8dc00ac99d35b346c3855ccb93a2aff7224aad01cfba54a4153e3344a2dc5f68

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 4.4MB
Sample260903-qbqlnaxeqa
SHA256 8dc00ac99d35b346c3855ccb93a2aff7224aad01cfba54a4153e3344a2dc5f68
MD5 425250c6ae84a1169d6553e04d1df66e
SHA1 1947d6e4e461980a933a36393831bbd102fb5cb2
SHA512 3daeb4d8ff8a30138166d67dc8c8207f78417a242032ad14062b3dee173fb7a7192fa436a0c5f145b76bdb23d5e4a9af2cb573850eadf8be58650507000842e2
SSDEEP 49152:znsRKkCJLiYjS7f2SnOmP3R4bn6B/c5KgGReciDmg27RnWGj:r6kiYG/chKgs8D527BWG
TLSH
T171262B12F7650DE2C99380B0CD776B22CB96BC780BF007B76B724ACE657A6D0352A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3336	elevation_service.exe
980	elevation_service.exe
4596	maintenanceservice.exe
5892	OSE.EXE
3376	PerceptionSimulationService.exe
4972	perfhost.exe
236	ReFsDedupSvc.exe
2028	SensorDataService.exe
2144	ssh-agent.exe
1020	AgentService.exe
5144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b6ced71e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036b18bf3a43bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032fe05f6a43bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a26564f3a43bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097a8d136a53bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fab45d37a53bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fdd979f4a43bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
980	elevation_service.exe
980	elevation_service.exe
980	elevation_service.exe
980	elevation_service.exe
980	elevation_service.exe
980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5048	2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3336	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1020	AgentService.exe
Token: SeBackupPrivilege	236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	236	ReFsDedupSvc.exe
Token: 33	5144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeDebugPrivilege	3336	elevation_service.exe
Token: SeDebugPrivilege	980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 4304	5144	SearchIndexer.exe	101
PID 5144 wrote to memory of 4140	5144	SearchIndexer.exe	102
PID 5144 wrote to memory of 4340	5144	SearchIndexer.exe	103
PID 5144 wrote to memory of 3856	5144	SearchIndexer.exe	104
PID 5144 wrote to memory of 2548	5144	SearchIndexer.exe	110
PID 5144 wrote to memory of 2012	5144	SearchIndexer.exe	111
PID 5144 wrote to memory of 864	5144	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_425250c6ae84a1169d6553e04d1df66e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4596

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2028

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c985a59a35d44cc7be961e9bf01d56b375f237eac9f1908639264a9754652421
MD5 ecf598605ef357552763c14c9f7f7e5d
SHA1 b75ffb2a67aa2d517c598110db2af98253247cd9
SHA512 52257fde649f13a4d47a7e43ba3c92c10e0b21b9b8ee4f5cca22e4d1b6abf080ae2d458d4bbc65a0c94977661dad5e786605f9a0b86436dc3643aff7a8713175
SSDEEP 49152:lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxngDmg27RnWGj:73q6sjBLD527BWG
TLSH
T1B1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 191b14be3b3af7f0ea84d1014f628ef4fb8634d915ebe98aedbce8d3fd15daeb
MD5 421c0ae43f2877aec934df0ece4fd4b3
SHA1 3f3b206d4f3299ad8e260501a28522c410a1e2fc
SHA512 904bb6dd2866d4e0ec777edbd3f50f72f69f3690f55412d65142537ffad21e792faf31d45c2e17726bede05a1ef410612db2a81afe663252ee86a852790ef74a
SSDEEP 24576:6XYfDtczA9sqjnhMgeiCl7G0nehbGZpbD:htc4Dmg27RnWGj
TLSH
T1F2850129A3D408F9ED67817CC9A2C506EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b09ea5ba43c55f6a0f82c2765269dc244afb7f7610bf0ca8b2f0803be89511ee
MD5 d5045c8781ad038e00f8f75c50eb9e4d
SHA1 8e5dc8e6e785a951d0437505c7f063d8bc03398b
SHA512 62d385fa1eedbad309d3383356e447f51c249b55d648c7142be4dc05630076de5b22416ca99c3ee62cf6e04f156bbaa082da445a2f83ac613a58650985ba1ef3
SSDEEP 24576:P0Le5ji0hmx7rMOsqjnhMgeiCl7G0nehbGZpbD:PPji0A5jDmg27RnWGj
TLSH
T1CB959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2c48582dc3b1d269f2479780e8edad3124c22298c96b910a4837ad9483bce3f2
MD5 4505f9d4c8a7ed01f08a88dc37a5c66c
SHA1 4beb4577bd9b257f7a9b00a5b14ac0fbe0e2beba
SHA512 53fcbfebdb1b648d45f59280bded6df7ac3ae6b08a8b64b3d129955c2e54a8d06bf2c03a343ec9b4213356b99a7764ed09f2d6e7fc78249450173727a7f85166
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWn6q8wyucsqjnhMgeiCl7G0nehbGZpbD:1/ezSC6vUzPveHjyPDmg27RnWGj
TLSH
T1CB755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a9d53f2293d1671253b3ade88b25e2b72789822a1f2fbf4eacab6851c3f83b52
MD5 f05acb83584c1329d01f631a9e9c8575
SHA1 14b46d1492854feab19e65a937cacaaf1007070e
SHA512 4d61761b02b5b7e6ad6a9c08042cacbfead969f47ae4b80a9a0b9ad3a4168f40937dd9c1ac7e2cbe69af42f17c3b2d8899bfe84f3c15d66f88a10151ff8057d2
SSDEEP 24576:+VbqPb88hv/l+YhsqjnhMgeiCl7G0nehbGZpbD:+VO88hXl+gDmg27RnWGj
TLSH
T126559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d99e53a042d7df28fe410cf4390ba1d6e57f305dd9870d89f795574182d62aa4
MD5 9d5acf4ed28697b9adf9ec603c6a9181
SHA1 6a46edea49ac33593ae28fa0d444801073974051
SHA512 42f800770264ebe6354d562573e3dcbe65ae863f80955db88cda30fcd9bc428e4fc5122c594f2298912567d6292ee0d0d39609faba6c10015295521cc000fa1d
SSDEEP 12288:r9iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r9isqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D6523BF864C50DAEB7608B5C3E9F11EAC177E56982008436AA37CFDE5B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 974e9e0af6bf053d035e197f1507748932cbe3a33cbd34a7369afa5fe2781d5a
MD5 780d5a9202b7092fdcf0478eb0d00d73
SHA1 fe625ec057c7d1a1b6d952dff53f4138f3a1390a
SHA512 d55dd714a0ab0c155474aae9f6bcf9f7e6681dbedd9b6db2b13f5fc364dac3966415d0c591450a0101f99a439dc9f54d0f39b98204b3c60d89587a481f4e4432
SSDEEP 12288:5eBNUbTVO86UZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:5JIUZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F85CF7BEE28FCD2C27A4DB85791C600E77278314B61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ddfc5a121d32380bedeee828d01df06609a5a305ba5320d7c093410c6b8972de
MD5 fec00f8fc2a28558c939451c3613b345
SHA1 601882fb2c1fcfef3bda76e663a1b81b61338830
SHA512 5576e7aa0be6ed5ff3c584831f2bcfce2f9eea0974eaacb892fca7337a3a5391672d565456ab5b8eb4d7d4ae87feae0a47720fe164c1dde06cebc3a80889c132
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:VQvGAdlCEL8c/DRNw5CYD527BWG
TLSH
T17F266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 39c01212b215557bf2fc6f7cd94011c47e84805942195969657374b50cf9f79e
MD5 b00a65fdb0e4603c75adc5508084a374
SHA1 1481384a4359455584c5e5d58b82564292795fda
SHA512 7e67d2eed2646643f4922db021ff79d148f0f1338b68d85ec26c04ad46d2b48e556481cb5d34ba5a1dd9ee78b553b6ee7741d85fb19912eb372fb600579b2d4a
SSDEEP 12288:LAwSfxL/2Dc3DDLLmt0LDQewsAjPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:0SewsAjPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15485E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dec2b33a2976a2f110cf426dc7aea7045eec19cab455d2a371e081e21e5ca3f1
MD5 ce333239256d5f99bb1de09145adcd91
SHA1 a8cc266008f324bda6266ddaf42809abf68b8193
SHA512 22e1eada3a27b58b3c431aebcf2998d20a63702eb1fae672b1090eae905b454108f48b4c00d58ca188f14c5976535f5c40bfe28bdcb0cfe2611f7526af6270c4
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrVQBWG:wUEtQevvqc2W1cpV2tI32CB
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 91d520bb9a3d59b908bdc67b24d206eb2bea522c0bdfcfa043f55f5a483dfe1f
MD5 dc344c81c77d4d793fc98486b5e06514
SHA1 976ff86edbcf15ad18ec6e257d8dea9e88664b18
SHA512 92cf6404a06306ea6b75390f12f70838e3a51c30e605903eb52df456729a6c7e56004ebc53ff6a3581070bf67753becf759b2c06cce0587997ee73d1f422cf0d
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zTDmg27RnWGj:XoquVjnmED527BWG
TLSH
T19ED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7bf48780f57a1cdea5aa62ed7566888751f687ff065b5c43b7bca2ffe6bd245a
MD5 5c3c1b64e472adf6c4c265a47de4372e
SHA1 af530f162939ff42defda45644818abb901dd8ef
SHA512 6176c80209e968ca6b754a709e34506de53b84475a8a486a1fee8fbd3aa1f33acdb552432081e69bc23827c0ea0b553b23d6354b52a23eb7b294360951fce82e
SSDEEP 24576:pAhGL3IFoiwtA5l7S534sqjnhMgeiCl7G0nehbGZpbD:pAMUFoiq5UDmg27RnWGj
TLSH
T136359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 641a87c8e43887cf2bdda1722b529a972619935a1b277d7941d59c3263e1fed1
MD5 5a3fdda3b81d3d3315551e8269e8a598
SHA1 f5e1d8c882e11c91fec35ecd812de03f6ef28c95
SHA512 fec394795c0edf567193bcc81a879c1bc12c1da628db1e9a268792a09e05b2310e57d994ca2a6cb9f41bc7ff582b281ae57c90d64abae8a8b41c49e5cfb3c1e2
SSDEEP 12288:Umw5HEjsChNPBFgl0WDm+C8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:RwuWOW7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16085F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4053da133b1f8eac6e136be25a95a3753efd40d83996aa1ad4e8ab7b0bc4a12b
MD5 7d2da18969521a532af20d1aaba0f7e4
SHA1 00f30432aac25b0808784c6be74fa4ca4c72ddd4
SHA512 04d2ebdef93a2d83a0e9a31476b4b30a0da6d765ee386a6e0fb864755d0d3b5ac7325bd1cb60db24145bf9ffa020bc0a5328a27decdd71545e03492f401b2fa2
SSDEEP 12288:S0Z1IyfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lZumsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A7512AE239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0f8ae538805e37f4d895d81ac47164e21841848ec0ec3b4c422b6095b7aa2bee
MD5 77b79b58694d1c3367d36f3ec4c6eda8
SHA1 c2e8a619b7821d9a1cd0a550ca6f5a6f5f1ef72c
SHA512 ca3e7a4c07ebe24f7c8011032f5fdb72740ef8cd26be82cbfb0d5a787993a5ed23121375ae644db54285e590261ea63888840f13f2eca43a455be407645dad90
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3JD527BWG:ZQyiKa/X+PN5VQBWG
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 701db4fb5159e42fbf22b0e11a1ff05ae894707f8698fd044b778f81a97add8d
MD5 12161eabbcb25966d53c9a180bdfa43a
SHA1 b02419d8401262d143102beb37d27f6e82f46a61
SHA512 2f2aa744bc9b2c0d00a8f3993dc3e7d9b23fe6ff6b541819c7dd5e316909ebd8a03cb303a322004318a2a2d0198ee9b9e066cc7a560e6e98c9a11734a3cbe717
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3JD527BWG:NQyiKa/X+PN5VQBWG
TLSH
T1DE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cb3f56f2edcbdae02af8254368ab68f2c8d721c9197cab22c45361b0fd640756
MD5 41f34f2b06cdfebec39038367554685a
SHA1 25629daf7b01a70259d50e4470252c721f19fc26
SHA512 13a912d0e0c37b47fe6067dc44b9a4d1973b1fc5c86bed71c69a7da3d07aa5329b5a1ae13b2eda281a5992811250bbe788ac70784bec47e13aa58d8ac92daca8
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WsqjnhMgeiCl7Ge:b68Qg55nhceWu7PNU3/jDmg27RnWGj
TLSH
T1BCB55A33B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 992979d5be5f4bfe99a052a31bd5f263c683cd04cd80b818fd8290f3abec23e7
MD5 2bd9f577f3afdfa775a5295897eb7760
SHA1 c53487728ac897539d60e4b7e7afa8b91d01fe68
SHA512 c7d376b76fee40a4c38217d986e977494526f1a7c3950421af2688a3d5285c2e7d9c11a5990087c33f3f5335d4f19deb1ecd501ee366caca0f1b82226aa8a2f6
SSDEEP 98304:ly5112gYy5azzVvt69nLKnhZmD527BWG:ILIHEWh8VQBWG
TLSH
T1D1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 394337a75749acbf01a08917dcbd34fbc9574b3d0f95d5458dd20f3bd88807f3
MD5 3e4604a86e28c162e4b3657485b43531
SHA1 89500543adddce5fd275e5ef6311356b9c922fa4
SHA512 75c960b716c2b622d2f4a7548db8bf030470138827fc34802af1c47ba2e99d79b1d6c23575475b196e878a463bff0ca519c0af18150ec6d7c9f8a63d7947e8d0
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl/Dmg27RnWGj:su6Jmdxd2d/D527BWG
TLSH
T15BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9ddf977413d31f1029c82cbb92e0b95d744cee09a9ce93736bc1c1bcc590750b
MD5 14959cb55e6e409e8bf3bb28f8eb382c
SHA1 2402a62b27be520b39b1b6f010df288fb4e77c18
SHA512 ff4cccb330ab777181b67541c94b50763885803b5957fc44cacac71a636bb62d089688f7d012863ba14626105d0c8a126c222a5dbe440b5d6575c686e8319a92
SSDEEP 49152:b1hpsNoJpF1A63U44CwH7R4x9Dmg27RnWGj:bmifPWRED527BWG
TLSH
T13FB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7171cee616792f1fb377498cf97e90e235637fec9700da73bbf9cef47b600627
MD5 f158b5ac0cca0ee57addc6ab46db072d
SHA1 e8887fea4b9e8a24c6fcce49556bd52cdf7c4fbe
SHA512 b531ca92795f2e52d6f8765ac85a33c16452de28ef7c9d315ba4437da5baff7b08624a5a20b602c6bc114d8b0afe831278d4ab534089fb86d012d3aa2a83096c
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqqDmg27RnWGj:O5dKii61qD527BWG
TLSH
T121C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bb1b49c9280aab9c9410515d66a2c8d932cc1472fa81751c220da803aa7fe494
MD5 ab5bdf7ac5218f4afb240302d20da6f7
SHA1 faf13ea7fe7964424cb6c5e00aa5a9f65f811b87
SHA512 bd3cc9d1c372d7faa1f71d32f94016117158bcf8d0eafd2986edc8afcbc36580103cee8ef4d013d74a643ff516d817f9f2e3a4d98660c60b76997c41a572f3bc
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5whDmg27RnWGj:rX2imphwD527BWG
TLSH
T1CE95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a1deb862cf389752d50d6585701abdac7cfb060f7ec2dc3ee39c6063bd36a9b4
MD5 f065d9765d919933b911f48f96358dc0
SHA1 fccba4dc4e947686c77ec57801e60a86d6f9babd
SHA512 c17402b583e28cf561d641d43a506088f065d7badf96dc00b9de3e0bea8b80cb94e3f9c4195cea4270dc13c9f7e2ffd71f1fb212f471d6f2dfe35a89766eabdd
SSDEEP 12288:O6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE6523BF965C41CAE52648B5C3E5F10DAC173E5BE92004837A5B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4f3f4d94e56a06d27af4cdd75920c708f4c2e61296feb6fb80f5ca29fa531848
MD5 7347b249028b05530b576d3e317fc853
SHA1 a377ea3c0dad91dfa075a12f8ee1a714228254aa
SHA512 e596b1bb418125aa69cc42c5ff85cabe1c0466013321e265127b378cb8739349440d25df6b3cb3169e0eaf34708f83ddd6638bb847ac92dd21151ef69b949b0e
SSDEEP 12288:mDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B6523BF965C41CAE52644B5C3E5F10DAC173E5BE92004837AAB7CBAF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 95b1a20cb8f0968b358e07a25610204c40831a3a6fc1eb5b450db5f6b3d67cfe
MD5 d2af2bfa0d7399dc65a4ddf9f54b1b0b
SHA1 2ad0e2096a98c9081ab331a68f992fad531585aa
SHA512 36142909e65ea814788f662009cbf0e14544f3500cc07fa54765f4c5afc9098bf3a95349663aad9069b69385eec194d43ebac87fee705378c034d66f4ff3f9df
SSDEEP 12288:dRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1866523BE965C41CAE52608B5C3E5F10DAC173E5BE92004837A9B7CB9FAB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 89393ad4ed863836dce8d2011be2706db3a675cbb52dada299c977a1cc79593f
MD5 65f41313ad90b8bc650d43b16ddc128e
SHA1 ca45072c4e733e1c5191d866d85b500e395c3295
SHA512 1e04f72258c62a50487fb0f2d38a571fb8ea901c76eea7a4db2c2730d872afcfa92643329004a9ab925e9f79c4876849c8e30c068d67a1f8183a43a42e58b212
SSDEEP 12288:FVYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D65236F675C00C6E83685B4C2F5E11DE8237D56EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 dcb3d1d9ff5babe437c221241a622511aefb183288f8acd0cee6006ab5e89261
MD5 0060ecf26791d2f4db6d6db788b85278
SHA1 9073a3c7ecc85947eb0a9da7a1c77c9ff7d904f4
SHA512 6bd19e7a24e1f50c7192306a3da77307a65f3f45c94117ff6046620de9443ce06ac8ee80a6bdce388f6f85c855051f20002af2b82e97020ebe776e4d4fa39ce6
SSDEEP 12288:zgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B6523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CB9FBB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 56d9ba58e78ad738ba7aad47af1a1d1a6b56d32ed43242b5aba98c105d554a9b
MD5 cb6c07d94bf7721425a243d8d0852a7c
SHA1 56973e04b9b8df18905151bea1f794120bda3fd3
SHA512 f83ddcb8b4a9c3fa9fb323f336b1151995d510d42de3144a38b08662a1a7563105511a2416baa160ce231da7eea37f44bd654382227378ea9a8b7eaa51e64bf4
SSDEEP 12288:QnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC6523BF965C41CAE52648B5C3E5F10DAC073E5BE92004837AAB7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5b07ba4a1433b2f38d71f02649ffa63041440e703ab717d34285401ac00ba149
MD5 f5e8f40f9d734d353b6dcd24f84e61dd
SHA1 39426b0fa3dab5a0638ff9918e5cec13901d419f
SHA512 818b02d20d2ef1bcd4d72f6301f3555e5b381926a719d1bcda3e9cba45491166bc50144adc64fac3f6f3296c3e55b55d0210afe034572b2d948ef62099199b67
SSDEEP 12288:grXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:grsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E86523BF965C41CAE62644B5C3E5F10DAC173E5BE92004837A6B7CB9F7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c54ae41ccd922fd2b674c8ce2fae6733ad136831c86ed35994698536e76e85b3
MD5 9ee38810870ca11d899dd6b79424b636
SHA1 f5f900cf82487ffd029ffe75652c58c8eca53ca4
SHA512 184bcea0f8adb641f48cbf538c529a57bae207557d135e6b89b1d20bab660cc08c213e3d0176291c7a3fddded2d55ffa2edf80e4addbf1af25bdf593ff194aa4
SSDEEP 24576:xZMrzFVSOjsqjnhMgeiCl7G0nehbGZpbD:xZMrzfLDmg27RnWGj
TLSH
T1258501A9B39418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 9b6510744e7c99a2ff4b374e30a87bd80d61a39cb4cb65e2b223688542f684ec
MD5 642cf2bc7905b25088f1bfbb1bac6739
SHA1 5e0c3b8d1fc238034934c359e410071b8fca6d47
SHA512 05f0a3482b867d1199c1e098e74dcb756658f9eeeab74c7668ba51ffb2c88caa6f6f5311d01e216090768e935c1cb0690fc600c999925785025c686a745c6d9f
SSDEEP 12288:D2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D36523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFAB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 46d54d31791f6e3530cba3355f1cf923059a82dd2c81cd789e71af716398fc74
MD5 2fcf7067adf3d029eb1308629e5942eb
SHA1 cd5edfb55046301c7bc0295347572fdc1fbe9b7f
SHA512 7bff79d8fc770357ed5bf9d136491958cc40ff0db13dcae961410431e2f5fd610daf2a9148172ea67442fa8159de76ce5a408557b2dac81f0233054b48dfadc6
SSDEEP 12288:kyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E56523BF965C41CAEA2644B5C3E5F10DAC173E5BE9200483BA6B7CB9F6B14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4dcc564066690ac94c84971ae65f4a742c26c47e8462e1e745b82e90ff889ef6
MD5 626bf8a24312e16d10f7270f7420bee9
SHA1 5f3b586d311869b54fb337f011137383624268eb
SHA512 74edd73dc001f621bc939034d4c0330b87b9f501390c312b04fa9d1d461c0c3409dbb63d963930aa77096839bcdfcf8c1db381229b76a20550edcdf2e27ae417
SSDEEP 12288:2yPz5L8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LzyfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A675025B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 37ffc488b7feea88a09ffc9e105addff2d9e212b599357c965371f49a84a027d
MD5 4e1bc2852481e3c22df441b2b683cb3a
SHA1 35635d205d3a5b8bc7315ec862205ccb77e163cf
SHA512 7dc3bd7c85aade6e0f43a5034051df27f89c50895f5b2f10bbc30b87fc604658a27af044021fd042c65a44f1de9a87228a9792325050854ecd97e10e1755aadb
SSDEEP 12288:a2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C36523BF965C41CAE52604B5C3E5E14DAC173E5BE9200483BA9B7CBDFBB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 39b22353965c28083e550e4624d88c7cb1ea5066c7f66c04f87061980181464f
MD5 1b4c6d735cd71784142daeeb7f1c850c
SHA1 446db7ac7756e922a3c765325f5af95e021df736
SHA512 807ff5cda236679699b55b1b60a5c76207f372aea7e0448cd83fa02b47792c5da46b300970b3e6bd6d29a763013ecc611098eb5ec11802fd7c9dae7d70a1c783
SSDEEP 12288:g2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD6523BF955C41CAE52608B5C3E5E14DAC173E5BE9200483BA9B7CBDFBB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 92d083e7fcba196536e67d5cdc59b9721ca3fce5a9a9206745a219f49fd86a1e
MD5 c91073d6a61363b9890430cbfe83d3f5
SHA1 7ef15fd7b7ad79b2388064bf559651419f4a17f1
SHA512 7144a8d0d32ef4c29972fc158ab6d72317f20e9e1dad223acfa1c66531b05054270d630295f909ee24c8f1f46178335792185df7b6c2700f988979be87ca2fdf
SSDEEP 12288:EyPz5L8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dzyfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15775125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ee470b3e7615c5f5b96ba37bee06f1ae464f060d4cf193fa7f50eea056e9d615
MD5 9211b27517d310335fc0af76c543d045
SHA1 1ca5b44de7975e4709847d0fe005fbc1facb8018
SHA512 60c405d519d3032f3e386c92f7c71f492360df17d4c5965d6cdc91269654e2b428257b1ebe4d08ace63232f43bb64c835a32f739061f39341cc39a3e47b38c85
SSDEEP 24576:jTxaLl3z0zDBsqjnhMgeiCl7G0nehbGZpbD:jTsLljIDmg27RnWGj
TLSH
T1D48501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7747592394adfe1218a68e97e7e15a3189aa329c919c3ebc621d8fae1f5f9b67
MD5 7eb3dc665e68826043eb940f9796fd1c
SHA1 78e1f16b27bb7eab439614db92ea736a9b843811
SHA512 c143c70670fb6c27b8eda8452c3401099b4fead461cd80ccfaa97e6990a4681212e1b1fc58ca3fa1ce05222235efc72d602896711020dc6cb3b775ff7c08c2be
SSDEEP 24576:13Zd9CHKy7GZ1sqjnhMgeiCl7G0nehbGZpbD:VZd9CHKyaLDmg27RnWGj
TLSH
T15E95CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ba42c2a949a95f25e2c774fa828d47b3c76b82bd21da5539c822c01db86d2cf4
MD5 dfe35837d40e49e124b06ae78e56964d
SHA1 f43d311c89c32d891f2ca08eda61e089481effbf
SHA512 3aef9b2d2c6a23ccfe69d10ac7bb8ff62ac64a38803e706065485e7cba2a772e6e661a212d8062dca9c4459c20b583914d171e9fcab6bf518e6183b0b8ddb25c
SSDEEP 12288:1xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1956523BE955C41CAE92608B5C3E5F14DAC173E5BE92004837A9B7CB9FBB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 22d3776ee4c615b31012516e09601d242eaea9abeeb09f2f0e7759b9c90867ae
MD5 a2cd61bf3aed8409e1cdd4d98c4b6d73
SHA1 4433e8d0b7ec83f11080ad68c748c2efc372ae79
SHA512 159421a81496fa13560f235cdbcc75aeb78ccea86169bdf9203e26468000a82abdfeff4f394f510eecd5b1440909956140cacbccf41c132ef4f017bd2518a715
SSDEEP 12288:U/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1086523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837AA77CB9EBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 abcbda0adcf15a134382d38134aaef617617217fdeba965ee59629ad119ffed2
MD5 4d1c249b72799283fd953abe1118b08c
SHA1 6eb2855dfa468817365edc7c9730ce752ebfa8a3
SHA512 fe1902e9331ff815fb546616a1bd8bea3223f804038be541b2ec89c8886fb6e4ed5db5eccb0dd0af79442f692e6ddefc961388d36d52752d81ad09f046ba0e67
SSDEEP 12288:DkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1486523BF955C41CAE52604B5C3E5E14DAC173E5BE9200483BA9B7CBDFAB24584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c4eed2ecd0ef66e768e46d9d49962f5671f2d63ce6c2c2dd77e544ae537dc6a7
MD5 85dd952ece6a4258805dda52f1e20f6c
SHA1 60075687975cc6239ffd86976080d33cc5291b93
SHA512 7d52f2882a7304d5d6e08a29c8d45823437af444de580d296c0a670d7de575a75091716f92493691732bd7c28f06f0749d57f9a0810da26e3ba39b7a70bf122c
SSDEEP 12288:y2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1016523BF955C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFAB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6a42c995d74ab3d517b1f74767de6fe81e13842cf1c3e2530c5e3de56d650274
MD5 ed1a434d3e353101627baf76172e1f8b
SHA1 0683492c3bb31adcb698146e01818031e14b0d73
SHA512 2daf0d8e478f2f236c0df30930b4b4aa3d4fad7aad1ddbba15defd443212695f79963c29a60ba2803fc8f0d666d87971316b2c994be6a8481ff7d28d3017a0a4
SSDEEP 12288:hxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1246523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFAB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 582da5c6be8eca5dfc90f597208e72c54e7a02805ccc26faa929d817cd40cd12
MD5 0edd284e87ba5ab3946d776328205c50
SHA1 44b792516b052c4b781c0642de6a8565092488df
SHA512 efe78f1a01ca932d63113f3202d8e6b87ff6f8b5af9c7589b2768f6282b7e127c9c02bcc38261077600e422eba8012d9798721888d2c694b3cf89ee9ae0e7e39
SSDEEP 12288:7+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C26523BE965C41CAE92648F5C3E5E10DAC173E5BE92004837A577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1f12b14381520e9ef7f70acf6c946e33af4dbf64834d210ff6402181c03987dd
MD5 65fc045eefc7940c2cc1a490bc148139
SHA1 505ba9e3e8f352be34b1e1da7c36b1c0172d2b42
SHA512 7c6d33adc44d7820d5499b696730400841a0dcb07c3ab90e40e2cb49670b354920a98a967c61155255f8201821358ab41b8248d81e915e13b984206f09c1c82c
SSDEEP 12288:agXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:agsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1916523BF955C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CB9FBB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 b5fb405c66191667c8db5d0c54be7074e358584b75bf93083ba303c8d407c287
MD5 7feb80d19e9ff0d3a3d2a491d44ee909
SHA1 73683962d4e615fe8cba9062abdaa1830f338b2b
SHA512 434faa1c7f9eea66bffd6354c7125dd8201ebd9db927ff27f3a81a1eb12d2e56cad5117e4d9feb1ee20a38099f95cc6fa4be2d8842f63043a7e574b4673c1269
SSDEEP 24576:9fwv2k9RX6wkyAICsqjnhMgeiCl7G0nehbGZpbD:tMnYIGDmg27RnWGj
TLSH
T10695D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4deb2a976a0cf0ff92f4dba62922ed9f2dbba1e6d087dda06165318c710c76f1
MD5 83681e450d329f48fe3c3ae8e2dd8362
SHA1 c8ab9c09a83ef6f74d7a75b0c356ff9b6056dfc6
SHA512 6a43b376db44d35685c194c15e90ef41d291c6d9f165d2decad5b6ff10aeb8e0e2917f26dcd5cd2d492149c1c15f0233d64cc7320acae3577822487e3adffc55
SSDEEP 49152:SYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BDmg27RnWGj:JySzPpD527BWG
TLSH
T18E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5a1ec96b5c6a5d9c9850553fafff0fc960fc8e384c40700a0a621f558e9fc2bd
MD5 fae0979eb9fd48464353f14869e801ff
SHA1 381402d308f83edc2cf18ef5b3fed9903f738bbe
SHA512 62aa01c03d43db2972c1be5327c2ca38f3f5564c4fa8803bf20d35351dacc0e7a4c7f992341d05717361518d455215a20bc1358eb7407d705dc108f35d727baa
SSDEEP 24576:x47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYzsqjnhMgeiCl7G0nehbGZpbD:x47JUQjTirIhCnDHUPfF/RDmg27RnWGj
TLSH
T12665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 56b4a107b15a43c34e1458a0708f68befaf8be6db78dd6dbc50f1783fe3a7307
MD5 fa5b297cfde9c095df5c25f54e3cbc35
SHA1 10bbd1dab80606765a6bcd6f3572f5d4322e1992
SHA512 9285eccfbe89d758785087989a5d348be4f3b6460f7a64c518c37afa85cb83a945f353c63c7bc1996441d3303bb5750a5a7875628fa9fa9b1559b1cb0fe0e79e
SSDEEP 12288:hVsfmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6msqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE75011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6151cb9c17aee16b00fa5c9c097569a64bee5225e63207857abff7c5b8619cad
MD5 33a47623173a7a11f65aff9a4240eca1
SHA1 8b11f42856dd6acc2a43c9726841fb117e69c7fc
SHA512 1a20400afa25f1cf3da6fff477f18a900aa7d95747a13ce727ce0b8f4331c2d3d8e393cd7e3405aa5e10e7505dbb598089fcaa1993cda14055752d6b9712468e
SSDEEP 24576:BqcMM+UPC9W7HfIfBa9axKjcH2PQP3bDhIclZT:sZDUqCfIfBasojcGQPnu4
TLSH
T1A2452740762AC78FC6A940325E76D6CCA7707D01FE45AF0773C9873F8476668BAB6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4bdff37a0d2e296176f9244a2956de6f1be8dcc5fcab67b929d427dc895294fe
MD5 8db7f808700ddb6a4383895fbfffa2d6
SHA1 da60e60f93231b23718ea4a08e518589350c26cc
SHA512 dc6aa9833eb3bfc1d92981c2438f89918b65d99c27978179f2993b12c836fdfb7a6490aa55bbee9e6131a643aae29631b8477dd494317ae769c1e9eadb786069
SSDEEP 12288:Llrd63+846Al0WAn2q4jI8jscm0HF6aE0XAjMnz63B0TMaMM9SyJt9SyJe9SyJc2:LlrwOzZ2Z8eAMaEmyc6uoFJK+53
TLSH
T1BD553B01A5A7E35FC9FE9037463286CDAB745C02BB853B0573848A3C987757EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 206177665e0bd19b12576018101c12a70d896e77eb3ba00c942f9c7a1c1d2ef8
MD5 77e356580a7d9275c3369b1999005573
SHA1 745f6e96fe5604ff97113ff6008007846fa4da9b
SHA512 fca893aae636f8e6f2015393bd7917b43c58082342a9dd8cfd29799f93ac9d763510668ca354f2527ed9229311ce6396a3a360b4b17147c03265561863d15b8f
SSDEEP 12288:zO7uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C265237B934C518AF93605B482EAE12D680B7E669F1044C3BA5778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1f20f13067d022651f5ff1edff8f0af729f28594811cbea986dd891636379519
MD5 a053288f475686e82132c3f868405a3b
SHA1 972ba3937fddb9f0b2a2fcdbe9db5956dce71eb7
SHA512 26303aa8a2ea82f853d606c231b1755fa7a286260a7faa4cc7a03c13918f344510ed811716f5caa22425552ec6ac0ae816f4d208f3f4c03b1e3bb1141ffc2c4b
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYcsqjnhMgeiCl7G0nehbGZpbD:Igb4mBIBhGF3Dmg27RnWGj
TLSH
T163659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 0d127f11a76e3ad3a985384d180b0d2695f3c7869e274bd2bc51b35a2db687c2
MD5 51e4f689832c30b5bf3c954ebaf2ad1e
SHA1 c739531e27d77581123dc41db64b7f2b97360b81
SHA512 808d1d84e634133cc0445b2046cf045a959c990c4987c60b6eda4e3fde693a165157709f3b00f3693d39b7c3d9bac4d37ea69a864529ee6fd8b9bd55de29cb07
SSDEEP 24576:dG88u8FpJqH19zria7/mjsqjnhMgeiCl7G0nehbGZpbD:w7ZFPqVka7/gDmg27RnWGj
TLSH
T10295016577E401F1D477D138CA868667F6B2B8250320EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 089eb6aa0b31f35628e757a263460283ccbce3d830e2139abad433af6c72fb52
MD5 11b1a8ca8ffeb0f732618417893d6971
SHA1 4d32b70fc7a244e800408a96ee1dc55a38486f0c
SHA512 927dd3b7e45fdb527620be9ebe458cce60c4aa4ffa4c0b65916f658bee63a29b4eb6cd804823f078a0887bd28bd8cfbab612da750f0e9e6f93c98fe3ecc97795
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Dmg27RnWGj:cG05lO43beD527BWG
TLSH
T1C9D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a5cd8b163a516a8656faca1bbff543f9a984d58c479d8aa7a07ed428d2fd67b2
MD5 0ce73510a29b7cc6ad3869b929aa5fee
SHA1 1a4ded79943f706428adf556384de6a62132d97d
SHA512 0e82e8a7dd7ab582cda83c5f0597719a602ba62dd8b496e4046206fa9a09b94845a298df83100a6aecd05f14d1872db909ebf2a0a6b91a0e166d5c70f703e9ea
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidndsqjnhMgeiCl7G0nehbGZpbD:0a5POZ3BJt2pasx2+mjDmg27RnWGj
TLSH
T17F65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 586af72a9fa20844fff4e571f2f70c68176bca6e3f0d7a5fced7aef4a827395b
MD5 c2030d637f6e9f02b4df0d55beeb1242
SHA1 4edb8351cc125e3b9931ed7ec2d4e1493627a659
SHA512 16055bacae4262393658d6aea254547235e79e8683871180299a7962f1c30e0d025e16ca735791f243d81608482efa99181fa8c4dbda31bf2c73d7293921b078
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkbsqjnhMgeiCl7G0nehbGZpbD:9Nc/zEOVHFADmg27RnWGj
TLSH
T155857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8a1663d9ddfd963c8237a202b3ad3508f7fa1606072acdb6ab3ebc981ea5554a
MD5 56a63ed9b37c95274ba4020894826575
SHA1 75dd652b82b1fe60363e958c1a48e2f2840a8274
SHA512 ba44f6cd14be994a72af5b6eef566870dfa066babdef23df0eb1be6cee185d3d017132767f439e07cb5d20548ee6831caa0ac107cd20c14d9391c2aafa54652b
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmPsqjnhMgeiCl7G0nehbGZpbD:aTMwBtOmzDmg27RnWGj
TLSH
T17055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 6b8f1efe8402066deabac5b61286c27b1259393364019bcc2d874bec3cb1c95a
MD5 7267274422422936a24ed544a11ce588
SHA1 5fae3e34547c2d02a13a0c46b544fbca8d0ccaf0
SHA512 528a8653f1ba32c233048cc55e664b42b05b25fbac6cf15a537491e4ec4499e3ce31a7eb9c9e78a3edba9b99dd5026298e7228a599309a1f3f6b57ff0c23d29f
SSDEEP 12288:kHvUrBFrEjwaQ3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:kPUr+NQ3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC85F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 4d12e4954d936a24e31128549b3bfc87dc3e0c8aba3aa8468e1f0c148e129982
MD5 957280da21339c756338666009761dd1
SHA1 ded00a08ac4d04b54167897e219a3a64d3ed19fb
SHA512 6e974d90c5a97b744b5da078e613987a9cb0e92a7e1dec3adbfda635ff459256183faed48afbe1f13a74b7d7108e9a60284b0fe12ef07b1ca907d1843be385f7
SSDEEP 24576:9D3FHshBIYQgAasqjnhMgeiCl7G0nehbGZpbD:9DVHeBIAAuDmg27RnWGj
TLSH
T1C195E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/236-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/236-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/236-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/236-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/236-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/980-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/980-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/980-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/980-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/980-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1020-132-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1020-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1020-130-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1020-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2028-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2028-99-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2028-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2028-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2028-311-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2028-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2144-111-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2144-113-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2144-310-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2144-119-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3336-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3336-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3376-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3376-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3376-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3376-283-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4340-325-0x000001DA2EE60000-0x000001DA2F0EB000-memory.dmp

Download

memory/4340-394-0x000001DA2EE60000-0x000001DA2F0EB000-memory.dmp

Download

memory/4596-44-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4596-57-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4596-56-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4596-43-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4596-52-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4972-303-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4972-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5048-37-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/5048-7-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5048-8-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5048-1-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5048-0-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/5048-28-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5144-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5144-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5144-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5144-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5892-262-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5892-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5892-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5892-59-0x0000000140000000-0x00000001401AF000-memory.dmp

Download