5f7e07ac3abef81bd612ed442e1801894a5f6072c8dfc857d729f23860de0778

Analysis

max time kernel
148s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample261102-aha7jsd14v
SHA256 5f7e07ac3abef81bd612ed442e1801894a5f6072c8dfc857d729f23860de0778
MD5 71ca8b6fd4f988370a50bf932702c8d5
SHA1 f48e6140dd7c5d65bcc6f21a868c432b7f460e46
SHA512 e88ee511b90b8e6b860dcc59a905243527d1ea10adfcda212973b2a2627cc05d2e5cf7012574866d36a4339a2147ba71e9901abc01de7f8abca29a9a9cf846f5
SSDEEP 24576:6EIU58bIMKEz5CYtk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6xQ9XECnLNiXicJFFRGNzj3
TLSH
T1B075F156F7A404F8E1BB9138C9664906E7717C1A07705BCF23A4561A2F33BE15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
952	elevation_service.exe
1764	elevation_service.exe
1996	maintenanceservice.exe
1452	OSE.EXE
5180	PerceptionSimulationService.exe
244	perfhost.exe
2760	ReFsDedupSvc.exe
2012	SensorDataService.exe
2400	ssh-agent.exe
5148	AgentService.exe
5452	SearchIndexer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3792	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d46a95c227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008072b3df5e6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1e1f6df5e6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf422e05e6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
1764	elevation_service.exe
1764	elevation_service.exe
1764	elevation_service.exe
1764	elevation_service.exe
1764	elevation_service.exe
1764	elevation_service.exe
1764	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4536	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3792	takeown.exe
Token: SeLoadDriverPrivilege	4536	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	952	elevation_service.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5148	AgentService.exe
Token: 33	5452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5452	SearchIndexer.exe
Token: SeDebugPrivilege	952	elevation_service.exe
Token: SeDebugPrivilege	1764	elevation_service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3792	4536	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 4536 wrote to memory of 3300	4536	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 4536 wrote to memory of 3232	4536	2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	95
PID 5452 wrote to memory of 1608	5452	SearchIndexer.exe	107
PID 5452 wrote to memory of 2636	5452	SearchIndexer.exe	108
PID 5452 wrote to memory of 4392	5452	SearchIndexer.exe	109
PID 5452 wrote to memory of 1080	5452	SearchIndexer.exe	110
PID 5452 wrote to memory of 2600	5452	SearchIndexer.exe	112
PID 5452 wrote to memory of 4292	5452	SearchIndexer.exe	113
PID 5452 wrote to memory of 4836	5452	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_71ca8b6fd4f988370a50bf932702c8d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SYSTEM32\takeown.exe
  takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\SYSTEM32\cacls.exe
  cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
  2⤵
  PID:3300
- C:\Windows\SYSTEM32\pnputil.exe
  pnputil -i -a "*.inf"
  2⤵
  PID:3232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2012

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e1c78a8216683af0c0006c8e46429496076fe8dbd658fe034c2fb49aa4ccfae3
MD5 20114364f81275fedfded4bd80c4cf48
SHA1 3a90e8d454c4063be57ed223617ee88dea6662f4
SHA512 6b6ce3301a4220e85d35fc5bf694609b6414315b7ae9c5affab02493898dc2d1c94a179e3c6af7ec1e53b41bc625c6699da255d167e1c889ea7d2e06a41b194c
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQLNiXicJFFRGNzj3:t3q6sjB77wRGpj3
TLSH
T191D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 811b90365539da32f58404732db8300fdb5d65f4ffef544ceee5c3bf3847e7b4
MD5 fa630e90b9fbdd067e2832974b419326
SHA1 6802ad52287e7363c912d1f166383d1dd7a2af93
SHA512 291fbb603112078e4f18ead97381cfcd997f89e7f216313e621f7abda3f10072db6cee06c090bd72d4bbda7270bd2a792cdb4b949ca14d574181333f113af0bc
SSDEEP 24576:kXYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Izs/TwSfVcYG3K/cJHlnFR+IGNY:DtcOLNiXicJFFRGNzj3NLNiXicJFFRGN
TLSH
T14E65126563C408F9EDBB403DC9B28410E6727C588760EAD703A4692A5F37BD98F3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 381d94ebfb33478a6cb3150921d2649b434313bdde0ef05d9bcd8398ec9aa699
MD5 e0cd724850126f2469069d3fce4f051b
SHA1 eabfe67270f6dd9e77e5da20bd39a0dbc45a3293
SHA512 ece9ec53d02a54c7d93e82c347cd57770cb247efebdd647ca3c4ec0031df27f62a072d58613ef4bf26917cebcf12e46400c2baac5d634be16599a7dbd31d917f
SSDEEP 24576:50Le5ji0hmxxrMX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Pji0AjaLNiXicJFFRGNzj3
TLSH
T1D595AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4dbf2775950d04dafb095b2dc24d78c2a7ca79b479bff801c26ecae1a6791da
MD5 0ba357bcfd163ffd54559eea317fda9e
SHA1 5f30304f67478fb215403a1ab03e2231011de28b
SHA512 a15860afd68126616c45747181bc4e6e40b5b68bc7e1043f33ca321305a71680ac736d3275830e583d5275ad4182a768cf08803c0cc51eb3ea8c3107f0a84567
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:p/ezSC6vUzPveHjy+LNiXicJFFRGNzj3
TLSH
T1B4756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ec7f568e4a12e0144dd6e9e2f0f584f94e89c4de5c63ffec01e20e2799c3ddd8
MD5 91a36f998e13859d0787c4865ba36cf4
SHA1 1b2b8fa59b19af8bfeb6e53770e023e96daec4d8
SHA512 3cec33b0f6ce755d85d95bc2a0ea4af1db6b3f68f582f2e1df3e9f3724a0fbd26d5d7bca8a850019b9f1d0d02ab2a1f820b0b31c8eb5f4a42ca2c9a18857eac6
SSDEEP 24576:AVbqPb88hv/l+YA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AVO88hXl+ZLNiXicJFFRGNzj3
TLSH
T194559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 7a0e98041ae9061401af2133928b0d791e010edc2c511ae70bfbb0318d2cf925
MD5 512440c657f18cc75ae337e8c25e01e8
SHA1 aa4e70f0de79cd136114f5f9b0fe3d03a310ba20
SHA512 04db4ae0b91d566db8a6a738bad2adacbdfb4dde071574fbb9da9043e6c4f8fe1edca1a2ad7b43f3e19f1dfee78b2c334d2518eb4cce5cc2289613b3aa106a5f
SSDEEP 24576:ELz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
TLSH
T1245523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA17CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a0dedc5734ecf0dbd108794201418833805c4f20f595c909f37b2ada81bbdc4f
MD5 7fe9776bde7c28f21d37cc73ade869f1
SHA1 555619d5e4a84bb2fb87cf414230748e952a39cf
SHA512 87e9c6e3d6f5f6983709454e65e2ea1de18321dbc52b02ec9f081ddadbbb82589c2a1ea2d0acbd0624b204c51484ec899ce0edf4cba12420c7866983c6819815
SSDEEP 24576:4JIUo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4JIUoLNiXicJFFRGNzj3
TLSH
T1B575CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d0b093a059cea37643a078a437d7b92d20838c6604f9f49f11cd13c7ec45937d
MD5 93198e21019ee0c4a7e6b04760779a86
SHA1 eaf166d07ff20d2f941ed304fc28c4b375be0fee
SHA512 745b57499aa7460eb9a376221e2c484ae9e5b033903df18b7e96c23d6dfaa1442025daed6059bf6cab536b79a06a894e943207c767e77288f0604c7abcc6bd8d
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:+QvGAdlCEL8c/DRNw5CR7wRGpj3
TLSH
T122266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8961ee94b8e30e7336af158c92790ea0917c7b934240c7805367f1cc765a3612
MD5 7caa8a3cdb24761e54fd45a10ade4c3e
SHA1 8a15bad22286f4e376077ec20f2c1378dc6c3c05
SHA512 6edc7858a75172e0deae08ff8dde26ae45a0b5528c72f5db9a8e631f8fb5018ada96ec178dc390a23daf9f7be6bde4d28c293681a0db52dd4297e6e5906819e3
SSDEEP 24576:F0ewsAjK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ljKLNiXicJFFRGNzj3
TLSH
T18675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 473f26107ebd4a2f6a9c72e41a3b2fd2f0400a8055d1fbd587234f0555fc654b
MD5 c538301a279769f159456236633d4b41
SHA1 a6bad26c5b59a08bea8f8c9a960732455b207ba3
SHA512 9cdb359e958e380cde1875fc7aa19d54eca563dcb5f7547d29e68585b117023fc53b49ded0c275f597ab725d75e0f1d6f4056767eb38b8224ca795556d9900ca
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmF9:9UEtQevvqc2W1cpV2tI32K9
TLSH
T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 81992346ae46421f7af64cf6ce3aadb560f3e30ad30d824212b6ddf69aea17b7
MD5 952b3fa70247b7017999f70546bee7f4
SHA1 96d95cd28dc83cfd4c2aea02e257595ec680d4e3
SHA512 6f3e3bd9de00410d1749e362a225ab7fc22e784cbedea89a48b6258cd76a5301ea61154e74bb6b6852510a42d4b78446f9105dc35ee7ded4a6d8abf7c8950886
SSDEEP 49152:oCbRquA/m2yL5zifFiV+XenmE3/zqLNiXicJFFRGNzj3:BoqHVjnmV7wRGpj3
TLSH
T17FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d6b5d0477b14bf5911db321a080352bf1945537869d578e398e63dc357b687c7
MD5 91094ca96e6ff0f86dbbdfd8c52e4c94
SHA1 d43a24c6806ea61d187eb03b08ca5c756adca970
SHA512 6316f548ea6b180f4e3a57cc0ef82fd81945a52a548e2635c180edbcde09d4cdae515fb891e9b108e71441c499648b13b1c2e797fe8bd8f38f382bde9286ec9e
SSDEEP 24576:PAhGL3IFoiwtA5l7S531/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PAMUFoiq5FLNiXicJFFRGNzj3
TLSH
T166359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e6cef6f4bdbf7bb45ce816f85344ad8063d20c8f56869d7d9ef04b5b3b3a55be
MD5 7fa6a234f36718e41b1f55d9d711a667
SHA1 b87e6299bf6b324f94650af51119851f34166e47
SHA512 080cb6d0846435eae65584589481c757311c77152b6b3354a9c30589840edfc96bb0eb2c29bb294b95a9b87aa094da80faa984a31472ce9ce7200009b793abe2
SSDEEP 24576:awu4OWe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:awvOpLNiXicJFFRGNzj3
TLSH
T14F75F18632A40CF9E9BA41398657C035F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 317369d4363b0e6e0bcf591eb3382f955c955b340650e07b44dea5feaa719db9
MD5 818943ef84808f743ea7194c86d99982
SHA1 6af4284ad2a5bc7bc8b27335ce0ce20881bafbdb
SHA512 d4abfdd7de013aeb0fe92dccdecaae016b2c5bbc6e33094fc8c362a1c994c7767c77c3a1aee2525a6fc054b0211c5ab90292047f5616fa3fb10029a7e65b2b1c
SSDEEP 24576:6Zuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T13665129622D420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d51366d074b2cec1727bd7d3176e428a5fd741a3551cf09805400fe32cde788a
MD5 f2e2ca1b9ef29f3ecd7166faa283e002
SHA1 e021c305c5c11541d1887464a937fe36958a7a33
SHA512 4532d1bbad3aad554453f2f6a9b4899bdb049844a7733e82c4dd03ed6a5bac8ec865760772715947f52fc204020be2ff1e51cba899f4fc4b7f26a5c29fcc6e14
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3s7wRGpj3:2QyiKa/X+PNYF9
TLSH
T1DC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 306a4bec59ab1fdbca8a4673ceb6dbbcb9bb9edd853d6486933f4bb6182b31de
MD5 aa78d33757635c21ffbb51e79684b23a
SHA1 d2947b9840010c1cf1832d107a919ee8a477c93e
SHA512 f5ecffb557a4352dc9bc37da28180e7d426e0509d2b5ae6795d6109bf899c73851d76ead296bf0d4946a608f81247545de2b7728225cdc9358b0d2a7715c94cc
SSDEEP 98304:QQRQyi36YOcPbLvw2gAf+PN3s7wRGpj3:HQyiKa/X+PNYF9
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eb1c978d1ef6ef7f6e82fddb98f1674138bf6e44b8c840caf52273f6fc7c6f10
MD5 7dbc23296cd589136fd39e162eb02b69
SHA1 ac2a53252725d3387d4e17f31f1a7fd147de610a
SHA512 dbf6ce9fe2ce11c09681b6515caedaf4604233f9189230d4920ac328d8f0795e64d2eec40e2e02e6eda2c64f93d6e4f55b7594bc4d25cf602d022675b87e5785
SSDEEP 49152:X68Qg55nhceWu7PNU3/aLNiXicJFFRGNzj3:BthLRc/a7wRGpj3
TLSH
T1D4B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0c9b3da8bf024ec1ecfbe1ff18e5f573e693b9261f95a1ebfb8c091c35323e41
MD5 0ff74c523ec111c246e3d48b31b6d9a6
SHA1 0de24db9ea0ae604a2cd7442e4dea6ea85835e5a
SHA512 a3a349af8c0ac2a71d3e13ccc7f3cc3ab938eccf2cbee9a3f156af31499f83c023a8cdcc9044df53af4d39a89676649d9f3935da045172960fca83f18343831b
SSDEEP 98304:Ay5112gYy5azzVvt69nLKnhZz7wRGpj3:ZLIHEWhxF9
TLSH
T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 501a5dc077fda83b51d206385df29bcc29c8061d8dfb5ac5a395d69a64993e79
MD5 8f371e12d74d9b135532338460167a99
SHA1 065c93aab5097a4f6a1a3388158e0bfb090c9915
SHA512 e492e213b9b823c6a5a036ea0f0de1b803f6a0a5de58cfe13466790eea217cf4cf5cd8a40fe2611e2c281cafd89c16522908d74d4473ff0e3501160d1262fc4b
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvLNiXicJFFRGNzj3:Ju6Jmdxd2dv7wRGpj3
TLSH
T109D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 827f0e0a66f9978255ea40b4b5388151656a1b32899be0838595dfec1005b117
MD5 c8829a80699f4f62bc0d316a00fc1721
SHA1 dbb1242b8eed7683fad0b21fcb1dcd7cfd8b0d55
SHA512 91fc62b6ef483fcaacb44cf266fea1f00d1d06ae4a894a2669de52dee64ecf97ad266e4bd060b1c6239f681a685ede273ea3878504bab3126466d5e2437110bc
SSDEEP 49152:w1hpsNoJpF1A63U44CwH7R4xILNiXicJFFRGNzj3:wmifPWRV7wRGpj3
TLSH
T1F5B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 59ca9b98c70adb2a415f1378cba87c4e29c3e59ccc81ef9f118d9b11c72b40f0
MD5 af4a20ceefb2b3be8096f6032ff4a65e
SHA1 6e520e1fae65e9a79d142f385db98f4f84298e0a
SHA512 c84506dc0a7b694075593edab042158123b0971025ad93e0d16373adec86f52880ad38518db2736ecd2059bd0cfbdada0cbcaf011d39fc501113ce7c9ce2e13c
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqfLNiXicJFFRGNzj3:n5dKii61f7wRGpj3
TLSH
T1A8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6a100b299852689e2f5b3af34f5d71e84c1ce6bb7944f3650ccc7d4ed631dd8c
MD5 3af2252ed1e564b29d75a921452b4e16
SHA1 d9a5ca3a141add64f435021de5d8ebcd891d77d0
SHA512 46045e87a9def8e553adbfb07e19ca4dd81f74b08b2bb46de8bb89494293ded2b8216234214993c59d144b3e49dff1a214628b3284724bdbdd97bb97a8595249
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wELNiXicJFFRGNzj3:aX2imphJ7wRGpj3
TLSH
T1DB95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 905d51b7c655196421b8ddd9108ecf12c43a2d6be3aa71d54e385d39a150644a
MD5 734af36fc4e861a85a75cff3f7c4f5d7
SHA1 59537cfffc7c4f12d49d2f0c3db8a8b76f83b09a
SHA512 d8d9b4a7366a204d3eeaa41a8d757f121d3f4fb16bef54e8981996a9b8261387715f7b2929bf222df58a1dffb09ba8230bac5a76e126c94965204718b07fbbe1
SSDEEP 12288:KviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3558955B1F6FC003AC6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 5bb4ff328295f858286c7a339fa76b950f0a799477d94614f7660e575ae47a65
MD5 5468798adf696022967ff57a6ec7b725
SHA1 2213f9bcd7ffc7dc18b281729b8749b886aa326f
SHA512 af8885ae24f0648465b09fdc655d1b6161e20ea27d76ad7befb72004154fac794d608d46bdfc089799fcd819afde45854820fb9d70016b9517eff486d4a5b990
SSDEEP 12288:JMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3548955B1E6BC003AC6754428F5882E2DEB5618E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 b2d71ce01aef4ba3a10f17f4a6cc0d2a91db1987ed50d929c8a557ee8a8ff070
MD5 3438b4f9f306b2b4369f7462b4705e68
SHA1 6d0959cd96184b3e2dd600520258108ecf22f860
SHA512 c3131290c403ee1eaf5c6cc49aefb0d1de015b574e48b7ec6398f1cfa9cda9e4c82e0191acdbc31f470f155ecd9ae7f035ab6294d37400a88d9ca7a84cd105bc
SSDEEP 12288:ImiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D2558955B1E6FC003AC6764428F5881E2DEB5618E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3d08887aa05142bbd77e4e1ef7563f1b6e0dca6bf2f0b5bb960a3292f13a15ff
MD5 aeef5a46fea115f02a6e164cbd2f02e8
SHA1 58dc260249f2d0006cdd0ee55008ac0fd8ccaad2
SHA512 7bb6f54b78cdba191ca70c957b353b7989cc36b05984c54e7b8228ccaa8afb0549b77fcaf3ea13958c6544867db94e5c3573fc52223277424b5cc8566aeda472
SSDEEP 12288:NVJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F552392168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 5662a2d771e04b3e0083321dbea37ef0b50d0bde190ee37bdea815c4c72eb4ef
MD5 65b09a0d84aebc98c988bf3e94276963
SHA1 5aeb607b3592df60649b6ce72fb7ece8e6d077c9
SHA512 91f6fec1dad2663b8f809efc83e6cece571d44def4bea0561bf044358032702eb697ad79b969ff82d967191c56a60fdadb39d004016a5d920a20f7e33e174d6e
SSDEEP 12288:EBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Et/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1845523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 80d8fd0041fe8ecfa315cf6539e3527a1f903bcae5dccaaea6d6b31e7ebc3f46
MD5 5f7e914f2020573d37818224279b7dfd
SHA1 4c3b03a88e071856185f3ed141838228e870d7aa
SHA512 ce4d0573f18d4054cbbb70d3bc1980caeb96ebb2aeeeb0f83ce4a3dbf2d28a7937926d18beab4fc4dc14b750d5c4abdc4ebefd098277b0c36eaff9e9d6948550
SSDEEP 12288:agiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ay/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3558955B1E6BC003AC6754428F5882E2DEB5618E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 2e351ba01d7dc0fec874e280639ae1675f2fec0e0f4d331039d78823f3a4e6f5
MD5 00f8562a5e85bcac70b0099f69d2e564
SHA1 ca44a7ef56d7b3d8a98461abc2479e52dc32502b
SHA512 0c8dda8eafd2db6b955003e08f096e14964b7a48b33ce49efb789edb2acc86d4ec3d9407d290b26b5b8d4d0b10e5bc033bab6ec4a7187a73ebe898aaca5b504c
SSDEEP 12288:TkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1E6BC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9eeead6d553bc0f78b2962b77be8e042d37510f4fdc2420bbd630bdbfa1f46e8
MD5 286608ca05d5d1d80931563eb4013921
SHA1 b2c591f068bf411c6dad3f1c5639e2788bf095c0
SHA512 038f6ad78bdef7f6647ae736362c471847b6ac227ce7e91679cd10a84d9cef1db65a5b91509064f0ba89140b8a32eb0e1bc77a67889717cadc64e71b562b39be
SSDEEP 24576:GZMRzFVSOW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GZMRzfiLNiXicJFFRGNzj3
TLSH
T19B750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 02ecc0888056a30600f3323a696fc94b81bb662704efaa248bc9af00ec90c282
MD5 3926888014b058db5e77a33aabcdb655
SHA1 04b40b6d3c9af11c9fd77d742badcad0e40cbd40
SHA512 346ecb6a8d9c49686fe12a7a4e9214cabd5ca0beb9da003f338d975c3f1cdb1ed86baf233576725c059f2df3f90fad57c222f5cf88b0ed11b4cbe855b64b4b23
SSDEEP 12288:ubiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3548955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 79b607b9fc51888229b3af05a388ca82baca7486b63b14580f68fdbf724ada90
MD5 458f17f241561185d8d1dd43d3f2d2c9
SHA1 59a0764496babaa95e69f9635026584894b6f9a0
SHA512 f8cb854d01110b673cfb201a8918e9bd3881897d64cbf8a7246107864fdb17b6ab383aa7a072544044b410cd863933133c5c2d61200ee6919fdb20403d7e505d
SSDEEP 12288:JXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1FABC0039C6754428F5882E2DEB5659E3E2083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f2ca81693cd6a7d110dde388fdd783f08a18e8062791daba8ced091737e69cc6
MD5 2c34680067ea6b4d931d7d324ba13cb1
SHA1 87a7e491691b300ae90b168575055cf91795334d
SHA512 88d85b30e34949c82687636ac7e1228a8b999b9b0f2c70e637e3ef912bd7a9889db7560038f7af808d7d9c2e64ec6263bb10e3b7a0d43f969a692639a9c62a6d
SSDEEP 24576:2zy6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2JLNiXicJFFRGNzj3
TLSH
T141650247629530F9E17A4139C9620911F3717C364B208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f8b65613571a1c791ebf88d6faf6d18ac049071aadf16b65249b8335bc9e0694
MD5 cba1f7cf86c7877f0bae985bee1ede6f
SHA1 bafe8501a63718440b8843374b9533dad8a11e46
SHA512 7128c9ad0576d43182e3aec4655a85dcffe8166976633e9cab93eb7ccf43dc888def9bbc8b2f190637fdcb8a239694030fb8770d293267511745271c7e998196
SSDEEP 12288:ZbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 ce17420ce84e1c5e85096c4457e1a81ca44d337eaf3a2f4781183e0707dbbd7a
MD5 28a6092d5616dd34fee3ff67cbf177c7
SHA1 cede9005d6a323012d33fdad1b5aa12a8c506052
SHA512 d4b8d9e04f54f4f6ff7be0b5022d3f168fee3cce2ec0a5b106e1ad0dd1e67a4cd610db28dc5be511fcc9faa06b0205e300ee83a3a6dba94ea96793f1a78c832d
SSDEEP 12288:LbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1445523D3548955B1F6FC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b4b4b0623516d1619a7b680e5c238ab1979a80401c9c052699112f9bd8cbee63
MD5 33b64044a7f009623c7ffc58047c60b8
SHA1 4a52d960f524c952eae6c2f4eb98b1b1cee44b29
SHA512 c35b0a0ae3de974c9c291773268d41756662e92b321532bb2d182fb967523d5af48c1b3264e011f49cdc4059d89615cd2a35be51d8779d078373c08f6a43ee21
SSDEEP 24576:jzy6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJLNiXicJFFRGNzj3
TLSH
T197650247629530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 fba7ddfd961a5cd8e5a7f03ac61f6bb8e03b36d0d1cdd59a9d34a30769366764
MD5 b2dbfb3e7d9bf3d24662ddf346520436
SHA1 4cccb43c3e9c275d34eac8d6c8502407d2447806
SHA512 02b08702a3ddcbb5a6049ad973f137689c4de9ea95ac2515be1c1543eb2dc18476330007a27ef56f38dbeff0a2866b7370034bcf7dedb2951f037c7d51a19b00
SSDEEP 24576:vTDaLl3z0zDg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vTuLljhLNiXicJFFRGNzj3
TLSH
T1837502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1fad8a2255646c617c491ca9b1bb602488c277278bdede46f958cab0cbcc0480
MD5 94b844fe46d12eab0087d2bcb4381293
SHA1 07ea46785e7f919112bc00c77a54df6b33dae093
SHA512 8e82daa68a8b817007254462c89cdb2c1f59bd4ec5841920a60b25d923f736c44b664bddab22066354433c23644b29f23cb832d8cd639ad422b0cf891b4995e0
SSDEEP 24576:g3vd9CHKy7GZM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qvd9CHKyaiLNiXicJFFRGNzj3
TLSH
T1DC85CE90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 dbb73afa0684ff701aeb904bfa148a48ddc3039470d7a9c0959361c6eae68f86
MD5 6517cf7647663ec531d994d7ec04f02b
SHA1 21313d9a80f3f1a6c708b3b034bb88a47dedda5d
SHA512 80735c91be387a271e5d1636cb3075733a37fb33e18e28bb718eea98a87662d6a801b729a0873e97f93ded7f7efb47928733602d041969c772b33ff83dcabd1a
SSDEEP 12288:GGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34zr:Gw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D2558955B1FAFC0039C6364428F5881E2DEB5658E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 778510aa42f32ad2a18be6f590813a289f6a084ee071a46d9f8c42e178b55ff8
MD5 a3cb75f70528233521eeb8156fc0a79a
SHA1 fd3d9436db88d49ebe8ef6ee5462d5fbcabf3556
SHA512 78f043cfeecee7b4c0ae6790ca4528fda4d868008500a88ee7745f6e0cb8168f0027063a9ce0a8bce8f62863b56145bc9f6376225723afdd6d7edbb052d64937
SSDEEP 12288:foiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D2558955F1F6BC003A86764424F5882E2DEB6619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 d53997483e58cf7ea2c0c27eb72e5704bd561a96099a6b24b9e7d2b96a455da9
MD5 1eab4644ffbb03f518dc52c742791aa1
SHA1 969a5056a2b1b1d1208bcc4b5787886b9b67436f
SHA512 f2e39d6f34f5922877fd377ed3bcf5505662d17905afb83d5d790d66dec30feb8e8bdf80bbfa4bc1dca9920cce2879f3e546e372bb296ae9eb77683de0528c32
SSDEEP 12288:yViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:y5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E05523D3548955B1EAFC0039C6364428F5882E1DEB5659E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 d9305385c4e6d0cf33f1179e6aa6e057a8031cae2ab61aa7140ceae729144395
MD5 0e4886a033f4d9a024bebd094c656d77
SHA1 2a0ca19395b25ebf4094ffb3bf242c5a251f63ac
SHA512 b2e11d8eb391b8d02c6db804c027a1d827d8c6b93d0f9f4a9581ed544d7e2f0f60ab9f79947f68e8e7370268d403dd4181a1304fb4e7505f707712c5aecd4ced
SSDEEP 12288:WbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D3548955B1E6BC003AC6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 c5099c7124432cce781c866e79879518e1694e1d876158515ad3502d4a0599ab
MD5 50f080f7940ae88c0a649b3f3d9fb075
SHA1 0b6c6d0653414021c907ebfc653c3b2feef1fb8a
SHA512 8959ba67b9e62769b35b46fbee7cfc0b50125bb8568deff19218d08c826eb8d98c25e4fd27e512ccea1cced92f83f91c70891f29c1cb5279ff2b259977371e1d
SSDEEP 12288:yGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D3558955B1E6FC0039C6764428F5882E2DEB5618E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 c82ffa44def3f3b6802fc5c5a4afdb1019856717440076fe488332cc30b25b25
MD5 539da060e26210ac95771d38403b6522
SHA1 6cc2710a693d19dcddbe77a989b4595129aba2e0
SHA512 49a1387c71a4dda186f5f0edc9f17ff49f6598715f06a6941356cfcc5015365fa620005402bb7fa789d650052219f4c50273d20e2042ca169eb02db7d97796f2
SSDEEP 12288:pTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D2548955B1EAFC003AC6754424F5882E2DEB5659E3E3083D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9faa4282f2c16223957a16382ac2ddc15f9b70429815f076a0b18063f48c3613
MD5 94481fab38b582fdb89c7197c126d9ca
SHA1 2fad51d014979e8ca884281f9e7352daa187051a
SHA512 979ee540bfc8e5f093f6231c0e3663fe5a838c74fb34b2afffc92e418f0655cd03aeb2a901ffec6235619ecb023d17c4cf2a80afa1edf25e453f46f2af876f38
SSDEEP 24576:WfwvUk9RX6wkyAIT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eMnYITLNiXicJFFRGNzj3
TLSH
T15A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 619d6bec299fbb4e310a0b7f371ca8649452ac1ce247b59d05073c02ca8abf40
MD5 974a6af1a0336c34fc7f72933d1bba87
SHA1 2ed411c55bd268046742c580e795a2fba27ddb18
SHA512 90021a1ddb87b3731cd0a1950f2eae4ac7f5d916def717967253ed376c3fe02d7a934d0fff02fba3dccd84d570e6b2fab41499f9dcfebfb4ef8cb2fe131798e2
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kLNiXicJFFRGN:zySzPM7wRGpj3
TLSH
T17F066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0f09e49215e06e3c6b042b3069907e6a76fe4d93d6fd5d3b0b950bb1326cc612
MD5 9b08278035c7bd01cccdcb9ba3995c23
SHA1 a7192a8d3c73b584c463aad5ad9a5662b24f25ef
SHA512 74e63dcaeebe0cdc8b860631ab6c5bdc3a6f056b8b985aa8ea0e745e792b9b321681b5ecaa8132207882e147b527c09a393e951a77044778cd08c9b0d79bc01c
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F47JUQjTirIhCnDHUPfF/ULNiXicJFFS
TLSH
T18365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2e0c2d3e6942b34f7ada4485539d0d0e48528ae47e9bf3745ed339b18cd377fe
MD5 660b9888da170aecb1842023d072a180
SHA1 6ec8606c43bef3cf67362e928cd63d3f3029ad8e
SHA512 b4c8013c2403d8382071ad349a755d5c8c2fe978395d6fe5e79c3f872dbfb3676dd1ac08b208fcfac3dded0f5ffa66b1177e89be21c0d134caa81a33352295e5
SSDEEP 12288:0bsfLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13965F15AD28802E8D1AE5139C7564900F3637C2987E1D3CB92C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 9ba2d6b7943bc9c40b7d0c117e4517d20e1efff592eae3b60660978a8dd4b227
MD5 a673cde5290d00aabdd9ba491352e2a8
SHA1 33a9b606e1f131f4ecfc15889fc6053e715a0c62
SHA512 e36bcf8a6306c88d61769e166a229e7cb75abb2fef2eac0fc25d090dc229b11a244d6c89f1ddd4a5aca417d1d2dd6218548396abd1e1d80b6872c3a60a353d1c
SSDEEP 24576:NBt3qUPwr4iP8/quMQ3gVRoVoJOOIBjSgt+aP/:1qU4r4i0/qxQwVRoKJbIBjSg/P/
TLSH
T12D4507407626DA4FC6A940325E36D6CCA7B07D02FE046F1373C9973F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 cc21658f7cea224b2464063e9c89a3e9cde361439eb722f99f60579b51a7154e
MD5 8ecbd52874640e69ef9158bd8a1b8509
SHA1 4be0990fe105e4982f2f463ecb384649c284a365
SHA512 b0e91c495fb20588806a6af50902192a58f6dbf49311345a919bebedeb09f19ab41b388a64daf18211fa669fce2fad18f0fa4325f83b4e81f43a69d2cbdc7a15
SSDEEP 12:K2XWEEEEEEEEQobBWkEEEBBQpEEEV/lkM:K2GpQnLQPM
TLSH
T12A42C2141F044BA0CA8AA43D4E8C4F6D03A0C051ADC183C7032C00A79C0EBCC2D52A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ce0fb422e5c83bc74ffe368ba2a308667ca75f0aa2de6f80b99a9abfed35cd88
MD5 ca39bef564c73a5fe6ac2bab80df5f50
SHA1 7aead86ceb7c88fb8a5f11e1bdf500b79c5640b4
SHA512 bce526c8ff7d7e6a249ade040895c17a0fd6efd154cf32e7ffc75259116295a80a69c33606f8b3e8262e4a6b7a372da99ac3835094784f7849aeb80aeda22109
SSDEEP 12288:shlRSn9T0DOgc9C1JJ+P97E6S692t8tKhwzifeWhO3TpSywAkW3NPa31H150eROx:WlRG2xuojYc8tKhwz6hO9Ez0W19B1A8C
TLSH
T10065170065B7EB4FC9AE5037563296CDBBB4AC02FB452F0173458838986796FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 9c896e15912d51f177b417e51349cad6776f30c372a175e5fb833d87d781bc24
MD5 6d54fb533921c4dd94898588f5a4a7e6
SHA1 15742b7d65462e78272f21d9685ce7a86283bd3e
SHA512 ae19c9f318b3cbf516448d2ca9a2d3b1edd8d4c403fbe688f276d43cef9a2bd60dbabb509f51006fdadf38a47f2091be9c2d10c77bb835bf55799654508a10f6
SSDEEP 12288:9z7DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:F3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523A3568C59B1FAFD0039857A8434B5497E2C9F1558E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6d4e4c64c157db362a95d6817aa0838f4d4cf52b3fca9c4f615c05e435a07c08
MD5 39b95527d0868731b1a371117931c432
SHA1 1d4e6335a4c388ac2c653efc4f6daca75dc3db81
SHA512 d85cc2f1e2d3c29c9ac95ba9e83e14346b32c8894354445a3df8bd1ccb2bc1dd924cbbc98aeaa33a85e2042a24b537001fdd310df19af6e5ce4c16a090e8d9cc
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rgb4mBIBhGFGLNiXicJFFRGNzj3
TLSH
T13465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0a1b1d029c7e6c6fa946d0f3bb3b53b4e56c5d8a831a62a8c7d169a69e1d4e14
MD5 9f442a1a2112f790cc81afc3b55e8e08
SHA1 42364b8c245bdede9c62d370371c3cae646c71dc
SHA512 b1b819addf2f764eb596a5d8aade17f2ac38870e87b47a7224c53a4930b8bea842820b85011d2094eace15f7d110555ea710d993cf54dea954f8650cb5acfe59
SSDEEP 24576:DG88u8FpJqH1bzria7/mW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y7ZFPqVea7/ZLNiXicJFFRGNzj3
TLSH
T12E95F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 28adaa94c0a72cc33f5112df3d0f28fe76f72b8e1bcc57cafa141007659375bb
MD5 c4caec12ead17ee8723a00c946ce25d1
SHA1 a4c1827f83e5349a70cb79a5a487597da6380737
SHA512 448d076dfc57ea1b88a6e7e6bdc5345bf7239cd9e843188b4400acedad92cc7496bb647121a39bdbc447c7be4f99a8588f0b3d61d7dd9e3a3e6089a05db65827
SSDEEP 24576:KPUr+NQi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KJQiLNiXicJFFRGNzj3
TLSH
T12875F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9977a85a151806e64068147a1f87889e0e0a5a403b56708d2580bd7ae4d82fbd
MD5 c247f81cf8d272785e50ece5f813e047
SHA1 2aef6623724ea6b2e8c107e1ad65c2377838413a
SHA512 8c21157b9519eb1c8a8469c676cb3b315b4a6ca3fc8e9254f12db6a0ddf32e6c1f47353cb847aba0a83705401d67644da041d39adfc16be6e83b668cda6ff8b7
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyLNiXicJFFRGNzj3:RG05lO43bL7wRGpj3
TLSH
T12BD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e2ba0423c67b269785be6dc30f6b96232b483d65677d3128c443124305c069c6
MD5 e43d41323ee8401ddc5162eea47087e4
SHA1 2ef74a9a12225639221cc030a4536089acb76198
SHA512 60e5a0cd6384cdaf304559259f29a9587f2ab3bf0d679c4075d0dd26f417af9949cb40a83ae64ddc963abcf053488b107e6e4c5198bd83f635dc4803fc00d543
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnk/TwSfVcYG3K/cJHlnFR+IGNe8jg:Da5POZ3BJt2pasx2+maLNiXicJFFRGNf
TLSH
T19065BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 378146de35fb11df9c466d2612a9579b763b8e6612e2fc9447f53aad0be9aeaf
MD5 7486d42814a3594125e94c6403d7f6a3
SHA1 cfd93894a4df995872ea4359b2b0236f1404b298
SHA512 29c532c13d631935862118c05c670109392bc12d2c32f7e6eafc8c918dfcf9b2a647138e8a36b10e23e2d247c94117d2b3d0df3e69b69b5e140175bcb370cf86
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7Fk+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/Nc/zEOVHF5LNiXicJFFRGNzj3
TLSH
T149858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b238110c2ef1033eaabb34f76fc1513987f7c2fb4cea672533ed38f261bc756
MD5 a9ef1ea0a7868915a10897e980cdfb93
SHA1 fbff9b224da1b7e622043009cc234b339e5af68a
SHA512 639c56d9e41c06241092bfb3a197686c7690b4672d639f990c1e787f753d2ad0eb35fd0b99dbc36ecb715503fab8a880efea7642d23ed7dca5c9c66d27bee399
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vTMwBtOmzLNiXicJFFRGNzj3
TLSH
T17355AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 eee2507e942243dc392d2c19ffb2fa1468c3f77e324bb4715ded9c062797c493
MD5 eb06f4d31a5f1c7339b7589e6912d0fb
SHA1 3c847aaf9e3544c50b4514b2435f8b687de74d17
SHA512 4b70781313b9f822ad422f371901ad340aedf0a490809dd36f69181bf0f73a00b4f5248bc483420473ab30307e0b5bd586f4eae2616937354dda86161f46f9b0
SSDEEP 24576:xD3FHshBIYQgA7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xDVHeBIAA7LNiXicJFFRGNzj3
TLSH
T13185E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-81-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/244-313-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/244-83-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/244-87-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/952-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/952-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/952-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/952-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1452-58-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1452-283-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1452-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1452-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1764-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1764-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1764-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1764-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1996-43-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1996-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1996-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1996-56-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1996-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2012-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2012-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-317-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2012-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2400-316-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/2400-117-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2400-123-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/2400-124-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2760-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2760-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2760-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-332-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4536-39-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/4536-0-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/4536-3-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/4536-8-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/4536-7-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/4536-36-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/5148-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5148-136-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5148-139-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5148-130-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5148-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5180-70-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/5180-71-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5180-77-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5180-298-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/5452-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5452-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download