67e54d016c4fb525703118d2c832ffdbc11c7aaf2c486ee23de3c6bef1ce7ea2

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260703-q146cafs2q
SHA256 67e54d016c4fb525703118d2c832ffdbc11c7aaf2c486ee23de3c6bef1ce7ea2
MD5 ea74ce5660b2f6a76c35d4450eb1b9c3
SHA1 f27364fc591c2f87d411849d3e1a03654a828f26
SHA512 bb078e8aedc5fa310c7bb730e63328a49b76639556f12418e8a75df0b54928583ffc60736b9fe1ee747cf7b1f494a27d04097c73916f910697cd5aa1939cfed0
SSDEEP 49152:3Hdn27Bk1l9kEu2qBnpmmr1Lc4o5w8C9EEonkDM6V9cLjipnpsGUTCeDmg27RnWm:pkVsvD527BWG
TLSH
T1C7267B0BE6B940F5C0BAD1798A57951BFA72785A873297CB4790470A5F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3468	elevation_service.exe
2872	elevation_service.exe
2332	maintenanceservice.exe
1624	OSE.EXE
1124	PerceptionSimulationService.exe
2460	perfhost.exe
5156	ReFsDedupSvc.exe
3588	SensorDataService.exe
4504	ssh-agent.exe
5876	AgentService.exe
2500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6f4f78ebc4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-03_134444_1484-2352.log	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a772525f20add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082cf0526f20add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008821866f20add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b347fc26f20add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a426b27f20add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007174a526f20add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe
2872	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1484	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3468	elevation_service.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5876	AgentService.exe
Token: 33	2500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2500	SearchIndexer.exe
Token: SeDebugPrivilege	3468	elevation_service.exe
Token: SeDebugPrivilege	2872	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4724	1484	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2500 wrote to memory of 6096	2500	SearchIndexer.exe	101
PID 2500 wrote to memory of 3240	2500	SearchIndexer.exe	102
PID 2500 wrote to memory of 2296	2500	SearchIndexer.exe	103
PID 2500 wrote to memory of 2948	2500	SearchIndexer.exe	104
PID 2500 wrote to memory of 1204	2500	SearchIndexer.exe	108
PID 2500 wrote to memory of 4728	2500	SearchIndexer.exe	109
PID 2500 wrote to memory of 3388	2500	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_ea74ce5660b2f6a76c35d4450eb1b9c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1484
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1484" "1440" "1372" "1460" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 02e54aab77dc38cb8a69a7f9f6a83eab7c22a5afdc058fda5d55e29d76e24566
MD5 5d234dd201f5f51435effac7f4c59424
SHA1 607d1a5ff13fa8e06b675df735166cbb3e95ff04
SHA512 4be222cd786dce20f5e7420ea397b5a40887c32913fd5133f38c324a89d15ec0e2c105f49ecdf55554b66984072afc3591ac97857e86ccb9d5adb8d7fba809da
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/Dmg27RnWGj:63q6sjB0D527BWG
TLSH
T170D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 971b0659e6311fa4616af9c6cafddcc6ccaaa4f846bc23fdfb7c8868a246230c
MD5 091f6ac32359cccfe2e5158f32dfd03d
SHA1 a645bbd079110dc369a5b96a6db27a539cf5f9d9
SHA512 a1b36b49d41a76a05f82bd74815c3cde83b2c96ee1aca3e238c68e54da5f5d33b365f7faf8508ca0bb9247ecedf75f47ed3ed70cdd3d0e9a56cb46a0eb6d2bd4
SSDEEP 24576:qXYfDtczA8sqjnhMgeiCl7G0nehbGZpbD9:xtcRDmg27RnWGjF
TLSH
T1B4650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 df410f0a62ee709cd8ddad3fd9b2ea9c91aa599154ff158d26dd82d56c707ea3
MD5 a5df8ffc7aa539112d132a5383ce6809
SHA1 01ddcf26ab9c8ddf4024ffb8c8d0612de8ffbcb5
SHA512 55f30515cea6149fe976cc6b6fe9e542efadde91e485eac8406b5b4f58db7701db43a43889614213d60d5ec7e071a9bd0f9ab4c5ba2a7f2611b96f5dc9796fc8
SSDEEP 24576:f0Le5ji0hmxxrMjsqjnhMgeiCl7G0nehbGZpbD:fPji0AjmDmg27RnWGj
TLSH
T1D1859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 79c9793b47a6d38e9fe92bf57a1ef7d306d4c2ae979d662fdc614f9f4ba08874
MD5 cd4b8a4df7bff7404507e5759a007907
SHA1 329531fdf33c9c4a9b4acf1cd8395d5c96fb13a2
SHA512 650a88bad2e018ddd3cef2c21f92a55e11fbd9a399367e8c2c10f5b6ffcf70a5470a801ecb310ec6bfd43b1dac50c788433bd55c32ab13c950817835b1598a84
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyudsqjnhMgeiCl7G0nehbGZpbD:3/ezSC6vUzPveHjyKDmg27RnWGj
TLSH
T107755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 de1768f9d535dbf436d8cdfabbdb5117d2e36a5f565df7fb1ef8b4643e7284cb
MD5 610b5d2171cc8b7a924b1642ddc34a62
SHA1 c8c29df7282eb6a8015c68e08f65b083c9cf9f5d
SHA512 bcbbe83f65c6571dc4600efa3f3fd03aa909bb0805eedfe397e47b2ef7f46bb2683d8a29f33494b72efa7376133a06ec7b6c0ad4020dea1556104fcaab37ec2e
SSDEEP 24576:NVbqPb88hv/l+Y4sqjnhMgeiCl7G0nehbGZpbD:NVO88hXl+ZDmg27RnWGj
TLSH
T1C4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6cb3e04c1ec23f969f2a01394a39646815258b37d00597e02bee2333d2b8f4bc
MD5 5261d18146b72a0e00c025626d8deee7
SHA1 8df9ff3c4513acb2737eb0b5542b1d558cbea6db
SHA512 5b750dbb6f64016d8d3ef8ba655e022938da5aefd0afb79e9b0190a9a50d1bfab99df8191cfffae2c0cd3ced47b687900d2c1cd0eb4e335ff881f0311c40f128
SSDEEP 12288:aL/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aL/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a3b87e5691bf634d27d525dac6b4a6aa2e7f86618f8a4ba3e9d506fb2a00a50b
MD5 250d8d6b6efafdae54824746df450cc8
SHA1 49a8f0903a90c0a63e9e7e4197f16d2349c331fe
SHA512 6fe46332b4ee33208a69b779ae5305db846b0e20fae9ec2988b97bd07c5b0edaa4318aac647092467d8cf7e31cf77e5e065481e3e758c387acbdaba34ca73c72
SSDEEP 12288:heBNUbTVO86UwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:hJIUwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A65CF7BEE28FCD2C27A8DB85791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4fc63f21752907f2fd46fcd4536fa5e8d53a0cb0e89f510fda768aaf694a627c
MD5 f004b0da249f194b9dca7d304b7338b1
SHA1 b2b248ba6e8c39fb2a60dbddd69d4588145b2f10
SHA512 e645d1df6055e8777fe1f92495c036596a46369d7ca98234bcac2f1b7dc77c95023216b5bfb896f38593e844b4950855cec3a3711953fa0efb7e9361f146f08d
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:cQvGAdlCEL8c/DRNw5CxD527BWG
TLSH
T135266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5cd51dbfa0cf6274f94d08482599c87f68c031a08c429c9e6e42f1fd65e9becc
MD5 72e7b6ec5c2c524c265763dba029bd7f
SHA1 f1dc07b23e44cedc054dec3660f278d0498ebc38
SHA512 53d7292ead3f382281c613bc033a47e076aa84fe79a910f5935d2a2bcd86f19f406563f3926dbec8c42bcd47e62ffb510165e35a27ceba1e6ab94119ffdf3ae2
SSDEEP 12288:vAwSfxL/2Dc3RDLLmt0LDQewsAjSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:40ewsAjSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F775E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a7330e44bf675d1c24a9d47018337558993cca6559103a325c717ec8a826330a
MD5 44e9a55d338df4aae39d3efae2c26c44
SHA1 7fd74b4f9cdece1551189302f24c97ba4b325b42
SHA512 84ca9ff7a432ec2d134e8f68388918942ed8fd7a43d8c34d05e04c2b13dc7e1122c916439725e0b21fad7b8adbeec3be6122fdbd2772be96b04bddcb2394ec3c
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHuVQBWG:9UEtQevvqc2W1cpV2tI32hB
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ad9881a817c8a22b29b23496ba2cc1e7b3b859445d5c4e0b80ac4c90aa341883
MD5 1b14ef92922752655b26dc2160921350
SHA1 a93ba293633e3a0c509bd0249393c70a0da038d1
SHA512 65a1f4175a82197859b40dae086c72b2687842031b3af95d2a26d07e77e2c98a2427b74e4a252e6c6c384b948077284c6838eda6880ab45e8bd0073b65ccdf6f
SSDEEP 49152:aCbRquA/m2yL5zTfFiV+XenmE3/z2Dmg27RnWGj:voquVjnm1D527BWG
TLSH
T184D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2c8051b3a12cd54a16216c03274df66f81b794314cf000b9da709a7071c60c7d
MD5 791df97d0164222d9754107748e718d6
SHA1 1d8d23d73e7d9da24914478d39523ead1f5bb281
SHA512 2e0bfe8f3d38b2233b1e1d822dec694124b7b59df8c7b805555252327213c20470dbe0a63a905a9813e9314687b797afd0127cabdd4731a5e02a55588f85ee00
SSDEEP 24576:sAhGL3IFoiwtA5l7S53BsqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5lDmg27RnWGj
TLSH
T13E359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 68eb47ebc3905ac972ea7e26ba1e5ca3a99833c6299d202770604da116570c98
MD5 3dcf69be604e437239a36073832c4105
SHA1 46f66a1e9e9e95e29c8fe65d58e34ece2abe8ba2
SHA512 93a2e7ba7b07a1299f7884bdb8810932afe5826b4236b67eb3d115e15024b5d6fcfc9bfe35effd04cb3fecbac59d4470c882732625e7ed7dbdf28902274e204a
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+C9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:awu4OWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16365F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1cec2ce8701d356b550e79251c0efa5a903ffc0e4bd486da1d5c05ef9d5340f8
MD5 09f7ce46fe809e63d391d42b4b931fe2
SHA1 df946883e64dc741a0dca04ff81730aa8b968177
SHA512 87b9995c4d6981bfdd4f2e208209a56ecb83711332fbfd51ee25b71d584f6b75a73ade900d07dc422a34c8316e6c6a3d2a8e91a7bde02be92f9c1484c6ceea66
SSDEEP 12288:YeZ1IyCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZu7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1255512AA239820FAE163417CC5E5D609EB337C62673003CF166656AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 acb06a5c6f72cffe8318699bf538df5bfc65a50396dfb598023dd767128dd965
MD5 093f946f23c2abfc81470570d4b22a2e
SHA1 6082c1d98b07aa78f66c5c1ad2ada6edc1691ce3
SHA512 fd0439096964930bac494716f0f0f9d766dc650c7ddf53b400753242014bb7119ac11cd783734f5ed931243585da472fdddce8c8e8bd083fe728df337539241f
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3QD527BWG:nQyiKa/X+PNgVQBWG
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a25c25ccca02ae936ab2f31a394fc59193209c8ce4b95ff52e7900b51593e33f
MD5 fcfba442ad316837995c62e47cf2f80d
SHA1 7364a7dcaa4de1ab4f81389b7ec961da78381d5b
SHA512 a8764f106e90aba7bf8d57e4396fb462fc263b55ffdf06a5fbb79b5ed1c5a6623af1d98271c33f8129ed13d1b7764258a45e359364f507a1f426fc4e1acca5b6
SSDEEP 98304:tQRQyi36YOcPbLvw2gAf+PN3QD527BWG:EQyiKa/X+PNgVQBWG
TLSH
T14F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 afc3f14f26a5f8e6ce272aa366f1374c59c9237518ebe8a6d273893066767230
MD5 ed2290626bed60768799d57e2befa287
SHA1 3a27edff51af7918eb8a3550e94f71b0962724c7
SHA512 96e915414427d257d4612503a536237da885edfa4f78c0b4b40732ceb000bbe4b51b312d0942ee40b4529516c0e54fbaa555021ef82afa82bea66849c524a03f
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0LsqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/mDmg27RnWGj
TLSH
T176B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b2a296adcd2a88c94a87ca7eb89feb614b8961fcd0066aaa67c6fdd1108ac07e
MD5 a2d83c363553f56cb365d3778ef5e024
SHA1 943e33029065bef74802d4e60d709a339113fad9
SHA512 76e446f02b4034ed985d1378c101d35d1aefbe308dce92fd12a7c3e9ed4b620295d8ad30a9bbdce63e47aebcca38736959bece5871155e6b9e190e46e33d5c3a
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZjD527BWG:pLIHEWhNVQBWG
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 74c84be6c64fa16aaa97194955d5a34359585e371d9b97d4485aa5294e06e6be
MD5 50218deb7b26805e0d6575fbfe78a284
SHA1 11f87f4db3f87be0bb5d30ced0f063c489c6b1d5
SHA512 925bee0634514e4587e77bbe1d49700609e34236a30ec24bc116aaa9eda25eafc5c2a9b467e5132cf37b321bf7cf3b22312450c9a52299de9e134f01b87b9755
SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3Dmg27RnWGj:pu6Jmdxd2d3D527BWG
TLSH
T1B8D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e5374c4aa2498dc5e9c59f8e7ad743feec4061a180bcbbd21a463f7d2220e7ab
MD5 80dd3df3bc56faa7d31818203f71af58
SHA1 dedcc93ec811a3865fa2a00e7b739dbe5d78ef89
SHA512 b104285c65577b9e63b53ab342eb516c6960a260ee5b5403b90de5db12f744b6deb1e30acab62ab63a46fe3200f0c35dee58295435c0a0a17970beee47da81c5
SSDEEP 49152:Y1hpsNoJpF1A63U44CwH7R4xMDmg27RnWGj:YmifPWR1D527BWG
TLSH
T11EB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 14dd99fa8a29ec32b05f32533de6e6d00260e7e4c1c39a037907939d87050835
MD5 d6027892beebc55be9959c5524e772af
SHA1 05bae0b4b365a81b5b63cbb0e9bdec4693d98e46
SHA512 f2788c3a18cab02ad2461b0ebbcd85c6e98ea3185728dd5b9a200b2ee533aab14ad71732428fb033632817df306a2388f2fd7e61ac0a79d73763a7e20ce1827a
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqvDmg27RnWGj:w5dKii61vD527BWG
TLSH
T161C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 284cd7ffd3bceef9dffaf5c9d976ee3f61ee5e2bf7053111b66d0e79d512922a
MD5 d228189d68e4e1c4b8011cd88452bf45
SHA1 f4c1de1323099c189ce80158e0a2c93c1d9f3dea
SHA512 7566e06cbc184631682f451d25ea9c9ed230edbd11a05641514e532b2c3e0b60cdee1cc4315564258dca5da662b22364c35da4e5fe063e8725a5a1f6f7457ea1
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5woDmg27RnWGj:PX2imphJD527BWG
TLSH
T1FF95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3eac3ee57c3e6db3cb2ab1d27e185a73a4a5b9b7c7d198c2683044850cb4801e
MD5 c666a44f85cce1eeb2ef25f654d2ae64
SHA1 9c53900a568d0cf80e3a324c569e3b899d53634f
SHA512 36ea9675af1b689b316be8bc6474adbbe5bce001a0aad2e5e0a59680c56eedc33a0a0fee62842636d3191af15b084ed42549e8d2ac15847b5adae4aac7d42291
SSDEEP 12288:wXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BF965C41CBE52648B5C3E5F10DAC073E57E92004937A5B7CBAFBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3192e53c9a744d1a8f3b4e58a59f1d14a5092cc90bf35ff33ac084703b5d6593
MD5 c86925b85544dde114fc4dda5ec5e8a0
SHA1 939db03157e9b4b75fed37a8ae3d78807ad12adf
SHA512 aa4c1f21fab59347331a30dfb3a39d1d226dc5dcf3cc9640b58b6430f757932711652548c8268f88144970ca383f04271cd036e655760fe8fbb32a12e128bb3f
SSDEEP 12288:/OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE965C41CBE52644B5C3E5F10DAC073E57E92004837AAB7CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0747b165218debb28e6c5762bf26eb94d1419797d7cb74b2cecec86b82168356
MD5 29fe30deef9db51b42d0342b366623f7
SHA1 985c2b52abb32ac520e3fe29ac80a0674aa3ed72
SHA512 cd4ab6d2317a95eee034ff7f8489b988ed863e922c1c5be3f6bcdd5b4dc34208aae2e9b040772aa31a6a297c97aef8e9a3d6d3c451da2faa895947c47d65fe49
SSDEEP 12288:1IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BE965C41CBE52608B5C3E5F14DAC073E57E9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 edabf72858a15047622c294422de7d0751f7a5dd012d4befcef314a1bcf7946f
MD5 559e4cc7d9338a8cdfa232c483e44234
SHA1 aafa84dc0910f891cbf1a3538daeee93f36a07ba
SHA512 6a0387bcd00da2b34bf1857f925e00f0736fd93d22533963c0446fda715e7f052d270175bee2a31aef6db729018f02883c616082de1d32e79ac92821753ac9c3
SSDEEP 12288:vVhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD45236F575C00C6D83285B4C2F5E11DE8237D96EA3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 df259f1bce59eacf566a78880d4c0a4554b671a42b6ff30d7f4c8b838f7b7884
MD5 8539c1569b03fb50303782ae0351471e
SHA1 008926bd73b3cc3f036a2ca6dd912875adad4ed0
SHA512 c22f4b61069ad7bed39e5e6d66efdd8ee598fcb130a2aee85f7d90f99df6e564f45db912348fed64e0f353120afe6defc410d3cebea6d565d4117600342a3801
SSDEEP 12288:EpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6d795904d7fd1d5e5d8e905c1390cd51419c51a503e66d21ea81618ef5defcc1
MD5 2b8030c0b8e67a9c71346199bc21287f
SHA1 40c1614aaa6020ce2e23439db02c8aa0f47825c6
SHA512 a1a99ad48a5f3dc13038ab03d452e485a8433af11d5e16a9c7a529dcc4a054be0848550081dafdc99cc72ac608e9003aad75e45843b45c62abf3c99f5ae821dc
SSDEEP 12288:eKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BE965C41CBE62644B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ec976c75430f95764ed4bde8b0b9db76b698958e8e0bc58431c4e9eb3cad8f5e
MD5 03cf6d0099334b5152d0a5b9b3d38c4c
SHA1 0921aa2524f03fc2b1aa9c522d49d3495332f972
SHA512 fa8c6fe3672bcb5077d24dea4c7eaf20a6f2c946daa52349a8c4b55438eeb493169f8e0ebcad5382158444f395289132eb4ce73b6eb1f9bb4323190181aee6c2
SSDEEP 12288:q2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE965C41CAE62644B5C3E5F11DAC073E5BE92004837A5BBCBAF7B14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 acb9561d7c46e97fec4299c76636e6f1b50f57627d01645dc1cba4853a2187cb
MD5 ccf262236374e787d037cee10daa3499
SHA1 7fe98082edc6301e167344cab58697b22eefdfe7
SHA512 3b8b023931b0c0234cad5c4d49be756db9935f13fc5706fec9270b10f03f50c21da20dec607d242dd43e0b626f553ba782556d4dd441b98c27f640944052b6f2
SSDEEP 24576:hZMRzFVSOusqjnhMgeiCl7G0nehbGZpbD:hZMRzfODmg27RnWGj
TLSH
T17C6501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9826a580ca562f6e62d4c27f3dfef98d1005b25142d4d2a7bc5826f65ad0c507
MD5 3b197ce0ad9229938a43d3aa75a4374d
SHA1 b116aa978eb24616f5a94560a19cce65d690a2e8
SHA512 452bbb6fdf05f91cec49bf07eb21d737c42d62a112e4d7ecd2e360c15d88ecae56d78017ab93ba9b08b03f813af576371a51ee01f9beca72d69e49d37551c79b
SSDEEP 12288:ArXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ArsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BF965C41CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 431f7070235030654d4da861e221d9f5156e899eb434840df43cf133ec8cc7d3
MD5 eed29ee75f87a559f37d89357ce3562f
SHA1 2b05e026a30dc1218292bcbad46200e361343cab
SHA512 1576b049b1696c3681e8e2acf9b5f8e4b05e8e761054ccfd15f6779556d1c2c0c795bf139b6ded15f4a16202a9d9b79a6bd386720d8a115928e892fde552e6d0
SSDEEP 12288:KvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BF965C41CAE62604B5C3E5F14DAC073E5BE92004937A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ee642ac95a098f609c73820d63f7bb1bde7478f4cf7d35868a50de30c9ce12e2
MD5 2c23b3587ee57822e8c917a70d557aac
SHA1 0135dc36ce4885477fe56d9b4d504c99d0910299
SHA512 87df0576c4f9aa26e76033069b33b8311712191aab1ea17a15520b5972cc441b09f9a9e7c96a6f19103e3a8f12103dc6f2728b36f02c9f4b08e50aea5e5c5f27
SSDEEP 12288:/yPz5L8CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzyCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16155125B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2d251994e8be4fe15b9303f84007e2311dca32611c1a8df802e6719925809429
MD5 b5f6e303e60a9a44e8028b1aa08b8ddc
SHA1 9d16a007732bbee49c8a1613ce8de311cb772b62
SHA512 7afa69a3d2e878ee5dbd4d82f573b1309170d3f0765bd65f70c1386a199699abe0d36f0040d672c25118ea08e91c4bdf0004f134b8ae9666e7aaad44074ca1fc
SSDEEP 12288:9rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB4523BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3fda535cd7ed68bf8d02374f3979dc5751d572ff8de4c3315687a87d970dd992
MD5 5fbd79ccca8d76930587f12ea9862a1a
SHA1 7dbe2759ec2d056a56dfa312d5c3bbb1b494d4a7
SHA512 83e42ff228d090e2d5da95d2519210f2e89032ea68bd9db64162368d61b859c8580387ea2c3bcd85815b52f488fb1830c65180b5fb155b1bb82339b4adba1166
SSDEEP 12288:lrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 489ce732d005e56f4dbe2f438564fddf45234851b21e54b4b7740bd5f6d4cba3
MD5 7cc23744f444f9f3d37ffaad4ce26718
SHA1 9cc2b71bb7e482ebd4e3392ef8b4dc91385d5ad6
SHA512 4f120cc85f8849bd863955ce9fa223c738d95461f20a0a87263b392b7c89c3715d2ad1e55b93fcc061d38d8ceee6768bf5b3c3a4d3897e503de69ca4be86ae33
SSDEEP 12288:vyPz5L8CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CzyCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC55125B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 beca7976f6f4cd643c23761ea5bc00d0592a370e24d39e85c67e79b352bd576e
MD5 ee4edfe3e51f5e98d419bbbf92340967
SHA1 e11e86c3352d083f5b297baedb74fae9edb642b4
SHA512 eeaeaede722713fe8ee1b291f052fb9fdff783a2cba7fe13040643e05c527a75bfdf14245af24e4f06a27115614ba0e1e6c4b8d6afa0f1669467363f6710eac9
SSDEEP 24576:eTDaLl3z0zDYsqjnhMgeiCl7G0nehbGZpbD:eTuLljBDmg27RnWGj
TLSH
T15B6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 84cd8900233a0feaf6149faa1487916b19d61d234c788c054ab9220315cb50bb
MD5 211e55a5315188d198e6496fa5446ee3
SHA1 179f49bc091f0d43b8a07deb635afde0197f36d7
SHA512 361333df66a312d4bc147eeb38288e78087e654e7c969b5b1a9447d6735ad1e6d9acdc97f6732c91114295b51a0323ff79d97bef56c66b4d06cd5f889e811b67
SSDEEP 24576:t3vd9CHKy7GZUsqjnhMgeiCl7G0nehbGZpbD:Nvd9CHKyaODmg27RnWGj
TLSH
T13A75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bebd835bdae6d97c2d48fe4870884e980fc28b61539f592ea70bafe337854635
MD5 eb487a60a234b8c360e1ae6cbacef8bb
SHA1 a0400edb58d96b601647eea829057234e437c1f4
SHA512 9338d5add329ef88212a8298589f9598f7003da2c4c68cfa5855fdf19caa3fd168cdf691a0efe2c553573395ed9e8b95eb99f2576c3d550dbb2e08e362fbb701
SSDEEP 12288:9oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9osqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BE965C41CBE52608B5C3E5F14DAC073E57E92004937A9B7CB9FBF24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 889a8222c595f59d8c231c2e403804bf598a2e2222a58f9321cf856a3f45e68a
MD5 4ac87d7ec8f0b688ede5d086183f9c7d
SHA1 a025bea5d3829361de0e35102abe48f231d91dc8
SHA512 3a4c236e737dbd8701e36a95fb8c5f4234732cb0ad53aad61e12c7a983d2bca53ed2e4339f169792a09f5a1e88e2d97601b27205a4915b94814e77852c42bb48
SSDEEP 12288:piXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BE965C41CBE52644F5C3E9E10DAC073E57E92004937A9B7CBAEBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 35da6408be16506a0116569a180d04ea2407c18386ce113003afc90bbc52d10d
MD5 3a284306bed7da45b7c75667f0ef4f68
SHA1 1bfd76d2effec8a46c010686d427a7d16c7abd3d
SHA512 46c98abe4679a5f0c9c1adc9611958633bf7a7254ce3bf147728f8eb3e5904b1a1576af91019c70779571d4bd972bcc05dfb31b65b80f467cda74c32daf4b6ef
SSDEEP 12288:kFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BF955C41CAE52644B5C3E5F14DAC073E9BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6c89d9af9873aa4f9659d5c9d245616a0900a425af381c290140c9af23a834ea
MD5 0f4998f7b279469602bc130db52a9079
SHA1 4605e1ea8b8c19f835a40ffcc6c8ad0bb13b5d89
SHA512 e270d3663fa99b3a2298fd1cd38ae20b3bd90049bd398aded97f4a271c8d0b65524b853a66a7e123849316391416ffaaa8864f5396d8a00351209afff85f299a
SSDEEP 12288:irXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbER:irsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 38da21ed08902c423dfb04d1eced0b8e4fcd4e7673942a012426da46f5355524
MD5 e2de25f60f9229fd93d41714dfa6e77f
SHA1 cb81969131d26aa64a8307a755df074880c43810
SHA512 e021f08a70eb7e2fcc9814e5d8ee1894520cb4ca1a9d7cdd032d8ff87151887847df35eaf2c94ab03dba0764e216c12ea2a4a8e1233831946c0826911a7e95c8
SSDEEP 12288:WoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbER:WosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BE965C41CBE52608B5C3E5F14DAC073E57E92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 77e78629b6924737810f7da6dd33e80f9d197a8e81d5cfea818a9fcb3096ba1b
MD5 ee627fe2de0c58b33f5cf04c0de01cbb
SHA1 1e39d1f5dc81d019899489af9df8b2567b5f0b1e
SHA512 6bb0a5037b3c5a948c347f219fc0a9c314ffdde1e55e49463b1b72666e6c0c3d4c88f1a180e55c604862197e0f13505f2e2c329fea98827eccab93e6b55f37f6
SSDEEP 12288:6zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbER:6zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1744523BE965C41CAE52648F5C3E5F11DAC073E97E9200483BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-03_134444_1484-2352.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-03_134444_1484-2352.log
Size 1KB
SHA256 0f57c2cea7ff607faf573aaf3229acd9319eb921a2047de2cd1071a11555c9b5
MD5 e2e50a0404a5a88a8eeb4dcf1bca0149
SHA1 aa5aefb812e51f8d60faa4fa0242c7ce7e9eeabc
SHA512 d086971ab55ad90e2d0384c7fa2c3fb2742d14a799ca4579c315d7b206e5de24f8f00da187d6452926a9fb48eec0dccb807180e0e6c944abeda57ef4ac39a019
TLSH
T1E5214F29ABE80B07FFFB99C29CFA11536E3A39926834CA1D5064434D1975F81DEB0317
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 df2d76a5b40863062eaf25bea2a4b9cf78f619eb17e3138c79b01afa3ca1645f
MD5 e8d6347d4fc9f961935b595d767ba4f3
SHA1 c5e87f9b5c0cbb7f31735e35425d66ae1e7a21fe
SHA512 a1885cbba85ed1a95c68268e45f031ab465f53df32482cd080d430a11e3a0a879350dcebf9eec0f225a7c8a90607f3c39796ed23772dabc4fa3ff30d48b0b1e7
SSDEEP 24576:hfwvUk9RX6wkyAIfsqjnhMgeiCl7G0nehbGZpbD:7MnYIDDmg27RnWGj
TLSH
T18785D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9c9c7ee0aae8a3dd78ca92e9d8d9b704ee73ff5e30d08ac973b97db10fe1c9fa
MD5 6d6202e0d7561f4f99daff43153b9f98
SHA1 4afbfb140d53bb2411167ddccb5f9a3632b7f3ca
SHA512 99d21599e3b402cb8397bf5eab3741e0b3107427300f89578707216e6098172f79dfe740057c851009271c2197b1327f4133945115b2c2868cf930a57dd02eee
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IDmg27RnWGj:RySzPwD527BWG
TLSH
T1C9066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cd4a41848bfb87884b60872e954a6099f6feb25c20f7686c35da221f68b51c14
MD5 1470d7407bfbadd500fa741d7f171881
SHA1 6a9ec524c62f2115b545fc8e4e0738b6d86de438
SHA512 b31eb4876dc51ab1a1bdf390d249e22f5f2139244d4263b3bf70b682103d89bcdcb64885fddf021bf2e21131db7b2239821caece368344f6e396cc2ca661c466
SSDEEP 24576:z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYesqjnhMgeiCl7G0nehbGZpbD:z47JUQjTirIhCnDHUPfF/4Dmg27RnWGj
TLSH
T15E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 951b05046662c4c0aaa6510c6705414a3d82127c03605ebdec76a308ce4d6b3d
MD5 75fa9abe5a6d4116e338f253ce811c69
SHA1 7e42e47049cb02dbb1305a466d932ac57b083af3
SHA512 bfb80e923083cfe9c7357bcb0eaa5d837f3eb0aac4c1ea5ba5383bb62f0d59445b56cebea223d3e3fef897397ff896ad4412582911d7d5b6c7a736b3fa612237
SSDEEP 12288:2bsf7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A55011AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5faec6694b01ebdfafb2509c2382ff55c32d57c3fff27a4b2d3ce40101c85e37
MD5 1a84b620b18c0c20f7ba7308a71b6920
SHA1 1f1c276a105e39608f64a39009756bfdec189d21
SHA512 dfe3a27e94088a79ae7cf10236646fc6829b007957848a1af7bf8be2a1109eea0ea10fb34230ba5a5a2897e160e48ef8812f42b69e6b0847c5198522a36cf090
SSDEEP 12288:umWYg/mU3fnm4KJL9vTyBXcdV5/8+W4h8AOEFYEKk:uTuUPnm4G6XcN/834KAOy7K
TLSH
T146350605766AC78FC66940321E32D2CCAB707D11EE05AB0773C84B3FD57665DBAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 651bacf952b21664f3e6fa19d23cba13f1d7e5549c816ca7370be55dd84de309
MD5 8e079b44d6c53dc44ff15ad1471ec540
SHA1 0055b849eef619be6d88c59a6c3684bf0e321e76
SHA512 ec29fe5ff1a9ccbc423645963227cc9b4b72145acb3bdff433901624e952843b166a969710cd9ef3930ed08bd039e5f7d00e23260f50f35c9ad0ce06c842b7b9
SSDEEP 12288:CRJ7yZB9d/kkwfNAxUos0iFu4TS/63W5AWEK:CRJW/k0AWEK
TLSH
T10C75F9416436E38FD1BB2072073A9B4C6B74AC17B705AF26B3C4493AD86AB1570F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e2588c41dffb73eeef58173e56e12fa75f7ca48854e47165a54707f33ecf6abc
MD5 9b1e1af72ded22805e2f9c8f6c1875a7
SHA1 66eca505d1b4c090386fa758df2a8ff7fdc56c3d
SHA512 871c4552e2bef53be9ed89acbe9c2c1d6841685ef869685422772a02a18f37d1f3b1d6d017acb1de4b4f13b7c8f059954ed8073eaa77dbbcacb0709ebc1020d9
SSDEEP 12288:Z07DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F45237BD34C518AE93605B482EAE12D680B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2d25b66623a9aa0b52154908a39a160c24edb57b656a17151d769f409934dcc5
MD5 85917ac9074957dad607321c305a7b4d
SHA1 3e01c2c4adbc979c5a9398a715d50c9a904b8537
SHA512 3ce05e5d33b8d109c8bec8fe8978545745b323c8e395d2edd476b1742e6b1e378b778a3de376630ae539f9b8b09e00dc7600107b72afc4958a95dd86d8031f68
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:9gb4mBIBhGFyDmg27RnWGj
TLSH
T1BE659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7da9629ca35b73f77893a5eeb096b6d037a8a7a5fbf406045bb70c837600798f
MD5 5ef112eb8bd1682b7a6c95251a049fe3
SHA1 c600450565cb0c8a9d9c7dfb8d6c56b75b82e9c1
SHA512 609e7e0a87dbe0c03bae9497114c75c81e0b316fb5c7410c32681aa0463839fed8d54300d069f6860f609d2d482234f62ce96fd3c8252498464b945ad7660ef8
SSDEEP 24576:YG88u8FpJqH1bzria7/musqjnhMgeiCl7G0nehbGZpbD:b7ZFPqVea7/ZDmg27RnWGj
TLSH
T10985016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 38358e93d42fd9e03a160dd95ace580695a8e336d76bed75c3c58faaa33254c9
MD5 d34063dd36ff77a9d6c9e7c6ccc033c7
SHA1 7708c571cd388c65c23228742ea81305fad47702
SHA512 a03b192b7ee6424c50ed8ec177667688e1c60a0d1ccbd03d63b7932d1c9b644bb69a2ce226fd3182a35ccb7c4e6482cc7e8c564cfd5cfcc66839d80a066472a3
SSDEEP 12288:zHvUrBFrEjwaQ6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:zPUr+NQ6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11865F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a661b1f26a43f97bf4fe0cd273d841575ec9317536f164507abb5bda8e43cdc1
MD5 937bb0736f26ced84ff2046f4f902130
SHA1 26b36f9a8654d5b46d2050230e799407dd3f7841
SHA512 1376d3a26d61ab1cfae5ab407d6d469358fc30cec220cacac7f64b0b95cb0749d2b1b93795007fc3c084625191d352d3927ffa362f6a396eaf88aa907094266a
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeDmg27RnWGj:DG05lO43bbD527BWG
TLSH
T192D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d2ff176d1a736a84fb189ca91bca0d74ceb9f78d4df1232879cb24284df665bc
MD5 15c1b133a3dbe3140880340c14746659
SHA1 7972b140cfd0ed6c5b435f32bfeee2d1e6c553d6
SHA512 42b8c4835fc0a89906d66fb46fd137b666b458f70c6e6200bee87a0d59784ec606f6101fa0ce8edc74854714bfff0aae17accac16cf49c7793c0c9c816e03903
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncsqjnhMgeiCl7G0nehbGZpbD:ia5POZ3BJt2pasx2+mmDmg27RnWGj
TLSH
T16065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 893cdf330579d581327caf4df84aef24a01891cff526fedf79939d13d35bc9fe
MD5 ea87fc1faa0566a501b79e518314d689
SHA1 b8f08dc26c0df99865bc96c7f7b7b489d2d0132b
SHA512 2f900af9a4b191d3fe304a412ea77048828f1a2d55b46ddf8e73cc53eb88b050fbc477dab75b892606c66075a06a106b201938df596155d87f3672ae9ba35e9b
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkGsqjnhMgeiCl7G0nehbGZpbD:FNc/zEOVHF5Dmg27RnWGj
TLSH
T1D3857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 251deacb63aa117fbd4ce6a30ff4da85919fb10f3a8b59b319b2a2d778d48f72
MD5 5e8e7d2fcbbd2d33d3a6b4b121a852e4
SHA1 e5e6fbe834ee5c34dceebe220fa1dad02b946091
SHA512 67c542970511ffafcea050dae26716c22d26a4a2588e017df8e2237cccddc234df3a46f0dda4db7aab2c4ad52121a7e076987f01dc9d36fcf78561f82487d165
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmHsqjnhMgeiCl7G0nehbGZpbD:gTMwBtOmbDmg27RnWGj
TLSH
T18355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 19d360eee1aec72bdaa9c6eef819831bbdca95dde2cf104220e84fc37dbcfd2f
MD5 87db2a25d795edd29501d2571134896c
SHA1 14e731e6e14519f8339283e954bebb320f4e199d
SHA512 9ecbe3ce45bf72ad40f34b74446f5baaa3bfbf4adda12c9af143c2fd34e94f3b99d684187de7a52408aef5a04b39772097d5af958c71cd1a52a55c08430d9517
SSDEEP 24576:yD3FHshBIYQgA3sqjnhMgeiCl7G0nehbGZpbD:yDVHeBIAALDmg27RnWGj
TLSH
T18D75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1124-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1124-295-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1124-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1484-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1484-19-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1484-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1484-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1484-0-0x0000000140000000-0x000000014046B000-memory.dmp

Download

memory/1484-18-0x0000000140000000-0x000000014046B000-memory.dmp

Download

memory/1624-279-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1624-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1624-66-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1624-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2332-112-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/2332-55-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/2332-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2332-114-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2332-49-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/2460-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2460-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2500-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2500-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2500-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2500-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2872-171-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2872-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2872-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2872-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3468-25-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3468-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3468-31-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3468-141-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3588-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3588-98-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3588-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3588-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3588-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3588-314-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4504-115-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4504-121-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4504-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4504-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5156-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5156-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5156-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5156-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5156-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5156-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5876-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5876-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5876-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5876-132-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5876-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download