a4fddd739d8924dfcf3b6d4fe69fde613f43e7f8971405ba1e33accf19c6d37b

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260628-2414msf14v
SHA256 a4fddd739d8924dfcf3b6d4fe69fde613f43e7f8971405ba1e33accf19c6d37b
MD5 3f2d997de89be79a61796b20ec972368
SHA1 9031d40298a3b5d7d897ed62285b13591533ce29
SHA512 c10a0a551e4ed3773a695d0733a0531e38aceabf027a75da930da33af8199a8b909fcbb81b053798e2dd0aba3e38944ac5730d2895b1c686b0913c49d9645029
SSDEEP 49152:kfWxV6vVfWe6OeaVVkzAsgFFTxYK/3XSbhv+NVrcho98awZgXTtLxJ+eESOXA7Nv:0x7vkv+NCsxVESOQjZ
TLSH
T1E2167B17A7B940F5C0BBD13D8A569657FAB2784A873197CB47A0875A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2452	elevation_service.exe
6164	elevation_service.exe
4624	maintenanceservice.exe
6416	OSE.EXE
5168	PerceptionSimulationService.exe
3860	perfhost.exe
4984	ReFsDedupSvc.exe
2804	SensorDataService.exe
4992	ssh-agent.exe
5484	AgentService.exe
5136	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\553a994f9a0cd01e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86453\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e936ec235307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed8d54245307dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000562e42255307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f7d29255307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059a6b8685307dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcab02265307dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000146f17255307dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
6164	elevation_service.exe
6164	elevation_service.exe
6164	elevation_service.exe
6164	elevation_service.exe
6164	elevation_service.exe
6164	elevation_service.exe
6164	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1356	2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2452	elevation_service.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5484	AgentService.exe
Token: 33	5136	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5136	SearchIndexer.exe
Token: SeDebugPrivilege	2452	elevation_service.exe
Token: SeDebugPrivilege	6164	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 3868	5136	SearchIndexer.exe	100
PID 5136 wrote to memory of 3916	5136	SearchIndexer.exe	101
PID 5136 wrote to memory of 4512	5136	SearchIndexer.exe	102
PID 5136 wrote to memory of 5172	5136	SearchIndexer.exe	103
PID 5136 wrote to memory of 3048	5136	SearchIndexer.exe	107
PID 5136 wrote to memory of 3880	5136	SearchIndexer.exe	108
PID 5136 wrote to memory of 1112	5136	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_3f2d997de89be79a61796b20ec972368_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6164

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4624

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5168

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-958335860-2021930596-4099878453-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-958335860-2021930596-4099878453-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2800 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2800 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f90172eb152fafa1188ceed4ef6f7d2545560ae635803e8ccb72dbca29c4f3d9
MD5 8485c4275a44c3a3ed1cb5ceb1325106
SHA1 b6bda59b906936e29fee7628cd886b5f827b572f
SHA512 a29ae69fd9de4f6da36aad76fff82c7556a16ff053e0e160d5ea36b45a2327abfacdc3058091c3d4dde12055b64200e5dfb5e75acbaf6dbb74d638773d7c48d0
SSDEEP 49152:Lb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnO+eESOXA7NhmbTmYM:Z3q60jBHESOQjZ
TLSH
T11FD59D03F2D900E9E06AD578D7469133EAA2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4633f88cade1dc21d91bbec8ea7cbe4f0a9008cc1536a44757b8e3380e366ef5
MD5 ab4ecc58b05cb4b55e3f3e744cae3f1c
SHA1 a8dcc15d2c4ee63dfbbef6c870c8a0cb1210939c
SHA512 7291519381869365be8c5b36fb03c361b13314ae35ef10874148443944f970ef1d47af7d79caffe5bb894a9beb6d46bac12b01d944abb6a00dbcdb72c4543bae
SSDEEP 24576:UXYfDtczAv+LaESOXA7NhrYD1/STITmr1mMi:TtcE+eESOXA7NhmbTmYM
TLSH
T1DF05012873E009F9DD27823DC8A18511E7737C9647A4E7DB03A49A691F372C86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ff7679cb8e5cb345dfbc251dbc2497c0261a9514ae0e2be0149dc29adf692b2c
MD5 52165c09f46717fdf8bbecfb92593635
SHA1 5424f9e37c993efdeb9c39f518dff62d4e7aad75
SHA512 bd2ef2bb9dcdd312a8cb43e0865e6c6b2450fad5098ffad03afb51d8ea8203f9a9d6858b14bd6ed31edfbe4c8194b9dd6ff9c93ed970b0f88b4f284d49e1df2b
SSDEEP 24576:P0Le5ji0hmxNrMW+LaESOXA7NhrYD1/STITmr1mMi:PPji0A75+eESOXA7NhmbTmYM
TLSH
T1BD35AE16F6748371D073C0B9C5D2A69EE97130861B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39cf690de13c8f2e69cb19d9221939948cbb64dab31a6df7355f7b8b6bbb10a1
MD5 b71479bdf666028b770eef8e9c341673
SHA1 094e744532a477e23a371679807e75e629ede9cc
SHA512 d44fcf2f4a80664a5d4ae569276b444655777352dc3d7ca4166f67b431ed22a0f3623a3a32bd24246c8a2331c23fd0fb6dfd5a3ef987592583c5af692b4208da
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWr6q8wyu0+LaESOXA7NhrYD1/STITmr1mMi:+/ezSC6vUzPviHjyN+eESOXA7NhmbTmZ
TLSH
T12F756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8790e69e3451cbcdfd75ad564ac5b06a4a1c4dd7bf0dc967be8ee6fa2ecd3bbe
MD5 52a237e3e9e55d91181fffd6d3eeade7
SHA1 ee42ae73e3960c82fa65c38a6e2b1011c33aaeba
SHA512 c2bc965a7eafc1124af2a1bb816fc211ee2f20b08c98399d30ab0c671d44a729c4a14ff00cbdda54e707c4ca558d899db2f427a084ee9a77d6e470b8d8660559
SSDEEP 24576:QVbqPb88hv/l+b7+LaESOXA7NhrYD1/STITmr1mMi:QVO88hXl+n+eESOXA7NhmbTmYM
TLSH
T12455AE66F5B48331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E6B7D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b32463efe6dca216249df7621bfc0f29b1bf0282b57f349985bd6902f2ed3c41
MD5 6488f80e39b41df410df0ecd193bf3ca
SHA1 0067d0e13bccf985171ed9ece8bdcbea7fd5e579
SHA512 bf0248a19de0a55fdf8a2c3cf52a8db825b58b5a61e83688ca6d8e026198b9ebd0ba764ee3db543acd090c4720224cd543812eb57e39f917c7c22e66beb801bb
SSDEEP 12288:BjFun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:Bji+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T156C4230642E4A6D5C30B8E36E4DC443893D9ADFB5ACC9FBD1202FE989E7C484F24A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 39886853c241f051dde9fa552f3c000771e350baf787d90943ee2a19bcfeaf60
MD5 a289c0bb070a371c311187f253cee2af
SHA1 8485b46f7aa3dd80dc0b93db570370f8980344cf
SHA512 c70128dcfb0c968d1ff37cf63d4df0e6ee7925395da2046ba927c71e4302ad2e535a760e53d705d3a1f5aa1d4c1ee6475a9952e27adf7f46a2536004e4247881
SSDEEP 12288:PeBNUbTVO86U2un+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:PJIUD+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T1A705CF3BAE28FCD2C27A8D7856918600E7B278714F51A3CBD165C30EDE275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a17396d838ed0e12585c8814e3a8ead361bb632e5843d9431d81a2950e149bdb
MD5 6158181ad72c4e6d90842b20f1935326
SHA1 0e8db740c6ec38d9ecb24cf05c3184f526e052f4
SHA512 8491d5112170e38163d019b5bc24922b25515a274edcfc6dafa35769c0293ad46101f0019c6b3ee4cbdb47cef49685a4a1d918245c0d2f9ce8c9d23858022ba5
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THb:EQvGAdlCEL8c/RRNw5CuESOQjZ
TLSH
T1E6266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d0f03a30dd8af561af805396416e4275112eeb64952ad39f56b55a8feb3371bf
MD5 51881e0f1ca5926d5aacc922a24837c6
SHA1 966409937d866e9478d615b91dbf67478b6d41d2
SHA512 1c53bd1bc8edef45cdce6f228634af90bbe7306a781b14d3241ea38308c7c7d2a7bfc93f2a2ee4c1e00144012c68246433602c8303c44186e95afa1759086131
SSDEEP 24576:xSewsAjp+LaESOXA7NhrYD1/STITmr1mMi:cljp+eESOXA7NhmbTmYM
TLSH
T1D615E031FA74E036C37F0DB61B69C716546CBE604F911AC3E3A88E9D59342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b9a2c1d2e7f871948aa0e2d53063df556add63c072e84227316c259ee3c3b2f3
MD5 864f52458049c5390216e11baa8759b8
SHA1 f678e212f769a382f6f09c6238eb8d515740a889
SHA512 531aa76b4bc0f12b54cc369ebf1ad68992a95e7e0d0d344e7f160fa9edfc3ccffc342f3533051e7f937a151d4446fd72d5eb3e882c33ef8a6a480923fd673255
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHzO:JUEtQevvqc2W1cpV2RI326
TLSH
T187474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c4a70dc3b6a80178a38dc321c348ec88cacf3d7bf9fb122c4613c32dedc76bbe
MD5 fab2130399c8e3dbb8b6074b238216d9
SHA1 7bea9eff2c71b1204f3379d00ffb7de897c56ac9
SHA512 5bb59075a0be12a36d2217f0e09798ef376077bf7b2b9533c42ae64995b67bd064afad13321d785f61729625979f13070ee648d328de7c764dda25d2b683c5b9
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zJ+eESOXA7NhmbTmYM:uoq2VjnmaESOQjZ
TLSH
T1BCD58D0976B8C2E4D1F6C77886A2C647F37178154B349BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 762769c6de758d9777228f21a824b494f7ebb39591be98438369c23761378bc8
MD5 76f9f499cf1eaf62665ee0f9ba637a00
SHA1 3eec4dc74e3a608b286f1d6dfe9c15a8f3da7d3c
SHA512 e8f8b75a517d07b22c68211647beaf371f11c387a870ef9c5ff5ec54b41e77c37cb3255d8f82ef685641b7b6e84a0f61609e481e98605e8ac3ef934702755467
SSDEEP 24576:qAhGL2IFoiwtA5l7S53Y+LaESOXA7NhrYD1/STITmr1mMi:qAM1Foiq5o+eESOXA7NhmbTmYM
TLSH
T1AD35AE81E7F955D4F5B3AA7899B68170EAB6BCAA5E30C21F2150D11F0E37E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5f1c5e239ddc77c122bc5270250a34bfe677905f1c0f121bea2b0b5725e778e2
MD5 1286c7aab72f077ab03ea56b58e5d526
SHA1 5927fbcf62dc712c284f30eb587713c646fb700d
SHA512 9f29ce3f73a216737e68aa55b6d51548410f82105f9f14ce3f0bd80030497c164e22d6b757e86b39cda83b854b1eb4c4927a46aa4526cc55dbc30a300b646c23
SSDEEP 24576:MwuXOWt+LaESOXA7NhrYD1/STITmr1mMi:MwsO8+eESOXA7NhmbTmYM
TLSH
T11605F14632E41CF9E6678639C5978135F3F2BC122A64DB2F1360C65A5F37261BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cb9d3cb8de8a7994bec231e96b9c1755596071313f2aa55f8615f81667feb9cc
MD5 c579dbe2d7aade75bb51d86cc3c90ae0
SHA1 dd91f6b269c1cccdfcc826d8b7470fc95ee62a24
SHA512 b711d8619e3bc8437abe12ac8bb69192af699dc9ff452c1adbbbeece55757e42ee820173724a01701212be909b16bbf7c03919490a2db861f2e352c0d4ba1b93
SSDEEP 12288:Y/Z1Iywun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:cZu++LaESOXA7NhrYD1/STITmr1mMi
TLSH
T12EE4124A23E471F9D357863DC8E84518D3F27CA727A943DF120186A95F3B9C1AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 84bebab772aa2f4ae290f397ded5dbf34e1585cfbfe927b7c55b29e3d4da33ea
MD5 586daf8a7abae065f9ed80f66b9bfea0
SHA1 23df15247554d77350b345fdc461863219dcaa5d
SHA512 9978adaa1893834618f0a5feff6d12ccc1a62c768de52284fc59dfc0e7c00747b28ed4b86110f2c0ad908a3534cbe61fd990a246a3983900968b3392cac7bf6f
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uv:BQRQyi36YOcPhLvw2gAf+PN3bESOQjZ
TLSH
T1C2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 65f8ff74e486c5bf2cf2a9cb852f0b3c89bba6d9a74e7fed6bd9290f317473da
MD5 bedd2c123899bff1d8ba957810a0a1b8
SHA1 094ee25cd6e8c18fd53a819ea3e2009554be79f1
SHA512 f4183dcaf280ddbf8b0859bd542664e28ccf54f7b908f6d7c186dad26e1ff0ba9a7fdb512fbe9ea490f67b0a0622772ee38c559fa44750687aa2682446fdcd47
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uv:/QRQyi36YOcPhLvw2gAf+PN3bESOQjZ
TLSH
T118667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 62419e52c70410a97af0cf4026c89a19f16d4d2912b72f4e0c98d7883da21e33
MD5 08083e4b83f3ba196eefb409fce00734
SHA1 cfec98e46c2ce9a2f86061ae4101b20d462221df
SHA512 6bd24dd459ce870db7ea75c8f58266039cffa9840e9cf4327841d6c60c52836622bb99f37d4c3340e085b1fa91e5adca9b8747763e840aa2fdc95a91a178d5b8
SSDEEP 49152:r68Qg55nhceWu7PNU3/5+eESOXA7NhmbTmYM:1thLRc/FESOQjZ
TLSH
T105B54933B2F600A9C44DE1769F4A873196D17C758FE0E7DB8501721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f49d1718ee489092899fbf8cb301da9caf6d8eb188869e4f577478eff890268
MD5 69f83f464456da1c46c11be8bc52b725
SHA1 cc2df2d6f6ed9fd0742b833ff814ef1bfda38822
SHA512 88f7dd43c59bb10fd82cdd48e810a1bcd031d49c02940cd845cd6a7653bb09beaed2fc096ec174c5a3406eccb5a5c5ff4d84e6ef9cadd7a7aca555511fe67623
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk991:/y5112gYy5azzVva69nLKnhZ8ESOQjZ
TLSH
T151167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ebbabbc2b391278670267aff6ea7af8cd0b3adb99aefb2b1e450e434ef08b855
MD5 8d26d9cad629dcc4e07b2702c8501f69
SHA1 89e1f0d3671ec778c5d9ceb40cb71f2c2fce8920
SHA512 650b95a1bd254a61a6f6c074f1ff8a6262edae7967b2d7bd46930f3febb66f56c40e49f3d9672a033d6427a6fd83144d8aa590c6254677c7a385a81a2341fe28
SSDEEP 49152:sB+taZ3usBWOBr4tEG20bqx0z+n217aau1glj+eESOXA7NhmbTmYM:mu6JmUxd2dPESOQjZ
TLSH
T1D0D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8c1261055c524fe75e5029e3c61d77aa1981f60e4098f3e9f8051664e177ea73
MD5 08c9bea324dc0c471a8fea1c7480b5a7
SHA1 40e88063f36f11831f84373e063891eab2dc7787
SHA512 b542e6c824a79c6ad7a01fef07e9f62f64b0d8d41aa3fa457c9d60356fd01edbd0d8cf46a5ac15835ce5552d4b1510f4b11b2270f809dcba8802d0ee8f625f3f
SSDEEP 49152:A1hpsNoJpF1A6BU44CwH7R4xj+eESOXA7NhmbTmYM:AmifPkRaESOQjZ
TLSH
T141B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6812255f236556f1ae6306291e7690e5c629618fda2c205deb0a35fe2118ae6f
MD5 2bac5dd664fcbc1bae6c306d073f9ce3
SHA1 3992f63c50d562e93d954aca1a8b298f89cf3542
SHA512 06d6dd3cd1e0f9aa077d28ca185c96dac9a901ffc776a51304d49e88866fa2e4f77a9bebac3165e547b3f3f0203eb31c549c0462f5cf20bf8e64f3ef9f41a092
SSDEEP 49152:rSuZQIY0Be2KNRVtOnks6NMHq++eESOXA7NhmbTmYM:55dKvi61AESOQjZ
TLSH
T1D5C5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3071fdadca066a7e19960bfff8b4e31a1a8bed0bd329c800f04293355ae0b2fa
MD5 ec310b4742ea54416fdf8a75605bf0ed
SHA1 3b7b445e8b61ea3fa20a972ca4aba815027db209
SHA512 6f881e3a8fd7fdc57d626c3d1323b715c441794d29ea8481513563fb4100b82e8b17e03ce68611598b4ec7bba604ae81edd8a6f29e22b6c1e817a95b18a39558
SSDEEP 49152:LhtSn8EApI0figXgiDn0AP5wv+eESOXA7NhmbTmYM:KX2iyph2ESOQjZ
TLSH
T10D95BF13F2D901E8D05ED178C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 be5c10606492b63725f5ba755eb7ee6faa29ad02b256785b8b4ff4a78f0b3815
MD5 e69e4e65c572a2e7e7ad2f2f6ef15a30
SHA1 156c57e25589173f275d8b7a5e2c9bab013523d9
SHA512 20d6bafc98c3c38ba77353caf7110ebfe7679cb08644c29beaaa5562a9aa760c31b0ff23f609d792377461d3a2044678d323012ad801a4f4b953e50c0b78b544
SSDEEP 12288:RNun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:Rq+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T176C4230650E4A7D9C3078E76D0DC4438D3D97DFBABCC5BBE2302AA589FBD484B24A654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 018b1d192106343455cbe737a0dce6ff534c7b53756308a81ecb08c99e9bb8fb
MD5 53aaf72eecc9c8798937d2223dbbaa88
SHA1 9762e526e32447ead697b38db7d446fbc9984ede
SHA512 530e7885b5c653a2c9ee2a5cc3c8e9051dad99301e608e4355847dac4665f6eef6109c7664ce10f02b1c60876a518bc31079e204751cb6b9a59bd5f1046b4481
SSDEEP 12288:Xcun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:XF+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T15FC4230650E49BD9C30BCE36D1CC4478D3D97DFBABC85BBE2302A9589FBC494B24A654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 57e8d8b64a37d2e4fdcb25c6fb90e4992503dc37913718aff8ee8b4d302dc9e9
MD5 e4d3b8d89d2e95bbd955a2de30fe9e02
SHA1 450ddb21f8581957ed1820f0750d68b0e37e99ad
SHA512 d7b3847bb06d8f6e1357530e4ea6a52c72bf13c39038a132cf31e8c886c729fa166831487607f3f0cf56df20284c15ccc187debc078ffb5140979ec4bd7db8c2
SSDEEP 12288:Aeun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:AL+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T19DC4230650E4A6D9C30BCE36D1DC4438D3D96DFFABCC5BBE2702A9589FBC484B249694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f81fd423de08a00c96befb7b10e5b2d655f16d820b5ba036d6d13da26b7cd617
MD5 7ede6c59a018c5687fe24b43f91427fa
SHA1 0d201a59179cdac5f8cf6ebdf3ffb8430c9f4532
SHA512 462c2a89fcb858c904819a7c806380f09cf1ee8b567d56a5993ea1e092c57914a33766f8c5aa8b8844b9fb61175bab8144929f483688c6ab60f082cf51ca7c8e
SSDEEP 12288:0VPun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:X+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T19BD4230612E496D5C317CA39C5E84038E3F9BCFB9B889BFF17015A984F7D680B629B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4b0f0daae7bfab7cbdc8c1f19cc2fcc2029206ca06188150636792756b9634ec
MD5 21fdadd7fe7d5f0038fbd16bf04a0098
SHA1 b11fca7d35ccd7beac9c8acd75d55d940ee93af2
SHA512 8cc7221370f1e47a08f7d27d5411bf6cefe10cf99cdbc2d017c6502aa446925f78eea1a709253fe61dadfb3306bb1d371ab8fb585b6dfdef872994fb59f9e017
SSDEEP 12288:bHun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:bQ+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T140C4230650E496D9C30B8E36D1CC4478D3D97DFFABCC5BBE2302A9589FBC484B249694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 04d617774632cc75f6272a8f630de798100e27ff3f7561e505d28749ee248e1f
MD5 0d0eac6d418ae4f6becceaec7a0b9416
SHA1 d7d72734c359ac9558ab510424cd32e6dc5e78b4
SHA512 631f2bec027f90781c27adc23db3761dd9c3013ea6d4ce2c75b7db74ada7a83122e6fbfefadd5e33d9bc9379b7ebed508e5ebb9c3ec42e4a8b7fbcec8e2dc026
SSDEEP 12288:7Iun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:7x+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T183C4230650E49AD9C30BCE36D1CC4478D3D97DFBABC85BBE2302AA589FBC494B249654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5890fe1be6d4a47885ee26ebd2a891f60c20c8902d44c1006a137b592b43b88e
MD5 3118fcf9a6d4be6bad81dd544f377a23
SHA1 4d587f420d5060961294ca6dda804251e39d53f2
SHA512 5e83590fc4f4511dfc53649b370d31b16f5331409657c08d8d498d6f870605ca1deb75536bc1faacad2b60698ba0d751dcac72c048b4d0e3fd1c43e4665c63b4
SSDEEP 12288:F0un+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:F9+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T1CFC4230650E49BD9C30B8A36D1CC4438D3D97DFFAACC5BBE2302E9589FBC494B249654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6bf01afa4078eb7c774d9b25ceea640d3c23e5337d269c4a9ffd77fe920b6f13
MD5 901099132cc0a669f9b6725729c53d2f
SHA1 f2fba793af721d02520be71ec060f0909a0703b4
SHA512 16bc399c0ef2e7adfa31c575f9f9878628a3f62164ede5e7b40afdefbc0c1c096abcc8487f24d4a4db0503fb0f5734ea3f74b13362832077643c9ae42bff4664
SSDEEP 24576:XZMMzFVSOl+LaESOXA7NhrYD1/STITmr1mMi:XZMMzfh+eESOXA7NhmbTmYM
TLSH
T173050295B3901CF8DD67823EC8548915D2F27C6A0BA0CB5F03A4366A5F373A11D2EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 503bad3ecf333bd55b7bc71cdb8ec8fffba9fcaad7a9e555d12dc1a288848d2b
MD5 bb5cce6d0b4249eb725dd627b853621a
SHA1 62a29476adf8c57bd3e93f9054da6c6ca5796733
SHA512 2ac6a373769466f20955a6e54cd2f10745021b9d7ef0ca27f322a99e4238ddc426973433a7ef28e3931c900d4699f8e8cb3341aaa2c81bd78b7bf77c7360203a
SSDEEP 12288:shun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:su+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T127C4230A50E4A6D9C30B8E36D1CC4538D3DC7DFFABC85BBE2706AA589F7C484B249654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f05d82d42cdb98c47c22afaae4656c17a101ee9ffd1880f445dd826d27da42f2
MD5 dcd28f1c9effcffe92672b3e37951ed1
SHA1 ba14a01e62badd3abd1281f098511ee13dc8b505
SHA512 b1039c251418557bf40014bced5ebaf0fa4dc28cbc60883f9f137af270bea579afb6c757141f47be79f2e6a7fd85ac1ae5bc6f7aa68839a49d6f29d226a09850
SSDEEP 12288:rVun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:rS+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T1E9C4230651E49BD9C30B8E36D1CC4438D3DC7DFFAAC85BBE2702AA589FBC494B249654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c9600a8d85f876da8b3f3fe17d73495f56af274284a32e860cf92a02d1f1b279
MD5 84cc6e86136ae6d9c208bf9125bca457
SHA1 bbeadeed4a5d438ef5db7684980aff2a049191d2
SHA512 dc652dea5a2d4f2e47275c37d22da8d15b7a33ea0cd1e08165d81542303f61eb3dfd3b81bfbeed35a07c7f96252e5778bfd6831e470e129c486ae9066a77924b
SSDEEP 12288:QyPz5L8wun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:hzyZ+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T126F4020772A531F9D2278239C8950915F3B6BC764B548BAF1350477A2F3B6D0AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1ed61cc48ca732d7de792268231d7badb615bbb6797ef53aabb96adb0811410c
MD5 678ad090aa46e27b9fa61e94ae9ba3b9
SHA1 eee919b2a0d0a5ac75a742c03c7b6e0cf3714a28
SHA512 941dbce107cfa882baa7b2cad18a8fd3237bf8c68e215de9ca2dccc2449d5dfb4c7f033e13bcade862a8d11e62915573175e7f69abcf5d9dfe73111a64874fcb
SSDEEP 12288:khun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:ku+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T17AC4230650E4A6D9C30B8E36D1CC4578D3DC7DFFAACC5BBE2702AA589F7C484B24A654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1f2fc24e9823f52c3baf7a9ef064a46c3f61cc660f1ccf0d8be0a3ac91918870
MD5 32e141f44e5128b158d2385e82fde834
SHA1 14c27bf3bb3b9085808ed4a7d11e9b335e756c6c
SHA512 4d00b905e9f4c2db355292137257eae8663127d5ae8a15aeba2b8921436e2f6f0955d350401a4f0115a40808fedf3e2ee21e4fe5ab5004a6a461020ce71cc697
SSDEEP 12288:Ehun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:Eu+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T18FC4230650E4A6D9C30B8E36D1CC4578D3DC7DFFAACC5BBE2702AA589F7C484B24A654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f8fd1e44cd7d42e0dd40659b5570373ab7e2d8434e7fa301579b3dc0fe464d2f
MD5 1bd8557b8b4c929a2e9ea3c309303fcd
SHA1 9e810bc8c068089f35da1cdec81fc0eda7bed95d
SHA512 0dea1c1fe459f5da335c6e5302bcb5d0d7c4e1ec9c90735a854b89a5ebd38a6537d764e9a20eff637cda2198c07d0efbb7bebc67459858f03f29f7a29683b0e8
SSDEEP 12288:JyPz5L8wun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:ozyZ+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T167F4020772A531F9D2278239C8950A15F3B5BC764B548BAF1350477A2F3B6D0AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1d40cbf86041a2f1ab73e8aea827f53b40da23c8f28dde4c503d9b3cd2108125
MD5 449ea2de028bb2dbd5efdac0d9aae505
SHA1 9d3697c8303c9b1937a8f030900aad5bea45e00b
SHA512 0f47164a0847ef6bc56f5159f80f5429d204a4a3b42d1b305ed56ad50396b8bfa76a3e650f488527efa3b28c978fadf3b9ddcd035ceaf6445dabbe283952b6a7
SSDEEP 24576:TT9aLl3z0zDb+LaESOXA7NhrYD1/STITmr1mMi:TTQLlj0+eESOXA7NhmbTmYM
TLSH
T1A0050295B3901CF8DD67823EC8558915D2F27C6B0BA0CB6F03A4366A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 87295162a43e717113b94a505ef9ed51a79b181fa04a0211919cc3eee228f744
MD5 287a047ab93a535f97a439e0fd7236d7
SHA1 1991ae5a56ed9ca743af536f0672ee52c61703d1
SHA512 e6aa7fbd9b30f895ec46f0abc829f2d3404a370913e2d4b1400fd85ecb393e9260fa20f380c130d6c1ceaca2770c7b2f492586de3adf2ec98044558b706ecd78
SSDEEP 24576:T3td9CHKy7GZ3+LaESOXA7NhrYD1/STITmr1mMi:ztd9CHKyah+eESOXA7NhmbTmYM
TLSH
T17A25DF90F3E414E8F1B7CA35C9754511DAB67CAA1B60CE8F0394665A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 34e20a60c3d2e5e54017c73138aeb56a8fd7e164119fdea4ccaeb4d6c32536b5
MD5 862c62777faad8bb03aca8957f70302b
SHA1 32dea46a3089819a2fb93b312841ecaa54f64ff2
SHA512 cdec7215cde541a7a344ef5a63f2f1094d52b937cf270df516f7cf6dcc9cc2adfb615c5ba60551512dde70a27ee6a9e13ef793494548bf700b9ea3e6ece05f20
SSDEEP 12288:8+un+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:8r+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T14FC4230650E496D9C30B8E36D1CC4078D3D97DFFABCC5BBE2302A9589FBD484B24A694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2b6b03bc33f92e7d6bec0288258b119eaf5445cf785a88be60c259286d46e0a7
MD5 8dd30a9f5ccf11c794f121856c6bae0a
SHA1 2bc6d2e967f2a788da2a1cb849a893f1d6eb63f7
SHA512 193494baf6c7d942c8c1490b6765906b4a65b0c49a66cca0dda69e570de131ff69244c294d7989fc3f5b37406a32b8be66950c1fc1cb26c1c645fd5c2be83c13
SSDEEP 12288:sQun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:s5+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T1DEC4230651E4AAD9C30BCE76D1DC4538D3D87DFFAACC5BBE2302A9589FBC480B249654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5a8720e486de5cc1d640dcea3b7dde01ad27cf325b32c6efcc456a1b1523ea64
MD5 47f587072a5967221df6831cf2edff32
SHA1 d99cecfd49555d51d7838b28ba295f50887c85c2
SHA512 8a71264c5fce6f5cca7f2f7fcf0d75bfe73b84ec87827c9b154bcb84249b991c9d4ff3ad354f826e2bd9e71bf6f8ac1001f593f967023c7653aeb04e6f47490e
SSDEEP 12288:pTun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:pM+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T19FC4230650E4A6D9C30B8E36D1CC4578D3D87DFFABCC5BBE2702AA589F7C484B249654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 5deb0678979fe6dc918e23a94b6ca90c6e7e5422a69d163187309c979911c969
MD5 9fd0e89337616a6adddaae139da80f99
SHA1 253ca2892e0b595636e0c52d705e666357843bab
SHA512 6361677c7c2b4f8849b6da3b43c1dbed9f9b3d785c74a23b01d6f511a0b8fc0c838710fb4573c8037f4b8088aef2386213b6c4ef8004a5e31d2d11f45bff5fdb
SSDEEP 12288:lhun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:lu+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T116C4230650E4A6D9C30B8E36D1CC4478D3DC7DFFAAC85BBE2706AA589F7C484B24A654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 57d3687627e7f5fdeff63ab9d4e964ebd5d4912d894251ddb16bc018df35b1df
MD5 dd420083c5a75282da63b3d3a07f2e2f
SHA1 7dd177dc0e409efb56293af705751fb7436ab07f
SHA512 28949d1333d542b2c1803d0175b332fd0cbd28cdb82d56ceccfc8afa748ad181421b954b8ec77f08c221d106ef4aa407b7d7c9a9a9465192ea7a5ec60c388862
SSDEEP 12288:7+un+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:7r+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T160C4230650E4A6D9C30B8E36D1CC4078D3D97DFFABCC5BBE2302A9589F7D494B24A694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4c34ff089ad77f102f111e3544b47d5ab92406b4fa5af060011d8e922d104331
MD5 7592ee025e37dc6a0b74e3cdb12e5a43
SHA1 ba0fb395bb4a7b7fe9a922e21757bd5a4a16ce2f
SHA512 425b5585c9af1181031fb370c7c0e0b44a89b78116f62002859c351854b543baf4feb0b20ef18737dea2a187bcbf921c115f23725812c1cae88cafe247f61b2f
SSDEEP 12288:RZun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:Rm+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T134C4230650E497D9C30ACE76D1CC4438D3DC7DFBAACC5BBE2702AA589FBC485B24A654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 aa93e674bba4829ccff90de0fba21b66d7b873ff05aee2c68f6614662a5753f7
MD5 fff91fd39e1588a189d1217586878aae
SHA1 11de1a4bfc0fb83fb536e7873026652cecbf6005
SHA512 ce7631b6e8baf821dc05d9f2af023ea4efa60a3b95dea5070ab6e684b471430ba6ee78fdfca157b2255eff9a6002093325756968cec94c32d44c0bd4963d39fa
SSDEEP 12288:IHun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:IQ+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T1BDC4230650E4A6D9C30A8E36D1CC4478D3D97DFFABCC5BBE2302A9589FBD484B249694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 d6868a775fd5349594b3e30c2e5b4ea917b013156051ba0e955fe4a1a168feea
MD5 5eeb30e60a5cab79f3c7fb9758a5b564
SHA1 ff6c852370839e81a254aa8acf60d8f65d2dface
SHA512 38ce13a4f6b94cb12ede46c3b3712bc138616b06a3623c3cf13f25dca3fa7c558ca6787c6dfc705187ab33d82eddbcb55cc8c72500afa8dea2233e4915695596
SSDEEP 24576:xfwvok9RX6wkyAIC+LaESOXA7NhrYD1/STITmr1mMi:PMnYIC+eESOXA7NhmbTmYM
TLSH
T19135DF29EBD844E5E177923C89F7460AF2B178691B31C6CF025A53AD0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6c5921833dd1fffaeefc768b35e35c0a5c682fec89d41cd5ff08d40ff82d505c
MD5 81d3e2edeea05d2685519bd02c63e2f9
SHA1 944ee44e8175be6f4a36c722086062e7ad07e84f
SHA512 b9a9fa1d53220b0d754f4b9838550ea9225bd1a8f5e6a02c6a3cd1db853bf9dd995421a85f3a38ef3c35adfd9203894b86fee61031e4fbb9641c1689ea236f88
SSDEEP 49152:gYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0P+eESOXA7Nhmq:4ySzP7ESOQjZ
TLSH
T1DC067C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5691d6d091d85a0e9c959074270c7c278b2756af84eac7f4215912b4f6c5d2b7
MD5 f4b03ccbea4984e38fa2e899ea97e6b0
SHA1 587cb38c118d34aa661ca4b1fd79312cc2e7b185
SHA512 f794ba54b8ddbf157c33fcde024a64e4d171bf40e673a105a9b1eb330534f497ca5bf9c409b0fd70ec9257dd185f362e7ae33c32538eb76ccf03ffc171bbecd8
SSDEEP 24576:k47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYV+LaESOXA7NhrYD1/STITmr1mMi:k47JUQj4irIhCnDHUPfF//+eESOXA7Nv
TLSH
T1F165AE1EA3EC01E5E17A827885554A1AEA71782E1F31CACF1270837D6F27ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c06f054b34f208aa5866a4e9e04345f1758dae64c951c47bfa96a2ccc4d4e360
MD5 55b0b24d2f6f64d7c88fc2c5f4bd1ebd
SHA1 d5d4cdcd6d1c8e6ca9e6dbd45930e47011f39937
SHA512 e043f685540dc02de2cc8563e4cbd716a1701a853eb1c262441938d40b2694d64208918729721c76d77326551a3f3da08a548966db3910d3e4c44936a53107c9
SSDEEP 12288:uGsfRun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:y++LaESOXA7NhrYD1/STITmr1mMi
TLSH
T124E4F10AD29852E8C12E9239C7954610F3677C6687E1D3DB13C0F57D1F7A590AEEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 17d73cd6ec9375deaf3fc7378969ac79ef8dd304013a10bddb597403a2f3cffa
MD5 a7da4452700a4f280e1e6a369e307dc5
SHA1 6d16b77531113ae92069a588ad7dec150138cc7d
SHA512 895e6ef69fae9b45255900ed3f515a3ca67462da32f9daaff9aac0c7cd96a9fe50593ea71911d889501fb330b854f0f8022c1f07c399050116557f420ba46123
SSDEEP 12288:pp2oU3fdZJ4P5iWhzm701uqWMs+BuY1Cc0chjnm58si:ppPUPxY8W2VgV1D0anm58si
TLSH
T131353800B666C74FC6A940725E33C5CCA7707D42EE44AB0772C8873F957665CBAFA292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6127875f01c85e906536ca885a9123505b807aa1f2a307f8052fbf192c312a01
MD5 5a1d9a766d6b655e3020d55962d9529b
SHA1 3f8298fa2f2a213a87f0d4beaa75fd5dcf23e254
SHA512 72ef953c9e00fac4f496d16a15f918f6c49dc52a2066b41cf03a0149918b657dfc2cd0e8234e5a86bb5a59858572c44358d42adea974db301012e5fbf0c7b11f
SSDEEP 6144:tGAfmX35nc+IqXQ+xAfmX36AfmX3tAfmX3VPYYwpiX317GN9HtMxb9HtMx92QvxT:KA+wgYwsnRGzp1
TLSH
T1DF55D8405537A3CFD1BA60B2072A5B0D6764EC06B7496F27B3C8453AE86AB05B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8a64de0d146a0544b6940ca62b8ba1378d61ef84ffc5603b90a326c90f969a52
MD5 97fb097bcc8119f7938806125814d375
SHA1 0a30cee34aa6850e8744a90732c0a85617d1ebee
SHA512 44d60065049341f1f17367bdea098100edc890f5cff2c991439f3bfbf555fae10a63bba5418cf759eb4f4bda262ca924299ec2a3aa498cad155e5ab545eb9130
SSDEEP 12288:4F7Jun+2+FjwXESOeSHvYqsNhruhD1/KNfkCb2LTzKrJPDmMij9:c2+LaESOXA7NhrYD1/STITmr1mMi
TLSH
T17ED4230652D8AAD5D32B8E35D0DC4034A3DDBDBB4FC88AFB7601A6989E7C4C0FA65714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 26317389ae5b8d00f940a592ed416552080523c7b9ef342019053de95c1478fd
MD5 a1b6a0c457262b8a930dcb6517a76df0
SHA1 cc41e81be22af7b6ffd88872f4992482d1240ca9
SHA512 2ad8a33121e6fd80d852e2760f7450e9e73e7c36da12ccc7513bc57cd3e532ec21eea94b76b6dc0016fbb51d4c93c373034cf4a910aba37296fe1b28bc492da6
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bY0+LaESOXA7NhrYD1/STITmr1mMi:kgb4mBIBhGFV+eESOXA7NhmbTmYM
TLSH
T17065AE1E22EC02F5E1FAD2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f8bc006feaada0cc85875ab4a9cfadc60998b149b10d5d9c21a16c63d89dd4e1
MD5 2af10873d9d9c859d965ef6db40e1b9f
SHA1 cd777ceb9159055447cd083bc69087de4ec92549
SHA512 2cae08b58e8371093bd5dd244899c0c26af6d9b521a7e95a98293a36416621c485769e2761e32fab152c60a54021540e944ff6099732f912a19f51c518659f8a
SSDEEP 24576:zG88u8FpJqH1Wzria7/ml+LaESOXA7NhrYD1/STITmr1mMi:C7ZFPqVha7/s+eESOXA7NhmbTmYM
TLSH
T1F435F16566E002F0D47BD138C9864663F6B2B8260364EFEF07988B551F33AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 12ba940a063bdf1b72d5bee9962551c65e25a5590bc495469620854aa9405b7d
MD5 0f477ae4dcadc713e0ee3af3e4268748
SHA1 ac85f162307e4ae2f59954b7ae5addd0d5221c79
SHA512 040f324362e02c34048efd1418ef0ebf2ce7d8a7156394c3690b4bacd19284a7e3315a041f1a335c18291a53f9d35b77bfbcb8109e34d60dc642cfb5e19460d0
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjx+eESOXA7NhmbTmYM:iG05lO43bkESOQjZ
TLSH
T133D5C06E62EC11F9D1BBC17CD9C6460BEBB23825032556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 753d3031cdccc3df8c289144a6af83b763a2589b95795c20d9e0c75b8fbd3c5d
MD5 e94508cb929f33acbafe26a606483f53
SHA1 6f9c7415f774e7432d0b46901f17cc275e50e49f
SHA512 7827b9fa70d3814e6a449963df5fefbaa340d81c49bace4a98b331a33637dd17a28dac3b2308c8ead013297f12bf8f5bd102f93faef6f97b763d8c59721a0c64
SSDEEP 24576:8fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnP+LaESOXA7NhrYD1/STITmr1mMi:ka5POZ39Jt2pasx2+m5+eESOXA7Nhmb+
TLSH
T17D65AF5EA6FC01D5D179D17DC583861AE5B1342653319BCF022182BE3F2BEE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b9ae9c621fd71c41819b19117e28fe985720d785683f75c077f2d65eaf38ec60
MD5 b547dbfcd231b794918dfb28271e7430
SHA1 252e7057dea31387cbab9c3de57055d82d13daf0
SHA512 c06f453d91447bbb1411f8c277db39d0abe610d7af8ebbd552876585acff866bcb428e2aa65f04ef10190919d406caadfee42d08088942ac02191c78f2404b9e
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkN+LaESOXA7NhrYD1/STITmr1mMi:wNc/zEOVHFM+eESOXA7NhmbTmYM
TLSH
T1EC858C1623E901E4E1BBE1BE89779546FAB1786513348ACF0291851F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b07ef51dd3b13fbdf2ae7b9b7159086c99ad65c7b0d4b79f8449f95c3a60ed51
MD5 59026827ae81fbdb79aca16330ad4a75
SHA1 3e96975567aafa8dcfb41a43a3722aa70638b569
SHA512 40d5bc02535db80ea5a0110b78a8ed5d77a87a6841609d1af987621a3ef083f96bfbedc220d9a9dc578532357c50a6d8eca47768ed6ab9018a5b136e86047019
SSDEEP 24576:itkNvNnaFeYhJNtmZBmH+LaESOXA7NhrYD1/STITmr1mMi:itMwBtOmH+eESOXA7NhmbTmYM
TLSH
T18855AF2EB6F846E4D1BEC6B5CD238512E6727861073293CB5390C13E0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4f2c28bd8ee42afde9cee69717109099d4c7b81bf317d1fd1167b21cf5d3ccd4
MD5 f9b29438c92a91988421d90cd7309d0b
SHA1 37da007d99bb519490712e226ed4d7478ae2056b
SHA512 16fe4a916cbf374492d888664700afc6bd8a0c8b365aa51be7c1256ce8397a85cbebeeaf08c79ef0cd1ae6c8b07ae5a8c36bfa114b7811f6188c1790aeadb96f
SSDEEP 24576:dPUr+NQh+LaESOXA7NhrYD1/STITmr1mMi:dJQh+eESOXA7NhmbTmYM
TLSH
T1F205E11F22E818E5E67AE17DC5868619F3B1B862074192DF0291817E4F77DE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 eb4c93de2d0628e4909bc94922faf255646f489cc2b7d9aa2cd373c0eec04483
MD5 c813a1989cd3b0a5bd7b14fd080edf8f
SHA1 8ff421ac21a0d25a0a9c0b48687d5cb8f2ed3e1d
SHA512 289fde52ee5d558ea0fe69d94b8a4e0faa690480380a03593c4c3a106ec640d6a85a7300d4e2035ddb1b88b8cba5022ee00965d4ee50b04fbda8f2dc459f8bfc
SSDEEP 24576:uD3FHshBIYQgAK+LaESOXA7NhrYD1/STITmr1mMi:uDVHeBIAAK+eESOXA7NhmbTmYM
TLSH
T1EB25E13EE69C04E4D57BC1BCD6A38A06E3B138A9032156DB1294C1B95F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-6-0x0000000140000000-0x0000000140405000-memory.dmp

Download

memory/1356-33-0x0000000140000000-0x0000000140405000-memory.dmp

Download

memory/1356-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1356-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1356-32-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2452-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2452-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2452-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2452-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2804-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2804-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2804-111-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2804-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2804-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2804-322-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3860-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3860-318-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3860-94-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/3860-89-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/4512-418-0x000001C264370000-0x000001C26453A000-memory.dmp

Download

memory/4512-336-0x000001C264370000-0x000001C26453A000-memory.dmp

Download

memory/4624-57-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4624-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4624-60-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4624-51-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4624-50-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4984-339-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-342-0x00007FFBF0950000-0x00007FFBF0CF1000-memory.dmp

Download

memory/4984-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4984-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4984-346-0x00007FFBF1FE0000-0x00007FFBF235C000-memory.dmp

Download

memory/4984-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4984-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-105-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4992-321-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4992-123-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4992-131-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4992-125-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5136-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5136-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5136-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5136-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5168-317-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5168-84-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5168-78-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5168-76-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5484-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5484-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5484-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5484-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5484-145-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6164-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6164-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6164-46-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6164-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6164-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6416-316-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6416-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6416-72-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6416-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download