c9507e22b54b875e100e636a8ba602c4967c2db696a08626c5bc031796a60414

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 6.8MB
Sample261027-t77ftsew4t
SHA256 c9507e22b54b875e100e636a8ba602c4967c2db696a08626c5bc031796a60414
MD5 59da3cc00fd2fedf8fa709098f36ad6b
SHA1 40b4fd5f024ae159acb8602b7dd884218afd9535
SHA512 e6cb3c45e034a0b5dc4d96f545db46db9aa03abc5c6b2d145fd4f5f064ba2037c73869588285f058e0b2849213a1e33bafb95cf18ec7442d1ed1192d58536006
SSDEEP 196608:11PZIgpPOnuZFJtPQi5svyeyvMuhXqLQu:11PZIOPOuZFJtPQJvyeyvMu9O
TLSH
T13566AFA9A7BC00D9D86AC1BCC2865223E7B2B45517B057CB1A6496F90F63ED02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2164	elevation_service.exe
5592	elevation_service.exe
2284	maintenanceservice.exe
3640	OSE.EXE
4200	PerceptionSimulationService.exe
4072	perfhost.exe
296	ReFsDedupSvc.exe
4872	SensorDataService.exe
3104	ssh-agent.exe
3316	AgentService.exe
2380	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54bb1a6567fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe3ae3453266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000193362453266dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c28b7453266dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000714f69463266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b56305883266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2164	elevation_service.exe
2164	elevation_service.exe
2164	elevation_service.exe
2164	elevation_service.exe
2164	elevation_service.exe
2164	elevation_service.exe
2164	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4352	2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2164	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3316	AgentService.exe
Token: SeBackupPrivilege	296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	296	ReFsDedupSvc.exe
Token: 33	2380	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeDebugPrivilege	2164	elevation_service.exe
Token: SeDebugPrivilege	5592	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2764	2380	SearchIndexer.exe	101
PID 2380 wrote to memory of 3912	2380	SearchIndexer.exe	102
PID 2380 wrote to memory of 560	2380	SearchIndexer.exe	103
PID 2380 wrote to memory of 4552	2380	SearchIndexer.exe	104
PID 2380 wrote to memory of 4628	2380	SearchIndexer.exe	106
PID 2380 wrote to memory of 2560	2380	SearchIndexer.exe	107
PID 2380 wrote to memory of 1812	2380	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_59da3cc00fd2fedf8fa709098f36ad6b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2284

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2612 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2612 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 38cf98c776f8c5dbed9fa10e31797a064ac322216d71f59b5ccaa89792807552
MD5 ebbacdac6f9ccc9fc8d57db8b55fddb7
SHA1 9deb546f8e15df500b9e7067ab229a8e08dd8c63
SHA512 0a2a249e26a99147f78d3ddbb785df743d00942dc10e57fa3d716808c9f487ce85630cf73b51415f3b172a80f7f5cf5815e0f121bf19bf4bcd0540a87c37e02e
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9tDU42mLsZFQw:Q3q6sjBGw7mLQuw
TLSH
T132D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 893882ee65143234b2f4ca486e7efda0f9cce37054d0e8be845e38192c4dc036
MD5 5b1517cab068b9e3fc4fd4307c56339b
SHA1 d75bffa8d89f8b973f35913f107836f4037b0f31
SHA512 cac420e0a01158c4192076edf919743793b4c51866fd5ee45ca3840ff24ec15e87044a9b3bac49fce770796d801ae866e89d6ae24b9a5f4618fb8bded398609d
SSDEEP 24576:zXYfDtczAunAUz5DFs1jsLqmVNPEZ+OQw:WtcbtDU42mLsZFQw
TLSH
T15D05F12873A004F9ED67817CC9A2D515E672BC854760E79B03E49A3A0F377D46E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1bab9d0d701ca0aa82c9ec27d9f265636ab38db22f8164a36c25d112373d560b
MD5 3b562a41063a6b197b1fea31a5f806b2
SHA1 da8e5e5333843d0675b4e4c575ac54bae4bb8bb8
SHA512 62e749a241a800709e7b72061ba077eef25cfd7eedba9374cd3952baea54a69f5d7ac8d5a0e114062f958811684cb80a3286ed85d40cb2631ab76c936081760d
SSDEEP 24576:50Le5ji0hmxxrM9nAUz5DFs1jsLqmVNPEZ+OQw:5Pji0Aj6tDU42mLsZFQw
TLSH
T10C359E16F6748335D073C0B9C5D2A68EE97130865B308ACB4296D77C2F6BBE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc3dd348168c8fb85db8ed43a241dc4064de072860342f35cef6245b1995fac4
MD5 e48e72f6883ba5e342e2742e89de0ec0
SHA1 0c4e9bdf3eb80965d402892502ccd12d9d796315
SHA512 2fabb8cbaa023ba8866693ee5e8ded363a2513c2a8b4f169b9cebdff767963430170a3590acbbe35781f92167eaad1bf31795e67ac39a84c4c970064038a00c1
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuDnAUz5DFs1jsLqmVNPEZ+OQw:v/ezSC6vUzPveHjyOtDU42mLsZFQw
TLSH
T145755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e7cce1f73bdba49ee1588755619bb8c2317eec36138f94dd30efafbe6abd3912
MD5 b16a7f044506116571b3e2fa31c19cfa
SHA1 f910f0a77aad297df38f1c30d6fa21e74e5e9b7c
SHA512 4a721813b0bf5acc977fbad2491eb07c9a84ca0ec629802215d6f9d93351b3f2df81204305d10d313d34c604055bd3a0797dec01500e69db9387b499af2955a3
SSDEEP 24576:AVbqPb88hv/l+YCnAUz5DFs1jsLqmVNPEZ+OQw:AVO88hXl+TtDU42mLsZFQw
TLSH
T1B9559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 87da3bc08df8571580ab4ee0138b7388ac64c3c42d272f2bdf5122f3c5ad5434
MD5 4a88f97289de01c38c56cb5580943502
SHA1 7a8a4817235ed25abe036ee09042f56ebe5dea20
SHA512 db6b12bb581ab299fb13e807a765574881f752a2493c69cecbc0edfa979035f674e4339313527e160c56868731b5e435bb51715a52d742d3a0de660eeb65ce70
SSDEEP 12288:pLRjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:pLRnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11EC42386A330A056D3672D75EAA6F54930F0EDCD6921E91B0EE2373F05BCAD2F456143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3fdb7161d9a0a8702c736d63d7bec7e37af260a212a4f836212c7c306fa18f7b
MD5 1d223680db54b99342320946f975a8bf
SHA1 5263e31a8bf4eb63feec13653777bbcdc44a579f
SHA512 cc7bd96a9fb20d3ed1fc2488cdd1ec3a1a04c93cda2fc419da93c82f5be7f97b223fc8ec6566184e92e6b9eb667a5a6377e18ce935b16faf1903004e656503a2
SSDEEP 12288:meBNUbTVO86UajvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGr:mJIUanAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T16605CF3BEE28FCD2C27A5DB85A91C600A77278704F22A3CBD175830E9E275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a8214a3e0c76cf49ada7155145e368b73cfdd656b6b31fa3ed2134a7d642171e
MD5 23f3192b40e46658c956cda9f03c87e9
SHA1 3ab8c4ee06ceacfcecd560017688165546a11bf2
SHA512 c904b297ad16ae139f68aaf5aa3255ded169f898de37defdb1c1805906155ace6ee2719f2f5896103758909df3f74070392cecb63df4514e0b13bed85c3dd3ec
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH7:aQvGAdlCEL8c/DRNw5Cxw7mLQuw
TLSH
T1AD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 249831f163c2cbd1dbf5f0911819a8a184fa1c1abf82e84ae358f21249fad9a4
MD5 44081388ed5cf66df2fb28b8c86518e7
SHA1 dc0aaedcf0e8c6cbded07ba2ecba7c3a037fdf18
SHA512 22f81105868088b1e063451ecb8c1ce9f8a122574e327d010b602753f58c61d2f39818d68406857689f54f5fcd396a494293d7957b7f9cb80a17cf8b3eb8c3bf
SSDEEP 12288:wAwSfxL/2Dc3RDLLmt0LDQewsAj4jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcL:F0ewsAj4nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A615E031FB74E036C37B0DB21B36D716247CBA604B611AC3E3E85A9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 25dd131dfc156bd0f5837cfa8c6411deb2300052d2de0549efd0770678865a8e
MD5 285448cc97b4ec4adfba25f204bf6572
SHA1 da1b4e528c159bd493154c065ece742c7e72fb6a
SHA512 c5962684d62fc30493548c11a65ff4ec4fab67cd92c7603cce252c640ac61b92f60c05379a889fbb2933f5defd7b6889389e75e2bae552d92228c668463a73eb
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGLQu:HUEtQevvqc2W1cpV2tI32S
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a5e32c02348abf3d9370724c3e0a251b11fe3a957eaef5e89dda8cebadab1482
MD5 ba5b06bd66c410f9586c566e331f1490
SHA1 2e3bbd18ac3dafe0dd684f32a74d64db65a2f162
SHA512 869d60a5f1fcfca0dfd756a58e8bf5083268f3a0d27f20deca050470584573bd57c8efa8a419a28bf41176fe07cb20b6be4c508f60e2dcd4d80985c7153c9943
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zqtDU42mLsZFQw:JoquVjnm1w7mLQuw
TLSH
T1F9D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b1965da2e9d23e2774086b7c70d5ecfa122e59f2b9273c53efc315e8a48517e9
MD5 9ec2bb90c881f12c1040d9dc3993e7cb
SHA1 690ff146dfca758aadc682a1fc5c665a46f13e6a
SHA512 b055c10a7f8f22ccb18a99c65cf0be69acf0b048d65748886890c3c795b51cd6a9a77f5fd468bb1d45d13b9854594b931ab4f262fd0c1254694f0b48f624fb6f
SSDEEP 24576:rAhGL3IFoiwtA5l7S53/nAUz5DFs1jsLqmVNPEZ+OQw:rAMUFoiq5vtDU42mLsZFQw
TLSH
T15435AE81E7F951D4F5B3AA7899B69170EA76BCAA5E31C20F2160D21F0E37E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b6e7eeed72f1e91f3811c4ff2112bb3747264ebaf3b7b6afad6af9296d6a14bc
MD5 f5b3422f5eb3d0930d4d373ac530fe74
SHA1 7e736c51c48bb3ba949ece80730c7f6c5da803b0
SHA512 53d7f0d1a6151314d51a2733bb4b8dde2f07726189a00efa2553830631e76009645c202b3773b22599b1ecbe5319b7d316e6376a4b079ce3f52aec45c864c113
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CjjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHn:5wu4OWUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15805F04673A418F9E56745398697D136F7F2BC062A21DB1F07A0C72B1F3B261BD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7dbfc1f632c7d48cda3e0dc8c396ba0cb9bf8a982ee29bb791775374cebfaad2
MD5 a35780a4bdc27001a56c2d0f5f77e929
SHA1 285f5c395c1144d15f17117050531fbe08de6246
SHA512 04f972358161b3a24a1fe3b70c9e6e205711cc3cdd7d204043b8905b247166592e5df19736ed336c3ae9ba4d76da8894ec7324777ace103bd28ed7246be3e013
SSDEEP 12288:TeZ1IyojvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:CZu1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1D1E4128A33A470F9D2A3557CD9E1A605E3B1B846673283CF0665136B1F7BAC26D39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 45cdcdb072bc779b99cb7718d6666538fd19887d3ed83559ad69af10857e11a2
MD5 8dbf4852bb31ec8ad6d094e0b7e81485
SHA1 7dffa59256228d7431ca8278a3aa4461e11020eb
SHA512 bc7a4f28dd80957f3b59371561edc5ab6edfc2187523ba9fc762b1cdf36c3085e67626bad9f585a372f571d16e77c697be53fb70ae699b31cfa154ddc745507a
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN3qw7mLQuw:3QyiKa/X+PNgLQu
TLSH
T1E2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9883d340e5a1b3ecab9f85a9bd8cebb3744a801b2613ef43d55cfd05b3826194
MD5 8688f4323c53be3d2ac9f7b3dd120903
SHA1 5bdeb2642dd0cb4374147292777ca2376c1e6ced
SHA512 8012cb0383c17458ef1ba7b04c2799e38a5b4dca5a641d4380a675c089331b9cb8faa5ec018a0b97bf1480a8b90640f36282f8b63f56fc7a3957b9f8615bcbc9
SSDEEP 98304:+QRQyi36YOcPbLvw2gAf+PN3qw7mLQuw:lQyiKa/X+PNgLQu
TLSH
T1B7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 122b4c090fd9117bb832937c90838f14d2f81d9ea708181bbb73bdccc8c7f26b
MD5 94f782c593e6b713426a7cfee04347fb
SHA1 74f435eb722481013cd909d2b8c9cd8c5ce7342f
SHA512 a2d7bef4af6edc91c288dcb966cda81b7675b342178389374c29812debbaf63a8b2da947a1e2825641770db823ab093e32912c3ce6be16294d9a421c28950842
SSDEEP 49152:g68Qg55nhceWu7PNU3/6tDU42mLsZFQw:athLRc/4w7mLQuw
TLSH
T1C4B55A33B2F20099C44DE1769F4A972196E17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4e3f4ddfd2b563233e7d9808e19dc7b472f4264038a3ee6b806dc7ad0d41b6b2
MD5 c1e05da5227b580911458830196d562c
SHA1 b2763066d9415b033170728325bc6bbed9bab2d0
SHA512 8e0a0a064517d900f9a4706ac0065123eec8827bd96bd58a1c374b14347bf5c395ab2a64655c197f3c71deaa44d54449a0d3f299810acf58b13c50a7955e405d
SSDEEP 98304:by5112gYy5azzVvt69nLKnhZrw7mLQuw:2LIHEWhpLQu
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d40b0b6c1734d52e1129afd111fb9243f041e593fbb8c972208ec945527c81fd
MD5 b1fe4077b0e3442df7213b32952887a0
SHA1 a40ba0edc6d28a5c2f2821a0045e21c2be668341
SHA512 4bceccefb7fe845c6b90463a58c9d64e074966120be497c665c6d54c7b30c71ae9ebe4c30849dd8da7fcacd849cb4b38a4b1e6ee05689301bee93d71df5a9423
SSDEEP 49152:lB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glstDU42mLsZFQw:Lu6Jmdxd2dyw7mLQuw
TLSH
T148D59D13F2DA01E8D06ED478974A9233F962BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d87a62f129856fb2ec8b1f1c2623c489542cbe4f842380541cbf2cdc53090af7
MD5 b0818dc12599582c836c6f0ada54c4dc
SHA1 584e9290729f45b13ddcf6c9b208d518f13e48b5
SHA512 5e9047441aa8e52d7155e71c38dd8f99dc8320e2543df8766957d82856503764368db34b50bb57316b581afecf070f42dedaa2ea814865c4ce0107a181f9b3a6
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xgtDU42mLsZFQw:XmifPWR1w7mLQuw
TLSH
T175B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 46193e2d7f66ed1f7cf98e223d92017544b64d9d314a94d0c31e7d7e64794297
MD5 3ce8808da10bc4f73d1da2e33b8d9d84
SHA1 41cef97b970bbda40619a7e670e24c1386080015
SHA512 c81095e061f204406093a386f884b7d8aa48f824f615e7593b05d320e1250533c58d43dfb6a0e7c756d555e77e475027d76f5c80ddd42fd7be37bc5b2d2bff68
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqBtDU42mLsZFQw:Z5dKii613w7mLQuw
TLSH
T122C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4bc0f415eaea86c02a69153bd07538adc8adf0cdc5f3c4523de87a022bc9e3b1
MD5 6df10f561b75fb3f50f73d1adf4a30eb
SHA1 3839790a632815887c766b13ecdc775e008a9b82
SHA512 13c048213e330ab17646cee70d10ccb4aa3a823a2084b15bdca332ed11bffa5d87a2cd60e2099a7d2e61b83fcc9644245faf0516add6a7801c3de766b305a5c0
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wctDU42mLsZFQw:eX2imphJw7mLQuw
TLSH
T1C295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6048d27aa7bb92853ae35704374b45b68fe8540425a851ea050fa3f0c3974b6d
MD5 d201709b6238ae06643ec704593e379e
SHA1 0f2b492ecb09f4bbf18f95f717f4962daa6df8e6
SHA512 41603b7695f4d3f0b4b82facc538f28f2456a2b8ed23230be1262b9c30f6122a8299000525826adf2066c16930fff5f2bae3a39210ba09a002dca7b5bb59e737
SSDEEP 12288:lpjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:lpnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T163C4238673319056C3161DB5D6A6F54930F4EECEBA22912B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 253a87a241cebfa33f75dec304d5d4abd68b05ba2f3b6e488b682e620b9c1320
MD5 b3aec04253a1a4c61e95e100de101267
SHA1 30f20f0b8d384d1dc8c2c909a4cb7c1959c13d6e
SHA512 c016a2532866da62442ae706a12b322399986c8f3549492c9536a9c0e2e1da99475ef5d1f0cf7a1bb757cba2d50b919950f95a96b0116e9efcd49fe2e2a9508d
SSDEEP 12288:UcjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:UcnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15FC4238673315056C3161DB5D6A6F54830B4EE8FBA22D52B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 53c50f0d4efa26bf7262877b08147d7d74952814fd367942066737fe6cd808e3
MD5 bae13ef346d9b8aacacdc68bccabf15e
SHA1 5126d5f393aaf9363ffab4c50a9227a112ff2cda
SHA512 2ee3fe963320dc94553889aefc982efb8a2bec37b15429e07f49ac3b77c5fb14f8e6e35b12a292ce759f22df3c0774644dca2ef718f7714a293eb20dc71ae4b7
SSDEEP 12288:2SjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:2SnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11AC4238673319016C3161DB5D6A6F54870F4EDCFBA22A52B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f2b4245b5376b2e7130ec4b10b34e2d287a36714888589dd2c3089f94a6fc674
MD5 0c9a1d55bb50c93b5878f7a258b1ed58
SHA1 a61143746ada3dde2e959c617613e6f4b6967a87
SHA512 dbb3103e0d7f23d0c15323320c872ad2abf28b8997714221013571a6f31a8a8a342817140b79985084446b6a9dba413511601b6d0ef458505b5562933e289172
SSDEEP 12288:HVfjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ZnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1BAD4234633355096C1669975CAA2F105B1F0FDCEAB32A66F0E92272B0EBD7D1B835343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f31d235c34cdc18e2e8fedce2c41e76d6ff8702b8baad11337b31183f9ad7e20
MD5 e3b472903d72b6e3e212fa84b5813c04
SHA1 51aecc2f9fba9be64dfa387a5370f86a57bc2d4d
SHA512 793c9fef9b524d9a6625eb54a95b9c532d043e43321e9a41ace4ae6234edfee26a8d3be1cfa790ec4771e786ca60b62f665914bbb543604856af3cb0d9d326ff
SSDEEP 12288:FHjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:FHnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1F6C4238673315016C3161DB5D6A6F54830F4EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 aee4a5848987d3187e2b41eca72e66688ff27d1a999494135cacb59b8541b82c
MD5 a13168024ac2390fa33dd178fb314fcc
SHA1 7e5b4a7cb7920a500da6afc74d3bc057217297c3
SHA512 c7c2b521ef941c19d52505b10105d03ce771d277bd3b3c1eba2c11adee1df3fc8c0b39eb08e1b3d3cd74ac0291da258b793f192097051819fd4113c36988ea54
SSDEEP 12288:QQjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:QQnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1F5C4238673315056C3161DB5DAA5F54830B4EECFBA22A52B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 53b29472e6eaf4fb448a5d56c4e0ec5384146876dee2aeb5879cbaccbdfd3785
MD5 81c142c02315bdb21cdf6b8affbb8b5c
SHA1 1422661eb353ca13481a7448f9d1cb68b63adbe7
SHA512 f6d8139fc5bab84ba80973b3ba74ff8c7f77465bf6c224a4bca5cd52e8af1d5c1ecfe79d152c6ae5a9a84dce39ff233975525cf687b8cc7f411992b97e57e24a
SSDEEP 12288:lkjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:lknAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A0C4238673315016C31619B5DAA5F54870B4EECFBA22D62B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1ded63c176230696cdd83f48b205eef7020c4f26358e6d361e4364cb3674e0fc
MD5 32692643ecd4ad9044126b315bcacee8
SHA1 22f41bff3b2ad500850eb533973ec425a2bb89f0
SHA512 e39c7256955a7c3a3118487033614a863d8ae36bb262d46259d0c2d84a1ad31168a0a77753a2bb764ce7aa20bae3cd27f8607a6bcca558943a0da8c646da908d
SSDEEP 24576:CZMRzFVSO8nAUz5DFs1jsLqmVNPEZ+OQw:CZMRzfStDU42mLsZFQw
TLSH
T1AE050195B36018F8DC67813EC9659906E2B2BC5A1B70C61F07E4362B1F773A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9be17a0a64b9dc60eef94e32043669db3d4df3fb07bda5e018eb4d052922e472
MD5 89bde91880d21a1360acd2fc5939c00b
SHA1 8a69294f27eba379b43baf267218127cdfaed12c
SHA512 983db6f16bebdc7d8148d7c7d1a621b5c9ac5ee56a5efb877b1ee5f58d82f322f90a191316a1533f8f3ec5215c2d28bc4e1a91e9031d06327f27f98257f3edcd
SSDEEP 12288:OljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:OlnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11AC4238673315016C3161DB5D6A6F54870F4EECFBA22A51B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 44f3c4a3f0e2cb0a2996eab3225d6a6c1b32a6d097472bde4abe52f8c7ba9502
MD5 27cd1ed78afb1246609c5ee9f6ff53ed
SHA1 fecc4033fe7e1cc5ee8c70159e3d612655e5d880
SHA512 8c5e62c059ce2191177a87d03d75888aa736f8262e0d8706994f581ddbb7d8d47996bbedb93146521451e7a641c19f7792ec153938d88641f01db72130e7eed7
SSDEEP 12288:tBjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:tBnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18EC4238673315056C31619B5D6A5F54870B4EECFBA22E21B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3e7b476558ebad88a4632d0fba406ca48e74c354141e9dd029c035f85adbfb8b
MD5 fb56f32de849a08c9a30206be8908a5d
SHA1 502203f7750270bc94e65d8cb24bc6917ac3b9c7
SHA512 18e8459197716c93e14d99eb147d0f225aefcb50d53f68fd54be353af7c9df5f25f43cda6df41eea1b7f376c35b7d354a03d7154bfcba5e3de0bf21fc549af43
SSDEEP 12288:JyPz5L8ojvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ozyonAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15EF41247736130F9D1279238C9A26A05F3B1BC7617208AAF17A4173B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 21d42f54bff65e9fb8ad1af46068053b3cd15aa885a09e566123d490ad2f5170
MD5 8552a80c2dd90754a0084b9ebad8bf9e
SHA1 6c9c6dc5157e754c080b505da7b47f99410f8b3d
SHA512 9f7915664f7b7f770b05efa3b4209147db306a3ea2f2ab2d64b33ce10696df02a63a919d31eec140450b453fdda4b191c1edc40f26d38c434ca9476d3120c2bb
SSDEEP 12288:WljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:WlnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T160C4238673315016C3161DB5D6A6F54870B4EECFBA22A51B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7de5389872f25dcf5ea9d6179ad478aa772b130e242202ce3d6446af64624178
MD5 cdbe46d83db364096fd5a6111ed84dd5
SHA1 cb1d5a0e44422563589b1d04019d74ecebfe89ef
SHA512 0896926c0fceef7637c68a685dfc0c0e2074431edeca28cdde359e978e5a0e99199fbb8a91d066423b41f1ac9ccab8f6f384f409f3c641d4a73eb64a5470e019
SSDEEP 12288:wljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:wlnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1B7C4238673315056C31619B5D6A6F54830F4EECFBA22A51B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 37eafa7a44a9408e6623b513695bf239790156d2eeb19e60bf03484329caea42
MD5 a39f6c64497a9e389ee0602ab38c88d4
SHA1 7e470bc02d43a893e0ccd2d77cafdf336f4511d2
SHA512 84510e2724fb78595d976631974ff9c12df860d33856f5b28f8ff2b9aea47435c38f982064754f3515014051188463a11364944f7d774577ac85095804a4bd82
SSDEEP 12288:FyPz5L8ojvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:MzyonAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T118F41247736130F9D1279238C9A26A05F3B1BC7617208AAF17A4173B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a47658ad7628692e9aac6cb628eda3afcb5d2b482d9393d7f92832dbe50c8970
MD5 8d3e9b376f6458750c021290e5f5cb7d
SHA1 ceb3867f0db7eee03f010ca581dad000dc9f6d94
SHA512 3b3deb532640f3434a020b7bc4e4d43643ac7f1dba3fc7583676390a0971d41ccf2d844f2d5c151838a0d5356599ec5c730a9219fc966e406f7dd23c9cf6b223
SSDEEP 24576:lTDaLl3z0zDinAUz5DFs1jsLqmVNPEZ+OQw:lTuLljrtDU42mLsZFQw
TLSH
T15C050195B36018F8DD67813EC9659906D2B2BC5A0B70C61F07E4372B1F373A16C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 38dfa82a7b42d2333866bb2aa17b026999f00cbf4ba641333c8dc6c74361dbea
MD5 18b8e53be72c67b16e32d9765ed6a5e0
SHA1 3b043113da343863b3b1a879763a10014dc363cf
SHA512 fd0dc67cd662829981267752bf3f7681de14bbd325739ee1840aab3d78ecfa90e8f96a4f389e3a868c4f100e2cab5319ef557d4f92dd389d62e6542bf1527d9c
SSDEEP 24576:L3vd9CHKy7GZGnAUz5DFs1jsLqmVNPEZ+OQw:rvd9CHKyaStDU42mLsZFQw
TLSH
T15E25CF90F3E410E8F0B79A35C9769501DAB67C5A1B31DA8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d390a9005523224c4c4e76e65c9af1de4f081af75633df67003079ac791fcdd4
MD5 11a947798577ad07498c7d3816961351
SHA1 337624a673353df90ee15500c5d4f7577ca3997e
SHA512 ea94d56c99e0c95c6dee525d2cc8ddfb61cc4aede90337d6c1898edd05ea4f6bd7b33b8335f7f0dd40486ce6736a7125a751bcf0fe46486197214c6d1a7621a8
SSDEEP 12288:kyjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:kynAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17CC4238673319016C3061DB5D6A6F54970B4EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6469d3a176c40aa0c78cab211fb81d639ec70857922a2ddb53458cb690cf1698
MD5 9de6d04cf7d08161ccf3d16abc07450b
SHA1 d6b651452a550f26c7d0b6e63a2c937873e3de42
SHA512 efb86ec620d9604d0f8ef56f50cda46ad75ea5176b76c6361f0deb1ba23e5816c396d1f37d21dba90d68e176dabb003bb3f61139bea3729399cb18b5df908a30
SSDEEP 12288:3IjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:3InAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T135C4238673315056C31619B5D6A6F54830F4EECEBA22D62B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 dab6e17258310c04b366cab15932ac1b4edc364c5c575fd647a411715ed85fd2
MD5 ab1fc584ce1e883cd9ccbffbe498aa17
SHA1 45f932c23a5cdd09b3323070183af905f78325a0
SHA512 41987cc4190619ce989d7c4745cd6988248bea1c576b77890da13e7b4ec271f29d4813d474e178d0a1f162256b2f0a6481607d61e8eb6db29d1b13b7a2aede01
SSDEEP 12288:irjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:irnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T106C4238673315016C31619B5D6A6F54870F4EECFBA22A51B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a5f5cd340aa012019056c82b6434d0d658c9a9adb31336b65b809b9886cca3cd
MD5 fcde7ce19220fd08b14dfa2854c0097b
SHA1 384c24976b17d9b92bf4d3590db2a92203f0904d
SHA512 8cad29c74882cafa46f66201708e8d51d433c032e91258d42ef023b41395a014ef22370c318aa34eba9046e1d47a307180d126ab6a1ba2468336c027d7d77b8a
SSDEEP 12288:ZljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ZlnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T140C4238673315016C3161DB5D6A5F54930F4EECFBA22A61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e47172d72bba8daced3e5489e00cbd12fc89a3657598488e6b3e4d704ddb24e3
MD5 d99821cca8aaf10e10bc1b434c4d4d8d
SHA1 5f17a2ac4fa2cc8175f223f55b00647bf86cbf3d
SHA512 d1331fba061799901bf39e947dfac38f9d87b443b3f2aa8fe32f2a28a42a2d26322d7349eb4f1d04a8566a2c0841367648d68f0165213518f77c77c36d65c7c7
SSDEEP 12288:6yjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:6ynAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1FCC4238673319016C3061DB5D6A6F54930F4EDCFBA22A52B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f8ee04868f1c927ca933b27ed718b9e4ac7109a7b4fc86258a05ef5fc0daf6f4
MD5 12c79827d43c9cac15af4547bf83e389
SHA1 a7657fc0a889b93d9091a8401ca2ee447afbf27b
SHA512 2dfaf0f84714f77c2a704f7fd72a77cd8115957fc9a5cd8141ebc4d4e082cd5c1f8b6a5d6b787870b3bd2598b8534f89499fbdcd034112bc1e8a75331f2a5eef
SSDEEP 12288:yNjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:yNnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1ECC4238673315056C3161DB5DAA5F54830F4EECEBA22A22B1EE7333B07BCAD2B456143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 743440295f2cab65a494ff5b0c9657a5297d94f1f0e2c680c0ce70137d7f9ede
MD5 f8fb8f7c0e75f17ad585992ab30443aa
SHA1 b07b5c37fb3cb3ea4af2e46e52591153202d17ec
SHA512 a0a73d739794f446663432fdce5207a4ca52573d689e6e2fbf84a8d70eeff01069671d68640b3420aacb6c51bd7ea01df7bbace9d1e21d4336191a3ae69c3110
SSDEEP 12288:rHjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:rHnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T19FC4238673319016C3161DB5D6A6F54930F4EDCFBA22A52B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 9731480a8feb4c51c167c2ecd7e8e9c4e36ce304cc29c519c49cd69370f5feb0
MD5 af76e6526ba2923fdba9b0aa82f10b6d
SHA1 aa3bcdd4a26dac2f1b4c20b831314b8388148d9c
SHA512 9d0fcce9ed8a20598bb024c8877779203985a4a6ad311df192e7a988f3bbdd6e426e969dbfd7ee38c55d4154f6a925e69481919c46de92f980bcec703e53258d
SSDEEP 24576:lfwvUk9RX6wkyAIxnAUz5DFs1jsLqmVNPEZ+OQw:XMnYI1tDU42mLsZFQw
TLSH
T13535D029EBDC44E5E177913C99B7860AF2B1B8591B31C2CF029A536E0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 85ac8ec7ca824607b8b729e681148720e73a99ae310de9d231ccffe7de6f9482
MD5 550bb9dce03519b11b00b6ba9400029a
SHA1 ccb0271d8f370c5375ce67fa17c78863007cd41c
SHA512 5ba96eaf76e6ff7b220c667d89cb0245e5b806327eab401773606557e5295af92a401fab2513618ead0dbc03b4be35fdcffeb35141ea321bcfc624af448c9e75
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08tDU42mLsZFQw:BySzPKw7mLQuw
TLSH
T16E066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5ff6529e6249df6c82d06223222b8e4ded008b783302e577d66c7310ef4ffb81
MD5 9b50a0c8c8ec6afe468d56a0fa7bb127
SHA1 c6d9873e217efc3af2d8f07a35cac438c0f8e8a6
SHA512 005487aa437ee4918974508633c10a43d5f842f9a1beb2f59651df38cee4b5bc9ebce3b4a3aaa1999d06461ed63342daae218730e183605fdc82d05a387cc671
SSDEEP 24576:v47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYsnAUz5DFs1jsLqmVNPEZ+OQw:v47JUQjTirIhCnDHUPfF/MtDU42mLsZl
TLSH
T13865BE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 4119dacf7a55490709ec9e9407cd887c9e0bc28044c05f8023797b77d74b3402
MD5 b47317393e9158e215d0315d5cd76ff3
SHA1 5b10b32a6b818e39334593910366fd2560b581e8
SHA512 3f3dc925052a97635d8e7da4a8f4b1e02b8321bf4c547511cfeee7b96972640ad9dbb3a0a670969407684236f2b91037ae8594a92bc64b7fd0c453ed0bc49b79
SSDEEP 12288:sbsf1jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:j1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11CE4F04AE36401E8C06E6175C756AA40B373BC5997E1D3CB16D0F63E0F7A690ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 dd290c1c798ff78fb8539ce6903dc15c3e647c1d6ebe30f52f1767a43b833ced
MD5 b9b68dfe4536e45423a81f8f7f155380
SHA1 a9e4cd8819f0b246c710c2734e09118d4940c94a
SHA512 f8242cd438d8620ebe80b32657bb55af300f43f1c651c1beff05489867715750669966973cbe38f5312597bf5dbd7bf9cbe4d33afbe501e8adbcdafab137b7e3
SSDEEP 12288:9gpiU3fCv4GkuY4poiZHgcuFMP1fGVzo/tiG/GHRjTH:9gQUPeDthUM1f8zKAG/GH
TLSH
T1B93528507626CB4FC6A940325E32D2CCAB707D15EE44AF0773C9873F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 28412ed193c6beadfc334a1ff595f508032b9721086b7f134f331bc25f4e3805
MD5 9793848a3201af4ab79989f03d74ca1a
SHA1 0c4617b7705a5fbc3509fcc589603a61b4d17224
SHA512 b1f5515c3b95d477d7d915ea7420ecdab18ae5824aeb72013f68a466a09b38248150a6d414a1c68da48a25efcf4d67a74f8d0b5f728d320c08e70539cc540750
SSDEEP 12288:QAfQwvZSSGNuL3+qoGSGFQriZ/9nOY7LAKIler0i9ZnG9vKv2c2B34lQ2:PkCz21Q
TLSH
T11665FA805137E78FD1B66032072A5B8CA764EC07B7096F26B7D9453AD86AB11B0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3d73dd3a6ca92005cff940e34f63ef5421e16a82ecc78f1d326b401ff747d7b0
MD5 e6c99666cebfdd470e61bc1b19c892ae
SHA1 b5bc0dff4a9072ad657e00a3038b2cadd7789b38
SHA512 5163ad11fa56a2eeb687a03153cc6cc508c6b40582619570d3aeb54033db78569e82b122c71ebff93c849e18fa5d352605959805137b9028744aa96ec7c83c86
SSDEEP 12288:G07djvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:/dnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T170D42342A334A016D27629B095AAF1143079FE8D6F21D5DB6D96333F06BCAC2FC76247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3d6267fec7b4e423946a28d127769ea2c27e48f1f0d29d53e79401ccc4922c8
MD5 5a24f9fa89cded81c496a74c54658578
SHA1 9c0e3bbcfdc63acba7b50d55b63448f640feba17
SHA512 2c6964ef8613ae8d7219c0eb1e575aed867b75df104d06ba695435c6938fbdc80877a0982dc5b930e969e2b141ef2838e98033e85c90cbba662cd132b989b503
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYDnAUz5DFs1jsLqmVNPEZ+OQw:xgb4mBIBhGFGtDU42mLsZFQw
TLSH
T1FF65AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 263f86cd22eea5220eb3fee18913be2318dbbeec207dfbb32a1e205a03a3070a
MD5 68c056350ded242773da17d975b09f6a
SHA1 64667905e91cdd2042f3821174bdc066ccad1b31
SHA512 e4e7662280ef5a2157c15f6018d88ee80fbd930598ab5b91bda6a4f454e60e2e0464461d914bb40b29b9b7ec55121c268cbad40b183128fa71a404413dcd33a5
SSDEEP 24576:DG88u8FpJqH1bzria7/m8nAUz5DFs1jsLqmVNPEZ+OQw:y7ZFPqVea7/TtDU42mLsZFQw
TLSH
T1C535F16577E101F1D47BD1388A828663F6B1B8151320EFDF0BA88B561F23AE15B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c36ee1136203d4a57cf5ac522e57a96170ee212502465dd45162230b72be6cf9
MD5 fc72427f340ef613a7c81b44ac27287a
SHA1 9ed05c968b6a47d842e0e0b00bb9fbea80d12734
SHA512 a00cfc807a0b157ec078886af3a8f6f6691833817fec6c1e9a92c4784211b8d1346f7eb9546bb67ad66c6666a2a4d9ff430bd84eafdb35f2a0e61c3fc2a08004
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCtDU42mLsZFQw:tG05lO43bDw7mLQuw
TLSH
T13ED5C06A62EC11F9D1BBD07CD9C6860BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1945bd74f90f0f713bc89458ff1ffae5f0ebe6ef0dfb06aeb6f271fd4816c454
MD5 1706ab302e749ef50894011312088a86
SHA1 f9ae04701c3695121605aef71671ffc95312f80b
SHA512 f1d09a86ad3eae1f9417306921ca77272ea78566f6d5a5849de614bf147e94b03e3c77132e6da39ee164619e5e5e8001f72842a4bd98056fef7332442b5ca01a
SSDEEP 24576:ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnOnAUz5DFs1jsLqmVNPEZ+OQw:Qa5POZ3BJt2pasx2+m6tDU42mLsZFQw
TLSH
T13E65AF5EA7F801D5D179D17DC583861AF5B1342653329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb9b72eea98ea31d457e3d6296c1d6b6c97f7fc2b55564b6a3841dbd5bca403e
MD5 f98ae80ea6b690f87407b52e5792c63f
SHA1 39160ebee10a7e8d7c2eff796f77195a3a3e9609
SHA512 d24539ad7795451f49d19cd0390292467e75324d8fe01c974a780f5bdb9c3bb74a3b93d7c36c8381653b0c4b2fce7f03206fb389e57d178791df8637cd12add2
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk0nAUz5DFs1jsLqmVNPEZ+OQw:9Nc/zEOVHFztDU42mLsZFQw
TLSH
T1A1858C1623E901E4E1BBE1BE89779546FA717869573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2cd74beed20d48c9d683e897049659667df39839743f9e823c5e79b094509c32
MD5 5319f4db5fd4e46e0cb2aadaba64fbb1
SHA1 f9d1be784a0189d9a7dc617b33f34951dd104547
SHA512 ea280b945a5bf7fa7a30064efa15ea3823bcbf01f37e65c57af0c2afe06336f6fe2919fc3fc6b9c274316052ebee229f6ea7ee8b868a554b6a519ea24e24ffa4
SSDEEP 24576:0TkNvNnaFeYhJNtmZBmCnAUz5DFs1jsLqmVNPEZ+OQw:0TMwBtOmItDU42mLsZFQw
TLSH
T1F255AF6EB7B846E4D1FAC6B4CD238512E6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 46c441b0a23b0e86827d060ba1f9ad6755f295cd9f939c48bd5d47d2d84ca679
MD5 4838d5b8a718235559be8db7fa178d02
SHA1 d44bb1a21cd38308dbd51e81eb4d58b261f776b6
SHA512 07e5866a458dd042c7a97415babcd11d2217e86e3656ac56c36eeba1a9bf4523708fbbca96e1982d1c57d69d1d91d090d2a6a57addcc9fdc872484769db1d27e
SSDEEP 12288:oHvUrBFrEjwaQAjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhg:oPUr+NQAnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T16405E11F23A818E5E676A17D89829609F771B8561712D2CF02E1817F0F67EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4e40fd614f5ae3d4c290946b0f5a04857c00d69dca503af30b30a25d61a4d6a5
MD5 2ef02f129412c280d092d410d41bf5c0
SHA1 5c097816b81b696f79ddb579f9f8767d16907cb1
SHA512 879306e00c6334e0408ddd3b64159fe65f03ee865004defc397ec84bd5e14893d802c7856a8feab61ec6632274d96c7b0ba969de6fbec513176e4003dcaf304e
SSDEEP 24576:fD3FHshBIYQgAJnAUz5DFs1jsLqmVNPEZ+OQw:fDVHeBIAAttDU42mLsZFQw
TLSH
T12125E17EE75C00E4D57BD1BCDA639606E67138AD032266CB06D481BA1F6BEE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/296-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/296-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/296-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/296-86-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/296-325-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2164-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2164-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2164-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2164-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2164-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2284-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2284-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2284-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2284-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2284-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2380-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2380-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2380-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2380-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3104-113-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3104-111-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3104-309-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3104-119-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3316-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3316-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3316-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3640-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3640-290-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3640-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3640-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4072-306-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4072-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4200-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4200-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4200-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4200-305-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4352-40-0x0000000140000000-0x00000001406CE000-memory.dmp

Download

memory/4352-0-0x0000000140000000-0x00000001406CE000-memory.dmp

Download

memory/4352-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4352-35-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4352-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4872-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4872-310-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4872-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-105-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5592-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5592-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5592-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5592-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5592-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download