52355d61c2dee68def4fab643c9137f70444343f4352f91f530243adf6fdbef0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260702-vcdeyah17w
SHA256 52355d61c2dee68def4fab643c9137f70444343f4352f91f530243adf6fdbef0
MD5 ac226115b1abcd1a36bca70ee18243d2
SHA1 e124084b53ba1ed9b7999ed1b7558eaf9d38c140
SHA512 03467fe031ef335f2e3047ef2bc438c45d1fa6f3a2971a747e070c46c0c864c60348bb34207329faade5243a52a9e0a55528e455b149d7b00197450611f32927
SSDEEP 49152:4HHwYJAhClcVzITEaFY2bwi8rquWXs+W/kakDcoLCcuDfqzzT1V8Dv66mG:LickaM0GeDv6V
TLSH
T1A5268B1BE6B941F5C0BAD1788A579617FAB27859873297CB4790431A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3868	elevation_service.exe
5808	elevation_service.exe
4728	maintenanceservice.exe
2328	OSE.EXE
5212	PerceptionSimulationService.exe
5476	perfhost.exe
2972	ReFsDedupSvc.exe
1244	SensorDataService.exe
6104	ssh-agent.exe
5828	AgentService.exe
896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\91db247a80095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-02_165026_2896-2520.log	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064f72cef420add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ae8efee420add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000dd45f6ee420add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1aabc30430add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000619fffed420add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2896	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3868	elevation_service.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5828	AgentService.exe
Token: 33	896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeDebugPrivilege	3868	elevation_service.exe
Token: SeDebugPrivilege	5808	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2060	2896	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 896 wrote to memory of 1252	896	SearchIndexer.exe	101
PID 896 wrote to memory of 5600	896	SearchIndexer.exe	102
PID 896 wrote to memory of 1996	896	SearchIndexer.exe	103
PID 896 wrote to memory of 5916	896	SearchIndexer.exe	104
PID 896 wrote to memory of 1784	896	SearchIndexer.exe	106
PID 896 wrote to memory of 4268	896	SearchIndexer.exe	107
PID 896 wrote to memory of 1512	896	SearchIndexer.exe	108

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_ac226115b1abcd1a36bca70ee18243d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2896
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2896" "1452" "1324" "1440" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5212

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fac90fb9a5f5df49b312b07e6e5b103e3a633c92eca36d43fe6f6307a68ca773
MD5 2d552bfbc06cbc66d02555c776e798a8
SHA1 1b3f09679e2febc756001a8ef7ded032443e263f
SHA512 b5019e976129c0522f2ac400fbf3828705325ad514c19e14f5d484705acaf8e739c0e1e2117d95ecbca7750f181ab79d70801a01e147f29f4c768458ef7011e8
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCDv66mG:x3q6HjB5Dv6V
TLSH
T16BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 00da599c9401b3152f4c33155ebae163ae36ac7ad378d5362a8963ceb0d4b099
MD5 b49bad8c4f5ab358900950f178810446
SHA1 e5de58f5d309b7e2e984a2a56ee0faa4daf2363a
SHA512 0d8def8c9f279828cd1b20400a4a4e59522a70ca20c2360a87835f4e60d7033d73c1087d21e720c985fb05d314fa28e2e80d020dfd2aa05a8d1036c580332d25
SSDEEP 12288:+1XLsswWkxy2lRq2czAXXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:MXYfDtczAo743TvRk6NwG
TLSH
T18865F12873E408FDED77827DC8A28512E673B85547A0EBCF03A499651F232D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0a8aa97d61f0aa9ee7ac3c5de5a1443ef604c11240f614c4adb299da139dd7f6
MD5 139d6d44f438f8f09cffbf1517c33160
SHA1 1b2f7e6d45e4b6b3e8ab5d9c1082bcade66a8463
SHA512 6de75a2cf6c053edecbafa343fc477917007d88398a6c9d57f8fe985cda0db4f3acc3beb52e9fed5eb97d5012ac789b85e234e634e579f9ff78ca450efcb0462
SSDEEP 12288:0XZNYVLeyUji0h90ZD0wxpGZIVuFrHs2XI7vgbrWVQhTCYHvRktx/aICF9flefu2:00Le5ji0hmxirMR743TvRk6NwG
TLSH
T1A185AE16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b88b1a50c7a487fbe648564b1e711c8d99b0a114531319fcc254590e8b6f29ec
MD5 286ccdb44d603b4716725c76fd1e839b
SHA1 8dceeaa12bd842b6727b77ed06a0b795a6fcf5eb
SHA512 b6471df02059fd5b225e967fac945c6ffc82f29f5bb4884564e8069034b63fc979da3b4f4d7d98f42240024906e6931717a900b7cc19847dbc2234c3578ea1cd
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuv743TvRk6NwG:P/ezSC6vUzPvxHjyPDv66mG
TLSH
T12E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4ec009caa3afc6f9fa56f005259f46b453d9772d2c9c5703af065b1480b75d7
MD5 a74beca15a36cbf84a070f42ebecb02c
SHA1 4c05125da0e6a1620c88e08f2c28144cba8504ff
SHA512 1c33961371b0ede047ea4252fbc84a8f4db3bd2fcbb1581821490c2ecd399e5f22a8163157414326145f8407a98d8124577dc3c4fcb09755463f24cb1e5f6828
SSDEEP 12288:zVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98zXI7vgbrWVQhTCYHvRktx/aICFu:zVbqPb88hv/l+6U743TvRk6NwG
TLSH
T1E1559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a75df59ef462445f06bdb296bedde833615b1a60a449853af18ef737cb9a96fb
MD5 3063f566eb7ce04fa198819b4440064e
SHA1 e0b51984a243c0764b0a30b9780bbcec8b9f8d4b
SHA512 e1f7b7c7df880066af6e34152c711eb355451d154d2dba6386fac5fbb7d5089022b68dbbf5570509ab4c168179cfc27a442436c1751133f75cbfdfb7dac6c56f
SSDEEP 12288:9RSXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:9Rd743TvRk6NwG
TLSH
T1F44523087394010DE7B3BDBAE889E0C390A3BF6499C59CCED669FD6558BC1C0E765B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 36c8b682baf5faefaa71ef4cb5323c22e7162150ab44c2f6b1252e8a6b66518b
MD5 a267a2703183efc9532f4192509758be
SHA1 5e296e394d76f622abfc03270db11f2a34789d5c
SHA512 3711f40885db5402fa88f6ead5fb1bf482cea836e788b8dc38c74fa3f21908b0461e151a0568b6044caf56781d590446e580314f4bddf986219055b590772256
SSDEEP 12288:eeBNUbTVO86UbXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:eJIUs743TvRk6NwG
TLSH
T1EC65CF3BEE28ECD2C27A9DB95A91C240D77278304F52A3CBD165C20EDE235E05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b02858e9aae1b095babf2373629d5ed9cfce5cb2f281c25d422f749c6302b58d
MD5 571e601bc739de025d200e19fc8759d7
SHA1 6fa7543b5a3e374ff37578cd05760ce7a8b711b5
SHA512 159d2a69e303cbf9e72cd9f4776eab9091fbb280c22ff09ccf446d59a3be91147911b270974cf9e6c77950d818209b07d26f12ec437b0548b3ae24ee768e4066
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:RQvGAdlCEL8c/yRNw5CMDv6V
TLSH
T11C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 25644ef022c90628da5b3f0d9b63b772107e6ad3f628263db67c3401b9e7be7e
MD5 357e76e66cf41c4bdbe441fae594fadc
SHA1 00912b8bd322f9d6d47b9d50b0dc4bbc29e751e6
SHA512 936fd5ea861b9a795459b2fd5d7ba084d9ed885f54df7b5f55713ccdf6c00d2c120da7eb5b00aac425fc4ce25ee7ca457a7de18eff9880a529e77e9e0d5173f0
SSDEEP 12288:nAwSfxL/2Dc34DLLmt0LDQewsAjxXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Q:AdewsAja743TvRk6NwG
TLSH
T1C075E030FB74D036C3BB0DB61B26C716546DBA204B9119C3E3A89E9E59742D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 08a0bfbcfe798dda7fcd4b3082c295f3128ed9afb21642c2c9ab08f37ed5a8a3
MD5 fd7198aef904ea339e40ce5f611ba4ab
SHA1 378e416dde69a803438f7016bb245e5f7834b52a
SHA512 12a6e683dbda3e517c371fb83bdf274fbb58f3accf6a78f144a5f0c765fab85a6f4a899390d5c83ab1ddb11dd25826f89bbb51df332f4c6019817a02b466869f
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7D6:mUEtQevvqc2W1cpV2EI32
TLSH
T13B474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d6d5d084eb00b5edfabf83725115141875fa589b4cc29ac75db59b7700aec5c0
MD5 cf1b28195a68a1cf1ad30af0baebe93e
SHA1 4c3ea9a3d8b971b5f766fba9cccb89e692e7af73
SHA512 030fe94d6b7942dd3d2654052d722d9870424a7e9423e6f49e26ab5021b20db68a02b68eafd6c3bc53576d2c443af791554708df86c0ce1fed6096d1a5e9080e
SSDEEP 49152:SCbRquA/m2yL5zLfFiV+XenmE3/zTDv66mG:3oq2VjnmYDv6V
TLSH
T121D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98c6fae136ac587e7db236fc46baa08be5618619df963bdb3e2ba7d36f044904
MD5 9759c9bcd4490b7d9f2186cb95ad3f1a
SHA1 4196812a2a17a71799ffc3b5ff9232155c376e6e
SHA512 3dd7c5c607e7a58a8f9bc06291cd4bb0d2e8bfc3a1605fa840c331ad8f30b8d2059481f2e3b3db74a52f329d0a2328ad06a23bab4a4c9af0181d7b7fd2f94b57
SSDEEP 12288:UAZ/GLJIFoiwtA5qy97S9uaYFLq3OPXI7vgbrWVQhTCYHvRktx/aICF9flefuKaM:UAhGLJIFoiwtA5l7S53D743TvRk6NwG
TLSH
T1AA359D80E7F945D4F5F3AAB899B69171EA76BCA65E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8e643b618e3d1fc6aa9bbb6edbafa0e346ebbdad38e51b6f677739bd09d2fb68
MD5 4d4dda948b816a1e9ee1f1f8662f2d9b
SHA1 149e5b87fdf9b882700253bb2de0931e22cb08a2
SHA512 f7cc94f6c57835f3910b0d79c4e8768f821ce8e5f92753a20f628d06017a7f95a90b539873dd882fe818ff9e970d30d4f144eb2b8b2cd439ab3de110c606e78a
SSDEEP 12288:lmw5HEjsChNVBFgl0WDm+CkXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:AwuoOWO743TvRk6NwG
TLSH
T18765F14973A40CF9E9B39639C597C132E7F2B8112A61DB1F1760C65B5F37260AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7f5bb1258bb8bfd2c0d737bc03c8987c74c81399198205e371e643ef867513bb
MD5 e39a60c821cf0a7db208ecee97cb67a2
SHA1 393ccd9c4d7d898f2bdb7d69a8111cfc90079e93
SHA512 dd6de36ba0a633183e2ce9c296d135a09ee345dfce87b605737174c68e3eb1c906dba05a11cc0df21e24052076d0a85a2fa064a1e2215548643fcb20da3311e0
SSDEEP 12288:lBZ1IyhXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:TZuJ743TvRk6NwG
TLSH
T1B755234933E410FDE2B3A67DCCE59282D3B37862677287CF12648A651F766C05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e46009aea7cc5e2d19d391a14ac35ef2d85dbf2d6c2b4e707ff9176aadc5fc1e
MD5 9a7e2d1ed82ddb6c20e47440644e348e
SHA1 04428ee9083ddbbc2670ed486832b670e291eaea
SHA512 b5dc9999c43ab6800183730e317881519673206b9ad178e46858eb926881d38c21528a8ce3082f9737e5741b6f5b71926197421ef4e4b6ff3a2e0fdb1f270348
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:GQRQyi36YOcPQLvw2gAf+PN39Dv6V
TLSH
T1B9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b18c6372fb0c9ca89f1e8095b441b034078c0eb3bc11dd610e571656e520890c
MD5 3cb4cd811698e0e5bcfb90d9de259b74
SHA1 bfd8d23ba1f9260b603ddb39ba5039037efe316e
SHA512 ea6f070e15c2c7b4e85c4b1600d62d73bd1794e1e3114c8085d6cd163cd4724e2467cba30af1460dc7bb3100e03c3da7534c1344a65fc833ebed8983da626df5
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:GQRQyi36YOcPQLvw2gAf+PN39Dv6V
TLSH
T150667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6f177666bf79fc4242c4319cc92d57cfd6898079a97404aea442938687db4de2
MD5 c83631f6289f6e3e43fa94ac34cd0d36
SHA1 57f15c7ee713a15365a8471ec42abdff079ff8e5
SHA512 05c07a36bfdef94cd60d074c78cbd51dd7b2bdbe237d3b027320b87c8af1e4034440d128cbde5c49e6241a890389e0281a1ece382fe75110986fc4a507d58382
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05743TvRk6NwG:E68Qg55nhheWu7PNU3/jDv66mG
TLSH
T14CB55933B2F200A9C45DE1769F4A873196D27C758FE0E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5cb8e537222166c186bba5774352355e0004615162e852ae564daa5b2db1b8ff
MD5 a08287f443939b686be50f5623df1bf7
SHA1 13d5fb47716d2870eb73f883fb95c4d88c4781e2
SHA512 ec1a6279a3f7767bde1545f169979d63809ff5d80aca5a4b9b10adceaacd002c3305506e0000ff19ecfe2331729a8b7426958c952f7637ae9237576aae227ab8
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:8y5112gYy5azzVvL69nLKnhZeDv6V
TLSH
T169167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a6772a45a4d3b3e091cc649bc7e11a73992c03edc142f59290f152852a3b6376
MD5 56591ea4e5c5b03a156cb354eb4438e5
SHA1 da3359cf784f5978863a042a06c28db0fb85f086
SHA512 3f767fa517ddc869976bb989ffc3afe313f14a4892a99640a15c75c99f20341071b5fceb87bfb35c02bafb16235834adfd62d81e1fcbf6873930bce99c8f3201
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmDv66mG:wu6JmVxd2dmDv6V
TLSH
T1D3D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 802dfaf5f6843e0cd6fc2a0b35b7ada7edc2fe30e54fc1d650f99082065f3327
MD5 3632f5db27119e762e9d3d942efef0c8
SHA1 f7ec2df28888f132658b8c0aed046844171dcae7
SHA512 099c5a9948bdf0b21552e1610031fcd4c44fea9e689087908d5270b4443962c6a4d13fa8e0c18b51a0c7fd1835808f49d99f8b4f9ccc3a139a1799a58689cb35
SSDEEP 24576:0hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3c743TvRk6NwG:41hpsNoJpF1A6UU44CwH7R4xBDv66mG
TLSH
T101B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9ee8d244e3beb1614363ee5acd3436476a96f59453b3f3b7a6b5ee66107961df
MD5 0420df29e8dc3a5733f5799cbbfb5641
SHA1 8a8c7c71008ec30bccad6d21bc7e14b7d93fd920
SHA512 35ef6db785368e76ed5bb70c635465286a42689a0121dc00b9ea6501539116d7253b821e06f9fc1c927ce3e128ddc50098159702ff87cf7f66000bddd178ca01
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHqSDv66mG:h5dKTi61SDv6V
TLSH
T1F6C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9b3c3afef5f2632cdfc5740fecede6e0b00bbd5f8b4d6b94b9f74063c2d31286
MD5 c8337203671bd6a60a0def3525d76dcd
SHA1 dde91b728f5407e6abf22c01cfede027c83f2220
SHA512 34868b46401b1328e57fec9ba66afbaa12662a31ccbef38f2a456b46cc28f47f4a87980d04cf4b03c40c091ba096089adfa3a312278d88b9f70e31dfb2743c0d
SSDEEP 24576:NhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLc743TvRk6NwG:NhtSn8EApI0figngiDn0AP5wFDv66mG
TLSH
T1D595BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cf24ec5985229c1f2672ce85c015549512e35f9ddedc33a828d65adc46e49468
MD5 f2b4ea9c4ce78ed6c379ff43af3dffa5
SHA1 8347017d8d904d6a27d5fb9067af78fd78a56be2
SHA512 ad726c2253fb268cb857d0fa5a3eafd088cd522135f4bd25b3a3fb02d3b1322908c78f456c7b6d20cd447eafbeb019ba88d2f19fa9ceb99609ffc64313ac866a
SSDEEP 12288:86XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:81743TvRk6NwG
TLSH
T1F94523087396020DE273B9FAC88991C39093BF66BAC65CCEA75EEC2159BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 11d04005839e0ef0e2c752432bc346bb006a7007f834d3efbf5ccefd82b8f1d5
MD5 4eb0a02526bb54e9c1ff5209ad405827
SHA1 700558075e8483cdc4cc4390454044495078b8e7
SHA512 42b0fe0a939fb060bc4cd87caa4f47e9053ddea40c23cb7476b8fd235b5c6d3442867b18aa0a84e8e69d358dfb7c7446382adac40869a61488051738524314c7
SSDEEP 12288:kNXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:kW743TvRk6NwG
TLSH
T1404533087396020ED273B9FAC88991C2C093BF66BAC65CCEA75DEC2169BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 df95773ca8d6e16e1cadb239b45333caa514fff5a100f43f1b4e4e4b0567aa2c
MD5 dacf1d05a4ce1a3284c58901d4a09991
SHA1 5b891a0320bedb2d2c0b24f5fcf904520e44631b
SHA512 4fbf90ad7338b613117d8785c51547a2cf9bcb8feee8aad505aa8ac8deca6a46681f93a0d8ab69af7cb1edf82fc45820bbcd9227dcb7c9d1f1494ac4bb72b847
SSDEEP 12288:lDXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:lE743TvRk6NwG
TLSH
T1694533087396010ED273B9FAC88991C2C093BB66FAC65CCEE75EEC2069BC1D46755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9d56a25ce3dd09da497ab0c745ff6841daa5acbd36a9ce19c03b5a2dfe6b0a5d
MD5 f54b4298273d4fa96c77e6137e1f58ae
SHA1 4ab39f7685808e96c2077a57c11abba5998e2f79
SHA512 682bd6e2a64f121fac30ea12021cbf0dbf47d2ab931e5725ca65a8efe663152f4de9d85605b107f6710ba5b64779789565eba6a09cd7ada1f5bccd26f4146f54
SSDEEP 12288:eVYXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:K743TvRk6NwG
TLSH
T14245230433A9018DD4B3F6B9C89591C2D1B3BFA5EBA29EDF97159C650DB83C06A34F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 83021b95e05d9600196b1c279b1b03dadf100f04e24c89f9772849c276c23613
MD5 5142afbc49d5b19523ec438e650111bf
SHA1 22aaf2dfed837ea7b7c80f1d2dd405a6980c7289
SHA512 d95e612a6298d57a3191f1d1ed6505100f3ce4dd88304c097dec665e017603560e681d712c1a36b8270ddc58b7e96328d79db90ff02bd243e819407d8f6190ef
SSDEEP 12288:rwXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:rr743TvRk6NwG
TLSH
T1C64533087396010DD273B9FAC88991C38093BF66BAC65CCEE75EEC2069BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d964dced57935d665a5da60a5a6095d363d204463c536d21786251d6a957ad15
MD5 af6e1f2b21da617f7c76f17ff159dff2
SHA1 664c63c5c1a90a6d367dc98adfb35fbc0cc8bf8d
SHA512 fb5420dd3dbe50afe60d41fb700deae6e9879f482504ffbd7829806d5598aff8419244dee2bac048415db546df606522116af8bf1580ab5aee0f6a2067de33eb
SSDEEP 12288:m5XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:my743TvRk6NwG
TLSH
T1094533087396020ED273B9FAC88991C3C053BF66BAC65CDEA75DEC2169BC1D06759B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5f1f38d250767ca2cea712320228e0cdc0fc2ec5f003e1f043cd3d19dc6b4083
MD5 ff3fab64b8bffa0708ba7b4dab5d41e9
SHA1 5c0fdb5b3306def46c6927822379d45ba34178c0
SHA512 020d1f59af2a7329d4a1df4161bd72df0fc17d430a0a7141b66f7845a5e0e4dc903cbe798698fb1ae5b6949392fc2729562c034509ed1943b172d5acb4d6f4fd
SSDEEP 12288:4FXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:4+743TvRk6NwG
TLSH
T1184523087396020DD273B9FAC88891C28093BF6AFAC65CDEE75DEC2169BC1D46755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d0d1b098da9608171d77279119a65a249552680acc55936c1d4732dfe0612e37
MD5 bcf880b2c0552ce610a3874fe84cb5cb
SHA1 4763972daa65a6e15baad5d3bdffb38484a288ff
SHA512 eda07b5d00f2271310342d269081dbe8d4b94d940bf66b05f33457dbf31d8a378870bd084aa83ae3d291ef17a7f5733f7e25c4dd4b2608ab6b83c26151922155
SSDEEP 12288:4iZwb6zzFEoS2cPvytXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:7ZMSzFVSO2743TvRk6NwG
TLSH
T14D650194B39008F8EC73817ECC558946D2B27C5A4BA0CA5F13A836665F773A01D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 479893a85fa75b9538180f0c14afc3dc7a5c7f6396a0c83bcedf7f5df3981d35
MD5 044197adcd569170df66de8101da4b0d
SHA1 7467314addf6fb3ff22b20698fcaa5c0b874bf1b
SHA512 f3a87271efc7a4208add171ab16d631aa000a45f87b10c2bd3718946b3b5664958517c03a945ff75b1c5df31c820b2dad87351d815d3adcfd60485126aa68ec4
SSDEEP 12288:/OXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:/Z743TvRk6NwG
TLSH
T1404523087396010DD273B9FAD48991C2C097BF6ABAC65CCEE75EEC2069BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 20dee4843c790f02876aad8ce3d386502ba115bd976a82bac6ef73f68230a866
MD5 80e196d4948d4fc4297c283dde4c17f6
SHA1 787f66f2abd345683da23c2e734dc38e383fd6ac
SHA512 ad2875adb899aa95e7e627ce92d8e1cc025f821b0a3bb9fa70879061e329f38c61cad508493f638b171f3f3c75838b709b3ad1a71440061f17b0904cd34ff047
SSDEEP 12288:bCXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:bt743TvRk6NwG
TLSH
T1AF4523087396010DD273B9FAD88891C28053BF6AFAC25CCEE75EEC2169BC1D46759B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f782e33bf609405f403b6a718161fa413034e3df820f7d2de9a747c4a7481dd7
MD5 b200ebdbb49d34340f910ca9cc293ef6
SHA1 624ba54bf1464f23ea8b5c9c0e0e985b52caf4b2
SHA512 4cd33485eba4e8995b13ccf6a28e7edfaafd073ab4efba606317deaa3cf9ced8fade3b734e6ebef409c082a4074be7560dca8c749934a89cc2c314a582ce0282
SSDEEP 12288:KyPz5L8hXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Xzyq743TvRk6NwG
TLSH
T12D55120773A520FDD1739279C8925682F372B83657608EEF53A446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9bed37fbaf2fde1b29844e0824cf8c78658d32a1e5c742f74898aa7dcbe8903d
MD5 51b870f4a053109fedecd88c7f50f59e
SHA1 cc715525cea9a170664d7c224743315211963107
SHA512 f3d6729cebfea01522787cdcba5427958de27b3aeac6d8c9642827541f312854f8f6d38799051534c02b7c879ee41f7d1e0b5e958bc5a5e0cee3b82ff80590bc
SSDEEP 12288:NOXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:NZ743TvRk6NwG
TLSH
T18F4523087396010DD273B9FAD48991C2C097BF6ABAC65CCEE75EEC2069BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9bce657dc2b8b2ba0e0c7dd520cfeeffe73d4ed0a1890f0855303593a2402247
MD5 b5fbbfa417050a8f296df7b217fd79a7
SHA1 d825084c0970afb6966125dc137cb83874320a1c
SHA512 12f7cfb91977cce747bd8720fdf4379d5fa8cd0ddf0a250b191d7b9083bf0e7faf925c009e656eab94309a18e59e85e8948266a91d01b850d3325d57e1262529
SSDEEP 12288:YOXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:YZ743TvRk6NwG
TLSH
T1204533087396010DD273B9FAD88991C2C093BF66BAC65CCEE75EEC2069BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 91263ed2c308f1097238c455654998555d31f2fe7c7dc0778461738e398ebbd2
MD5 b8cff76c86e389c3fa466096fa1862bb
SHA1 78d63aace1c42fa5ff6950b4dcdad8c20cafd337
SHA512 6358b469d65e21ac6aa4962175729a7c5af2fbc37f4b3a6c1cc710ce750f110c58307884b3f79b421419b660824ace408a897eb8b1ba303a9b198670a391bf9e
SSDEEP 12288:WyPz5L8hXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:rzyq743TvRk6NwG
TLSH
T18555120773A520FDD1739279C8925682F372B83657608EEF57A446762E372D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 745e185b251e6f5a25340f0c9ae154a428308ffae83d6ff2b4ba017e6695eee6
MD5 a03ccd29add5a9b331417683b75bb1da
SHA1 684ec0d1ec9f32a59c39f39291e2a6ea11f696ed
SHA512 f2416c87e68b7c1ca0d84d894db2392a2d9731f0cdcbb9dd294c36724c59fcf07914ce298bed06e08465ba73d6a1fc6fc75c1bb8d457035b4d1722cff0eaa05c
SSDEEP 12288:9Cd9eWYoaLHF3z0z04PDvhTXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:oTHaLl3z0zD0743TvRk6NwG
TLSH
T13B650194B39008F8EC73857ECC558946D2B27C6A0BA0CA5F13A836665F773A01D3EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 919b8fe390a460b39be2003a14fd229fc46c4cff9508d8563986f976ae301eb5
MD5 80dffe10eb4798a6505dc02b7e7f4be7
SHA1 3489fd8d5147c94fd164780944a44487b725950c
SHA512 777911ca79a192e6f8af76c6cd363bba460b3f5e40e47e46338c5e2470baae6529c2521dbec3cad83fe839d2186d405635d2fe565f3aefddd460a1ef1f714f1c
SSDEEP 12288:zi4e7+RdTfgwCHKy7GLbbdIv8XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:z37d9CHKy7GZA743TvRk6NwG
TLSH
T19275CF90F3E410E8F0B39A35C9765512DAB67C5A1B61DE8F03A8651A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c6c7baf83372c48764767a95e42dde69073ae3165694f18079669e51e4c188df
MD5 cfb1d1aef195c1344c221968715bb374
SHA1 5f20937d595a7e29aa360fbedfa1f08b14a25dc0
SHA512 2fb7421c8c2de7f5719055dea9280f7f3915c875bb9200c1d4b42a6e0771569d0198399c7f7eb04795267a2cb536c8399d5e14396ec7129e04a15f25a1ed2e23
SSDEEP 12288:7jXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:7k743TvRk6NwG
TLSH
T1844533087396010DD273B9FAD88991C2C093BB66BAC65CCEE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b7b26c4d730ff6bb58c208ee75afd480a1b74fccce3b1645f25dcc2af6a2dd1f
MD5 d4d56bd6b77e67076aeba29f93314dc8
SHA1 792f7bd2e00f65e91cc7ae5662e23837aa9611c0
SHA512 747f4c2f711efcf31a3670b830dacd4caf65978c9755301397b0deb1ca1ee4fc8f986dca8c0c083c383b931f04530072ed6a62733de9e3842ff15ec5c2390a0b
SSDEEP 12288:HBXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:HK743TvRk6NwG
TLSH
T14F4533087395010EE273B9FAD88991C29093BF66FAC25CCEE76EEC2159BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 de550421daec0874cd2a6981933f80c0561fd96fd008703aceb6c79b1a5791b6
MD5 707f4583645dd8fb518811c0a1bd10e8
SHA1 c23c900360bb837840fa33b8210c821be269ab7b
SHA512 27a8fcc2043929e6d6560d91a81f96e8c4f70e13131fa8d3d6cc6ed7ef3d4d0126cea368a3ef565259a5b6a67e233df634cc92255b0558480ea73ecb69291cea
SSDEEP 12288:a8XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:aX743TvRk6NwG
TLSH
T1474523087396010DD273B9FAD48991C28093BF6ABAC65CCFE75EEC2069BC1D46759B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 676c27dd3f22b744cfe6536c45266ff4eca6bb5531f872960a695459bc8c4e25
MD5 d00bd3bf829d528b2c2c2d52bdf050bc
SHA1 cc634c6668f5a00b7408636e7a19a420ed0b3043
SHA512 6076c64114d2a37967ac7083188367ad306d8b4bc7a1d459fcb45bd5d02033ffe38370a6adaec4e50fd7ed54b88613d40b8805ee1961a8e11e8d5abaa6a6593a
SSDEEP 12288:9OXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:9Z743TvRk6NwG
TLSH
T1F04523087396010DD273B9FAD48991C28093BF66BAC65CCFE75EEC2069BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9391a73fc419c643daaf41c82c1593ddccc4e3428a33fb53762020f9e8da0ed8
MD5 ed32f6e7121be0fd77b18110f4976ce6
SHA1 e3c6fdcc7d692d674a13ecbb0578a2a051eb6f97
SHA512 c1bc0a1b3fd918a8c88aa6f08a0cd1bb794f15ad2e52e4c78ae8602405c9fac31b7d6cfd4c8c7264e5b00b1daeb96ff9ec5e679da0b230139cf8d910b8dbaf2a
SSDEEP 12288:bjXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:bk743TvRk6NwG
TLSH
T1A24533087396010ED273B9FAC88991C2C093BF66BAC65CDEE75EEC2059BC1D46755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 17c8f117702288a891deee3e24d74152ee64cab6f993bee3f019dce6997638bc
MD5 fbdd8ed5203250f975707a434b74eb20
SHA1 40ff61e6018c259878658d0d2e88d7f413064716
SHA512 2e00356ae27505acc98d72ab386965d8afca94f841289806a3926c343945208c70f63fd653f79d6caeddc64374bca1ffeb7ae15ff706364916fd88c027ee78cb
SSDEEP 12288:FGXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:FB743TvRk6NwG
TLSH
T1594533087396020DD273B9FAD88991C38097BF66BAC65CCEE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-02_165026_2896-2520.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-02_165026_2896-2520.log
Size 1KB
SHA256 fe95be44fe2cb744fa14c85c3be7eb280338622da078196e7aa389d8e5e48528
MD5 448cc7b627b9b7bddc87a2899988b173
SHA1 bc37e7231a450a80fd8f4ab6efc5c0880a3abb06
SHA512 964b1d33c40f2a2da216de6333f2de3f8861149d0e8d74713cc59cbc1d0a15f72727d967820280aaf9e6ff30d1ee0a162d91df586cfeff94f58309dd2922d4f4
TLSH
T16521846A2BE40A45FEFBDAC198FA5153AE3939517C31C90C01A4434D0A75F40FDB4327
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 fbdb586a833aa1d63f799358eb016876692ee751cb4a5a5410c44f267ef4d332
MD5 c1e79b5c56fb450434dfc3b2421911c7
SHA1 1ea67a0e65a25bf6bb016a51b258fe2bcb2a62e6
SHA512 f06bc023bd3d1cb69c987890187d477ad68304690c183f92dd67ddab2430514f8ab3729d32406331eb37a48909e4b871280658fad4653b174c9a63fabd245488
SSDEEP 12288:5fwvD5uX64Lk3tRX69qkyAI50XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:5fwvok9RX6wkyAI9743TvRk6NwG
TLSH
T16485D029EBDC04E5E1B7923C89B7464AF2B178691B31C6CF029A536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9741935538df582cc968f36754948e305d20143a8e5f58727d6b0392d45a14c7
MD5 70d1d9a160796d8ec022b1068ace1d43
SHA1 085357ea8400a7c144f3f8c86743974d5ee4d70a
SHA512 100c3fe5e25b8973c9916ffe355e73a77df4bf8c3a54ed5a805d9aa2ebf0de4d5542f4d2e860e96a6d5affae1f2a0b7fea8a186683445b4f06cdf47b2a670aa8
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lDv66mG:lySzPdDv6V
TLSH
T167066C56A16801D9C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9267494aaca38b2f812f62fd04432b58ed2fb2a7da47f483cdbd0cf9d1af924f
MD5 952e8c45e95005d2e1f274656b6b25c8
SHA1 48a733634753f2769086072e792c3de2b55b17b8
SHA512 154b762ab815a1d45f613767cfeb20836a478a9895fb66fe0b0cd6988beb4d24da9c7aba6d6e111303817ed3aaba30ab03a39d7c50aa936e1f9dc7afe8ff259b
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYG743TvRk6NwG:j47JUQj1irIhCnDHUPfF/1Dv66mG
TLSH
T12F65AE1DA3EC01E5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 75d7a29768ddbcde13162978bc19d7b7d5e963940ce271d83ce02ab32d000edf
MD5 9bb2c07f98f227178c628474bf60f861
SHA1 b65e71c030372952a5c77d6d3d505623f2f37a1e
SHA512 b029281101c4d4e7daf1e5fae77f767ab0e3e5b5d201f7adeaf699bd8a9adde746576db11ef849da35d8d42c05a8ac69e225d764ffa5bf6a3ec6280eb5806c6e
SSDEEP 12288:GNsfeXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:PJ743TvRk6NwG
TLSH
T1FA55F019E29802D8C06E6279CB458681B3737D2597E1D7CF52D0F93E1F792909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 95e963e48449df86c3ee70ce58f49f31e18d0e0bfbdc5a21176623544abd45ad
MD5 0cb30ba9a2cb3ecaffd0b6d92b731bc8
SHA1 d9de22e545ec2f07a8a2831419deb6d6adfb93e0
SHA512 5c3a9b988110c19c9b3061ec618c76268408479b738d1c8d378324cb0b0a31320c039a7168fa799dc3aa3f811d38a50cb0083fb2bffe64c08d42ce8063fd6dd9
SSDEEP 12288:NF7WXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:7x743TvRk6NwG
TLSH
T1C44523147399050DE5B3BAB9C88DD1E2601BBB759F809CCFE619E96068BC1C0AF75B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8199b7fa624fa8e0bedac333ac02bd1f39b2a1848a50396ee7303fff48e13119
MD5 66b13721dc45896e4d6504a40a7119fe
SHA1 15e6265643f911c0fc2cf224efc2bf8687e49560
SHA512 b9221a51b63311feba3a2cfc9164bf0ea74489dff7ecfc975dbf8d3e9ab800e69ea16ba57599fbdc23ef41ae2b6e647cdd2aaeb8b6cb8a609f32641544d92f63
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYv743TvRk6NwG:8gb4mBIBhGFHDv66mG
TLSH
T1EE65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D6DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0a3d5a474af46b26b9057a262813b0e33d105e6b47d215aa305cee4a6a13598e
MD5 7f1f3fd61aff075cce8c4bd7856a49db
SHA1 e169c9e1ae2178131bb8d088ccffa2df76bb7b15
SHA512 222d712fa63994db7de4bf3a3071412d6d9df4abfdabbd5f02acdb203d2e5e47f7f03d5717d36a8dd73c7f8385e0e0df3a5707a34d37ea59d3e48e4a6a33bd6c
SSDEEP 24576:wG88u8FpJqH1bzria7/m2743TvRk6NwG:j7ZFPqVea7/EDv66mG
TLSH
T19285F16577E102F4D477E138898646A3F6B2B8250364EFDF07AC8A511F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 81e15a16dbf3ad7d98fba504c638b3fd5efec8a123bf9b61f1d7485cdca01a11
MD5 2dd02e56ab3ce4ce84aa7c9aa8af96a3
SHA1 5f1eb8c090590e453e854d48c0c792370cb27286
SHA512 0d8cf3ecdd729b754e86cbab0ff99ab7f0844e070b6423b1aad0946fa4119cc4171059ae850635d8777c1ef11ee6b116a50e72ceff3d485cfb477319ee73ad06
SSDEEP 12288:oHvUrBFrEjwaQpXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:oPUr+NQC743TvRk6NwG
TLSH
T13F65F11E32ED08E9E677E17DC5828249E772B4621712D6CF02E0817E4E67AD8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9154e7b18d7af432a73b815ee3a1c8b87860a8b7c638e155cc472531622d4782
MD5 3c9578ecddcd72b86db9cda1d601385a
SHA1 8d324ed3e050db6d6a578ba10677dee35c11b7e3
SHA512 78b2e2659bb791395bd58442827529653f4cd17f512e8bdd3c2c95c164987825f5b5ea6c438dbf08b60ab627d39c02d24fa95695a09c6be02f758529f243765c
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLDv66mG:cG05lO43bmDv6V
TLSH
T16AD5CF6E62EC01F9D1BBD17CD9C6860BEBB23415032556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6619a921440bd6729f11d08991404dc1d06331196443b3c3ed7e500409281f1a
MD5 65ead1b76d39dc967e227b6588ba3a9b
SHA1 ac95f72ba33a73fc63c50927ef71f22e11295656
SHA512 ee2085a84adc33fb6735bf7350ec72ddd49d95e7e1b50e590f0dbc09719a6bd44df6ec0ec6cc2eda4e691a173f0180230c89d22d3768962a37ce4aaeeae46cf0
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnI743TvRk6NwG:Ga5POZ3+Jt2pasx2+mjDv66mG
TLSH
T17D65AF5DA3FC01D5D5B9D17DC583861AE5B1342653329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e91ab71d2be2d8404dc4bc908279c5007c0db42601f61c373bcf56810896dbe8
MD5 9d23ef44a665a1631d349bc77619c7be
SHA1 ee09379556d5b956fd9e8d90b7524e6f75a31d5a
SHA512 0ef905ed670ccd4eab08462990d082585a604b58cd3f60593a14ce19295c525fd2b9ee29821be604bdeea5cdbc5bd3a3ce3415b6db7b0916cabdf84284196103
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fku743TvRk6NwG:pNc/zEOVHFkDv66mG
TLSH
T186858B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e2170dd685bdd51f69cc5b06e42173f29d727e62edf6218a3e2fdf85a4b4ac6f
MD5 88ccf2dc68390bbaa451ddf9edd431be
SHA1 ea881415eb9650f0afc78ae75e6dac1ec9032e5e
SHA512 2ec912074c41e25f757c72f93f28d63c652b778caa30191cdcb1797fddadf9d47ef5e28bbd817c75baf25b1fba88d143b98f74e67ee20899bb719aabfed0e660
SSDEEP 12288:S7FSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17wXI7vgbrWVQhTCh:S8kNvNnaFeYhJNtmZBmZ743TvRk6NwG
TLSH
T19355AF2EB7B806E4D1FAC6B5CD238512E6727461173293CF5290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8e074bbabb9a3b310e81dc3b9039c29d381b0de251d8fb23dd45e193e633e5a0
MD5 888176f8c111cabc7dff3e19699e5ef3
SHA1 4884952b1b779db3a4c6b212b80a9ed461c4c6db
SHA512 ac263704409a365f3c0e2283e8a5aa81052bbd5437442e792bfab78e3659b8f8d6198cd33402e35aec07abda2a55b7c96ee5fac4e38a905b4d653e681b27a099
SSDEEP 12288:YQcMxWDXN1Dp/fshBItT1IQgAaXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:6D3FHshBIYQgAV743TvRk6NwG
TLSH
T11F75E13DE79C04E4E57BD1BCDA538606E67238A9032269CB0294C1B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/896-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/896-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/896-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1244-109-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1244-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1244-115-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1244-322-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1244-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1244-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2328-261-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2328-70-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2328-64-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2328-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2896-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2896-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2896-0-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/2896-28-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2896-31-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/2972-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2972-337-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2972-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2972-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2972-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2972-103-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3868-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3868-15-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3868-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3868-22-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3868-21-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4728-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4728-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4728-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4728-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4728-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5212-289-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5212-76-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5212-82-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5212-74-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5476-87-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/5476-92-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/5476-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5476-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5808-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5808-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5808-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5808-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5828-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5828-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5828-140-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5828-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5916-336-0x00000223DD4D0000-0x00000223DD653000-memory.dmp

Download

memory/5916-404-0x00000223DD4D0000-0x00000223DD653000-memory.dmp

Download

memory/6104-128-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6104-129-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6104-122-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6104-321-0x0000000140000000-0x000000014027D000-memory.dmp

Download