45f5bdd9da1c2fc60ab93c4780cf180ba5adfda1f7b8580087efdae93bcecee5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample261113-ver14sys6r
SHA256 45f5bdd9da1c2fc60ab93c4780cf180ba5adfda1f7b8580087efdae93bcecee5
MD5 1631d96ed8f58b705a736d294204cb78
SHA1 1f8ed4233f5fe2bed7261e99a0351269065ef6d9
SHA512 0f46644d26df9f84f25ff63c89bcdf85844863b73ad69ab7f54442b4234fbb4751df5d6190412c2284a9fe00a99428e54da3803e0571e30fea9ce45415842792
SSDEEP 49152:9UVaItbsnUaFIn+Er29ac5EVyq6rQKUTBgcVHVHfYK2YTkVdIR+ft983Dl3gEe8H:kqGTB5tR+l9EDl3VxA+
TLSH
T17A167B47E7B940E5C0BBD13D8A579657FAB2784A877197CB03A0861A1F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3340	elevation_service.exe
4080	maintenanceservice.exe
788	OSE.EXE
6056	PerceptionSimulationService.exe
2420	perfhost.exe
5980	ReFsDedupSvc.exe
5096	SensorDataService.exe
5608	ssh-agent.exe
3772	AgentService.exe
5376	SearchIndexer.exe
1148	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\572d016d67fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	OSE.EXE
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007799a1f58f73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fba08db48f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d39e7b68f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000053be0fb58f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000648290b38f73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
788	OSE.EXE
788	OSE.EXE
788	OSE.EXE
788	OSE.EXE
788	OSE.EXE
788	OSE.EXE
788	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1044	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3340	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3772	AgentService.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: 33	5376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5376	SearchIndexer.exe
Token: SeDebugPrivilege	3340	elevation_service.exe
Token: SeDebugPrivilege	788	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5376 wrote to memory of 4884	5376	SearchIndexer.exe	99
PID 5376 wrote to memory of 6068	5376	SearchIndexer.exe	100
PID 5376 wrote to memory of 5808	5376	SearchIndexer.exe	101
PID 5376 wrote to memory of 4316	5376	SearchIndexer.exe	102
PID 5376 wrote to memory of 4860	5376	SearchIndexer.exe	107
PID 5376 wrote to memory of 5828	5376	SearchIndexer.exe	108
PID 5376 wrote to memory of 3696	5376	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6056

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5096

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 154a10c1af697e040323c8d443ad2479b20a3516ef7fb4ca81b875c7050483af
MD5 5a2a9fd8ab76b2faa4dde347e16fa1e5
SHA1 5aedafbbf02cd1f2ae16041181669953e75975b7
SHA512 b63949670cb98ca5d1408d2c8f06343d0dbb6612278427b78f381039517f8481229d38b713f590190d024686bd3d811780a46752e34338198307a9ab49779198
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMR+ft983Dl3gEe8xA+:h3q6mjBjR+l9EDl3VxA+
TLSH
T18ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 776ffb3c9bf2d0350b20a8f8895582c471c42b28716248bd65688a217a9e9825
MD5 210c18f266c0659ba77ddaa2b64314de
SHA1 3a4d786ec77605ddd53eb90b923f9282d79327c1
SHA512 7289944ab47dbd18baf6e50dae74e82c09c799c2d67f8adb3314b9089e37b470e8298c0f991c76fdcebf15d2fc31cfcb93392d167f0c8192001b0d1729ea4243
SSDEEP 24576:pXYfDtczABRPWxNs298r3OCDIjG3gE9ow+8xA+:MtcER+ft983Dl3gEe8xA+
TLSH
T1FE95F1287B9408F5ED6B817CC9A28512E633BC4547A4E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 ec9be54604afdc90ab03681450a1142eb34bd40d82474d0d03af7fdf2752585a
MD5 23d7dde62559e717e6b523683faf4ee4
SHA1 748173de058737ea6344865bc2c1a461bf6e2ff1
SHA512 4e159d2956fcd2b05cc7abfbc74ad3a5555f32078707d8d5dbe35a46188021bdaa138cf068130be04b6d3472c9f5383df7736def8b8cf1606bd2a8c9698dcddb
SSDEEP 24576:30Le5ji0hmxhrM6RPWxNs298r3OCDIjG3gE9ow+8xA+q:3Pji0AznR+ft983Dl3gEe8xA+q
TLSH
T13BA5AE16F5788371D073C0B9C5D2A69AE97230861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0a003f33903cdeb14f49d98ebd884ed20412099b7ae2ce17babb500844d516f1
MD5 51e76d4fa45c9329ca203732147fe7c5
SHA1 3bcf347626aa92b6ced81d346e2fb1c1e8f820b8
SHA512 0fbd62dd38c037095c8193826954474658273f18e1623e8fa22a7bd315354d9d7e1981aa2ae77e89567337d2b93ff2d7d61ee01b28fee9222368d5acba4ba2d1
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyu0RPWxNs298r3OCDIjG3gE9ow+8xA+:j/ezSC6vUzPv+Hjy7R+ft983Dl3gEe8H
TLSH
T125755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c1668bc92b0b0da54716c5fab91af614949a5c5370a772009c2afff98b6e6bfe
MD5 37f4fbeff61145d1ac8bf025f32b84e9
SHA1 e3c34f71a0981fc190a68f2dd113dac30534b6eb
SHA512 97f2739f0c57d2a2b35b04790e8389f0ccc84ecfe2c4c096b146e5b878bff50585b64bbb1dbba3c0968106839e4f60b64e3fe3035886f7fbf8bfff7118533455
SSDEEP 24576:IVbqPb88hv/l+BdRPWxNs298r3OCDIjG3gE9ow+8xA+:IVO88hXl+HR+ft983Dl3gEe8xA+
TLSH
T16855AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.6MB
SHA256 e090cef248d3228c954240042c30b73e5643ec485a903e85dc688c5df9406e70
MD5 ce753ec0da92d59e26dc9a2d803a444d
SHA1 6875dfce14abdab424ef814f381844a8f296ff7c
SHA512 d6aed128cc7948001a2395ed6b49606027f294f0ba399a0033c983c31c1254599b9038850d540d2fd380c27dbe7e0beec8e8ac9a992d742bf7d72fce2eb6d61e
SSDEEP 12288:zGGRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:zGGRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1937523012C0C75C2DB2F81F9998AF0E2A1339D4D38F929F3D461AEA1AD7D25ED980177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 7b8f6d6156df5ea105241c6ad5b64e52e58eef148a07fd18444ec54a9e55e26f
MD5 d27070f522825bc56d887861836f294e
SHA1 fbf289153a311693a8e90d6943b49f5a6cab31ef
SHA512 ef66dc2bd31308c396e7e529ea82dbccfc9bb64ab078caa75a8613208019b44217d0a5a14d2c835d9d5a7f2ef8ffb3b35bb555a9489e2eef5e3940e6c77aad7f
SSDEEP 24576:zJIUlRPWxNs298r3OCDIjG3gE9ow+8xA+:zJIUlR+ft983Dl3gEe8xA+
TLSH
T15695CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 95c6989b6da98919716e3891a81495202af54336e0eea849c582cb562b0b18a0
MD5 a9b9360c6b5ee8e0150f2dde760462a6
SHA1 4b2c6ddeda2a426d673e946234c595e74c2aa50c
SHA512 9ed53356a056d63529a5cb66aecb3c9712901b4139d7ba0160c032b500d9d1098958dea01f536834b09021777a333cd30f062ad6ea238114b3f9d5c750bf8ef8
SSDEEP 98304:sQvGAdlCEL8c/WRNw5CkR+l9EDl3VxA+:RvyEYc/W3w8k4sDlF
TLSH
T1A3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 07a794649cd7423b6bdf40e0f18035e8c030cd61cf9b86c158de8d962cb76e55
MD5 32c14a6be2ab31069eff849318d89085
SHA1 5b8cd20149b7d06c7f5bd6121d41d2451bbfec81
SHA512 4714e3a42ff421f3a19f7e0b15d9aa9431a04fff9c3e70c5c170366ba052366af67b3704770801b8c8cc9c6ccfcfddcee582a09776668d2740d419340a06d429
SSDEEP 24576:qfewsAjXRPWxNs298r3OCDIjG3gE9ow+8xA+:QljXR+ft983Dl3gEe8xA+
TLSH
T14695E031FE74E032C77F0DB61B26D716543D79204BA12AC3E3A88E9D59342D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fecdaacdce91141483854df67e0948f698ed8c6d2ad99b5c69aeaf5d08d1d9e7
MD5 e34cdd2db49fb0271ac03ca5d6925f24
SHA1 55e89d08b21f794645adc0b0ca511142ae2f012d
SHA512 ecfa17699c057b341419777e097c7936d8329d59285a81bb05b50e9e95cb609aae66c3e6f3477d0ac6125a1c6df3232f41d3dce7f6ad8544cb2cd6b061afcc4a
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHP4sDlF:YUEtQevvqc2W1cpV20I32z
TLSH
T1C2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4a6773a65986c822f34ccd3e2c7107fa27a0d742a298c196452fb8721ac9bdf2
MD5 a31ce0034b4f53eafcf37215803a4388
SHA1 f5ed7fcdec41d99d24f1acfa0413c1d42aec8e29
SHA512 aeb15a706a87da8bb7d61666c968d8bdb12ca2da67c92828f39ef5e94ebf123d3ff9c3989dccb7a1a1cc7274e68134e12574c0a26ca42bbd9db07613ff046494
SSDEEP 49152:SCbRquA/m2yL5zLfFiV+XenmE3/z3R+ft983Dl3gEe8xA+:3oq2Vjnm4R+l9EDl3VxA+
TLSH
T16BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 97120d67f9093645f6c9cf2d515917eec1ec4fde80d1238d8b73edf416b2b249
MD5 271f830133e8de858945cf4675f566f5
SHA1 fb65991250ad3cd62f6dbe721ea4d9e68cd1c94d
SHA512 708094b1f84600f4d98ed376bf84c97c26d26702aeac59c2cf09112291c3bd2fafa7d8b75b427a45f5dc14b268cd29cd243f35054b9ea8d01749a622f866c06e
SSDEEP 24576:qAhGL6IFoiwtA5l7S53YRPWxNs298r3OCDIjG3gE9ow+8xA+:qAM5Foiq5oR+ft983Dl3gEe8xA+
TLSH
T14335AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.8MB
SHA256 c5ffe3fc5ca5a46e759385127ef9bf23297a5c25617560bf0f4a636f2a038105
MD5 1b62cd92d96b48d2160544a1ce1f5a97
SHA1 68fa7b4ada0be114304af49d5a3877fbe1466ce2
SHA512 8eccab5cbb625d944f0052710d2d3e5af05ce227467a3191765accb643a4caa0aa39edee85013e5f959ef48d76496ff52232058bcc95d0d609b01da09bb0b744
SSDEEP 24576:OwuROWbRPWxNs298r3OCDIjG3gE9ow+8xA+:OwSOcR+ft983Dl3gEe8xA+
TLSH
T1FC85F1453A981CF5E96B8178C587D132F7B3BC022A65DB2F4760C65B6F37321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 2941a07d6852650b3ef19450ee775922779aa7bf36c75de40dad05a09601a8ce
MD5 293a338f3247b6aeab001f1ddb5da846
SHA1 87ba251e9c5529ca9c3377559f7f6d1c92d6631d
SHA512 d97694b11faf548374e51c43eed00628e3868551fe6ad4eccc8c0ff3da4a35e164794abdef55fff5971c770c5cb9ef915cd3ee26e239517b2cf229e873786d62
SSDEEP 24576:7ZuiRPWxNs298r3OCDIjG3gE9ow+8xA+:bR+ft983Dl3gEe8xA+
TLSH
T1388512493A9830F2D66B81BCCDE5A141E373784627B513DF542086A66F37ACA9E35333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9d7edb3d2a0c495a2f9eb2627af229f4ab1b58a233303fadab6db04381442c2b
MD5 800caf2ef65c2fbd5df3fdc40134db17
SHA1 6bfa08d9620f9606aa4d3e3ebb68a760b02c83b3
SHA512 dc3440296c845a40f72ac6bb46cd12d88d837213cb4ef61c0996160bec5a8160b64f292a30ac496ed570da97ed4184bfce98f05ab0525fc946304483217ead5b
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3pR+l9EDl3VxA+:jQyiKanX+PN54sDlF
TLSH
T110667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c0a82da1441bae01806033d486fbd309d084fe60654c8d6a0b2928adc19ea3ec
MD5 d459d3dea14d94eb85732724cc696d64
SHA1 9a9fa88bfd951b39dd90c4753c4626cc34857d45
SHA512 523cb3255720c3e2bf40951773bdc3b2e2b7b411fce9a4373cca0ad7fca6a59c6335da8f6e20f0de9297070328a8cc8e9d945ea49985dcc8e81743d09c89286a
SSDEEP 98304:LQRQyi36YOcPDLvw2gAf+PN3pR+l9EDl3VxA+:6QyiKanX+PN54sDlF
TLSH
T16C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ef27da0b1454a88a2a49aba862f0c272c704ac9192eaa091f197dd85e1fab526
MD5 c128156e6badf04ebf26136677a83dc4
SHA1 b6f40a7c81a0c20fc67c16959ec7101f5429395b
SHA512 0154f7545efec20514519fce26b27f6afc366e03f9e98bc00146767f9d0ba6470c58e1b9f4db4a7af10a43fbb393bcd110d5d3c75ce3d65eaeb7816f7d70a439
SSDEEP 49152:F68Qg55nhkeWu7PNU3/nR+ft983Dl3gEe8xA+:TthTRc/nR+l9EDl3VxA+
TLSH
T13CB55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0ed6fd9e21da686c5a7b57e84b45a9fd2a691e4e2e2e629c129730bcacb1a966
MD5 dc4e05980e4964b832b8024dd977bf79
SHA1 05a96fc3809e684cad863e07db3d013bfdfb00a1
SHA512 d3c934e082a732344670d1e1e51d51fa3fc6d7841654e12f569e47546e2e3a356e0a6cd699dce399885db28d053eba8bfe95e6198dd23dbe77eb0fdafcad097d
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZGR+l9EDl3VxA+:eLIHRWhQ4sDlF
TLSH
T182167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce89efc4123487e67ffb875ebf80ef9b49bc58b9934e900e86fb60c81f827d73
MD5 29c1197623b98b03e4382ecebccb2cd3
SHA1 c9a25c12442635a2fa6edd67f46c1992e316fd3f
SHA512 ade431f21d679f7311de88cd06dba27313793a558b7508a7ee5ebbaed48d1845b145c68b1e19a75a4a8a7f1c530a1b2c56943490ddcc76d8714cede183f24452
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCR+ft983Dl3gEe8xA+:au6JmIxd2dCR+l9EDl3VxA+
TLSH
T1ADD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9462b3f7874659317948ee732ce01df44494dae652b45c3712e7a939cb092200
MD5 68744d1fe5c1a93a4361d9733eb7593d
SHA1 053714930cb7dff012520933a448fe0e7dfaeece
SHA512 c52e14eef62ec02dfd76d4f6b594d6b6f2852a301a952911b3575c86e77adcd26ecf6bc6c4a4560d02e32b909eacc314c74a3d3b8f8d332f914dc2f5a5adad32
SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4xFR+ft983Dl3gEe8xA+:+mifPqR4R+l9EDl3VxA+
TLSH
T10AB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 30c17897ec1e9645e15d785252e21a4fa9df53ea16a9f956b871b05e273a041b
MD5 abab94dbb37b82ac6d9d4dda1378e5c4
SHA1 303d0d20e9d8945f3861f49d1bbf3255d2671e62
SHA512 821fb7f01f307b261bc309e9800ee6286a817c944c3e9145b7dcde1385704f310dfdb0f3009d2ec6ccdb0e75bd4ef27009d4b9e53de5b8bb67ce0bc0f62155d0
SSDEEP 49152:ASuZQIY0Be2KkRVtOnks6NMHqiR+ft983Dl3gEe8xA+:a5dKqi61iR+l9EDl3VxA+
TLSH
T135C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 342265a51eef8d555cc76785fee454afdf5a71aef03986826d2cfeca920e9805
MD5 7959fd6041b2eb4fc291bb5877bf858a
SHA1 97d1457a54ed16eefe2e9a33ce42fa2823cafc76
SHA512 dd6c7ce8e1d6112b7e525d7e1346f0aea795b52910d6bae7cbdf3f4bbca017c568b819c3049853101bd0581f11a159715bcc392719b76a2cf1e9107d2931dd41
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wBR+ft983Dl3gEe8xA+:oX2iWph8R+l9EDl3VxA+
TLSH
T1FC95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.6MB
SHA256 b76869f505502c9527404490d35c406b98623792051d7482601d04989a1f8661
MD5 36e95e550886a780b477a26d64556232
SHA1 01d65b5d8496d5c886dc2ab9e3dcf12a512179df
SHA512 4543bbf96776d075e97187ff23ad7697c6f2452ff4cfa90f774e92c95fe42007753ad0b16d21041a3c8bcfe623257d1c4f557b8610aae3dc0cde05c0418a43fa
SSDEEP 12288:CORPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:CORPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1787523003C4D75C3DB1F81F98A86B0E1E0275D4F78F925F3E4618961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.6MB
SHA256 d93372178a6efe38c74d2f5176cd20fe3733ad74eb74b6b3d5df42a9d171c06c
MD5 d7d2b7499f4bf0862b87e9ccff5041ae
SHA1 a0bf42db8370c2c0e515c3e43ee506e908c88245
SHA512 cdc05a623feaac24a12d0927ffd45812f96a678092fd775068c99cef20b0511e89369b4892e45d85ef39e37fc4a2532569540ea15e528d130e0e49a2e959c33a
SSDEEP 12288:0zRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:0zRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1507523003C4D65C3DA1F81F99A86B0E1E0335E4F78F925F3E4518961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.6MB
SHA256 00b604e2d882772a95de10921d3d891f34558483e8866f8b0a1581caa7c65770
MD5 2a2f8abee09fafb2242f0d826f21d4e3
SHA1 613233adc9e8641c3cdf98a5f77613148b270524
SHA512 24b0adbc262bbac8f801fbcff7e4e532976ce851639cb31d0383572a2293c415116b0f5a09ca1bbdcc9fec4952b6dffe1f5ffb1c65c594c0abca2668472f8af7
SSDEEP 12288:ztRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:ztRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1CD7523003C4D75C3DA1F81F99A86B0E1E0335D4F78F925F3E4618961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.6MB
SHA256 5250963ada76929ae6e000521197827c2addd3e289cf05c23f5a1cac71bf040b
MD5 32119aefe4723a6db7dcd559c0cae266
SHA1 f4ef1757dfdc114f154dc34dbb28501e79142ac7
SHA512 a2e66f4e1c8359087a53d16c8b590b7b2960fc538a43468323e7811933a28339a06d82006ac7b979faeefccbb0410db9dd701b92324d245a6b35bfcc240c98d8
SSDEEP 12288:NV4RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:wRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1597523013D4D21C2D92FC1F9CD86E0A1F233BC8E79B626FBD41049625E7639DAD60A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.6MB
SHA256 995138cc9a7d77ad7ead410bf5bd60307f67db21fd82e8b48741c32c215c4f8c
MD5 f305188d3c55957dcc502350bb695a7d
SHA1 914cd585dc528269646250a4c86ae9b1221f34c5
SHA512 3453d077aa382b328a772fd2dbdd325c5140ae1ee707d3f66841f23f6a0a527f9586b54c525e903e20bf3f793a9ba641aeb5dc53e1c008f4f47e6f9958ca6132
SSDEEP 12288:XwRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:XwRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T16A7523003C4D65C3DA1F81F99A86B0E1E0335D4F78F935F3E4518961BE7A65EAA804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.6MB
SHA256 3d6265f7fbd136fe2f08e6d736f72b80c20d278f5a19283e371aa11a50bc16a9
MD5 019c8a5b4d06da9c6d737b5911a2e955
SHA1 f69e9a6f6a83b3382d6e88962a7727883dc494a4
SHA512 d0a3ba4c806f46f48c8615db5a250bb760c72d9bc93e74473ed4587eeb97f8f54eec6e7d73eea6a2aaf8e056e24359f98eacd94c01b0ba582c62709754283f4b
SSDEEP 12288:H/RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:H/RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D57523003C4D65C3DB1F81F99A86B0E1E0335E4F78F925F3E4518961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.6MB
SHA256 f3ae25e3449cd80e41b8615d1acfb8dfe1de3dce1ece19f48e035064a8cf2034
MD5 b846657ea5e5686856a01b36dd68a5d5
SHA1 a3f1910b91d92a8ce47c9fad066490c40e4eb02e
SHA512 fd2e5fe7bff68681e462798cfdafff431e1f1ff79149a755dfcb1ef3f17e15a4dc819ee12775d653926e692aa697db79b8bbfa5c326831766a0590414ad5bdde
SSDEEP 12288:KrRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KrRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1667523043C4D65C3DB1F81F98A85B0E1E0275E4F78F925F3E421C961BE7A25EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 cb8a388a15a144a1cc1818d4b83458bc4abdfd91dcba4074a74bc4ccdee6f6e5
MD5 b238c93f01e86aab0722da93f0bd2d9e
SHA1 1ec100a41c0173d4a6f997021ef950971d2adbc4
SHA512 8b39323e003d54da18d4a70ffdb7fef661621f7d5e5c8a5e7459d9a22065567a3d7e94bc111a7f01b0a488fd8c28019f0043f6d645c509c22d48605c082c3c6f
SSDEEP 24576:tZM3zFVSOTRPWxNs298r3OCDIjG3gE9ow+8xA+:tZM3zfvR+ft983Dl3gEe8xA+
TLSH
T1A3950194779418F0EC67817ECD559912E2B27C4A1AB0C66F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.6MB
SHA256 ddd7c50afb77abf2c632ad177732bb5a2709e4e5907177eb919cbcc046d7100a
MD5 04a825c67a64ebdf917afe431c600118
SHA1 8f80ec6d471e76764b1dacc5d505e8defe5eb419
SHA512 28c5e95d80c716574671b3b337da1f16135d44a0f656f336f3bee15e74ff8304de1f9b64b516d81c4de3dade8cbdf0f8f2f9c72ebc521722095b9b597affd9b9
SSDEEP 12288:lSRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:lSRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T19B7523043C4D65C3DB1F81F98A86B0E1E0375E4F78F925F3E4618961BE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.6MB
SHA256 909200791b6651e06cbee0026fff8eae62c57ca8c6155a0895231bf12dee8618
MD5 acad1d97fb7bff8b8b166efeb96cd188
SHA1 c6f514b45874d8dde787eb37e7b663ce97cce9a9
SHA512 c7bda195790f093b1a7addea6878a1751d43290ac73003f79f27ca478762baee235aa9dbb160014b8ce168f6d4e5c3c6555e4ca07bfcd3342c558611977d8c31
SSDEEP 12288:f2RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:f2RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1667523043C4D65C3DB1F81F98A86B0E1E0375E4F78F921F3E4618961BE7A65E99804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 5abf3982617488e49521eb28f1f90bc2cdb246a607ace793c77ead8f109d0f5a
MD5 bbb9369a417baf751cf017cf8be588dc
SHA1 3096eba04b1bf176b777c7177e8b3da34947585b
SHA512 1aa94523602bf12848bec806083a8c629c8061305d12eca29a9799c9501d36142bc34baa4108cd9ab88fc63ef7dba2cec6b2ed99b26e8856ed635ea59ee0ac81
SSDEEP 24576:lzyHRPWxNs298r3OCDIjG3gE9ow+8xA+:l8R+ft983Dl3gEe8xA+
TLSH
T1518512073A9930F5D13B8278C8921952F372BC361B749AEF526046722F373959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.6MB
SHA256 ebe377fc4273211058b5782756eb79d20371946eb88bf4c34efce842d343e906
MD5 6e7a2a05cd5f8d8ab3e7f9087bb50529
SHA1 97ddd4d917d4354b5b2461bfc670dc6292a095da
SHA512 c4026dea2fbf6024b5b7886710d2e9a6685208493dd5f56508b519ef01adc6f422c97e93286579cd12a57fc5f3a658c63206c3ac7da836014f16d4702169b2e5
SSDEEP 12288:WSRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:WSRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1417523043C4D65C2DB1F81F98A86B0E1E0375E4F78F935F3E4618961BE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.6MB
SHA256 22530572ad3f09d200e45f6ffa04fbb97b9692254eb21fd805eb0105285ddcfb
MD5 299e28f6d1fb5751f9527c79bbfea666
SHA1 e4432815558c7f1d648c8c67a77b0861834f1620
SHA512 65dbf56887b09bb57a16b0977714dd2bee73b7db3f6ada491fc345d68cf0eb27e2af2208b7b8d3c1f1a830b8d3eeb36fdfcde1b7ea7bb4655c4f5cb94b09fd87
SSDEEP 12288:2SRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:2SRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B27523043C4D75C2DA1F81F98A86B0E1E0375E4F78F935F3E4518961BE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 10f4f27b89818aa0fb36c9abc874383479c5e54c695d0bbf3819dc8d1cd86d7a
MD5 82c07f3f2be1cf4aa944b965086e2f11
SHA1 6511abfdb89ff3eaca8c158e6ebeb5e37d106463
SHA512 d45eb167202ace4df404e8eca8d0e0ecea9c6f540c2210235eca15787b91a0254add58cc357d100f8277a88b03f782641317636a283ddeab12ea2862cfd50cdd
SSDEEP 24576:YzyHRPWxNs298r3OCDIjG3gE9ow+8xA+:Y8R+ft983Dl3gEe8xA+
TLSH
T19A8512073A9930F5D13B8278C8921552F372BC361B749AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 ee28d194d54591376eb7b1116ecd9d836ea0b8b1f5773eecbe4a45db52b814d4
MD5 d9a076941be8a58f5642cad70f635053
SHA1 5303e34894c60246193e7c21e4664e5c5c79725d
SHA512 dbcf8319b5ef4d289150d92f2b5c5094c619bcf377340c72aaeadc31a99d994a2ccb959a50abc8986e54e0c00377ef82d4d124762d20adbf915a1029edf3b680
SSDEEP 24576:UT8aLl3z0zD9RPWxNs298r3OCDIjG3gE9ow+8xA+:UT7Llj0R+ft983Dl3gEe8xA+
TLSH
T152950194B75418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 c576b37c9e4e8073f2ef5b7e23918b2fffa9f1d99fd5fd323e65dba503297d21
MD5 6f23081123be656290454238e1601f0d
SHA1 04c2622073a1685f423a4b3d861e0ab06c131cda
SHA512 00d12c7b61e3c6aacdd5ed19c3431c5851c27f70e267beeb03e647b489796d8fec77b73850c1695559f36d7e6e147d3ecf405281539b9589b8b636e6c469158f
SSDEEP 24576:S3rd9CHKy7GZJRPWxNs298r3OCDIjG3gE9ow+8xA+:0rd9CHKyavR+ft983Dl3gEe8xA+
TLSH
T106A5CF90B7E810E4F0B78A75CD669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.6MB
SHA256 1993d8ed9de4562a54419c1499079af8567be7dbd6e4b5c51cbc31e8c5f40a0b
MD5 36f8b9de2034bd141b256b15ee614bdc
SHA1 77ea6301f5d3e0d060a5140b8574f802660d3abd
SHA512 4a8c4874174200f7d892f6d027d1b9aa02c2b8d7c7e9f255b2f59770bbf4496dc005080c12c2cfcbc43e3f13b6bdcee4d67e0654a19d41229c90e30831c56ef9
SSDEEP 12288:sNRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:sNRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T10F7523003C4D75C3DB1F81F99A86B0E1E0335D4F78F925F3E4618961AE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.6MB
SHA256 3fb4074288b4f5aa25d45b57a1d9f01f9553cdb1211ea83033b9aec2599ab636
MD5 ff9e7fded2af6d8a7bddf1090987455e
SHA1 495b3d5c5d188ccc716fc1535d220c8cd334bd15
SHA512 5816d4f4ae6f3a577e54f4080e8eb6a40fa62762846afbcf0d015028df9dfa3a9150f71ae437674f64c9c46197bd4fc5a2fb408f6b8fc6763b42853414592ba2
SSDEEP 12288:1nRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:1nRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1AC7523043C4D65C3DB1F81F99A86F0E1E0375E4F78F925F3E4618861AE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.6MB
SHA256 b712e88e8f6a059151eb302316794c2a76a8788039a311e0d3f8a4746dcbb6c6
MD5 1af95aa1f3138e97ea5fd3699ba7262c
SHA1 d0802dc0509396bd86489ac898c2bd948047399b
SHA512 2d1b3b8367317f0263431945f227b2c66fc140fdc83b592d216256ecac9a38930aa8619ddb39625a3bf878139ebad9f9a4cbc2c67d40c064bc5794df9759338d
SSDEEP 12288:RsRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RsRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1647523003C4D65C3DA1F81F98A86B0E1E0375E4F78F935F3E4518961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.6MB
SHA256 03ebb2159098ab8fca2dc473a11e496d245eb784bcb31a59355837ec67920af4
MD5 38598dc7831e9667b17aacdbddf2a431
SHA1 acc92b4cd8d933a5beac9a8cd05d9915bf006354
SHA512 b707fc6ebf5d4ea6ff220e845045647e9caf9b0d70d6e85454d6654fbd962e242cea63f3122b99a075984c869a078a42396c3ebefb1ddb23239503579724fd79
SSDEEP 12288:uSRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:uSRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T16D7523043C4D65C2DB1F81F98A86B0E1E0375E4F78F925F3E4618961BE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.6MB
SHA256 bd9ee90511ee17b61f741badd6c0f08b21188c5fec161c585c467d9f2f237e12
MD5 c900661525fd70af756f544c9b2e09fa
SHA1 f737b95f48f1e63bf1f251f096e173f2af89a2e6
SHA512 6978195cd612c85b256b1ba8124c7b5e58d2773aa9f4a3f09b4213e03b93558cbe4a7279440e1e7c22b451b00451f48cc0fd8af283f1155f163a92d1f32acd74
SSDEEP 12288:HNRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:HNRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1727523003C4D75C3DA1F81F99A86B0E1E0335D4F78F925F3E4618961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.6MB
SHA256 8e5192b92c0b1d217bb6f201f86d582cc52aea08e332459fd498320367a5d441
MD5 fa9f2fcd4fee5d698ad058c1e9f63bc3
SHA1 671ed0db854591d73ca4bdfb6df2cc7564a78e41
SHA512 230fa367192e050525471e558519b31024ab5b6d389e4186cf8676383d8512abf6542c0785afed464cbb51e55fe9c59db8d4e55349c2300acc0d2cb78fd34240
SSDEEP 12288:DKRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:DKRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1CB7523043C4D65C3DB1F81F99A86B0E1E0375E4F78FA31F3E4218961AE7A25E998047B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.6MB
SHA256 23cb491632bc0100cae3348ab4c8939957786c9c7f139695fd938449c9e23b1c
MD5 48d5d699a8307473959544e900daea9a
SHA1 9d0a8ebd4bf4614b8356c289899e26ec1ca84d95
SHA512 d68bcfc24b5830ec4641956b4e3e7303ff57c60fd2f3b8190b4961f94d4b5fc2777f8e6d6fcf251400e4c6926412da8f622f3dc9d28471de08f58878b15a9215
SSDEEP 12288:gwRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:gwRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1F47523003C4D65C3DA1F81F98A86B0E1E0335D4F78F935F3E4618961AE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 3d4381db07e72aac9243a1e79b438455c961deae14574c0fb1c8bfdd76a0ae46
MD5 e8136169fe224ab9c709db07f53d7c95
SHA1 f54559e89df5d3e56af69a42f77e46c7c0f5f92c
SHA512 6cc2dafd21bdec9291143ab13bba4445f2445ec52a49b09e1a7ba3b0cc10d7dffc9dd362d0739ec1636816bed0400778aa508f01f58dc043e8a8cf9fd98826f8
SSDEEP 24576:vfwvzk9RX6wkyAImRPWxNs298r3OCDIjG3gE9ow+8xA+:qMnYImR+ft983Dl3gEe8xA+
TLSH
T17FA5DF29EFCC44E1E177927C89A7460AF2B178591B31C6CF029653AD0E37ED4AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9d21373df91235987ed359114c07ea69f9a3349526479462bdbc64686706da1e
MD5 4ae91b6556d163940f7a4235c00c8ced
SHA1 0fd673fe0c59f94d353ef346d238fa93a799a2b0
SHA512 39436cc3d0ef355b28be4def82a38a87d002c85ddf841ae097a6054573727c6964c2a16e5fa40dbade20eb894f538bbe2e7216a88c8391b3a1da22333c4cfeea
SSDEEP 49152:SYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hR+ft983Dl3gI:9ySzPJR+l9EDl3VxA+
TLSH
T187066C56A1A841D5C1B9C1B98F0BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 db13140f1d480f0d6a5b6283a7495e18426246af6d8f95e37e2bb3ce94b6a748
MD5 6eba458d4517eedfb56e0211c47dec48
SHA1 6850654fe127734e93916c96a07a0fdd17267cf3
SHA512 dabcf9eac9e3f5e840e8c0b06774352ff6a4c2a6142f7134e1927945535d74c7ea2a68d67d0d2f2cb3043de9ac66fd3315a4883b3d60221ca65a6f103eb70c2e
SSDEEP 24576:/47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYDRPWxNs298r3OCDIjG3gE9ow+8xA+:/47JUQjqirIhCnDHUPfF/RR+ft983Dl1
TLSH
T16965AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 4c0098b239734c61a0f56de10772e0ddd2d3e2dfc112119dee561813da281cd7
MD5 808be25bae217f1dec16d16ecb420a9f
SHA1 be4acf3df4c25226067b533d8e1f5db03f287d33
SHA512 a93556aa06e1793129d2989543b3b1fa8ccc9187be1347759fb8627a62037c486df34357b0489d9f43c74a24c8d19e912bcefd294debbe43d0d92050afce5b8c
SSDEEP 12288:8psfiRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:diRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T133850109D68812D1C02EA1B9CB469641F3337C1A97F1A3CB92D0F93E1F7A6949DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a0f98f9851230afa5a6c0de0b6e1ee3f7247fa4696de7ce6b272e35f60c00fb3
MD5 7680e7e155474c76db94302a2ebbcbac
SHA1 2d97b814a8632a734b67d10bf911e3b77386e23f
SHA512 657f2cc441be894e6539d7658f0ae1aa0546571c1999b4d6a98e764c703636fbe5bcf6a2ff79eff9b6991b45d537a2d632945cd43c36961b0779d4c6617fb12b
SSDEEP 12288:U6p1U3fYApECyDfNZNr2EpEHdcYePkv3VpvGwE+:U6nUPmHr1/EH6ZPkvFFGwE+
TLSH
T1E84539007626CB4FC6A940325E33D6CCA7707D16EE45AF0772C9873FD576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 559b506669737c7ec689e71ac7ef0f30689b2c8710319882302c1c72eecb3d4c
MD5 a1e815489963c2e559dc0f01b9762b77
SHA1 0295c969f79c6d34f6e5acc751d5257aef776b41
SHA512 0d2deb3522d9e6c5831f0433cf5317a8f1b4918bb8036ea9a95665cc683ee72e6357a692eeaf72bc5676c89e7a4f35cdb8b59c3d36097eedbe3b799adebcd208
SSDEEP 6144:KxU2m+9cyRZcZntv0a79D3mW0vEtMxow0gGlhd3Kfc87JA09L08VygfvEtMxZ:XeZcZl79D3mWLd3Kfc87JA09L08Vyg9
TLSH
T15D45D8809536A78FD1B72032072A6F8C6BA4DC17B7055F26B3D9453AD82BB15B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.6MB
SHA256 83e04e35bd948e82cefb58e17ddc0ae2144d0e2d6e041ddd90671f388f1b89ea
MD5 abb1f6ce06ff691f62973637b6c96e60
SHA1 58c3db6d4a2978c8d9a3bab1f9b37aca75ae81a3
SHA512 1a343c1a7d4e2e99a7f70b4990ab200ce44424944385867b55715ae7cdf6e2a838ffa80dcbdd7ad6b79b0edd46d5eba355c85adef30fc51178cd913b312ed2b8
SSDEEP 12288:9F7aRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:raRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17A7523012D4C69C2EA3F81F4498AE071B127BE4E2FE461F3E41186A1AD796CDDDB052B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1d3818300e1654e3651ac7cfcba5772ebbc0e019dccc14c65582047e91932fa1
MD5 866e6781da59f635b657fee8828e56fa
SHA1 87608129bf74151f3cba9f5b1ef36be0024413e5
SHA512 638a1ef1d8b28f9d21f5268e6b811c5f030be0de40d1d1a8e6f740a1ba87690e0d6795c700bf9251e8f01738efd65baabef9f77ce9af21d0ae137b2d6d4927be
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bY0RPWxNs298r3OCDIjG3gE9ow+8xA+:ugb4mBIBhGFDR+ft983Dl3gEe8xA+
TLSH
T14A65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.1MB
SHA256 6203f7bdf4301743a524bd0c061bac8bc1ebdb4d0d7588df28cae26a480c65de
MD5 551dff131eba6efc60c32bd5f0b54bd5
SHA1 cc0633c3f0ce8ea7107718edaf15d1980a0796fa
SHA512 e1fc3e5c98c81dec7c11f98a6e8a7bda0f5a98bb368c2fb1844a15cc7caf567b044e5331657d5140c611ba46ef1d2c055d3909486b6ef0fbf40e024514cd50f4
SSDEEP 24576:uG88u8FpJqH1vzria7/mTRPWxNs298r3OCDIjG3gE9ow+8xA+T:l7ZFPqVya7/MR+ft983Dl3gEe8xA+T
TLSH
T1B9A501257AE401F1D47BD1388A824663F6B2B8151374FFDF06A88B511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.8MB
SHA256 bb40f0a5523820e29d616250b2be6b2291bff670aecc3445ab8a9c0df1fa1dd2
MD5 33ea927f7d4482caa89ce584690ac94f
SHA1 702305139526c9f4bf281344f0f2dbf7d2e74a6d
SHA512 6c6f664673b6b642b5e6b649058f331de23185a32c4e864e990b89a60d9b4c353d96bcc4aae8b53fe080b3c3f88e9c0993cfb27a093c4cf3e3274789fd8872c2
SSDEEP 24576:rPUr+NQvRPWxNs298r3OCDIjG3gE9ow+8xA+:rJQvR+ft983Dl3gEe8xA+
TLSH
T1C585F11F269C18E1E67BE17D89828219F372B852171292DF01E0817E5F67EDCBD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2573b844bfd73a182e6f0a1527e6d0a0feb1c7a3a41113003f4d1ceb2d22e6a4
MD5 7acf1abac19832e3feb2d4fb7263ba26
SHA1 c140327105a26c258b1ab6d0fbc9e6c1db520e4a
SHA512 62bcde3fd67221ecbfa52f0d67d21118687267b0e50ec45f7c6836fe060dde10b655abaece597e83c8e4895979c6ad13d99570160345afe3e8bea25216f8e957
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/R+ft983Dl3gEe8xF:7G05lO43b+R+l9EDl3VxA+
TLSH
T154D5CF6E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ebb1f5d1ca953ede6a6e362837b190ff96eafd6d7c3f13bfc70784fd36114714
MD5 1a89e06430eb1b222159a87bab5cb74c
SHA1 3dcd9fa7994a26b674d2b4e37ac0ab384fece957
SHA512 e04156d602680f6ee328968241d020542108a63ed19b24964addaa41af47dbf377857d6d86f4387846498cb647e3a13aa3b6748b48dd7e7b3eeb4829cf4af0a9
SSDEEP 24576:cfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnhRPWxNs298r3OCDIjG3gE9ow+8xF:Ea5POZ3lJt2pasx2+mnR+ft983Dl3gE9
TLSH
T1A665BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cefd1fe293db0e0c1d09447e0aa5b698c0a03657f62b9ea2a5e95281befd4255
MD5 66898b28d885725aab546d2244b473f1
SHA1 a9de656e2a6ca57921dda21d5f46f4252ec060af
SHA512 7dd802de25c3cffbf5d2741392aacd7435844cfb57c49c049d204c29f4cac0201e1ea60a8ade768cf5268915a0d87fb1a2ec1d7b7f6cc00b60706b527c688639
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fk7RPWxNs298r3OCDIjG3gE9ow+8xA+:GNc/zEOVHFsR+ft983Dl3gEe8xA+
TLSH
T164858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ccdcc23dcd9dcf8097b465aa3ca2b7fe7112497fe97d96ec05630a9fd5396954
MD5 4a3f318bb37fec0a8b77882639542e95
SHA1 67767194fded68e378aa025da5c8dfb44fe2e4f1
SHA512 4a1cdacaccf47c3d6b7c9fba6f57cd145ed9d340461dbb1ee0380401dd4d256a72e3c680489ef00822f565b9a0ff964c726187d29529eacaea205e1366e6cbd2
SSDEEP 24576:FzkNvNnaFeYhJNtmZBmGRPWxNs298r3OCDIjG3gE9ow+8xA+:FzMwBtOmGR+ft983Dl3gEe8xA+
TLSH
T1A055AF2EBAB846E0D1FEC6B4CD238512E6727851173293CB9290C13F4E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 cdf837fd3ab61598933d3a23374cd065078d080f9bbf78c41e49345a3e9bc165
MD5 890751f05e193eb55b70674855b5a802
SHA1 efa682cf419abf102cd6907327cf20a3825630e3
SHA512 c6ec13f3a084d0d08579804739e58210892d6655054b20c8c7c8fb7c0d6604167247ae124b2d1b1047a7da34fbe643f5433f65b0fa104f2963008681c8222ab8
SSDEEP 24576:QD3FHshBIYQgAuRPWxNs298r3OCDIjG3gE9ow+8xA+:QDVHeBIAAuR+ft983Dl3gEe8xA+
TLSH
T12F95E13DEA9C04E0E57BD1BCDA538606E67238AD033266DB0190C1B65F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/788-64-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/788-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/788-307-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/1044-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1044-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1044-34-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1044-37-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/1044-8-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/1148-392-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1148-340-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1148-339-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1148-333-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2420-83-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2420-78-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2420-111-0x0000000000400000-0x0000000000696000-memory.dmp

Download

memory/3340-15-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3340-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3340-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3340-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3340-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3772-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3772-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3772-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3772-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3772-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4080-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4080-51-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4080-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4080-47-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4080-41-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4080-49-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5096-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5096-104-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5096-310-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5096-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5376-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5376-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5376-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5376-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5608-121-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5608-313-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/5608-113-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/5608-115-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5980-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5980-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5980-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5980-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5980-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5980-109-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-108-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/6056-308-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/6056-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6056-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download