB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bd7acde54e46efd2a8f7793efbd1dad8c180d0c8df0ae4833e9a50bf8cff5e00
MD5 8e06d646efb6af5498ed22b57aedb3b0
SHA1 2fdb4f36c9d1a47d67bed3fd161eb61aa732b49c
SHA512 1d1803066de6dd1da2d6ee804947383af4a78d5e74bd3c457e5bffbfd7672de4de7771b540d90d647ca6cae400946b25a3dfabc2418df77399c013418c1dc5cf
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7Fks2i4/y4rs0vx+Rj3he3NIlW:1Nc/zEOVHF754K5QTdqW
TLSH
T1FD857B1623E901E4F1BBE1BE897B9546FA717865533086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e8f98a17785ea68fca731582c1a4573d063574d3227aae3482b29a85fcb19a48
MD5 8aef9f24b1d239cfc006f0b11b832331
SHA1 c552ec8bb0a57dc434c6883b34f670fed0485727
SHA512 a57bea1d424cd7e67e9a31186ab358bf8189add0ca88d8234597bf1585e4cf153a3f96ebaa550d07f34095063188772889a4f8d9f96d80cbc910394a8e5405d2
SSDEEP 24576:2TkNvNnaFeYhJNtmZBmL2i4/y4rs0vx+Rj3he3NIlW:2TMwBtOmL54K5QTdqW
TLSH
T12F55AF2EB7F845E4D1BAC6B58D238512F6727861073253CB9290C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8dbcd53d00552e5dddc1c57e16dc7e36e4a70139cfe6bfb6767581d93be86cbd
MD5 f4cbf0044be45924f81e249412b0a4fb
SHA1 61b983d7515e8b93da01a3de1c31db62b68521fa
SHA512 3877a6095586d877e39313c89e904a479c9cd854df4c7fcfe69c40b52ad3c9b62abe95d938e6acca75d553aa470f93b44630acd7b2baf3de7fc95191e4e69721
SSDEEP 24576:ID3FHshBIYQgAp2i4/y4rs0vx+Rj3he3NIlW:IDVHeBIAAp54K5QTdqW
TLSH
T1AC75E17EE7AC04E5E57AC2BCD9638906E67138A8032155CB0294D1B65F7BEE43D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2332-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2332-142-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2332-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2332-144-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2720-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2720-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2720-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2720-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3240-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-321-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3240-110-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3240-116-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3240-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3428-82-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3428-74-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3428-286-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3428-76-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3864-69-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3864-70-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3864-249-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4392-121-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4392-320-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4392-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4392-129-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4944-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4944-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4944-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4944-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5984-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5984-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5984-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5984-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5996-103-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-335-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6464-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/6464-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/6464-29-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/6464-34-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/6464-6-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/6464-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/6596-55-0x00000000022E0000-0x0000000002340000-memory.dmp

Download

memory/6596-48-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6596-58-0x00000000022E0000-0x0000000002340000-memory.dmp

Download

memory/6596-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6596-49-0x00000000022E0000-0x0000000002340000-memory.dmp

Download

memory/7148-86-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/7148-303-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/7148-92-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/7148-87-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download