d93ec145c5616754d3efe48ccac7ec022a7075430ceaba14cb780bd9a36e2613

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260702-v67wmsaz2x
SHA256 d93ec145c5616754d3efe48ccac7ec022a7075430ceaba14cb780bd9a36e2613
MD5 599810038dbfd65a38e1c6bbf7ce2599
SHA1 0b92f4c1413bb033e128f32b086fe54d159b0a09
SHA512 ca9fe21d910796baba899b79a5e2a533d884e3002f8ab24819acdfe7548dab838b9834e127b73f77c00f4cb727df32d72836d51f8d1a41f0c1ac09c8523fd07b
SSDEEP 49152:SfWxV6vVfWe6OeaVVkzAsgFFGxYK/3XSbhv+NVrcho98awZgXTtLx2LNiXicJFFS:qxevkv+NCsx27wRGpj3
TLSH
T1D4167B17E7B940F5C0BAD13D8A569657FAB2784A873197CB43A0875A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5736	elevation_service.exe
2544	elevation_service.exe
1152	maintenanceservice.exe
5132	OSE.EXE
5920	PerceptionSimulationService.exe
2248	perfhost.exe
5416	ReFsDedupSvc.exe
4716	SensorDataService.exe
3088	ssh-agent.exe
5208	AgentService.exe
464	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\49927141118c7e83.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110781\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d74c04ba490add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062aca775490add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026745477490add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037a82376490add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9fe58ba490add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007f175b77490add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2780	2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5736	elevation_service.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5208	AgentService.exe
Token: 33	464	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	464	SearchIndexer.exe
Token: SeDebugPrivilege	5736	elevation_service.exe
Token: SeDebugPrivilege	2544	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 1344	464	SearchIndexer.exe	99
PID 464 wrote to memory of 5324	464	SearchIndexer.exe	100
PID 464 wrote to memory of 792	464	SearchIndexer.exe	101
PID 464 wrote to memory of 6140	464	SearchIndexer.exe	102
PID 464 wrote to memory of 4080	464	SearchIndexer.exe	104
PID 464 wrote to memory of 1244	464	SearchIndexer.exe	105
PID 464 wrote to memory of 2064	464	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_599810038dbfd65a38e1c6bbf7ce2599_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5208

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe4827e511f5119d15d914a53509cac8407b53c68f2e8707ad7366e9728689a8
MD5 3eb83e68a69d234abd8223f11f25007f
SHA1 a91794a664fb097fa59bc126fe4a1f163752eac9
SHA512 0d1a21ce423d48d8273a464399ea9e7fb97a7a17356b44cd648657d272d63f9634e9669f5e0bec2ed3a05ee0d574b36a900760d8c4cca48e5a76138c35443fa7
SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxneLNiXicJFFRGNzj3:U3q6mjBB7wRGpj3
TLSH
T158D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f6b73bbad694b64173a14f6d36fdb9e5a3a6ab79948a53c031623cd26bc3a9b6
MD5 b301a86ca309fa7706c53f681f2f065d
SHA1 d59253242c84e048b2c9ebcdaf049923560780a8
SHA512 3eed015c0cafde66194c490e7655ea11b473038df9612a1606a40ec50aed95a77fad6e9a183334c9502932ea8ef00c975e3572cd1e3cc182223985acfb587a6f
SSDEEP 24576:vXYfDtczAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:atcjLNiXicJFFRGNzj3
TLSH
T1AC75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dc74239b110e975881ab2ebc050d48997653cdcbb5117048c0d12d6f5ee7374e
MD5 e14c9d838d210a53d2175b58843bcebe
SHA1 bcd73969881d4731eacdf7f9f8bb65d82f624a21
SHA512 988b5c692671d213c1349dc9368474333ce0874ea3fd334c62c9555f19396e719879a4d73d68e6f1e0dda4e637542a399cb851fcbcfe6d9fce889c21d66f0588
SSDEEP 24576:60Le5ji0hmxhrMV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0Az0LNiXicJFFRGNzj3
TLSH
T14F859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e95078e20666ea373891f426042a926401f70992d326076e88c7bbdbc9366ab6
MD5 1fd91b4f332a926ea262d2176e6bc784
SHA1 b44b91f545af5c99e4eff3c3981b29d1e5b4fdf1
SHA512 7874ac53a2222d7a6e6330c9b81e765c464b1575f6b6436e29ac4ff02683ef153305bfa8653e8ffc761d637cb2f24aa0a59a76708881d5ef0139404ba5300bc0
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyuT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n/ezSC6vUzPv+HjyQLNiXicJFFRGNzj3
TLSH
T1E2756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 252741ec583058947094c4dfaf2d53e4e84cf6b2e67f3aa23e413f2d2c5a8c85
MD5 891049a1e56a699a990239ad97b075d5
SHA1 54eec69bf2e9e8b9d8238e6b35680fc105572e84
SHA512 72fc83b3278441aae543a8b7bb4439bd9102b817a01ff6e0f86a9ffeba32793851670094638bd0a0f802922361d2940873d82326734a0f44e5edeb8e65b704a1
SSDEEP 24576:pVbqPb88hv/l+B+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pVO88hXl+ULNiXicJFFRGNzj3
TLSH
T170559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1ce8784df6a32a130035739b5c8ca71c7a11418b50ae0452a1213b616047d3d5
MD5 2d9f17eab1e165bb921246f9791d1ea3
SHA1 18de42e4f528e84a164c167b89682ad7f0c3ffec
SHA512 0140aa0141815d915aa5998f3190240b133aeb4a1050e07f96991686c16d82a6c99f0c7e182c3a719feecfe16724366943269faff214ffdd892fd45cbb9496c5
SSDEEP 24576:yGJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
TLSH
T1805523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 427910e1d7823c410baa370cd434b67c30a78e5d5955fd355796c219dfcf4b6b
MD5 8064f6324b68c420838ca297d0984b2b
SHA1 d180a723934ce131e1b372983cabbfef09154b31
SHA512 861f4c25bc1610ff0fd8ad5d856b188a1d25fc761a25093e91497dd931ff468e815f16f0bf6cc44bab012c3c4fce50a7401ae000d12acb3c6fff0e2fdb509762
SSDEEP 24576:jJIU2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIU2LNiXicJFFRGNzj3
TLSH
T10775CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3f3f0ff2796278234e418ba255fa7bf11094f1b5f4e44914feac05611f1d5a32
MD5 eb0b1cb5e6011bf30c55a50f3c28836e
SHA1 bd29c2ec805b4ab6c6f15588c399f82c51f2c743
SHA512 a3479d9043a566ae6b0db95d0014ad2b6e7a259d1d4957a471db3b589eac675042c71bed1ae2be31bab20265492636765463504a6c46f09269a5faf501ef53ec
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH4:dQvGAdlCEL8c/WRNw5CD7wRGpj3
TLSH
T182266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 24b98866756943c95afab253e1ca602669e59e2d493a789fd7ffe1271671dff9
MD5 66eee738de4deb6ed7117a57dffbcb2b
SHA1 067d942a90b2ad3401359b90cc81e423e7fd0ea0
SHA512 16d5bb77b8592322d1d4e62e36c908fb142d41149b2b0e271ea54915fabfe2937d058af4bc834aa6dd935a2325311c0da630eb2000a45fbf02cbc7aaa0f1dae4
SSDEEP 24576:rfewsAjk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rljkLNiXicJFFRGNzj3
TLSH
T16875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7aeb505f362f2e3aa60293a8bab19bcabec2f2305b2cb8b30654dffe461c4299
MD5 07e2fe9497bf1abc0d2f456528212a7b
SHA1 f27d3f2b360fa30f2c3ffe7d6e4510230d17efde
SHA512 3084d715decee309d299d7352e0002fd6407dce9d6a128282c99dece83c105e2983d7fb5ce4a69d5f79d7e13b6249622f1fbc9df68c084d5846e84fd511f3418
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHIF9:QUEtQevvqc2W1cpV20I3289
TLSH
T1A0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5984bde528e8669a10090033b9f438872f2964abadc7f658684f66aa68f9d17b
MD5 b99fc95b0869c47977f18d61a8c2ab3a
SHA1 d229b368585a16fab7189117070cd4c51adbab17
SHA512 2b933bb1ec41ae9ee5e27ddea33e6cdaa489e67cc135c05002c7b98d1b2fd2b423b11f530924d62cdb2ff9a2b91255f02a3c544d1998e450e05fdaa4ac4c2504
SSDEEP 49152:uCbRquA/m2yL5zLfFiV+XenmE3/zELNiXicJFFRGNzj3:Doq2Vjnmf7wRGpj3
TLSH
T171D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 002db1409d8e2904905ee4719a5af8f0f55018631f9d18b7091a106394b89bf2
MD5 f5158d659099380900448b24be884fec
SHA1 37a49318b7529b4cb4eea21ea3188c2189fda63c
SHA512 174cc04c488c9bb7077ae7122d12022f4682b1cf1f677567a5ea9f4059dc7c6cb1f411e56ca3bdd763f9a9439c63b391af3db0b3993c0f0f4299feaf36ec7f98
SSDEEP 24576:UAhGL6IFoiwtA5l7S53//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UAM5Foiq5PLNiXicJFFRGNzj3
TLSH
T111359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a14bb2676bb7e7846b3ee3ee64d84a33d6e2f7bbf888353051243b9bcee45941
MD5 a8808d9562cb3802ec80c59da7e18116
SHA1 e022f4d6ef25bdb8afe93be408682a074596bedf
SHA512 545c6a5d99786f2f46be82ff9b6aa55f6bcf25bceb669db1bcf1e452095937173a37c60444c4c57e7f66e5345bce26799254a02774a24abcc97f7e15b55ef927
SSDEEP 24576:NwuROWw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NwSOrLNiXicJFFRGNzj3
TLSH
T1C665F18632940CF9EABA41398657C035F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 36febc6be30ae04753d73cd70cc792826b2fc3e84ada23b6c88fe318f8dbfca2
MD5 18913a89f97da15450036d3c23d0a1c5
SHA1 731ee5962db5e8b17736ffd540feb9d9c0a2f464
SHA512 0ec4700190fd607a537635010fe549c5785f8ec1a7671da65ae60d0af217a2c560a3d90f9ce4a0aa9fb51eeffae91db1cd290f6b6d7e6226507d847c535ec7a6
SSDEEP 24576:BZuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
TLSH
T17955129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8abb4262de840fe9b78bb23ceb5faa1fbf509df70b3d4d837b91c42da2662d18
MD5 4870843391f5f4a8b2385f643416673b
SHA1 ecd925cf79539cf5f3867476c2d97bee965d6f99
SHA512 f981bd449e584b749ba5e488d0fb916bb1f6943b89fb50079c4a6f10b378f776f1f111aa237c14f771489b3dab590f58d55c3a2019edc95fd935495e74456da3
SSDEEP 98304:OQRQyi36YOcPDLvw2gAf+PN3i7wRGpj3:VQyiKanX+PN2F9
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c4d2b5ce3794bd630ce8eda37ec157d791b7fb3ed8068103e619bcfdf3e40aa
MD5 21e8bc9d102b5f35f7a277e2bceb3666
SHA1 6107eec84b57d01246444170e6ab4476cf91df74
SHA512 7db66531cf2ea40410a63c268e7115f823c680e9e2d9f21ec50ff3bfc83fc042eacf8c449be0f23e942529ee23c3dae6ce00478aec112196088ef15f430f790c
SSDEEP 98304:mQRQyi36YOcPDLvw2gAf+PN3i7wRGpj3:NQyiKanX+PN2F9
TLSH
T1A6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8214f8851180a1722ec8f2bd9285ed7a54e36ec21446a4d4a077197e5ae5ae43
MD5 838a160ef4fcffaa3b7178ead687de48
SHA1 7c2e4ec2c2f457a0fbd1b8ebd13d71c8ad428abf
SHA512 e38be045f88facd1063a0eecb60240ad080acc01a9732be4b9c85309d6620d6718a1ab751b14a38c7ca0c69bc052d4c19103dc330e02a58bcd8812d1236ae317
SSDEEP 49152:168Qg55nhkeWu7PNU3/0LNiXicJFFRGNzj3:DthTRc/07wRGpj3
TLSH
T1AEB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3f8e140635880661088707734fa6586013cee825f358e7bb0c5fce34b31840d5
MD5 7720af01273e07cd073b982634b62734
SHA1 1a87f91315a0cc76cab2692f5a5b3a494a5fcfc0
SHA512 b1f0df666b668f71aee2f3872db96126c804b73cf2281064b7020a0526f8876f78ed75ac1ff22781f2dfea8eff861e13030048d90e6142ff418b41fe05095108
SSDEEP 98304:4y5112gYy5azzVvU69nLKnhZJ7wRGpj3:RLIHRWh7F9
TLSH
T10C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8f19a872e0a1f254b28d9b224f0063119ba6e83234ee14c28545a287dc34dfc
MD5 82f463ad980eb3603a60b5df8b03a302
SHA1 3ec398efcc5c3c597562c350a469b51e9840c3c5
SHA512 d0935555f9acbf2b7191808a90738341e3eedf374455e92cca09b348c55786537279da128595d29f6cf51e13a04298546c2aa3e17e3fd126a44ab53c0eba4b57
SSDEEP 49152:6B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gldLNiXicJFFRGNzj3:ou6JmIxd2dd7wRGpj3
TLSH
T1D2D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a41865e81b2081762bdc144c5d6590484cc26f3875cd1303c4598bc67541fe82
MD5 3cea6b1c194510896b8ea42de49e2eed
SHA1 783699ed208bd863b4cdfaa2427a353bc3564b36
SHA512 3539b863baecb3d8de3c9ad124a5551b7fe931169d45834693fddfe8957909e0abb96d14b7f3c952a3dc6802f162b161fa6f6e242f8a28adf0b88bb2e008efb0
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4xWLNiXicJFFRGNzj3:YmifPqRf7wRGpj3
TLSH
T19EB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 656e0d5ebdc7b29dcc2b5465eb0a53317ed4f9acc4e5d1f5aed77a6529ff081d
MD5 539bc13bf4f9c0b88ebe5eb00f889c66
SHA1 448222fe68c1476b7629fd8b290a9ce820a2dfbf
SHA512 dbd2a2461f0649760e568f1d55b099d91de4d86cccc628fe2959b92eb3a99a762f3705656e1272bf110c82748303262c15abc681a64e2110a022b7e18327c439
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHqNLNiXicJFFRGNzj3:D5dKqi61N7wRGpj3
TLSH
T189C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 31fe0e5328c92b7c947bbfbc31b911540ca9bb4373a0653fdafc35a1f3111677
MD5 46df2d72871fa80b41b1cdc82a64ea7f
SHA1 c539e7be50542830ef46a906d9001e462e9b0bfc
SHA512 80d30cd0d0e0943b9a63b1533822027aa0010590145c80b5fba0960e72a4a06bebfd0b6253d5108eceb423985042e60581422590a212f3f283b7ad35cfe8b946
SSDEEP 49152:8htSn8EApI0figjgiDn0AP5wqLNiXicJFFRGNzj3:9X2iWphL7wRGpj3
TLSH
T16895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 836e682408efca8cde27e779f36f7636c52d3af365ba09a87a6170a339e015d2
MD5 b7268a99eecb239e11b4f9e7f4f92f4e
SHA1 5e7db48d28c9eea332fe3274c43aaaa93d9d044b
SHA512 37dd12069b01b4629e91539a5e2c0e8ddab2402a7c4cf9db33510a78e59ea2f8721bc3139beecd3309b5a6590fec9f9b9a0041f6f5eeb1a344814206cb34f079
SSDEEP 12288:H9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3558955B1FBFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 975f6d3b42ceb416d6d14d586c743acd35e40c80f5bf9155c0492e08dd049350
MD5 b71390bc865ffacdef96b2a02642ccce
SHA1 7368671ed8ea010f0684ac978a1bef7873ace6ee
SHA512 fd6a919d3e242799600634878c54281ab3850100ae73754469ec187380424845718af4a26f04f6fcc8c183c1f045cc753abeb3b821346466b64792602b057a00
SSDEEP 12288:ROiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E85523D3558955B1E6BC0039C6764428F5882E2DEB5618E3E2483D1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 43207c2a4336c035ff727865aa9734594b36517b1f42f637fc7a27862cde0a81
MD5 1619eb7104ada4a7ec93000360deb8c3
SHA1 4ad9be8dd30bb2af8e67ae2a5c32b9563c7d9ea4
SHA512 c2d252958ad5387aecb5b8e3b9a447b59b61ff42f1c862a33fd1ce19741f0fbdf8764e05520cf552c635b418bd0013bbf8402c42611e23812701e1403327ce5b
SSDEEP 12288:VEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3558955B2E6FC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c41527db0d0128e83930b547890aa5d556cb9e5c0bdb03ba7da47b8931e7258a
MD5 39265450ceb7c82d245646021652312e
SHA1 0a16d737b663aa5e465724aab7856271bbd5be07
SHA512 26dbb4ac171d95ea9a4171f5bdbe315af64ab265e2d90754cb31f0646df758fa6a8b9575c03b759b20da2e343415750c8cb8879307a7093cf69980a23220179e
SSDEEP 12288:GVLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E5552392168901E1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 21421284c4e8356d17ee6d22486a3ee85453d2a3f20068a3816a9dbce19e24f0
MD5 340230453ef9ee868c3d7bd5ceb74ca6
SHA1 ab0f19a651b0ee397e8956990097b47bc0d724df
SHA512 0480f44522af15fd012c84644ea9a80d8b088f58dd50117308b5bde94aa5caf30b9cff066a1390464aaa8ba381177ea96e7d4595b8aeb4b2fad934dd35a81bc5
SSDEEP 12288:6ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF5523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 537fc0b808d7de5d6f33ab7fd187c4ca24aa6184934ccd719797220d2edb67ba
MD5 6866594c1cffcd1e3a5a6a37be60c4ba
SHA1 358d8cb24aa8396d90e9c0cf032b4a95351f0711
SHA512 d668484eba4b189919f8cbb92c12260a713ac7de5239f45d776a6d2a694827cd9e4f516402c6a62fd479e8ae656657e200c326d5b88f0802585dde4649ea9251
SSDEEP 12288:XaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3558955B1E6BC0039C6764428F5881E2DEB5618E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4f918a1fe788f3b7a9e6713f31d6c2982d4ced80ee1130be571f7517b66ea6b3
MD5 0f9166654f465996911f81a852e3178e
SHA1 1c9aaec09d185fd7009e150f2eadd681ce260bfd
SHA512 5fedf7046e707ca379cec6016b2870129ea5326d1463a15fc7c63c58c7ffd9eafaba80a6c66005f85d723f37c083761a6b5c1faf8b15b2d7ff38c43896636afc
SSDEEP 12288:C2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3558955B1EBBC003986754428F5882E2DEB5619E3E2083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 47116731a20c9cbd02daf153d9f38240a8e6f8d982370f094d25666e0e03bffb
MD5 7232a0f22fa4d1da2949cf1f48f93fad
SHA1 229f3303e1a6ef80975d51a6570910923ac3d18d
SHA512 985660af43197935f4515960e9907d076630a7d4ad7a72a5b133d5b4772eca2902f28b311ab72e238b127d89639e20ff590283ddf9f84b0244a855b5df880bc8
SSDEEP 24576:zZM3zFVSOY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zZM3zfsLNiXicJFFRGNzj3
TLSH
T1DF750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8bffe10d7a3de70584279a14a45606fe7f90dd2e0499875b97c9eb36336deb1b
MD5 f393d84c128a045df4574bf64b4984b5
SHA1 27165c98a4ae604264073cf01072689d95608954
SHA512 16a3a9e05d79fa5575392cd7791da274c22d9c11f6a96c83c09d3271dd9bcfc653e2bf560ada8c317aeaf8e3549e9a044b406edaba1a5f45c661dbae278d2921
SSDEEP 12288:XxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3558955B1EBFC0039C6764428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a4fc89f3c3365be4a8a354424e842e883beeff5be50b325ad482ccabb51e02a4
MD5 65d378de74564081401d55af3f960c54
SHA1 14403e84e3f16f84d979e7b3def47385c6a73afe
SHA512 df651e60f382cc0c8a4e2bd66964a9bc2bf432912ac9e5d379d5cacc0df1de90b6f770aea90d52323cac486ebe9873209df1ab84caf32c0797dcbafe7fec6785
SSDEEP 12288:rViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E2083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2c830cadcc24e48f4411a078e3ce2278506775d323e97112881d6fa57d59de22
MD5 724a11f7a21b29d28b8f0405c41b8191
SHA1 bea04427486eccc9d336d9a654787b47617e7f34
SHA512 44a75b426dab7556aa5b03e9dee91824aeae41dfc0ab2c61408fc034c87cd057d0befd256ddb53d63e591e4d348a71b0a7540b41de638264110abdf6761fd826
SSDEEP 24576:/zyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/LLNiXicJFFRGNzj3
TLSH
T10C650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 922af4edcfac478a0f90e5b42ae07458a0fa2cfd8caba49e5c43a0430416e249
MD5 cad3e7917afc35b617c0fb11f0c31c6a
SHA1 be4b7437024f1b65657044be692d479ad57e8402
SHA512 8449bf5ffc239d1522c1e643104408f646a27a74ea585f446b8d2d4b028f4e038cfda8126a69d7c9e81462c799640b6b2eb6394bee35b474b41a326f88c07fed
SSDEEP 12288:DxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF5523D3558955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f0c54aeb02fe25570fc8e52182d2ce5f7be5d0c4c2cbf31b37f78da4170e524e
MD5 5de79a736e2552ed1c95e5d9a78b1243
SHA1 fe699f935fbd0a193c6539dd17c0338e4d4f2bbe
SHA512 4527e98cf2aa5a5745565466ba47cd3d6ac109d4e9912f372f24c525cd4641e2af294b1d8a502f18dc24d657b529672a39c9403dab3136db24de8487b22a836e
SSDEEP 12288:dxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3558955B1EBFC003986764428F5881E2DEB5619E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 05dd479ed25032cdc7e0115bf1c5137735db186f34ffb69338ae7a9abefd8e53
MD5 a3f9e52f145af572785f1632503fb477
SHA1 5b56ec6a17f59732970aa358db0e40b8546fa8cf
SHA512 a67f57cfe692ede27c2be23cb886ecf1eb20342fd7e436cf6e212ac07f6f0fe2981ed38a9113c73c39ea047cdadde7b7149ae50ebe6ed55ffcad7afb2f7c1762
SSDEEP 24576:+zyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LLNiXicJFFRGNzj3
TLSH
T110650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6ef3a734176e5d4b6f1f1ba3800b6021433e7dcf235c3d8aaceeb09957473550
MD5 274b0be01b495673af46b201f35a6ef7
SHA1 56fd81ad25d7f4665ad14ef2c8c685f39f320475
SHA512 9778dcecca9008b900a172fdf9c1918608e71d44181ee8ade8f001b65cca1872974b14e7ad76a6d75273d6ce7fb405979fff3212947d19bed3e98675870275dc
SSDEEP 24576:jT8aLl3z0zDe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jT7LljTLNiXicJFFRGNzj3
TLSH
T1EF7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d23d8dc07287be92f145f5456de9591e44feeb662e729aae8c785b4c12871418
MD5 65647253de6fc9cf1606e5132af6be71
SHA1 86494aef435959088181a31ed8230ee832293769
SHA512 fde5eb3d4071e6627e52b5fe21873c351320a7e40401ff4693d5072d8b21ca83b33be8b221d2f48e1cf17f4a465f344f78e684aff66315369f9caf55b654a615
SSDEEP 24576:+3rd9CHKy7GZC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ard9CHKyasLNiXicJFFRGNzj3
TLSH
T16585CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8ff3dbca939b1974b31a6508681d9aaf0642fbd39b546a4c409be7e8ec460235
MD5 c7587f8688416b3e7df745dbf5849065
SHA1 7545125fe97758733e66cb334321b0964e7720fd
SHA512 803aa1ec74c8146ea8580e09b8fbc5006db2b2eefad8b0e322707f758ba2088d416e8fd893d60e026af5e09869ee6875a63067c8a20a5b38c4384c39124363d2
SSDEEP 12288:4kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3558955B1E6FC0039C67A4428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5811f82a10034f0e7b032c7282c355ae0eb34c0798fd217af677f6d863d83978
MD5 07419b2eafd1b7054c3d298c575316da
SHA1 ed0b65e2409821a3b35255a352aa705688f16abb
SHA512 aaadfd5c9ee01bc5e644c0be3cfcea4cc720e076dce4548bdef771553926637bc75164ceae9cea821fc133559c5ed5f1f18594bcfe906871927142ac715a415a
SSDEEP 12288:sSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D2558955B1F6BC0039867A4428F5881E2DDB5619E3E2443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 01a63bbae12073a7476021a97b8aaded00acd240dddbd2ebd26082f6a5ff02e9
MD5 a6eb3fa34c4211e050ce8c7fd724ad91
SHA1 8fa0b23fc7cc63de700c9ddae042db7ba237a6d4
SHA512 a5b2e67fb6b39106f1548c16c9c1a05ea3711948d9a9417cc4a9e249bdc2048d12cc447e2361a3068dd4371b6b0b9704c0788be61d93a1d28094e8a789c608a7
SSDEEP 12288:IPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D3558955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4aad77e3273b4a0322d0625fd6e9639f165bf1655c143372074fe8a5519783b8
MD5 680e8f9b43f11909659cd2892481301b
SHA1 099681f0b521e8d095229f7ff0c8f1da8c41a664
SHA512 b71afd072af8204929912f2a8230b0e52e6b5cf0ab424c1e1ebb4edb1802e11446d0e2499d216850001617d6f57a404a6d9886a8e39eeb621b0c6336587e0292
SSDEEP 12288:wxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EE5523D3558955B1EBFC003986764428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9ef20327146b7991c3eb952e3a958013221553180f45db8bea9af757dd85bb1e
MD5 18f854f6e1a023d834387156b5399eab
SHA1 d6da7907424c3ee20cc8ed337230cf0435c1d467
SHA512 d69b80062c720487480e36684c3b8a42e6270606d523f8ee8d01f5c90f0f3a642742fa2cab3f916fae930acde52e545644f25fe947f58d2e9560c613ce47d491
SSDEEP 12288:akiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:au/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9c50fb1572ca101c74f5739fc191c597faead84535bc4ad1a3e5cd8bcb71137d
MD5 de46ef0669431378e71f49da4bb35e58
SHA1 0faaabc000c9512c2c65b022214415077e456cef
SHA512 01296cd53ddef54e540d7e6490306ba23187ba992a7380b7797a502cc23f46df65804380a1774e8e0da12b0ed9e904e7c97dd6b9449dfbb7412d760f3415c6db
SSDEEP 12288:l5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ll/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3558955B1E6BC0039C6764428F5881E2DEB5619E3E2483E1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3aeb88c018026af7e086d1100c9f181ec0321e403acdc124092db16976bb40bd
MD5 73ffe8db9236f4b971f2e242b707a0d4
SHA1 52caf0a39e43b849f59a7e2d48809415a94f666a
SHA512 fce461a43600c61c6ba539b6f098aa1c1f084793e4b32312f9af0dcd985fed827b9002ab321940293db0cc876c08f204aac4c13f75f068f7f2466bb596b1bf34
SSDEEP 12288:SziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD5523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 bcd23f3975659e99255d676d2043bb5159a5333e7d3fe2e9ccd1c28e2fb18b46
MD5 49b0e7a8034afa0aa256c25e6e7b0330
SHA1 73007a24be87f91c70a9a5220d6be2ecfd6b3cca
SHA512 27301928511344907d77eb9189a58a08afd09c5129894423d19c9f8dbddb4689f4d700448ed1126dd96e69f2b74711f1153162b7a55db365904d7558bed74e26
SSDEEP 24576:yfwvzk9RX6wkyAIp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5MnYIpLNiXicJFFRGNzj3
TLSH
T1E585D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9abadca578cf273fc618b0575c7b2e171925a91072a19066c33bcdae32c05610
MD5 be9135c15a78fe42032e49ffcd739d0a
SHA1 07eeaf0037a6cc7b5e7f84787bd36151de784a82
SHA512 49ed98bf9d6d1b1b0176683a75fa5f413cb4a22cab7bc6c4e1c30d4e6a53154a8024155779181a5326850b8290ed56831b073d664cf43b8f0fc25b8ad0edd613
SSDEEP 49152:LYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KLNiXicJFFRGN:WySzPC7wRGpj3
TLSH
T19F066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 982c0c6c11059f2a670cebf1fa6d6ff6c91674ee8e99d9e1048268dee49bd753
MD5 b3ef80c7d1296cfb11f8a97e84a41dd3
SHA1 83994fcd8bfa3c7f69b27cd09b8a73ce95a8c0db
SHA512 5cb5e98edefa753efe6fab8e42b3bc795866cc36f8211308aaebf514258feca418411cd3a577d7bec5b1819f2ec75abb3a4f3a77d989130fd82a5c4ae7e866e7
SSDEEP 24576:d47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d47JUQjqirIhCnDHUPfF/6LNiXicJFFS
TLSH
T1F465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 207a2eddb71d5547102195cdeeda512772d9561d9885beef3c11897271d8ab6e
MD5 d479a17dd7aaa635c844ae2c77047b52
SHA1 92a2cea93b77f87d08515ad5f104c108105c2d65
SHA512 fc2126ad50a17f9acd64d9ae082bc4d60ae75eb2b4042d2d0d49b33782c4ae71d37aef3ca91174902410c7b40e6c591d027d00ebef3961a79bc80e7f73e31db7
SSDEEP 12288:ApsfhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13165F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7a2ff51bbd0e32d7e605aeaca9647e1a779e14560a631eff2a8a9f48fcdab404
MD5 b2e2c6595fe7579029e18f677ddec57b
SHA1 73df418f808ef35bd14bec14896c25f477d28c1d
SHA512 cb0c8d61f9c7f86c0fa8553c1feb19ffe673e287cf9499c42feb1bfae776b665fe4b61d7bc1567a583b216fd09d0f9e0b635a5d9acfd2bca855969c2964ae502
SSDEEP 12288:HgCi6gKdU3fKH6RqHQJszbyZ7uvbODNKtlSNGsRNFb:HgB6JdUPKH624g2uvbiNKtoNGsRN
TLSH
T1DA450700B626D78BC6A940321E36D6CCA770BC01FE056F1773C9873FD476659BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 3fe559908bc81024350619e357658d1a5f662ee924bb4440ea3f40c83ba47e30
MD5 8e3180e76ee5ee250d24b596d6851af1
SHA1 41dce009eb9b2f880c5b2872fb62e880feaa605f
SHA512 c48d9dde178acc6daa6b14db332d52155a6d3d8e674cef45e87e83d153c508bbc5ea44f1c35891d8e7b240ba672ae5f95997e39616ad292df66c967ad0633304
SSDEEP 12288:R9B/nxstuksZ0vhf6/zsMZFCZuKXNGoEYRmnlGNZZzyZZPSuevqILfFe:R9Elg0vhf6/xZEcycMRmKOPHVIbFe
TLSH
T106550A01F5B3E34FC97A5037467286CEAB78AC13BB452B047344893C986765EB6E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8e18e5c65ae3f71f104b5babd780f0bc058bcdb97434d0f039862fe3cb7ada05
MD5 863e311bd7a0d4104c6e7ee652c4e21e
SHA1 d04bd79ff646d7bdb554062af10fc89fd1cdfbc6
SHA512 be528ffa627976cf584570b07160bf95c225b01a026d90de745b1d463ad8150d8cb1d0ae88739a0a9b471e500f87650d1773804a7cf3fdb2bc853bddd4154893
SSDEEP 12288:YF7piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:81/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A552393568859B1FAFD0039867A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 30ed5a44122b4177d49fec903d7cf9dc8fdb871a72ff0736073ccbf927472bbb
MD5 d8843ea8f9d10d939db9a0b1b587e509
SHA1 4641985eca3dd5ab073430db93290ec3b4960746
SHA512 6c0bf78c3a3b7c0e1b25b7650523aa0d5bbf8d2d9753d7a5b29cef543d1ace33a639d637f54acd8bfa1ccb1ffbee2fb1e88a4142ca0aef2e3f3adca274788ffb
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xgb4mBIBhGFILNiXicJFFRGNzj3
TLSH
T19065AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2fc6c15b3f41db3dd2459249aa4eba21f19b5336dbab957a8b81730550fa34dd
MD5 994d3ab0ca9a9d7febaa7fff97954176
SHA1 cda547b20c5e0f048596e133436a6822ab8e5b70
SHA512 e04a54176f598ef0a2c77937d6bd6ef5d61ffb9208694028d8b4fdf42948fecec196f75015753a1c0be4f4dbcc16652e185010e76e21d8b9b6cdaad8ee0fca0e
SSDEEP 24576:IG88u8FpJqH1vzria7/mY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r7ZFPqVya7/bLNiXicJFFRGNzj3
TLSH
T1DC85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 da63b879c0ac03e02bce6aca42f8820174b914f329f4411d84175d556d8d77c9
MD5 a05b2d15ce9c554c139fdb12de7927b6
SHA1 0e69b6c67b88c992742a10e816620f6bcb9c57e5
SHA512 bf15041828cb8c018b65f4c0e09db184ef60ae60d25441c1f5e0c6393b7844889b9cd7dc5350a57d5c5caa44586b7d7c325c2667746874a97bb96601fc714b3b
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8LNiXicJFFRGNzj3:TG05lO43bR7wRGpj3
TLSH
T12FD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9df480d1641f7320c2907e1cfe41313c70968acedea6f29ab5d0acc64d8273c6
MD5 641d4fcb9656e19534d0761115abf17c
SHA1 74570f449b4a3b8b598a1871fb3e0ae561428ff6
SHA512 5b92de4c7ee0c95a6f27252989b972dfb674f536b28aecdfb63fb63e1c7f7ec49266f78c870dd91d51ed18bf52c24a626045f9b59cd9f3932e78b5488f879d1a
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnK/TwSfVcYG3K/cJHlnFR+IGNe8jg:Xa5POZ3lJt2pasx2+m0LNiXicJFFRGNf
TLSH
T13965BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d317a3e7fd6007ae5575898f932503f9350200442e15c974cc5ee07c10412142
MD5 5c84a9b658a18765a24a046e206134eb
SHA1 037d29834b247529f3d683d93b72c7672dfe31f9
SHA512 edd221e46d1e6ef5a7802cce72ec76a18cb9671fe71ea9c7a79ad97eb0e906bba2609c6b0ae56f10ba93059ad3083f731b0e0e5ccfcc75580961c541bb075d06
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HNc/zEOVHF7LNiXicJFFRGNzj3
TLSH
T1D8858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4d669ac7a016826920e10cbfb761cf728f86570abe014a9268919cc523db2e6f
MD5 38c6d853b01640a4483d10a8babebcd9
SHA1 f926f7c413bcf3709ba29481bfe648c8f6cad7fd
SHA512 12a3410486f5fb40282175054fa58fdf1dec4923b78c242263060f88bd9f19769bf2018aeab27d7b9ebb167d7c7c845438fed0dcca6421b77a2910106e2ca998
SSDEEP 24576:xzkNvNnaFeYhJNtmZBmZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xzMwBtOmZLNiXicJFFRGNzj3
TLSH
T17A55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 27be1afa6750ed1e7e3a822bb90b7761800541ac6fb705bfe9cd5474e3cb9efe
MD5 63c9a6b80fc937486437deaacfdf7e39
SHA1 979b72e2f47b039e032da3430835cdd391999221
SHA512 476b8ff076bf3d546c3c54304b2e09657fc9dbcdb7bb8cd6f027b2a76f22fc2307f301b5fe62b30e5b43f1c91d381dc25dd9e01bef767d5ed04b5d77befaa11e
SSDEEP 24576:PPUr+NQs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJQsLNiXicJFFRGNzj3
TLSH
T15165F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4b494acdbe446154cdd00ead16fd1e440e7a52eee841e4bb43733a0c832e50e2
MD5 6e41d3326fc126f1e059d304cd6f2b6a
SHA1 e74641367c91b48d617af8b8c476d33d49a2f7c1
SHA512 77a714545d4d3f5e466b506066684c4b37277bbc45ee3ed83619cad1d15e6ff20cb33a2d8778837ed505ef53df92c3e140a4dcf9eb15157b248418d49435d1a3
SSDEEP 24576:GD3FHshBIYQgAB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GDVHeBIAABLNiXicJFFRGNzj3
TLSH
T1F675E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/464-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/464-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/464-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1152-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1152-57-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1152-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1152-61-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2248-320-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2248-88-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2248-94-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/2248-89-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/2544-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2544-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2544-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2544-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2780-48-0x0000000140000000-0x0000000140405000-memory.dmp

Download

memory/2780-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/2780-35-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/2780-6-0x0000000140000000-0x0000000140405000-memory.dmp

Download

memory/2780-9-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/2780-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3088-131-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3088-323-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3088-123-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4716-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4716-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4716-324-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4716-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4716-117-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4716-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5132-65-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5132-72-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5132-295-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5132-66-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5208-143-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5208-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5208-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5208-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5208-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5416-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-99-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5416-105-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5416-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-339-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5736-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5736-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5736-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5736-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5736-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5920-76-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5920-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5920-316-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5920-84-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download