793578a974edcadf24c73761876ef9724f5f4921e70123229c792a51a7e4cfe5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 2.2MB
Sample261018-2d43lsbt71
SHA256 793578a974edcadf24c73761876ef9724f5f4921e70123229c792a51a7e4cfe5
MD5 a42b48d0c3f6e53f10410667245a2b66
SHA1 43de86a401fc7e69229bbaeaa8dcd09fb9b04c9f
SHA512 86b73039c4b063964b0a1ebf9f256ce55a5d1f3cc32bdea2a7bbd2c00d554c7a62c941007e01659dda7ec0c7cddb58a779e8c94ea75afc56c988c31afbe30742
SSDEEP 49152:ZWz/clX4N/j2U4FHpThHTKmyBQN/j2U4FH:fXkj2jFz+ZBMj2jF
TLSH
T1E4A51255F3E514F9E9B7823C8A558A02EA31BC659760968B13D0479A3F37BE08C3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3412	elevation_service.exe
2664	elevation_service.exe
2632	maintenanceservice.exe
4540	OSE.EXE
5464	PerceptionSimulationService.exe
264	perfhost.exe
4784	ReFsDedupSvc.exe
1540	SensorDataService.exe
3188	ssh-agent.exe
2508	AgentService.exe
696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\365b6b35b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/768-0-0x0000000140000000-0x0000000140230000-memory.dmp	upx
behavioral2/memory/768-75-0x0000000140000000-0x0000000140230000-memory.dmp	upx
behavioral2/memory/768-134-0x0000000140000000-0x0000000140230000-memory.dmp	upx
behavioral2/files/0x0001000000009323-126.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008902221e505fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d89cb45c505fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002701115d505fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fdbab1d505fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9f53a1e505fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	768	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	3412	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2508	AgentService.exe
Token: 33	696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	696	SearchIndexer.exe
Token: SeDebugPrivilege	3412	elevation_service.exe
Token: SeDebugPrivilege	2664	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4480	696	SearchIndexer.exe	100
PID 696 wrote to memory of 5544	696	SearchIndexer.exe	101
PID 696 wrote to memory of 2924	696	SearchIndexer.exe	102
PID 696 wrote to memory of 1740	696	SearchIndexer.exe	103
PID 696 wrote to memory of 4516	696	SearchIndexer.exe	105
PID 696 wrote to memory of 4572	696	SearchIndexer.exe	106
PID 696 wrote to memory of 3828	696	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:264

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fa9cb8d96dbb7a865688d29d48d8e2856d0d20379cfe367b99bec357ba6639a4
MD5 10f703257d657198c05161fc235e2846
SHA1 ba853ac0bb369770035843299c928e0da732ac04
SHA512 08e66755f99355123f2925dfbb9303bfed1046e99137f36f19e6097b924abc5e57e6489fd98fc45a5fd7154fd77cf3fd002f23db776e7da2786609980798b973
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2N/j2U4FH:P3q6HjBPj2jF
TLSH
T18CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b8c4235479c98638cc44c6bb456b3eddba70bd9474b49aefebf25386e2efc876
MD5 408170e9baa857f50c4562458883614c
SHA1 a9982a4a52945e4f9f6d3fb70abb138edf1583d4
SHA512 a790be158a64e942191e1582c9da22f72749798b916b071bb74b42becfcbd05111e4a24ced93903354ccfe6b174846f9b2d4756e106d2e07b49abd5554999b11
SSDEEP 12288:B1XLsswWkxy2lRq2czAOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vXYfDtczAidCN/j2GLl3iFSE33b9
TLSH
T17705F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0347acb6e9d7aadccc5ba44fb0ffe1cee1e4a8c9753041362852017de9c6218c
MD5 d2ea6de94d442f725c8da0a8bae6e9ce
SHA1 54ba12ec1275c5e598851937a7a5427c33fefd04
SHA512 58d83ce40a3ee9fc6aa9576dd5d085a0642b3a2a16258bde8b40a8fae0f0cf550f6ae80e44c3cbcb34b266c752fe678d3b7e8463fd0bfafeccff70b4a9148a2a
SSDEEP 24576:C0Le5ji0hmxirMNdCN/j2GLl3iFSE33b9:CPji0AczN/j2U4FH
TLSH
T18135AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1fd4e42b00d38ab7f49d8f51d6c324272963abfb69688d1dc7fc227db74aae5c
MD5 21583b36b71dd6f3a523a3682166c15d
SHA1 ea3f34dc62ff6fbc0668a3c7d23c1574e3eb8915
SHA512 e33bdd60449d051e1b610850af349586893ea11b10e2d4dc3cbe2220bd376c44db395e3ac3da95dc88f7d2ae4f9c3855f6958d1044184d7aa62c6d3bf0a2872a
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuTdCN/j2GLl3iFSE33b9:k/ezSC6vUzPvxHjy3N/j2U4FH
TLSH
T17C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 562c74082bc117a88adc1841f32c93b4a51a7c392fb9fd7bc6da1a1cb8174109
MD5 2cbe041e9f85181c6bd51a0c33d814bf
SHA1 473f85bfa97359c42175bd00fbb585c334efa0e8
SHA512 84466783daf34757b4d3037edd68769c0f9babe520b2d6276ca20db2fc7de16747284180e44f7fc7be9f3c2a2098bf92d1a6039837828c88a11b4ea6020972db
SSDEEP 24576:IVbqPb88hv/l+6SdCN/j2GLl3iFSE33b9:IVO88hXl+GN/j2U4FH
TLSH
T193559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 53e39e97f1b1e7fbcc5bc628f004808fa1dca2db758ad22b83fd176bb7b066a3
MD5 b059d4be433041752e9f471db70b2bd5
SHA1 7093d6ef836b16c388deebc046bf2ede22fd61d0
SHA512 ad983740ebe8cea0c5f23ee80ac0bba34fb11a02f7a9f12ab4ee7fc27850e9ad8473960fbf450a0da99a9b59e5a60d182a276d0c0c58fc19ce2c235fe8fd3bf5
SSDEEP 12288:fRtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH+:fR5dCN/j2GLl3iFSE33b9
TLSH
T13CC42364DAA5B565F66F837903ADDE615200FEE8E525884782917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a9aff4ab3f1512d0c3f073a13bb49dfc4424da843c0c548827be15527b139850
MD5 605c51282d740385253bbe53aaaec18c
SHA1 92924973f793224ec3b8f59f01d051c8826dd1ec
SHA512 076af0ee58a53fca60981a8b6ee8df0e9895b194042105c8f2ce1f2e0e99038657f08440f696a3e8cfac7923f898f50d451188f747acb5a1936b2dd5e29d5931
SSDEEP 12288:ceBNUbTVO86UGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cJIUqdCN/j2GLl3iFSE33b9
TLSH
T15305CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ef164ce48120646cf91e734d3a9f0678334dbc5b0e668f5df3cbbc50cbb23b66
MD5 e97215e960e7b6e018e185ce6e5018d7
SHA1 01b9b1c24a49ff9702a1d7d4c39c8af80e2c8bf1
SHA512 6459f9bfe924bb79a063f5816049145ebf7cbe9a548da5afb6a29f59d6cdc25965bf8641987c84e5b28c3e69a7d363d302dba78abeb1f7fbc494b4e78216a9ae
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:YQvGAdlCEL8c/yRNw5Ccj2jF
TLSH
T1F4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1e370c7f937a774fd0bb0fc01af0e14cf7be172af22631258a19be680fb279ca
MD5 7b24264d49a824e32b5cc6d50494a2bf
SHA1 f73eeaaacc245a330e1d00e6208506dde08782dd
SHA512 d8e9bf2555979bfa02a609be8923ef211f3024f555882456ca8b5450beefa70b192e1e80dac7f5a0bc65f671a4b5f3f060270496fb558939edecb44c4343bad0
SSDEEP 12288:PAwSfxL/2Dc34DLLmt0LDQewsAjYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9m:YdewsAjYdCN/j2GLl3iFSE33b9
TLSH
T1C915E031FE74E036C2BF0DB61B35C716142CBA608B6119C3E3E85E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c56ac25afe9f9af522fb1eb8b4b7cbe50cc60276ea32afbc52f64a648ff87c2a
MD5 106f652935a742dbd1ead2a600e1598a
SHA1 fb29bed297bd2adcc46fa1cd486599559312538d
SHA512 ea0f23e9dc78ad58928c0dead4af42f2bf1a85366f56bc6abca6010d85801fb1f2d8cf0dd0f01ce42e6075a9a21696605b44a7137da6cac1742462bffebe12aa
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHF8F:hUEtQevvqc2W1cpV2EI32F
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 15d756a1158f5c852f7156ccd33676b4a2d5b5eb4f93d60e91f58652ce22dcb2
MD5 0237619ef6f8ed419b84ec79ae134704
SHA1 b32a46bcd9c3f365771549319cd858424d3ebf04
SHA512 6ce51bca4c3bd3c8ad802b977eae89fe661e41f4052da6005a60c50cc8f336b6ce2228f1b875080d3f23e0d62ca026c76f4c791ad694ddb534eb28d8718efe9a
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zjN/j2U4FH:PoqtVjnmoj2jF
TLSH
T176D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9dab33e2250d1fda969ef841d9e805ffedd0e55c9f3498320c6aa2fe9a52c768
MD5 cd557b7ee00ff16e8134884d2b6cda5e
SHA1 a3feedb464ddd7b4488466ff6b6d2a9fa081b236
SHA512 a5f43c20251eb8e9506f244dea3b248a77ccefc6071ab60bffc047408436ddf97478839879f28903c9ac3ea05d3af154364e203c1334e028ffd8148d1d7fd2f8
SSDEEP 24576:JAhGLJIFoiwtA5l7S533dCN/j2GLl3iFSE33b9:JAMyFoiq5UN/j2U4FH
TLSH
T15935AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 760158894f980201d0f5849e7313c85329c27c845dfc4440cdd02ec9b868ea3e
MD5 704af0a255af6ad52f5865086e4b66e6
SHA1 73203546302c10ea302c82311a0968a8b30919e9
SHA512 c077e0cebecf49ee95c4a1d220d3e74ff2db5ec695df065a2e3b7d8bd682fd62ce7208255bbf38724c83f4b828cc5d88d23db3577dbcc60ff6514b3996254f2c
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9wuoOW8dCN/j2GLl3iFSE33b9
TLSH
T13D05F14576E41CF9E96782398697C536F7B2BC512A21CB0F03A0C79B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 bacb5aa7d085d5ec9e8b1905b2a64fde47bd13c180de489fe765ae06e22c8fe9
MD5 69ca974a12029c3b49865b92b25dada7
SHA1 80aa68f76c604846b904d622b8230edb17ad4188
SHA512 2bae6d9c656a1126f841b93ebcf28b00609e118221266ea3efb9cadfd8b17864f61588c3ddece12b5c14a59045d55f0b609e8fcd25fd92688610362c1de1b971
SSDEEP 12288:WBZ1IyIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gZuFdCN/j2GLl3iFSE33b9
TLSH
T16CE4125933E471F9E1A7827C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4ad6a7ba144ead46ccabf8f716417185333adcbd23390bd4a8369065f17b9cd9
MD5 0c6029122ff3b863991b4c6914a13514
SHA1 f98b3ad3bdea111c06dbc111c31e4775c7883bc9
SHA512 f895e9b3889e5d01c097f5d485e4d1fbc730d7fbc0df9100d75a0030a07858ec5b4b0e6356db24495189082a2c2c5d354cb1eb81ffa839c3cbdef86fa0d8fc2f
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:tQRQyi36YOcPQLvw2gAf+PN3vj2jF
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a181c99331d041cbb708ba169f5f2e16e6474e324f57b7b8079d5ca4665ebae
MD5 a99f689f9adb413f687079eba27536c1
SHA1 cf93d01f8f9c58432cdd9b7bb74e1fb8b29b958a
SHA512 f53fa1e821ef1d15fa00f79fd2f2687615d68fc079c3e8b99fd9205741e40ccc5f80323a69e7d0f547542af0fe51f9e482ecfa5ce63ca614e8a8ec822188e4e4
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:eQRQyi36YOcPQLvw2gAf+PN3vj2jF
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba0affa69c71f2fb2b274683dc09ebdcddbecd10a4d6c7e9dab8eaf420a1bbf9
MD5 d186def57a0e4a89d5cc36319f30e025
SHA1 2f61cc59a83cbb7b8b333deb991f6ed43894bf07
SHA512 27d380c9eb831e54c6d362d297f17824e90add89e9deda0a8646e1371d3c3d45c256c358f27a43130ace9409df2e01e8e05a063c7fb99fbd5bebe5f9964a670c
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01dCN/j2GLl3iFS+:m68Qg55nhheWu7PNU3/zN/j2U4FH
TLSH
T1D5B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f33c1029c523a1dd182f6833f41b6b99dbcb7830bc138aa224bd90278ce2052c
MD5 d9a741efdfb6c2b6320fa576bd0b327b
SHA1 e1274d46ce302211e219596a66f7e7737237e80c
SHA512 09943c93301abc0753c9300e28da4e271331350ae44ef99484204abcc37a455dcdc3e886bf2d939367add6e8d2ce1fb8d0fb5636fd9bfe05826043f8b5a4751e
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:uy5112gYy5azzVvL69nLKnhZ2j2jF
TLSH
T1E9168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44b1940a6a2c6f5e118369c7b84777e8b1ecebf84f8842cb3d2408930855f5a7
MD5 b5ce10eb82b152dd8ef704e5d84d8ba2
SHA1 c0579dc97095bfc219f5242deca965471616dcc1
SHA512 e3b8a3ebc3fdd48e7e91f8bc2e5f8764bbfcc57c08a73eda8b391a150c2a64f9452f1633996c194455e30a4bc75bbf9dd35449ee5e1e8b69b1d1e5122984f24e
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1N/j2U4FH:Ru6JmVxd2dbj2jF
TLSH
T14AD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b9dd903c8d3bb1e39092be3a8e091ee5b7b42d58f1c5f256fb8ca870ec4bcb6c
MD5 7f6e4169efea257792b715f1fcd95eaa
SHA1 37e116a4ec58bdd37f02a60d14b07fe0870a06c0
SHA512 076dbea2ebc707a9be94c94e8b7ebd6fea7835b48c10abb6d399eca7d84c819bf6eb99aa4fafcb891d3c6adc4aa5a7780546c81388535cf52250f0ae8c9640c8
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xtN/j2U4FH:pmifPbRoj2jF
TLSH
T10FB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 97819d1ae6176a0aa481b4f0466614d571a3579faf61f0701e71ee9ede80f232
MD5 3f249667cc9a5f2eb47b69fb30d9671c
SHA1 3d7057b5c9ede98d8f6f8605af4ea35c21db0236
SHA512 cecf81f85ecb397d1f65eeaf238cd4f12d12916768d66b50935b7ef77f116724ffceeec2b6ae74958e19bf160c1d3696d20861e93440abf114d9c8950aaab389
SSDEEP 49152:sSuZQIY0Be2KRRVtOnks6NMHq6N/j2U4FH:O5dKTi61aj2jF
TLSH
T15EC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b7cf65d8c31c587ce1b881ddc3f63489d00edc2fac55ce75f80c834185f857e4
MD5 b81878bd0489a72fbaf5e10d5dd351f7
SHA1 b3fa32040cc2cf086e6d3f69b2b629cfc6ba84ee
SHA512 c2fdab54e01ba1549c50ec0278f8a8f5df28d4fb2957497079de1057aee464c0199a3a2279d64d16161fffe038f5942b990d85ff0b2c3d214744ed40067a089d
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wJN/j2U4FH:9X2iyph0j2jF
TLSH
T1E595BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c08ddf659821a91f48e5a9043821c352ec1028a428c26694a085c297aeaf29f5
MD5 2de6c906a319fd5a6e61556e5196f1db
SHA1 1a278c2990742aa6abe4619069556e5b900b72f6
SHA512 bb3ecd322c024de22e1fee93a522c695b20752e6573c6df708312f014538589f2f2f7bc771dede059a188aad7dccc60f65a458208ac96c9e4e132c843a06e9f5
SSDEEP 12288:vVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vxdCN/j2GLl3iFSE33b9
TLSH
T1D1C42364E9F6B669F15BC3B943A8DF515200FEE8F6254487828556EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5f082cfce9c806f91fc3d6b598f5a9ada69b35ed835d575892b0cf6b182df434
MD5 0309e82f0b5fd48803645f2185ec96f1
SHA1 e236e68bfda6373aa657d18532266f44b92ef491
SHA512 9341a5f190a697388e60dc5a0441f156410c0f02ee8b67263f425cfaa2287c0ec1d61fd197eca2275757ae1f0b24672c0fd5685efa42e7d90551d7f104aaaba4
SSDEEP 12288:T8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:T0dCN/j2GLl3iFSE33b9
TLSH
T1F0C42364E9F6B669F15AC37943A8DF515200FEE8F6264487868556EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3b1624defaa6dc614541a6ff7a52e83d31d1f9ace284f199f725771c16a6ee32
MD5 30e69ef437b971bc7d569b26d05ca4b8
SHA1 c92155aec9d2dbca506c3e620fdc99042335dff2
SHA512 9c701e8455f16e9ab9f9a2f073c54c51325ea757ea3102735140b36106edbdf116cd51a083d9a504a5acf5e8550d1231d3f2ee353bd659adcb1e8b4b7267fe1a
SSDEEP 12288:kuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kCdCN/j2GLl3iFSE33b9
TLSH
T16BC42364E9F6B669F15AC37943A9DF515100FEE8F621448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3e93f1b0faebe5c65c69ca97b2c95b5fb87dc887cafa7664d9924e1d769db7bb
MD5 91724ef15480b8dd8ec91bf684d87153
SHA1 f38860b360c780b6b4978913dc57e75e02e9492a
SHA512 003f9b4bcfd9fd168dc9734792877006bce20506fcdff0087fccba3797a560fa48c39096cee30c8d79f4f9fb61b883e1acce1be08131c4f65c443e0e9a8c691f
SSDEEP 12288:JV3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LdCN/j2GLl3iFSE33b9
TLSH
T106D42360A7F561D5E46BC37C83B5DA21E220FDE8F732458F87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1a229b3a7496de2162e70dd4422a674b4576aecbdd3296d3dd7961173a91b610
MD5 a23fd993fc692a10557198e8f1c4d867
SHA1 51c015eef906219b46811cb133444bb7f62bc5d2
SHA512 3082b2c83752127a2cd7338f38c05d54e2ec4d0eac5ef8a58d22e9ded353d7838c76f8a1632e8a2a004c8c2462d38f00faa3f1a8ddc3b154a47e1bf7abac3915
SSDEEP 12288:/PJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/fdCN/j2GLl3iFSE33b9
TLSH
T1EFC42364E9F6B669F15BC37943A9DF615100FEE8F6214487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 df0c91abc321740ab4af8219e892c59dc86c2cb5acb14e2b1cde488fe428b71d
MD5 4a9f3254976d39eb7038cfb086d1a9c8
SHA1 59f2fdce472df263e14de381aa14488f4e30ef4d
SHA512 757a6574162d45288159ea13214e52cafc96ea8bbab2ea9ab2f488c199ce904e59c3027d8bbb16a9168b1cd16dd9d4f4de751ee82e716bcf9ad9542ae15cd0af
SSDEEP 12288:UgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UQdCN/j2GLl3iFSE33b9
TLSH
T1C5C42364E9F5B669F15BC37943A8DF515200FEE8F6254487868556EB237CFE880330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fe37ddd8bb97522a1868fb4ac4ca90a683112eb6ab87a243cf0fb331f877b2dc
MD5 7b6aefdfcb8eb1547eb814c3dcbfab21
SHA1 ec290d6bb50ff0824a081e138880a035041aae38
SHA512 04f3b826b7f025b3077a7701787ede54776e179c8ae6e2d13a4fdc3968b025d50454b262d56b86e80c3c8e72d14f69a995159ea4e2ad3202bd8929029247cc59
SSDEEP 12288:GUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GcdCN/j2GLl3iFSE33b9
TLSH
T165C42364E9F6B669F15BC37943A8DF615200FEE8F6254447868556EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b11125838e9c6b4830d02ccaced2696eec0f62c979559d9a58d7914b69e272a9
MD5 014cd1ea01717582ce06df851a4d6f7f
SHA1 85d9411665006bf028faa48ca00a3ab1cb695877
SHA512 62124426652909b4e8fd075a6e2bf0fa770de482c649528151d40b8a422bac4a89310f1c04fe96ec89ed74d40f23a50984d167bd64b85769eb452f5f32ffa12d
SSDEEP 12288:AiZwb6zzFEoS2cPvycJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DZMSzFVSOUdCN/j2GLl3iFSE33b9
TLSH
T1CD0502A4B3A018F8EC67823EC9658916D271BC595770C60F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 cedb5ba65379537a84c5f3369f11bd6e36c38590e06ce65e03d970033d5466e7
MD5 057ed022a94f6862ef478a0f73d8f97b
SHA1 2368ce8aeacb9a161e94786295064fda600e06a0
SHA512 8b927f02a0010cab2ca4374e6ee86ef41f62c37d4ec15b86290efce2c8a5700f93f4deb2900a976bf34fcf0b08b2221cd8fed1522853c0a0fa8b45bd3a71642e
SSDEEP 12288:+hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+VdCN/j2GLl3iFSE33b9
TLSH
T1B6C42364E9F6B669F15AC37D43A8DF515200FEE8F6264487868556EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ac73c11025e13a3f38c4b0d7b9fcefe785383755aa4fd7d9dc9a191543734b3f
MD5 d101a1814259b1d77f97a42205d082c1
SHA1 b5d50a4730d10173ed885b0340d1944fcbc23689
SHA512 e892901346e099a38c87f99fbc6ac97d37125021f49f7bf37ebf77984054ec3162a4bff4e91a5a96d382fc9838ca31dea51e54a633a4984b5c8625efa8604c41
SSDEEP 12288:bdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bJdCN/j2GLl3iFSE33b9
TLSH
T106C42364E9F5B669F15BC37943A8DF615200FEE8F6264487868556EB237CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1d8ed0d4a85e9471f56ce7ce70274240865252cb4f44d1021589ade5cbc90f70
MD5 6f26b6abaef858cc7cc4c67f32dedfdd
SHA1 6df45f0047caed0586e0504a1efd54a5f5c964bd
SHA512 413090dadf0a9b403c0cf32690618667bff0b6c0b21d6169d8c06806360333092d45c52f7c8f242a78a810d7471479aed069bac3db34df66afe2c92091819122
SSDEEP 12288:eyPz5L8IJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DzyodCN/j2GLl3iFSE33b9
TLSH
T1B4F4025773A131F9E177823889A55A12F331B87597208A9F43A007BB2F377E09D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c0ccabfacd300f5f681701dda4ab148d5c16f97fa5292dda2704a5a0f22b97a6
MD5 ac57e2af32d147dab2e4a210935399af
SHA1 6ce5601a02802c815427802153e6e7a38982705a
SHA512 6d3da7e1ef52bedbd81b582e6e3a215799e9924a8c8ad4f1bd6bd49cda5ca358a8701479c292e9d32bfa3fc96322bb89b708796e116c2787a01492069eda3064
SSDEEP 12288:thJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tVdCN/j2GLl3iFSE33b9
TLSH
T191C42364E9F5B669F15AC37D43A8DF519100FEE8F6264487868556EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b9404d8d5ab58312a37570fb289d3c6f96ec761b5f4667367c04d83c49436da8
MD5 46821ac103c5a5b4c9a0ec0b2849529d
SHA1 bb92a1e6060b60c20a49a157d0bf66ef352ceea2
SHA512 9a598e527485c1a4705068fd6c019390095bef8b589dd833ed385f77f9836aee7f9ab534e952fa40557e7204ecabddede6252fc1698d5b4aefe2d797611b6e50
SSDEEP 12288:JhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JVdCN/j2GLl3iFSE33b9
TLSH
T1DAC42364E9F5B669F15AC37D43A8DF615100FEE8F6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c4979054e3b4702a22d066dfe028855a0dbf2beb488ba1671db0b3af270040e3
MD5 f64286fe2c581c43b706d7033130781d
SHA1 25ed050420e15bfc5d2b23c6c35e813177940325
SHA512 2e18a944c8d58d75b6c10fe742870736b0656b16014a94ec2605f4b008de9f210a300b9cbdef11f3ba733d4af96a0243b3eeb8f62b6261039fc51963667438bb
SSDEEP 12288:vyPz5L8IJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CzyodCN/j2GLl3iFSE33b9
TLSH
T11DF4025773A131F9E177823889A55A12F331B87597208A9F43A007BB2F377E09D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d955f49ab5b435fcbc9f39fabc0d6621a714a8753f9dadb542dc98f30aafccca
MD5 f6a55546a2703e5ad8d2c510361ebc28
SHA1 1ebde954c0beb2b8c54a98870573253127c70e17
SHA512 f202c45f05ef3621f089fb22696efed10f35f649f4df852be2c85a8061a7977a316ee51d57ab20504e57d450a03e8aa9c9d0db11611de57d5dea649368e4a10b
SSDEEP 12288:3Cd9eWYoaLHF3z0z04PDvh+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yTHaLl3z0zDydCN/j2GLl3iFSE33b9
TLSH
T1070502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 97d4e228361c0e34a5f68690c05623a18121a5cf28af9125bebdb6bcbb482c9d
MD5 84dea71d90516084032650a4af04fe66
SHA1 6ab2dd98d7719d1ada33364f0d33b504683e0829
SHA512 931c1a7c97f3a7f59468d3b6afaccb17dac808d9afecf8109837232fc010e3ca9f1f23b7d874ba553d9b40566f6c1446f768533fdd5053f3cc181151df2f0867
SSDEEP 12288:Ii4e7+RdTfgwCHKy7GLbbdIvDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:I37d9CHKy7GZedCN/j2GLl3iFSE33b9
TLSH
T16C25CF90F3E414E8F0B78A3589769511DA767CA95B31CE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 fcf743c5f2019baab5ff56c9f099bc35c8b8eb4a67d1e74fb16b94e0524b0d3f
MD5 6807fbf807ff89e5d53dc8d66cf06229
SHA1 88da37e450548962d3daee9f0302804d417254a3
SHA512 13a6514e1bac525c4051f8fa6e272f3cc0ac6079be0c994fc78cfd1ee2058a78b1cbf3e6ce98ffc50aebffd0d85755ad3bc9dcc95601998274969515666aaa85
SSDEEP 12288:3OJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3idCN/j2GLl3iFSE33b9
TLSH
T1E1C42364E9F6B669F15AC37943A8DF519100FEE8F625448786C556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 81a3b5eeb698bfab8a57a2c761d4e38cf3a87a5aa92b148a949ef0d86a8cde6d
MD5 cf963d3a2563747f1bd0efcaf43588a3
SHA1 efe9740639e8819658837054f2eacbb9f59ce2b5
SHA512 0c6e95f6c179fbcf829e393ec2995cf7dcf625fbf065a0e5c8354041be9c6bfb367fdf446b1d763f96c02255bf4e87ccd79cbc7e2fd858be46e19547a44c5aad
SSDEEP 12288:roJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rIdCN/j2GLl3iFSE33b9
TLSH
T166C42364E9F5B669F15FC3B943A9DF615200FEE8F6264487868156EB137CFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ea6505de49d1403de1559ab387de74a344c18b1e8bf6ec9df78921c5b68b402f
MD5 90f3ff78bf2c97e4709acb4a51e90c4e
SHA1 d9142ecff2bc996f7dc81ab234a29a124546ed19
SHA512 7a7ca51840146b73d139ba7ae10a7167145e10bf4aef7260a7b11503075823a769f4c70b844a495f6d78d02fae9348dc5af8ed6c41efcf0ca61b26b5b6e3e4e6
SSDEEP 12288:gDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:g7dCN/j2GLl3iFSE33b9
TLSH
T123C42364E9F6B669F15AC37D43A8DF615100FEE8F6264487868556EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 f2cbe904dea47f6bdd3e09fed5b65e169f1d4f7fd9f1cf0dddefcba6bdf774a1
MD5 c724edb99c289a32ef02144856d9d941
SHA1 3d74f016f41282095f032aaa9fb46f5aaa549e6a
SHA512 6107bc84ae8daa3e1a999557862bfc76dddfba6948da37bccf8a1f81765b3f445e528110f64eaf82a0d2bbe125a0a9562509d5b3118cd8f8378f1a31663e0aaa
SSDEEP 12288:jhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jVdCN/j2GLl3iFSE33b9
TLSH
T142C42364E9F5B669F15AC37D43A8DF515200FEE8F6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 23689f7e720832b5aaa8822a74c7176451c211fa6b1c022c366eed24ea38153c
MD5 7f8265ac6db9af4c5849d6d77721747e
SHA1 b885bcc3a6635e2f6f71f581bcbea570d0ddc868
SHA512 926ed1ce1c92c454161a79a7ad19c3f7013beabe6fb31773f1147fb70f130960999f18f88c029767aa6f0b6d412a06371aa990ee6d860ec18dcc75a11b5c2de1
SSDEEP 12288:tOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tidCN/j2GLl3iFSE33b9
TLSH
T16FC42364E9F6B669F15BC37943A8DF615100FEE8F6254487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a8161c1d39b3ae6ce2bfcc76770171efa49898f3ed8d04264b01d169889b5677
MD5 fd68d50c19bd96707b4e854fdf9228d7
SHA1 152411be1399157fee14be650547b83ab1caed0b
SHA512 31919749c6047d64acb84e613481a54d510cd4791f27d9ccd5e6cb774f6953a7961d96c103bb49a90a8c3b5a99ad3e3ed7de94e6ace3a70bf02f9747e9d8c2ed
SSDEEP 12288:nZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:n9dCN/j2GLl3iFSE33b9
TLSH
T130C42364E9F5A669F15BC3B943A8DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e75c2b23d9369aea63c9cbbd2599ff2d5dda8690e8c00f03f0d1210400e9ad77
MD5 82eaeb2cf1f120f82527cb6b7f5511c8
SHA1 36c10a74b39108a13017433913a7e6e0df791bd3
SHA512 fdd32db7312894d8c4fa3fdf6326630b4d212ea6df05fba668f6e2b161134fef96dccffbc2034c105d49ec487fa6d7164d201c3edd46991c1b0398bef3192bab
SSDEEP 24576:TfwvVk9RX6wkyAIVdCN/j2GLl3iFSE33b9:0MnYIKN/j2U4FH
TLSH
T13235D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0c07a20e18a55a32895f9846ecbbca88a0ecc1ea43efed759e05311ea787a970
MD5 a2bfd36cf3d9ee621f247f7baf7a568f
SHA1 151bbf1bb0997081fc2bf0a266fb021b98d8994b
SHA512 d16f02d248f654a2a3232d3936d55070c4f2622e0cec1fd66f37bc181fe58826820b4360c2dad6f4a2a4a9899c15a1cd0a99509557dd2e970878641ba6863283
SSDEEP 49152:zYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pN/j2U4FH:3ySzPPj2jF
TLSH
T183067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 702d520f7c351f49dc090584e12d3966bbd7d3c983ce037c9d5ff439e7862f01
MD5 46106a5710df50c1a6abc56bf47bbbd0
SHA1 d10917f5a065e1141fe260be71668b54b2404f46
SHA512 995c62fa8d4bef12ea2f6b3043cf3f9d1516610c2f4349ecdcb15fbbcc44a2802f0632da2e2278ed66abe6467062c4205cd58d643f81cbfd68e0dc66837a658e
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYkdCN/j2GLl3iFSE33b9:y47JUQj1irIhCnDHUPfF/5N/j2U4FH
TLSH
T17665AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 13f08e511c237b5aad4f71e80058e54d6fbb21bd5891d28dad1738f9b571b9f6
MD5 ebb8c0d06db640081bdef363aad27c0a
SHA1 c0e108d18bc1ccc11d36552a17893b07eee83248
SHA512 186cef96301608aa796ebb315b83a1225b299d76eafc3c90e096665692125ab740fd3ece0d75074e406190290173226919852529958f170139eaa65725394363
SSDEEP 12288:sNsfxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dFdCN/j2GLl3iFSE33b9
TLSH
T1FCE40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b3ed08315721c8fc93cad7af93bc3d59317561d4418d314fb86f05d227a896d3
MD5 092b6f852527a68e56436115d7a17720
SHA1 bce389aa90d9cc345ce40157a87aaf3c82215ee8
SHA512 c1d4e9a812212489158ba8ad6d043af9a1c0c1e649acb174a500491c1e2f1d9c4ea44b1412ee37c0620ff3739d7cc0164432e45cac65ab196497ec3b2c6bd604
SSDEEP 12288:QVqKo2z3FElTqz/KfZl2ZUIzJnV9j/d2kL:QhRaWz/+l4UIzBVNw
TLSH
T1273517017666CB4FC66940321E33C1CCAB707D55FE45AB0773C98B3FD576A58BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 6fba64b1e0ef4ef2e0513dac04a50215a1bcf2f69c07168cc21d16693c34594b
MD5 de268e81df8f3d9fbfc338f3f884a60b
SHA1 2e12904decb1f058b5972b6490b3f75420532d0b
SHA512 2307eb6474498de872719c6bca50b401e469429af5d5bd613aa629801911713324e109a1db70cf867f5a933e53cdd8d04891c8c99e42aace0159141c17d95b09
SSDEEP 6144:tCZFl4jhj4d6dLZacTIWSQtMxAruQkqtQtMxAeKqK6h8gPz:t6jKtR
TLSH
T14C45D781A037E7CFC5B62032072A5B4C6BA4DC1677496F26B3C9453ED82AB51B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 af7a240aca199c89dc7ee66a602e3aa367a669e332d9f11e0315404da61dfb17
MD5 d19daa0f15c4d46b81b0802e06acbe95
SHA1 bfcc9aecaa059df459acb6c138cdf9af715dd88f
SHA512 50d37ce62b4775c75cc2f1c74d954c12340e6e91f267f5632b1d0bbfd6ccec7aafa18dd7f08f8795088aca5b00596512a47afff5fd5cf5a1ad2683684e3e37e2
SSDEEP 12288:CM79JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHj:/pdCN/j2GLl3iFSE33b9
TLSH
T1D7D42360D7E9BA55F47A837803ADDA216200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 03aad976a4fdc274b01df473c1e7523637e7507fef7130e92b504eed84ba8f15
MD5 03db9d92e9f1203f90d00b2edbc6b38b
SHA1 291fad7ec4b1dee4d7da8f1e0ff33da81475642a
SHA512 84e50766af1fdec5b461e3db2714ff37bb4ad0ee056d2d7445db1cae4760744bed11fc2c3d02694719c7729ded24069996c89d9b1313f9ffda8242de86fb676d
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYTdCN/j2GLl3iFSE33b9:Mgb4mBIBhGFPN/j2U4FH
TLSH
T10365AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 143a24bddf4eae12e4f6f9d634e536baaac869c0e8fdbd8e6b255d8337a6d200
MD5 1c1609ffe7c59a415f0808ef1ae4340d
SHA1 6d57117997f2bb26b159d156055de8141ff15a01
SHA512 1abf7986561cb3ca931ba8504500bfa23b0b718823cd52a9a06dac9e946cec42b6d8041d569f84c16b6207f01d491bde977c858eca9aee85b86de395beca71b1
SSDEEP 24576:JG88u8FpJqH1bzria7/mUdCN/j2GLl3iFSE33b9:c7ZFPqVea7/4N/j2U4FH
TLSH
T17335F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 86849083c224c14620f92c10d6595758d91edf40c5f89e0a5dd07f4271ee2c1e
MD5 18f5420276ae4de21735fdf7705ab7dc
SHA1 b4b8bd716ab863b74320129740dbc6a9b8d6325e
SHA512 9e0d06c9c63ce3f39fc595fb72117d4d792b2536e50d4cbe154904258ce39044f1539191d476da76805bfc74e350a840cf42954100d70ba08492c30048c0a7b8
SSDEEP 12288:OHvUrBFrEjwaQwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OPUr+NQAdCN/j2GLl3iFSE33b9
TLSH
T17205F22E62E818E5E67AD17D86868719F731B8615711D2CF02D0817F4F67EE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2f1bd5423867847a7cc58be1acb22014c6958a03f613b7d65649a328ea6ebaf1
MD5 64c3cb926ffe607e6f18ba71b26ecbf7
SHA1 08ba4651ffec643027a53da0444f422fe03a7dcb
SHA512 7fa82e077c5c3f7c3364d22dbc7997edb696b46ddf61d8b7f605f8aab67f2bfe7ea4a6e73540959a851ac9ac20eaa5144601529b18f93a81fb1bc5354ca5a0f8
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbN/j2U4FH:NG05lO43byj2jF
TLSH
T1E4D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d6284dde9964fe1eb45d70b94e8dc447e9810334c0eb31de4142d4971a1977f3
MD5 0778e14328557b8fd13744540068af54
SHA1 d35ab4238a437bdff71b487d6b091985ac9b78d9
SHA512 7dedab7d62eafdb0db7a9cbd0d3b1ddf84ab19587dceca756ae734235ea2ccae08ad03797f5be7eeaf700b2bc03404d9614c407a6f4756b2fa4e0ffd4918ff91
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnmdCN/j2GLl3iFSE33b9:Aa5POZ3+Jt2pasx2+mzN/j2U4FH
TLSH
T1DD65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 baf91563c56921cec44f955892425f9083dcd6e95777bd4411e81adea64cca9e
MD5 f3ae59331ef51ff3864796c788914d06
SHA1 5d230c3a17a9fa35b9d09cc016eeac8c6127f1fb
SHA512 e4c408cccfef2bbf6f9db6e818970fd8b01fb922d7f2e27ee7c86c55000754336c3b8adbecbf385333fa68e27c747b85dd73a12af12af43c64eac19dc8567c9c
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkMdCN/j2GLl3iFSE33b9:HNc/zEOVHFYN/j2U4FH
TLSH
T1EF857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 12a99d45d43aa79a34b4a19512419aa219645a9564d78c84b0dc9c7706e7ff31
MD5 6598ab8293566abbc8040506eaa7bd6e
SHA1 cc62b36bb89776ce51e6b0015f6e8c66926a1c46
SHA512 77c2249095edf6482787f6f0586ddca98d0f9427a0c806477f84e6e7a4c166c812223b42af0eadf76338ed095771a4e3c0bc8838715ba03b2584d6e11614d51f
SSDEEP 12288:e1Htk065ZI7Mci//LPhAkvU4OmbL1TKwzafA55aIN4sIitNRMDKW/XuDRoSBCGYn:p0QIQ5nThAmjTKtI5EkoBDwoBdfdxN
TLSH
T1C325015D33AA00F9D1B7D03EC6930202E5B2B831976259DF1A94C5BD5FA3EC8B939E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a3da5fd2d1964d47694edddd7f05385459ba3285e5e88d66f6b5efc2d849bf33
MD5 bd68b925e6fe921cc3749114cf1e818e
SHA1 f942f0980c240db925d86c7b904988942c079c2b
SHA512 11f6ab5f0e359676f674bbd19555b4a20f002588b34dc1976ba4633f0f4e258416de43ad9038fe010304f5d1a51d38f1705931ecd97584eda526532da9c589ca
SSDEEP 24576:r8kNvNnaFeYhJNtmZBmGdCN/j2GLl3iFSE33b9:r8MwBtOmJN/j2U4FH
TLSH
T19755AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 863c5c6cf134cc378d0bde746beb3f48b0bb8d82b4ed72445ff94be0a9c518cd
MD5 1f867ae2043cc05523d1b00ddf8c40e4
SHA1 6fad54381273c899cf0d947a2c1c6f77851a56e0
SHA512 11455882462a004c79a8cfc3fa95e6766ce3e0caf537e6f730510da48aa97daa8c3734db6726601c2ea3c7a4e2b03662a4b7539131af73f0a5de7d0e9d884030
SSDEEP 24576:ED3FHshBIYQgARdCN/j2GLl3iFSE33b9:EDVHeBIAAmN/j2U4FH
TLSH
T1B825E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-92-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/264-343-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/264-93-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/264-98-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/696-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/696-351-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/696-185-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/696-179-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/768-0-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/768-10-0x0000000002960000-0x00000000029E3000-memory.dmp

Download

memory/768-113-0x0000000003770000-0x00000000037D0000-memory.dmp

Download

memory/768-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/768-120-0x0000000003770000-0x00000000037D0000-memory.dmp

Download

memory/768-134-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/768-125-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/768-75-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/768-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/768-124-0x0000000002960000-0x00000000029E3000-memory.dmp

Download

memory/768-18-0x0000000002960000-0x00000000029E3000-memory.dmp

Download

memory/768-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1540-136-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1540-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1540-348-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1540-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1540-144-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1540-138-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2508-171-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2508-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2508-169-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2508-173-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2508-163-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2632-60-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2632-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2632-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2632-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2632-57-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2664-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2664-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2664-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2664-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3188-150-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3188-347-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3188-158-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3188-152-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3412-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3412-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3412-31-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3412-30-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3412-137-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4540-71-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4540-64-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4540-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4540-65-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4784-362-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4784-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4784-109-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4784-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4784-103-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4784-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5464-76-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5464-87-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5464-78-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5464-330-0x0000000140000000-0x00000001400CB000-memory.dmp

Download