bf68d9750332cbd07d9b68f856c99fc724b09b01d544ac4e8684209d57ace5bb

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260708-ncakqaex4s
SHA256 bf68d9750332cbd07d9b68f856c99fc724b09b01d544ac4e8684209d57ace5bb
MD5 8ea083fb7d3e47219f02f3cb3691de6f
SHA1 7573f49af5405278e11287c01add048cf2f98283
SHA512 f643267d68b4a0290da588243cbccc7c07a1b3bca2b89f420024ed23eac91c824fdb61dbd3bae9c6a0c9c645478555c8e1b60d517892c490d91987e25cbd1961
SSDEEP 49152:4oQynEIJx6iEdOXdgh73Faz9wLXDDZoaLOGpyE5QeaXTMc8aTyuPjSTU0CxzPn9p:oFAeaAhmznPzk0F
TLSH
T131267B1BE6B940E5C0BAD1798A57951BFAB27819873297DB4790431A1F33BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5696	elevation_service.exe
3740	elevation_service.exe
5424	maintenanceservice.exe
2836	OSE.EXE
5660	PerceptionSimulationService.exe
5112	perfhost.exe
3324	ReFsDedupSvc.exe
3280	SensorDataService.exe
4252	ssh-agent.exe
4176	AgentService.exe
404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\76bb0af02718719d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114953\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fed01d07cb0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021eae446cb0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004beecb07cb0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3b9de08cb0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0e2bd46cb0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040fa7708cb0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5940	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5696	elevation_service.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4176	AgentService.exe
Token: 33	404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeDebugPrivilege	5696	elevation_service.exe
Token: SeDebugPrivilege	3740	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 1624	5940	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 404 wrote to memory of 3488	404	SearchIndexer.exe	101
PID 404 wrote to memory of 3704	404	SearchIndexer.exe	102
PID 404 wrote to memory of 2668	404	SearchIndexer.exe	103
PID 404 wrote to memory of 5500	404	SearchIndexer.exe	104
PID 404 wrote to memory of 4552	404	SearchIndexer.exe	106
PID 404 wrote to memory of 1428	404	SearchIndexer.exe	107
PID 404 wrote to memory of 2612	404	SearchIndexer.exe	108

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8ea083fb7d3e47219f02f3cb3691de6f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5940
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5940" "1460" "1372" "1456" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:1624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5660

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f3723a8028ecb2f6e75c3bc4039018284d296abc8dffc7e004ae472fbbd5c2a6
MD5 24dfc85bc3846916fe818805832b4eb8
SHA1 e35c69451bbcaf83b7c0ad528b52f40ffea94383
SHA512 7dcf3b54c8d1cabfa21721900f5e7ad67d148709c30dcef28d02848dc30fbb944a0244233ec5960b30702e8bc00bef0407e4b1861330967dc0016d2be56f8de5
SSDEEP 49152:Wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSCxzPn9NHzk0DF:I3q6sjB9mznPzk0F
TLSH
T19DD59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 12647c2ed3d33577003bd0f0c3f481397c8685dc5a2aa6a4ce6abc224f8f8f50
MD5 eb10c274a9ace3f8c187d0a6a94895cc
SHA1 c39af0fa189614c99b34fb7ff6ca45225595ce79
SHA512 c65a69f2719343baa781edf7d502edb17925c2cb8197fc09046788b85b207cc83ccffc6a64d916d259dda1042dd97face05f46f731e0ebbe7cbd0927f48497f8
SSDEEP 24576:kXYfDtczAhCxxBPRd9tdHZH+S010DFCQ:Dtc8CxzPn9NHzk0DF
TLSH
T11785022963E409F9ED67823DCCA2C516E673BC914360EBCB03A499255F233D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9d713392cdb3f15352345fb890e69f94303437b5f6e3deaace9f7e7f33adef04
MD5 56eeb9f68405dc4f6b60e470bde07e5c
SHA1 f298a3bd2fc916c27851f3c27011dd658439cd89
SHA512 ea38e155db39b3390fc998da268bd4185d7d35b9012d0caa3a9e930225c80345bd18efcfd4ca15bf4ecec700200d709c7f0847459c0d88f8cd939b91c3682550
SSDEEP 24576:w0Le5ji0hmx7rMqCxxBPRd9tdHZH+S010DFCQ:wPji0A5fCxzPn9NHzk0DF
TLSH
T167959D16F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ab3c6aecbb8b45f4f781e069c96e35b8151271bd0019edad908d37c4c7edfcc3
MD5 064abc031f7c21b03e108e219939cfdf
SHA1 3b2a2ec863dfc2074fd10826d951a1f3625006f7
SHA512 67de5eab29979b462ae8125b327099731019c5cbf89cad150b1d423123055731556fc79432a6fd1fa5cbf24c55f02a66649e7753a9fd4dc6a0ec983be60dcc11
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyusCxxBPRd9tdHZH+S010DFCQ:0/ezSC6vUzPveHjyDCxzPn9NHzk0DF
TLSH
T1A2755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 371e30b2d888f7e652406bea61ae07b29ae08226a1cd30d3a924b39133c94c09
MD5 058259743e862b05374062e18b0fbb0f
SHA1 e9e54d6ee5d6d7a6f0b739262e944c59f57cb4a2
SHA512 51629b6706a0a79247b5c9347a7ae7800f1a00faa4a86d9aae23d855d6d54ac48bc194aa01a6bca4340c62a893e49dcd67e2f22ac7c907fe30124939cf58be96
SSDEEP 24576:WVbqPb88hv/l+YtCxxBPRd9tdHZH+S010DFCQ:WVO88hXl+0CxzPn9NHzk0DF
TLSH
T183559E66F5748331D073C0BAC5D2AA9AEE7234425B318ACB1246D72C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1104b32dbf4846a10fce57b278dfef3af7c1ab2a5c4b417f2ed22baaac68bd8e
MD5 27c38afcfd3c7b90d15cd659995623fd
SHA1 3bc21e53dc93b487929a9891e881f75bb46a11ab
SHA512 9f8e62dc65ddda99a6d7ebfa461aa24d7dad4e3987f1a19679bb3722ce50bb9d72bed8532ad021ea3062330a2a457370ae48a9d318e66d635ef8d66ed0a36978
SSDEEP 12288:TNVPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:TNmCxxBPRd9tdHZH+S010DFCQ
TLSH
T10D65230302588A64FB34C57279A7EFAE84DFEDC095945CC6D7207A12ECBD358C6678A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 092729850e2d7bf6552db4d01174601f70acf875f9aa68fcff9c9869cfa0a686
MD5 5323ec049208fdc2ff025634815d23ea
SHA1 a05a50bb9341cd893b076c86c3a9f821622f4ad9
SHA512 b559c075288eb0b8c926cbc6914d153f10bbef47a573816f7c623d59190a395bfe16b39d4ffdb54a15dcfd57c053818efb13c98530f39acf346ba2ef6cf40cdd
SSDEEP 12288:beBNUbTVO86U0PUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCy:bJIUlCxxBPRd9tdHZH+S010DFCQ
TLSH
T1BA85C03BAE28FCD1C67A8D795A91C740D7B278704B61A3CBD274820EDE135D44E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b578a649fdd4b4d3bbefaf809a57f96f8d9bc1069c47fe5d59e8ba377018c0b1
MD5 75429fc09f05e881d1229b6c85defc2d
SHA1 3df26540e17dc232fbcba39967daac2e15cf0b35
SHA512 0ac72bd1e7bace6b2e60b9d84fe3dccc7f26367bb0ea9e543b72d6e3fca01c9cd7f2f53998a04941ff8bae530571e5a175cd5cf68b692539cbba289f504c3797
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:rQvGAdlCEL8c/DRNw5CcmznPzk0F
TLSH
T179266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a28f9d9fcc13723f228cb7f404c359c65cebabf120add953906bc1cc3ce3f458
MD5 42cb3c33764e9a376f346e4b58db4860
SHA1 aa177a0ff18e02529c1b42809ea505df7c826e44
SHA512 7101e4b47e5a75ecfb519e362496f91fbc0f88fd61ac4eefcfef46b17940a1282dd371e8c9e1a2bd490776e63d1c49600b987ec8d1f1f12753fa90e0f5adb9c6
SSDEEP 12288:VAwSfxL/2Dc3DDLLmt0LDQewsAjyPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nSt:2SewsAjPCxxBPRd9tdHZH+S010DFCQ
TLSH
T12A85E031FE74D036C77B0DB22B36C716146DB9604B6119C3E3A88E9E99702D26376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cd8da24659860ba81f0dc9ac5298635b873655bc3e8eb8a0be92cb9d44920b19
MD5 f40a1a522acee5a81672b0a502e3425a
SHA1 6accd87b7d70f9bc28aac7be96a06ed0ece44ab8
SHA512 8a651a18e46fa6658c7f206a3175cd524f914f5c3ddf15cc329765490558c1363ad4a1fa7b179ba561a7a30d99ef5727526254a59bf6cdf8df49da0c52acb9d9
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHXmz:5UEtQevvqc2W1cpV2tI32Xm
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 847f5bf8891f50746a08a09405f139eb27a894d57d2cee72d1d52ff8148c212e
MD5 0e5361cdbb38ae01b064c89b84bcf11b
SHA1 6fc3522ed79b2f0bc77dfda6f32e03de5f8399d0
SHA512 c671eb6069d17045cf32640281653d52cabfec1555f8a91d9a2d70ab4a097fd2874aab8e6f316ab5b47dc457d900aac382ad40a98d3b0fb5ad5b9a77106e3778
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zvCxzPn9NHzk0DF:qoquVjnmAmznPzk0F
TLSH
T15FD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ce6b87020d954e428f2a121810553e9c91ced9f5463897cba95e9e7d5149bdf4
MD5 2969d02608c51171aa0e7c0091a6ea64
SHA1 481ced53cc5feb9348610d22caaae82cf62acb2e
SHA512 0035c92f601eb33e097ad323c3664cf3407a56f49abde5dc75c8e6524a60ea1beb2775aaa4f2907d259a4d17bbc45392b8de343ddcb0dcbaba0902631f924430
SSDEEP 24576:9AhGL3IFoiwtA5l7S53gCxxBPRd9tdHZH+S010DFCQ:9AMUFoiq5wCxzPn9NHzk0DF
TLSH
T1C635AE81E7F945D4F5B3AA7899B69571EA77BCA65E30C20F2260D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bdbcd6e0dbde8ed5b741b81d09215d94d69025a170d733e6443c3d58cfb6b59c
MD5 d01108e7cfc50d68853cada1340cbafd
SHA1 d34545010e18fad7bf8c1982be92181628c42deb
SHA512 87a24362abdd0121416eafa7f149812f641551c1d3da94a46b0433bf9852f27deee2dcf88f2a6c2c132dacbaeaf53738bcd2c99fa26e882c9c23eaa7b96b8fc9
SSDEEP 12288:4mw5HEjsChNPBFgl0WDm+CnPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tR:1wuWOWjCxxBPRd9tdHZH+S010DFCQ
TLSH
T11485F14632A40CF9EA7682398597C536E7F3BC412A21DB1F5760C6176F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0ea07fd4c3a27097be04921169723e0c182b2d38bde4bdb193554066f179882b
MD5 d10602ded98d2f703ee3dc6ef485baeb
SHA1 6c3958d4ba283347a82437246484b2af58849b2f
SHA512 26865bb7e8deab4ca5845b01f453f314a95b51008cdbe83c9565f45e509cf28fdad876cd2a38a9d982cdc6af6de851a3806e6924154d2b8ebc717d4663592210
SSDEEP 12288:p0Z1IyiPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:WZuCCxxBPRd9tdHZH+S010DFCQ
TLSH
T1AD75124623E461F8E7728239DCE19A49C7B3B892637147CF572046266F637C58E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f490ebcf465dcc83c93fc09d31bd4885875e8fe2962ac1a8eee600743bd845e0
MD5 1a577afc17eaacb432bd82d4e18fc813
SHA1 9d0cd1bb5e7269eae3e4f863b0d2df9632798156
SHA512 d56a6bf6ad7b40250c8b3f5cc6766d50852ae8d5601b7ba3838838183d2cc8ba06785bd05b27168521ce45e8aae021dbc04635b035529535c4e6945d8dd24a8b
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3ZmznPzk0F:tQyiKa/X+PNpmz
TLSH
T17B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 88bc35ea4f8088f7f69f3cf77c858a80623f205b26dd83a4e435ee095cab5610
MD5 7728d3695226af74ed41d6ab3b42f715
SHA1 90fca8b74aa0ab697d529b0245ed2d8df0b8477d
SHA512 fb07f8b87f71bdd433e4946ec1a4da739751a0c7d75e17627e817c5fc111138601e432538d9d4e9bc86401696a78f19db8d064c8f6d206ea4f7fed4706dfc992
SSDEEP 98304:tQRQyi36YOcPbLvw2gAf+PN3ZmznPzk0F:EQyiKa/X+PNpmz
TLSH
T1BD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aa2f6453e05dd90f6396a9d07282b277745eb8572f574d39414a2152cd8a3e2a
MD5 2f59a02c3b2759d5907560c225b1a925
SHA1 469eae84cfff3b10cad777b4b717832991a8d736
SHA512 635140381ae4f9ebbb691586179c2f9895bb6e6e79734b7ca5057a76a54748375b186ccea36b68d5090a7c7983f7f4955d7286f5abcbbaba58fcb0d869e75286
SSDEEP 49152:B68Qg55nhceWu7PNU3/fCxzPn9NHzk0DF:/thLRc/fmznPzk0F
TLSH
T14DB54933B2F600A9C45DD1769F4A873196D27C718FE0E7DB861172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8c8c332749c3aa2007b1f9a40f31602ce6d89edf9310bd8b27d55eed5469c42c
MD5 6f1dc01481bdcf078654e5471f1f40a9
SHA1 809ca1eb43d714df39e3a322a36bc590096b011d
SHA512 1c48210dc6c07b4b49055ec01e9ed3e2b33a058614fbed1b23565e91646d7c8ed0b7f0c729366d26494ea596b908ff0d416af045408f05fe67b80f83107921ea
SSDEEP 98304:Fy5112gYy5azzVvt69nLKnhZmmznPzk0F:oLIHEWhImz
TLSH
T1FD167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9d60f7f11903acd260f039072d3a1b462a6c0dc6b884ee8a22400ad88eb21fb4
MD5 8df879475c166622e5c111349d721927
SHA1 6596ec217c066c253d31068294feb31152cd4d7d
SHA512 e0bed405ed8ca03a8df07228f61755bb6e336b40b8291785dbfda9466f7231c5b0b5eb0dcf2b24ef27e5907fb61bcffad12e036498b9b0cdc93f9dae49ff9085
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glVCxzPn9NHzk0DF:Fu6Jmdxd2dVmznPzk0F
TLSH
T168D59D13F1DA01E8D06AD478974A9233E962BC490B35B6DF0B9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7928db3f21452d2cd1cd248d57d1dcd756bad73cf821f96ba58bd4ac31b00bfd
MD5 3c3a584b78c21d50650e118a3b833503
SHA1 818df2b467fa3f60438266dc8df2c527b64f3216
SHA512 3acdb2cfd0a65a46618aa4032c9d160ba380ef60af9c7c8d14a2b3ffc4b89895e7f7a62ca5ad286370e900e9cd25826a33c9bf9bdf191337415214f09d65967b
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xFCxzPn9NHzk0DF:HmifPWRAmznPzk0F
TLSH
T1B5B5BE13F2D901E8D06DC17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e6eb8a625fcf4da7af188ea99652a95d42646ead4acac8fe96c43d5ddfab1cd5
MD5 52978fea8a03ccdf7516140caa310f17
SHA1 27995157ecf564f5b469ead7c228fbd8c117c128
SHA512 02c043fceca9a6ed43500c9e72d489b3b9bb8e1017fd8d01877649d7c058bc944c91cc8ee4654da4d24fa30413573d4383732ea733f4dfa933093bc08c831d34
SSDEEP 49152:9SuZQIY0Be2KcRVtOnks6NMHqCCxzPn9NHzk0DF:T5dKii61CmznPzk0F
TLSH
T16EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e38e99772dde5f00b7cadd09149530cd8726d316fdf905455f6a88d41d8c7bd9
MD5 cb88f58a98fdfb17e24940dd11804968
SHA1 aa7bf236d410b8bff5aab32c111dfa926d7a0c78
SHA512 ce7cc394d5fadb02bb3c143b8c3c26b6e8b5e5543e60b776c426c58309597c15ec16a580703e1f43f702a8a8a82908f9183933b3c16ac5df654686fb876692a0
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5whCxzPn9NHzk0DF:rX2imphkmznPzk0F
TLSH
T10C95BE13F2D901E8D06DD178C7468632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 44752939789959a807489288f52a7e03ac1d13a5e67ae9e3e4356162ec1ce99d
MD5 3069f4320cd01189919cbcf9b82ccd73
SHA1 41c10c00783863ff39c4bfee9195437d1d34fc5e
SHA512 dd98b4969b41a4328a7ed8c32d5e7187c1600332808c082b5a19d22383e4963a57541b25847110429413b4498efccb19dd67b973383bdd3090a0f68bed8e5fc2
SSDEEP 12288:f9PUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:feCxxBPRd9tdHZH+S010DFCQ
TLSH
T12565230305698B69FB34C272B992DFDEC4DFEDC1E2911CCAE7106512ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3cfafb5f92d5e31257e7631201e85bcfa4b9218b49b04abb759fae93e821b504
MD5 b23edd79e865e387cba91054798a8a66
SHA1 3d3352f28e71108510594c3327132d33059168fd
SHA512 b226ea6eb60ddbeaa5b89fecfb15e9954c41863fc09b44b396e8e9fb59257a757390e09d9f7e381c7f8f4622bf71136e8274badd395905280488ed0abf9c4b7b
SSDEEP 12288:AWPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:ALCxxBPRd9tdHZH+S010DFCQ
TLSH
T15865230305698B69FB34C2727993DFEEC4DFEDC1A2511CCAEB106512ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1e742e9585f8410309987097f554a164cfa0be67b47adc4f6645e52e97423300
MD5 e796f9c63e37d58d40d28dbcd328cedf
SHA1 15d7db2b17a1169c3dd056bbb5263921b84e67e4
SHA512 2884f111dc0cb04b55481f0695d994b1a6723a25c5d8c7622a0e7ac47221e0327459c0bbbdc13e8c18d7d8edc7cb0f18d00e52562c71e443bc4e6feffeda394d
SSDEEP 12288:ocPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:o9CxxBPRd9tdHZH+S010DFCQ
TLSH
T17265230304698B58FB34C6727993DFEEC4DFEDC1A6911CCAEB106511ED9A3588626CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 89c7ef2e8d5df49155534dd4e73b0df6d41711d44b4d159819b4ea4b71e21c56
MD5 ddf5ce1039eae85a42265b967096dcaf
SHA1 bffdbfaeeb5fce493cdf58704373bfe5ea626111
SHA512 47489be1860604574d81784bad813dfada1984f54d0ff7ebcbb9e04bcb61169ff61ff7670243e1326fa587d010e0f124067abe07996a9aecad929c2a2a164026
SSDEEP 12288:OVjPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:vCxxBPRd9tdHZH+S010DFCQ
TLSH
T1CF652303026946D4EB30C276D9A3DAAAC0FFFCD1D3715DCFDB1019129DA63948A35EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5f31e055b791c0ea516bf3c097e9faa90540341caae23f741d91acfdd8008b57
MD5 64fe9723e1c42aae87b21cf2f2517e00
SHA1 3b267306d300a7387e7d0443f7f53e8f964ad49c
SHA512 47a15a21d61ac5e5b01d418cfcf0285faf8642f0e94f53fbe42592b9fc349f38fa01a858bd66036e8fe84c3a19e6d3e68220582af107d28716485d0f579a1b67
SSDEEP 12288:jbPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:joCxxBPRd9tdHZH+S010DFCQ
TLSH
T1BB65230304698B58FB34C2727993DFEEC4DFEDC1A2911CCAEB106511ED9A3588626CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3bb11c0c8e99296100de1067f7406fbaaf9c1006349ee6aac5b32d07e1a96886
MD5 6ab0a3c740d5a6308a574677caf09e8b
SHA1 056f0e51a11f063c77203b67de0a3572afb702c0
SHA512 d72c52b93f9c22ab826bd40301b81d4f666fa62182f07f8db466e19abecfd5861793a821b264fe77c8af0627df985a9308950a21184fa50a783a5027fb8ee362
SSDEEP 12288:z6PUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:zHCxxBPRd9tdHZH+S010DFCQ
TLSH
T11765230305698B59FB34C2727993DFEEC4DFEDC1A2511CCAE7106512ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6fc7a4e0d49dd57d710a2ec18797f55bfebc5c9bf77f181cb4038290a6abda83
MD5 a5fb02969fadc0a6a9411f0fd746692a
SHA1 788c27c5d3990a9e96935e9644d5353c999250af
SHA512 71d807bcd9c319712469a36ecc2220049fef212b11f153d9c336b6b7a0b2c7eda0fa942feaf8c173e0bb219c1d6f5120c0a24afcae51a4d10e43839617eabc8d
SSDEEP 12288:XuPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:XzCxxBPRd9tdHZH+S010DFCQ
TLSH
T1F665230304698B58FB34C2727992DFEEC4DFEDC1E2915CCAEB10A511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c2e8e65a3566ffe4c33a702d4194dc5adbb53d9174ab37f538900e3daa9d263e
MD5 6d5d46fc5d8a02bfad8237685ea8b322
SHA1 efb5a4c16552e2d4a13588f887ad3a7e1440dc07
SHA512 244e0de06283262f89afd428482bb08e84ea64ebd22a11a560fac81761043fa9f480337d1c2a0956c38ff78e4abd8ab412ff1cb8065d5fc8c90b5aa9c6b32325
SSDEEP 24576:gZMrzFVSOrCxxBPRd9tdHZH+S010DFCQ:gZMrzf3CxzPn9NHzk0DF
TLSH
T100850195739008F8ED67823EC9668916D5B2BC5A0770CA5F03A436275F733A04D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e9b623ef9fd2d4958568e4a916841e37d6217b8267a5e03a7fdb09fcd733b15e
MD5 31a4f9e904702d39d6789f17851173db
SHA1 7b7f6913cf8d3f33cf3c87ada1e993531ab501fb
SHA512 f953edbc0214fecd5fa662b8221e39bc1cfb1826de48b41a9018abbb455e8ff1d856c803df026fd81f2b6f0fea9680be3dd32355a3ea27f9a43f5aff9d9e9260
SSDEEP 12288:PZPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:PyCxxBPRd9tdHZH+S010DFCQ
TLSH
T1D865230305698B58FB34C276B993DFEEC4DFEDC1A2911CCAEB106511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 555e5810bb11e8f5d002781d67b8bf4f4586fd01ee7801636f3966ba2f949bcd
MD5 759c18874993b105051e58a260a09fef
SHA1 6f46840f6f5a56737ee2a4b4583b5e5b4c79da30
SHA512 6ca70ea1b5c3f8bc84f53f2b2509c75d1e5975b7483669df98f0ecf45e4be784ef54f14fb668833689e2c1ff0df20302a3f8d352ad3f41ed037ed69d2e1f09fd
SSDEEP 12288:sFPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:sWCxxBPRd9tdHZH+S010DFCQ
TLSH
T1CD65230305698B68FB34C2727992DFEEC4DFEDC1A2915CCAEB106511FD9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a3c8fe960661d732455ccf22ccbcf7bf4d7caef34b5121bd2efe8c7a34673edf
MD5 b3acdbd53df005d99e2c3d75b36892a1
SHA1 38944db335eef0207b56a1699be2ddcd878d9a54
SHA512 901dc32d7ae2614e386a8520c9c587fa24937f4168436eddb2a261d945a24109dab3c68f1cdb5d21c5799cbeefc7f64be6ca597ea449f2ca66a26819cc97669c
SSDEEP 12288:OyPz5L8iPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:Tzy/CxxBPRd9tdHZH+S010DFCQ
TLSH
T10B75120723A521F8D6368235C8A25E56F7B6B87247208EDF576047366E273D08E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 831169f9c88605f56049d024040c8beda37479f7bf12c010ec7bf75a8cd10bab
MD5 83d6b829f1d235d72954a6df51f5835f
SHA1 8b463b64d284b75f8554af9b1e7db999c4d1a173
SHA512 8d62a58b958df064d8add9764bddd61728d4c8be607900321eada1de0d0771cba0b16c24c57b31224c7fb09c448acd942d6fbd2288045b33b3be33cc8f5db7f2
SSDEEP 12288:YZPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:YyCxxBPRd9tdHZH+S010DFCQ
TLSH
T10F65230305698B58FB34C276B993DFEEC4DFEDC1A2911CCAEB106511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 618b5ce397331f954848509c2e4b71984a3f1452669a0c046bdc2f4bf6a3e38c
MD5 5022d218af4af11647d86b7d51065b1c
SHA1 663ca986bcf48c8507826f2e542a05e27f37078e
SHA512 a965408b6656a7c17e74dc945bc61fed476b7459f32e5cfc3d44fa7ff75c7063fa263f712a399f53f588ba91007077c543b1fc034fce62fedb946d3bc71cda26
SSDEEP 12288:jZPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:jyCxxBPRd9tdHZH+S010DFCQ
TLSH
T15565230305698B68FB34C2767993DFEEC4DFEDC1A2911CCAEB106511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 41587e2ff0abfc659b54631005abb3522c113f9b7a1560a2b930ea232ebbf655
MD5 14b80c60e74643aa9acfab05793e43a2
SHA1 603d81cff5381a115834604654592792ee47c490
SHA512 d8c5babeb255d60cc754fc476bad411965d928b48a506e1b2797c64d0372151ef5950e7c420f8ce024be91fdb09abd371827b2c404cb0fe016c2e6317c4c5117
SSDEEP 12288:/yPz5L8iPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:yzy/CxxBPRd9tdHZH+S010DFCQ
TLSH
T1F775120723A521F8D6368235C8A25E56E7B6B87247208EDF576047366E273D08E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 47dcb3b47dd16ab488f889f37ece13b109e41ec1de86e2f7a67e64863287663f
MD5 3b3f51d775791633e4397d214942956a
SHA1 68f99e6460d0f9ec709517d65d6e4fe3fe7607c7
SHA512 3ac7f7529e6f3d6d2bbae94a606e581ea51669e1c03fd0e9b1e30bb357f92ac3da93eee2fe0cee766bf7700f98b9eb5692e9666c4e500b10618950d06659981a
SSDEEP 24576:ETxaLl3z0zDNCxxBPRd9tdHZH+S010DFCQ:ETsLljsCxzPn9NHzk0DF
TLSH
T14F85F195739008F8ED67823EC9668916D5F2BC5A0770CA5F03A436275F733A04D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7ab610f7a3cc06e3c2eb1850cbcc1d8733e5771b3c5e4aaec0037f6ae9b8ac9e
MD5 a90b967036091ee7981c2d3cd1452230
SHA1 f80acd24c28982d400b3a379c6376013e393bf9c
SHA512 ee74d3f05751d853b1eb73924d6238c8a0e771fb237533c643284f70ecce21a9cabb2f5135154e938641a9e542cdd70e13560f2b9a9cf5c318535341018061b1
SSDEEP 24576:H3Zd9CHKy7GZ5CxxBPRd9tdHZH+S010DFCQ:XZd9CHKya3CxzPn9NHzk0DF
TLSH
T18C95CF90B3E414E8F1B7CA3589769511DAB67C9A1B31DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 043fbc21b253dc428ffb3380b0064b05f1a2813d3dac2beb3ea11385826d4459
MD5 8472e08306a226b58d9ad8c928335d65
SHA1 6ece11b855e2782cc7692b8bd3a05ecac652c0c9
SHA512 b2931fcb0af4f78b440f454f0f3d61cb8f7600fd252996b53cf12d887f6fc469f94bd1184fe5a843dce21cc64aac9dddd4e4818e25e5c864b1747462a6eb5494
SSDEEP 12288:I8PUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:IdCxxBPRd9tdHZH+S010DFCQ
TLSH
T1B665230304698B58FB34C6727993DFEEC4DFEDC1A6911CCAEB106511ED9A3588626CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 94e94bac47e95dab4044bdd55b105df8c7600e804e4c748dc7d42bc3065a4e52
MD5 f8367c1a1320ad7977eae070db88aa96
SHA1 071a1b44f046c7baa89d45457b5ed720568c06e3
SHA512 424eaafbae2a2bf45df09a08e6b42a1b50c0f038ba820ec79c7ea50e40ff759ed472892e4457bc27e329aa7b7e535f56d490f1a4a573d8740b6ab2a18b675f63
SSDEEP 12288:kCPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:kfCxxBPRd9tdHZH+S010DFCQ
TLSH
T1B365230305698B69FB34C17279A3DFDEC4DFEDC1E2611CCAEB106511ED9A35886168B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 cc8452ec188e0ffff5bb611871d286e98a6f8b6928952f0bcab5a12f7737cfd7
MD5 d8f7dc13a5d216d54b77d4c4539d261d
SHA1 213811b37762bfb2df1b5c9679712726286cd33d
SHA512 997c9b3e5b99f9aa790955c53bb741096f0222d0ae63779c6a60d75a77510f7093a2d098ef38b8f8111aa460abccebe5e60e8a9e42ce292fda31271226b3af41
SSDEEP 12288:V/PUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:VUCxxBPRd9tdHZH+S010DFCQ
TLSH
T13365230304698B58FB34C2767993DFEEC4DFEDC1A2915CCAEB106511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 fd2793f6f97aafcd8bab6de1dde9a9ed798e5b055a227b132e437a728a4c1c4b
MD5 25bbad30158ab8a97dcd53f011ce950f
SHA1 0a3b7ee4ba24f63a262693b5e1731be3177a397c
SHA512 0b230857d98d745d83a14970b249bccd1792ddfad65063794f5c086cf94d27c9f4022d86638c028d5f0d4fae9d8469bf5e65947adc7c8dfffaf185c8a38349b3
SSDEEP 12288:xZPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:xyCxxBPRd9tdHZH+S010DFCQ
TLSH
T1EA65230305698B58FB34C2767993DFEEC4DFEDC2A2911CCAEB106511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 3bdf1bd6d0dc76abb88e3a434c0fd6facfa86392c92070270097dee3bb42b9d6
MD5 074a29d5db24c1f20eb94ad4c9228894
SHA1 784fb7a50a10eb15468fd376e7691bc791bd7e01
SHA512 12a1da1ddc97ce44e40e70281ed433ab770c8bd703b0e5484957bd8e5f9028a9acdf726a6be7cdc43b626bbbf1f476b05f826087e436acf40aebffbd827f0a6f
SSDEEP 12288:m8PUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:mdCxxBPRd9tdHZH+S010DFCQ
TLSH
T19D65230304698B59FB34C6727993DFEEC4DFEDC2A2911CCAEB106511ED9A3588616CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 3113c00137535a819f7c792fa93f175b933be979866ad04f31495cd861c06c69
MD5 24eaf0eb169294771d4ffb08c90b9bff
SHA1 482ecd26ead02a955987c5cc83c072082fae9383
SHA512 d428f5dc13b00082e9148f0be831c02edeb9a72d4a662eb435f1e8d4b016b0212a3eba5997426f4fc86e1846fa7cc443681b7978f6ee282aa8fc177e1aceaafe
SSDEEP 12288:3RPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:36CxxBPRd9tdHZH+S010DFCQ
TLSH
T1E065230305698B58FB34C672B993DFEEC4DFEDC1E2915CCAEB106511ED9A3588216CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-08_111445_5940-5512.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-08_111445_5940-5512.log
Size 1KB
SHA256 ba13490e63f456c065e708a06a6eccab6ff23756164ed225fe5bc74ead6be8db
MD5 4bae8daa0cf8016ab5aae9f62a5a164b
SHA1 225e69d8112183bfb4abc0166141c290d3a758c2
SHA512 a6884b4403d97e87eab3b01e93590368e6c5fd054acf7af836e966668dda04898058b95aa5399d41900bd2eea6032d1b994f8431664a7050e3277867a360f72f
TLSH
T11F217F292BE80A06FFFBD98299FA1153AE3979A16C34C60C40A4424D0971F84FEB471B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 3a42da7b0918f321374088452e0395b58d63067df50a34b6422ee9fe7c2ba72e
MD5 bc81a9d9566ac839ecb366cdc60a3e53
SHA1 fd610bcddc3fea00b9191a50d5144aeaf9a26618
SHA512 59afb6e34518512349126001fe6383b807d34950b2d2aeb46767cae4b856d1a636f44c0597bba51da58d4eec8d02b5d3dd41523637c8428064ef66f742d8f690
SSDEEP 24576:efwvmk9RX6wkyAIGCxxBPRd9tdHZH+S010DFCQ:0MnYIGCxzPn9NHzk0DF
TLSH
T11395D029EBDC44E5E177823C99B3460AF6B278591B31C6CF025A536D0E37ED49E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 77f8a4e8f3373e35d72e1abb371d771fac6af94b61830b20dff7de810cc1db89
MD5 a95068376cea9c936e5c3a46e8bca0cb
SHA1 b73d24d2cb688537440893295a1575d009b0be52
SHA512 f687b6c5cb39c99e1fd2c7ebf85d962451f4ff4456ff9c876f666261bfddedeb4ca9d693c4982a8ee0fd50f637f81aa28b67fbc4a2ca058e75383246776ebec9
SSDEEP 49152:XYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BCxzPn9NHzk0p:SySzP5mznPzk0F
TLSH
T137067C56A1A801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5cf3080eb6b6c9845125b8151f201aa48dfb14a5149f3a0aa36a5e7bfb699bfb
MD5 21c77f44e7e52870e2b8128c910e3e8f
SHA1 76be2b7d65a9dd367081d1c0f4a009f33fa4b922
SHA512 61e086aeaf7512e485e059aef7e512b613fa8171c1452b2b999bcedfc307b5128fb5ae14d2231a9413b6644a1b32ffd6ee5494ce8772977afd3af9165ea0ba5a
SSDEEP 24576:947Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYbCxxBPRd9tdHZH+S010DFCQ:947JUQjTirIhCnDHUPfF/xCxzPn9NHzD
TLSH
T13865AE1EA3EC01E5E1BAC27885154A5AEA71742E5B31CACF1270837D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7f492d33e42babfe3114b1bad2cfae08cb6c02b4edf6bdf5ebd35aeba5a4182e
MD5 b3c2adef9b38de982234dd13cb13dacc
SHA1 a0f8cf4af8416f63b03ca37f4663a7f4fe51c562
SHA512 8909155edc0c51108666dd12d07fc6ebd23b26034ebbe92c6b1e458680080e09b4acc7529ab4c96cfae9570df1cab0b215494c574243c73161aca166e645d5a0
SSDEEP 12288:8VsfpPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:lCCxxBPRd9tdHZH+S010DFCQ
TLSH
T1C575010AC29802E8D12E9275C7528A45F3777CA183E1D7CB97D0F53E1F762908DEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b0ea635613613d77b0613a927d90284cb5f01534d5d1b8a9ef66cb21500b0722
MD5 44f6f9ddbabea90b26e3c6960c017f7e
SHA1 cd56805c3eb4b8bc226dad955b7ef664cc021cb5
SHA512 9c885dc913e11ba84ebe2d20a4b3d509ce518736f60251f1f5afa1bb3ddeca376110e5c26c0a0725c5a56077a7e48b2181c11eefed2f09aaebaaad8da4548ed7
SSDEEP 12288:MKlc6rSr+m91s1x1NiQKg2QAFdNQcfFS/5:M8frSrd9ur0jDPNnFSh
TLSH
T1DF551710766AC75FC6AD80325E32D5CCA7707C51EE44AF0773C88B3F9576A58BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 571052e43364eff8d9c15c5514c6322420aaf056c7851262b66b1e821c952fb8
MD5 c030eb11232ca6967d7b92fd0d77b926
SHA1 0226e57ed9609b4e7d5691862475cfe48c709529
SHA512 93e557578724dfd473daa246c18438f065bf95def446db54dd1dba3770003818f2b3a3c6e57373b25e9e096eee55d65bf0a0e4f1f74aa072a20d2dad64eccf9d
SSDEEP 12288:abtWm5fXFlCTdnwLoEhG7Q1wG3RRQB7/1TWxosvnNvDB4W8NsUFwY2ibOq1qEqMh:aj6pwLfAs+m7SdKpPFtz/2KFN/A8N0r
TLSH
T16E6509415136A38FC2B750B217296F8C6B74EC17BB44AF26738C453AD86BB55A0F83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8ace00759099c1a9cc4051e8b0f46fb0e0b6a6bdd46a523bcdd56cc0abb5d206
MD5 a47242ecb0b88db6b49b9b30479adb75
SHA1 1bbe96904892b7d7281183e6c060348aa141275f
SHA512 5b3b1a33b9bfff309b1b0a0df28df54c7c20b38b4e7b7b6788b7618747401f0793e31ec7be650d87c7b56015eb0ccee99e1c81976b8ae28b9be6e35c381fd71d
SSDEEP 12288:6O7hPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydCD0r:dKCxxBPRd9tdHZH+S010DFCQ
TLSH
T1F2652313026C8E58FB34C67168A7DA79849FFDD09B509CCBEB106612EC653C8CE76963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 024045335d667023f0fbf39111e1d320ed525fdc2491bde86466da0aee057bcb
MD5 bdf7218f405c7c27c7d3b9fb05a923ef
SHA1 04b2d7ca1910efd39ee84c344b0b5c24214dc836
SHA512 321ac907d8fd3250f44813b499a7681ef4058a7c4037d49bc2b2debf5687ca3e1f00e8f748edc9776c5be02cd696a98c5b141a61817b620f4488304647c4334f
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYsCxxBPRd9tdHZH+S010DFCQ:Hgb4mBIBhGFbCxzPn9NHzk0DF
TLSH
T1CF65AE1E22EC02F5E1F9D2B89DAA4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 d080663d783c499e9c746e40d42879db57d6fc2661fa110c5f9b1316312d887f
MD5 1a12187012e97b77f63321fad51d52a9
SHA1 90df4e938abc5bef3170280321414d7634d89dda
SHA512 1ad059bcc5e29c26bc120974185f1c07308f645264eb7ac7b60a439233eeb4f4bd5b6afe58ee8b5b47d53d4f18ec76c3896c4f3e3a4cb53e5b23ec54ffa501da
SSDEEP 24576:ZG88u8FpJqH19zria7/mrCxxBPRd9tdHZH+S010DFCQ:M7ZFPqVka7/0CxzPn9NHzk0DF
TLSH
T12A95F16666E102F0D47BD13889824667F6B2B8250364EFDF07A88B511F237E54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 d4c897d78c4f53be920c980b4248571480ae0b96d34246624ca02c1737a9edd8
MD5 3ffef09f304c20c8140cfee201a699c2
SHA1 3981d8470e6cc62448c73dddcf005859d4fd3794
SHA512 dd5b09c913110840eff9f9304b82b0156ae0e641c55e2328a503a6e153b6af3face1cf5d18dcad171c9928992b90e35e7897fab1eb5f18f235287ef52032a9da
SSDEEP 12288:gHvUrBFrEjwaQqPUCx5TlKppnGBPlfPd9HNdKwo+3JrZVU3nS0/90tmwxDbqhydB:gPUr+NQ3CxxBPRd9tdHZH+S010DFCQ
TLSH
T12D85E21F22AC1CE5E776D17D8982871DE772B862131196CF03A0813E5F67AD8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 09051130ec70f05d3d31e82a24126e614b6d159eb251ad16556a273c11cc7869
MD5 d387052965e5f6900fe8f7be2808adb4
SHA1 f75f95313ef2e21bafc9fa1d2299ba84471e9575
SHA512 70f245937e4b654ace66009c571d832397ed0765c3e638ddc470f36214eb486785f3bb046e05bc6ed1bca367a24b75514a984084549296e78273bf845056034c
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHCxzPn9NHzk0DF:2G05lO43bOmznPzk0F
TLSH
T1B9D5C06A62EC11F9D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e4fb52b2f634c28b07e4c0e28914e6b2c501cdeb16a4b365d7e7b24679ec12b
MD5 f1ca235d6fd465875345777ad877e4e6
SHA1 1e9e4af6f04f16741583f2c1807baa0bc9cb8480
SHA512 a120dadda9d0c763fdb4e927a2a3b6694a9116529808c91dd5476e3c6ae4cf26e16bc1a0345e74264d01dfbb8b414aaf3150d654ad7d0452198c76b8f50b4145
SSDEEP 24576:Wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBCxxBPRd9tdHZH+S010DFCQ:Oa5POZ3BJt2pasx2+mfCxzPn9NHzk0DF
TLSH
T17665BF5EA2FC01D5D579D17DC5838A1AE5B2346153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 684ea6f21912d035e852ec10785f5e14c253fdf0c8e5fb030f261c682e6a21ba
MD5 ea25989609038a806a165ad2a1813742
SHA1 157b5091c9684ae082fb6cd56ad2dc7d8d157a28
SHA512 49adef04e1fb5d3ae56cf57ad0d1adc01c17c987cb8cfd6e9744054da8ce2df5c320033140a218de1fbb7f610820144eefb17834c5d95fa9c0074f6c297bcdf5
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkDCxxBPRd9tdHZH+S010DFCQ:UNc/zEOVHFUCxzPn9NHzk0DF
TLSH
T191858C1623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7bdce6ff4270870a9d46b2f4641a93e7a74936c904b18fa178b71253218ad59e
MD5 5b6cde102913381fa6139bb1210df963
SHA1 aa275d8b0c3552a3b4ec5feda5934cf49bd0968c
SHA512 9fc5f8fb50d054634635a995136c6216fc7f9ccca385ca7c87575e8cc830bcad0caf474523df8ac566cdb11b16664fb8930d536270da752d923079fa1cf99b34
SSDEEP 24576:CTkNvNnaFeYhJNtmZBmZCxxBPRd9tdHZH+S010DFCQ:CTMwBtOmZCxzPn9NHzk0DF
TLSH
T18F55AF2EB6B846E4D1FEC6B5CD238512E6727461073292CB9390C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 14bf8e1d6f4dfabed8ab8fee48650d1b06d9562478c4f3fd304901c3cf1464a1
MD5 1d9af8a29c832d190582e6f57732fda1
SHA1 cebff527cc54c316d4f802f00e75c2eb28293f4d
SHA512 2a8a37e06f00bd3a46bada3bc4e0d9ced6477ba91c676b0ecfc1ca9bd4cea14b4abedb551170d176a219351808ea9826c140c222c7e692f54d11346e61d2da14
SSDEEP 24576:OD3FHshBIYQgA+CxxBPRd9tdHZH+S010DFCQ:ODVHeBIAA+CxzPn9NHzk0DF
TLSH
T18195E13EE69C04E4E57AC1BCDA638A06E6B278E9032159CB0390C1765F5BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/404-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/404-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/404-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2836-237-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2836-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2836-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2836-70-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3280-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3280-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3280-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3280-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3280-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3280-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3324-96-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3324-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3324-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3324-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3324-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3324-330-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3740-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3740-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4176-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4176-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4176-135-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4176-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4252-121-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4252-115-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4252-124-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4252-314-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5112-297-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5112-86-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5424-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5424-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5424-61-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5424-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5424-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5660-74-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/5660-82-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5660-282-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/5660-76-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5696-27-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5696-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5696-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5696-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5696-24-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5940-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/5940-30-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/5940-25-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/5940-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/5940-8-0x0000000140000000-0x000000014046C000-memory.dmp

Download