b7da18cabcd5409deb53c1ba118f239dfe5d1502c4c24691ec430bb2601e08d8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260709-js35raew2m
SHA256 b7da18cabcd5409deb53c1ba118f239dfe5d1502c4c24691ec430bb2601e08d8
MD5 d293fd92e2f1cbff4ece3a5fb6370b0a
SHA1 7e46ff81f4c3ded78eaf9bb1c65b0530bfee0940
SHA512 e935af90c9fb0cdc9da1c332e9c3e5f5a6f3c0941dad356683b5ea7e22c6d3481c3b5b6bf454822d0cff5b093c290047a3672bb2358ad5838688894e191daffd
SSDEEP 49152:k7mZ5UxCNBjHYi3ScakzEOyq+VPRT7uGAc9e7ao1d8bSTJGJCYtqLNiXicJFFRGN:EO2sGJeDt7wRGpj3
TLSH
T1DC167B07A7B940F5C0BBD13D8A579657FAB2785A877197CB43A0861A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2424	elevation_service.exe
3240	elevation_service.exe
5992	maintenanceservice.exe
1596	OSE.EXE
1104	PerceptionSimulationService.exe
3092	perfhost.exe
1084	ReFsDedupSvc.exe
3084	SensorDataService.exe
2272	ssh-agent.exe
1708	AgentService.exe
1540	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46bee7af4cf0ea5.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009df47fd0780fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009c0118b780fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7a7a08a780fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000113c3c8b780fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d7bd448b780fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d88948d780fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad7fa78b780fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e97fc58b780fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1576	2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2424	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1708	AgentService.exe
Token: 33	1540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1540	SearchIndexer.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2424	elevation_service.exe
Token: SeDebugPrivilege	3240	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 5424	1540	SearchIndexer.exe	99
PID 1540 wrote to memory of 2688	1540	SearchIndexer.exe	100
PID 1540 wrote to memory of 996	1540	SearchIndexer.exe	101
PID 1540 wrote to memory of 5088	1540	SearchIndexer.exe	102
PID 1540 wrote to memory of 4720	1540	SearchIndexer.exe	104
PID 1540 wrote to memory of 5760	1540	SearchIndexer.exe	105
PID 1540 wrote to memory of 5116	1540	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d293fd92e2f1cbff4ece3a5fb6370b0a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1596

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3092

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2716 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2716 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9b7480b8e0752edff2d044492960a91f7661354c49ee9dc117596b9a17437df8
MD5 48a866980747af9dedf53e5150bee432
SHA1 c575ce7a97069c1bce7ebd4e5aa60d68d55582b5
SHA512 fefe1dfb11fc0ae30666b5298b9b40c405ab5f199dda7b092932b1a7b62b18826530a8380cc1b64c7f645cb8c586c4053649d0918a172c7ad25df2fba80227e6
SSDEEP 49152:Mb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnoLNiXicJFFRGNzj3:23q6mjB/7wRGpj3
TLSH
T165D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 646c2377bf64ecb9cb8daa5405d27194fcacab2458622a42a9e5b53707fd47a4
MD5 c69ea1b7c4e2c93146aa575e1340901c
SHA1 ec7e20e1dd53b8a7013b0e1f7e328fa207a6e8b3
SHA512 0f7f5382677f11a0f51e02f026768a8c4a01e2effc7e11bca8836a7e2a150e66d8ad5b328eae92eaccf9e9986d48b9aaeef760e1dac68034bbd6ce0b500c75bc
SSDEEP 24576:iXYfDtczAr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ptcaLNiXicJFFRGNzj3
TLSH
T14585012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ce8a37b204ac9e238d63465887b2e8d74c28f0e582f564592f8c787c2b18ac74
MD5 90cbaf1e2c0cd0a073257e5409235ffd
SHA1 57f20da29bc221e48459a1da6bc304718e868719
SHA512 40c4e0fc6824e2bbbf877c9c9d157cb886b30ea7693a6d1d931f2f5bb68bd75e9a816f46e7b7d9f77b8f3d0bcfe9efeec175d4ef11132ed0a27e865f81cd552f
SSDEEP 24576:k0Le5ji0hmxPrMg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kPji0A15LNiXicJFFRGNzj3
TLSH
T103959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 afc1acc3a422adc59efdec2862bcbc74a263b90b200d89ac629659f0ae982d6d
MD5 b2d364c1553a2830ed54b25757aeed43
SHA1 4e54e31a396acbd92a28f807e0ac2cd7bf47bd34
SHA512 41d0bd1e1b4f1336996f1465eea09d9a5d906824e6bcba8f824e7602211bb356964077faae69b1307a60db3822261913cf90b8800ace7b28287e38a2db5b5653
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/ezSC6vUzPv+HjylLNiXicJFFRGNzj3
TLSH
T1C9756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e9f979203ba6f010a375a9f0a43d8b1543b07bd9b9a3df9375597cbdfd1ff9bd
MD5 dc11a9eb0e8904b2e705679f3dc7226a
SHA1 d7beac6992456affbc8bd40010747c27381946a1
SHA512 c66850782ff6af8b2f62142334b82e214bba33cc9c27d3d900c08a2588f1c164b8f81f5fa91fffeae3c55dae0fdf9a35100a003956c0a8bd965d98e68ce7abad
SSDEEP 24576:LVbqPb88hv/l+BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LVO88hXl+ZLNiXicJFFRGNzj3
TLSH
T183559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c050e09d5240c2a382a50a4ab8d4350b109d2a4fec19ca1c8df4d04085edc24e
MD5 66d93a07ea1eea3b60d4af4e29a85b1e
SHA1 885c8570731beb7710b7097979672f554102f960
SHA512 4d011cc21230bfdfa2ac4a85ea01c4de8451978b8b9019e5d1f4dde82e386ed1a127f5d45f45a195e2d5da4cc45bd91b8398645145b25c8ca218c9025b46fb28
SSDEEP 24576:Il0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
TLSH
T1646523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 91ff3329d77b10e50a90a87b374af1d3625c771d3d238d7552debf4860216a06
MD5 378ff6865286f0287d0492dcb2ad9763
SHA1 d57887eddc50b6f5aed3263b86690c72882c5c5a
SHA512 9c87e1e3a5b73c94d9cb7751ba7040065cb49262750053daf7b1d95ac06008650489bb4871df45e6c32054bdbc124ae454be539aef59a562a2da263a1a9eacac
SSDEEP 24576:WJIUn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WJIUnLNiXicJFFRGNzj3
TLSH
T17785CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5f5e186728d89f94d1a7ae967affcdf85c9516d1f3eb3608e06b5b072f99350c
MD5 98644e432b102f8bbe2399835e69891d
SHA1 dca24849305140f982064297fb03085efe082e27
SHA512 04e50fa71a7a89bce542250075c7453d7076cfc7b3b7ee956ce2f1321bcf7768017668f5d57630265d37a8beb421e6fdf27ec725f44fc12668c2f6ab6b8416e8
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:oQvGAdlCEL8c/WRNw5C67wRGpj3
TLSH
T1D7266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 12d11d9af125421168ba03799d8f1d491f55328aca0cc5caa2e26fcca882cb78
MD5 f53e7429fb86d61158212afa40233e72
SHA1 c09b7db41608cfb113f25a37992aa65d6f7a09fa
SHA512 5659d803dfde2f05a9adee80a85789f95ed799ea925b773b7acc8f96f4bf77a3f54f5d5b8041340f64d41c3ebb3648f5cf9954b4e04f4063196ad6395a4ce7aa
SSDEEP 24576:o9ewsAjJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oljJLNiXicJFFRGNzj3
TLSH
T1C985E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7fc47d8c6fb85605a6897175567409eb1fe28e40d29e559000ea4070b835a08
MD5 0ca8b5776aac5b2764f74a47ea331744
SHA1 13127b258b4511add08d6966b664bbbdf1d5ff1d
SHA512 7cd8bbd7aca5bb15001a4d17e1ad74c78699e902f5c2014eb5bd768ac9007258b2be0a34cc40524b14ba86c5e3d82a45dcf07ebd82f3cb3acde3184a461042c6
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH1F9:nUEtQevvqc2W1cpV20I32r9
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 11d2f75906dc4ba477d9c9d211383562f308b7d177d899abfd79faab461eb717
MD5 2554480ab3b1f5df0a27a4e1f0f7e6b6
SHA1 231e3b21d5ec919663b5eff7dd1f2a820c262a86
SHA512 59f97cd077d9183e1d853464a9274c6b1eb05b948768f00f5aee4d771f186f9d18bdf3676a035b981b55c95f5e3fde5c76a487749c62b652ef8269a3ecf210d6
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zpLNiXicJFFRGNzj3:Hoq2Vjnmm7wRGpj3
TLSH
T173D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a04debd6396a4221ca53e8ea738bb4bbce89d852a22b95dc760bea31c5301968
MD5 005fe133f10e53d00de5bde2468f3088
SHA1 b44ea61109364169826df61b75d7a39282acce99
SHA512 0eee8791e2072646d12f4c818e6f5befd3bd592388067b701f111fcda95b46f225db65a4750db49384ca221c7d483d6efced6d6e534c77e8282238898d9c7fe8
SSDEEP 24576:8AhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AM5Foiq52LNiXicJFFRGNzj3
TLSH
T1FE359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 62e8258296025ea3f3b42bb8f2aba50702125291c2e0e0022fd6b0198c262276
MD5 56a7d1863e5431e27049310249b3e1e6
SHA1 0bfe3bb4a7cefd1769f997fa615923e593df7661
SHA512 b8e2a1d52d66edd7a8746564520d11f6108d4445232116d14b4bdbff1120a7578f07c190f6889661da7fbe653000e883513cbd87d05191142e785612223b1905
SSDEEP 24576:pwumOWF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pwtOCLNiXicJFFRGNzj3
TLSH
T19175F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 23c18958170fbf81c66977632b7ed8214f1f24222aa4d647e2ef3618b67df726
MD5 efa3b08caacda538864bfb0b622b1264
SHA1 7449b43b2dddd2f3a0d827630ec457448c913a38
SHA512 0ffb033be2120cea1c8dd1fb31e5ef4218d1cb395c48ce4292089d00134917dc1af68e5f67629c93046b23e092a198e46ef8431616523fe09e77279a94d55202
SSDEEP 24576:kZu4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
TLSH
T15F65129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 99832aae93eaaf8dd97ff31393d75c2c75d8675c5c98960dc871bec1ea5ff647
MD5 1fc6269221726f4885393ca8570a174e
SHA1 851a7df34a9a6137efe655798bc13c222de4070a
SHA512 8236196cee8a78cb048d218d7e82dad1924004a3f5cb6b9c823e91def88c836674095de001bb74107606a97be45c2f27c8b9b67632c71499987208db3b36c0d0
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3D7wRGpj3:CQyiKanX+PNHF9
TLSH
T132667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f30654acb5685126354dc3f9cc0a76effe0f9a13ad2f60d213836045ebfdd638
MD5 b9aaac53891a90c1e2136306e2938c86
SHA1 2c840ef366cb8db7fa2d5a7cd6802aa267337aac
SHA512 a09a866dc0121716856b6ad924bf9d1289d9c2ac5f95974903f78885b7dffdcc2d00f8d39db54d5464d0c6b5028b6afa2f621e412e0d33f9d308fbf9d9f67603
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3D7wRGpj3:SQyiKanX+PNHF9
TLSH
T167667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7b58af23e4d70d443274b0b40bffa3295a5c5963a4302e36a174b48bbcf71734
MD5 2a6ff66c4ea16d803f70cd37c3dd6a4d
SHA1 4b599308c064c789092675acfc10c95148bef0ec
SHA512 bcef03579cf700fb6a8b1da61afec5916b462ad1246cb651ea4bfa1a27dc20d2ebd23c32e5f2d8eef81c99249ca8be1984847f551292d52368ee42ea425f02cc
SSDEEP 49152:/68Qg55nhkeWu7PNU3/5LNiXicJFFRGNzj3:5thTRc/57wRGpj3
TLSH
T100B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 27ac08f8d093b433a487df952370669825b4fd3b9e032af93fc06c477ef085d2
MD5 647e85883be81d290a57a03e758e8a41
SHA1 75f5cee9ed61819400f19c7c533b82c474bff691
SHA512 72038bb825fc4f1a9d4f4be2b04af7f6cc8891a300a5f9edb8a3f3e3f79253156f8ef0a4b87388daba2f743ab8d024f28628dee90c5f1450535113fd0c16e0d9
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZ07wRGpj3:XLIHRWhCF9
TLSH
T11E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2c5b05127ef629ef1fae508abe4b26b52c2eca374e3c61733b7a61ab5a3a482b
MD5 a7f80a2f2419bbe8c33f8db5c9a60290
SHA1 9d555ed1dd17a3b06cd0ae42abf27a3ea35c9f8c
SHA512 51c56d52ea769555df8b39cc659d841c083b27a5a153c2bf6649d831303d71c1ac5ecb0bc1695970692a5937d481d97453419f0fa37964e6343053a749fb9787
SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBLNiXicJFFRGNzj3:Tu6JmIxd2dB7wRGpj3
TLSH
T1CED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 99515ec0a12873b1fac5a574b10ea36bb4420235db20520ab067e7047f1e4f44
MD5 6e91c84208157058773e7df94c9af9e9
SHA1 113965b9d4ef76726dc7a92870d373e88bc9e6a1
SHA512 e252f63183c8c25fff617821d63a93739486fd03c9c7280e85bbc2d1fa7df5f3f62904deb5a22d85d18612d0435714eff657b0e51b3fe5c8ec4b56d87c6f7957
SSDEEP 49152:p1hpsNoJpF1A67U44CwH7R4xHLNiXicJFFRGNzj3:pmifPqRm7wRGpj3
TLSH
T197B5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dee3da01ef0b1892b628e843da482eb1bc4c79a0bbbe4f4b0bdca32330dd46e7
MD5 49f6dd20bfa89a1e232a7637f2ad4576
SHA1 057abaa8fdbe713896ad9ae4ab17ccdba613b404
SHA512 7fa53626a7631be3aa5e17836b76fabbaa8b8532e646c1200aa471763f463473b3ef14cb4acac76ba03165125ac168be81d5a0aeae9529fcf8ae5391223843eb
SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHq4LNiXicJFFRGNzj3:V5dKqi6147wRGpj3
TLSH
T115C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 81b469067c762004b753badc2d635f1b5845f17bd900678c74a0291e34a1c599
MD5 5091854cfd7283dfa5bc195b1d13b444
SHA1 ce10d950ca7b594fc5b97295017f1aa1a5471d15
SHA512 f9256db4e7980a65681236d15340a0e9fcb4685645ef43cae84cb13dcbca7a2fc8c3657bb7e698921943f8e4ec677bd9faedce520c1550146b93f4dda5069c17
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wrLNiXicJFFRGNzj3:FX2iWphi7wRGpj3
TLSH
T16B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1d76f733836d660561f82cba8ab8b9606ac3ce59d56c83fa44e8688870e8439e
MD5 5ba6ef36026b1c9a0982bca8a78937dd
SHA1 ebf1ac22f176b475a0bb8618872884b76c72e5d6
SHA512 1b44c0ebc9932a1a18e8c5619739df55e3fdc1f0aadb96bebb3abdca230e88a54e3b400de8c3c1663037bd244ec4b8703146cd3b12bab46794be676fddf40b7d
SSDEEP 12288:0KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C6523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d06792c451ab09b70b3f6b39b9cf3f3dc9c125109dab2f667c4758fe440df911
MD5 7c193881addd05907e574f014fd14789
SHA1 1543019b8f7829eb8722e7c0fb9fae89e2d0c20b
SHA512 057584b9f7f91bc118f6a85a7b5ce00fff222ed7e0315a10305753d11a27eefee8b7ec4f77da1a96803076534bfcf76d9c0fe32d638c8c0bfa633eaff273d8ef
SSDEEP 12288:PBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1786523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 08420bdf3f2918cc6a0d285fac24f6899b45f95ee6fbb000cb02ab62ecb10420
MD5 fb22a97da2b502479ec0f48b6b616fc0
SHA1 81caa091637d6bc2835e04835f3ea38ee291268d
SHA512 0906a556ad268739a08d492d210be785b095193474d8b87f7eb741bf63f099474146dce9734e70472ccb5004d5109762dadb42019bc0ef6286f5afd2e9e560b9
SSDEEP 12288:0riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1696523D3548955B1F6FC0039C6764428F5882E1DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 974707834409bc749debe3e2a4e4ecaee76201b8fe6343e19d0854230271122c
MD5 354b1ccb8eb076141771051c98c0750f
SHA1 931f92fdee51a5efd2d8910da07f2e27d67c4935
SHA512 52fb654ccdca3afc41f589536412c91bfc8da71515b48675f12722575803fad85349b625d405361e1a112f2be56ec9cb76fb38e951236eb67a5a0a03acf1ed15
SSDEEP 12288:2VciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A3652392168900F1E9BD803DCA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 03fba63a28f445bb3c31062c7acc5500dbe63a12795959d1b6d59a1b3ce0a4a0
MD5 74a7060358d0aa5c0984ac4e9a48ce88
SHA1 94882280745adf2d9115ba1b63368124cbcef619
SHA512 2789ae99b8a23731faa87dae317c7e382c30b7b593f958fe31d6df4b0455a97df4184ac03a51975dad149faab8552f8afd362b674504ed8fd9c411db49f22a02
SSDEEP 12288:xEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C06523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 aad1896b7dc0bf1f1ca32b087711c33cf7ab9b95c0edcc8022c60951de8a4578
MD5 b94956380793cb6a8507564afafb06ae
SHA1 b2a812fc359d5c6292351d0800ad1d5690294f03
SHA512 cf70b7e9e0c86b86df99536da9d5cefd930f61e6c0262b4afc9703741efd0322cc912c63bdba8f3545bf742a6ccf8ff1d91ad32ee443a3c0f24bba93513c51d5
SSDEEP 12288:+9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B6523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 16922322fec0ac1901d20910689347d16fef6ad782585f49eb52e6b8561f0944
MD5 33b685cc67a185c2274d9584b361d5f8
SHA1 4b44d4d718b41bd0d646066a89e70715f50238be
SHA512 0a08d0c15ec1f91409fd4a00f0bb7dacc66d927ba98a75a1b12373c0b8ec10673f7a9d0914284a8de03fd353d747b398c4680e0e4662c58a532f2a5a72fb4fdf
SSDEEP 12288:+piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1186523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 cee67a9ac2aafc921d11c1e11b957274fb26996eec3507cad4f1fe0f3d128bc9
MD5 478b1b92d743486874c5db65063b0710
SHA1 0ea838d8ad8a33c9e4b9f4f145820d90cf0ac2da
SHA512 b2afba251fd5631d260251590dc5b890db581ea67d46c8509e28cea170e01e8be49c64bf1c1ae120fffdf3ad9d251654abc53a8e75eaec9ff506299274c39a6c
SSDEEP 24576:gZMNzFVSON/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZMNzfxLNiXicJFFRGNzj3
TLSH
T182850295B39018F4ECB7813EC9258815E6B27C1A4B70C65F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e14749db20c97de86627cea493a4115eca5b1169f1d68001e88816776bf15a88
MD5 c4dd8d4d284a2d0e1ffb6eaa6f1849b0
SHA1 073d35fae7153a7b645a45ec59c38c6b7f9e42e0
SHA512 a569ab5487ca04f9df67f0d8e02b9149967ac77ce73348de6fe673e6a19ad226aef9d3e84c9816b2b7a51f21387901a500570e855469b984996859bffd3f8e3f
SSDEEP 12288:a+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F6523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 fbbe778212ca21f8550cc2f762541682d8e9e34309f4dddc7124049e5b46ee49
MD5 019986bf24c4daa6dfde6a16da19ba0d
SHA1 3c8ef47874c56d801412761723c7c81ad4b4d7e5
SHA512 b3f557ef04d74b120c59a8fd2bdfd72b42a665e343f571be8e4dec52050ea2cafde203115785f03558cc365fc761ad381e804a599a01870ca67de9a71e41bb53
SSDEEP 12288:xCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C06523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 68d5a39043289a1d723baf18cc2b181abedb784e55d216b934ff1c19c84bc7ea
MD5 bacfe07c1046bd84a24c54dc908df621
SHA1 05bf98f8568b6c6e09d99b6736c1df6fb60d7b9f
SHA512 7fd7480dfd07d1eb6ca1e23a5aa3b3f334cc43cf709d59032d4c415fb900064fdfb21ae0541513b319b7fe1dc4db45e920e27791e29fd75ec0e2c260c42ca673
SSDEEP 24576:izyZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iiLNiXicJFFRGNzj3
TLSH
T160750147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 afcebdb339982600ff047f61783462a39eeab105fd69e75c51536fbaa416136e
MD5 7b439efceaa869fee7ad60d06c4b2298
SHA1 9708df640429276537ca7daae72e721dc358166e
SHA512 e430f3cf31ae554b9336024fab21f73c6e4dff26585d484654bd131ebc4bd639c58190a5676144a5f974284bad3541ae83c9e10667ef133168e149a8aced689f
SSDEEP 12288:v+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1966523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4123124e1d4097455213d96e968a9a75c95d810cc8f45d955199f063d8d365fe
MD5 e04e45ed22025e1b97fe2b4e18f42799
SHA1 6430e1d894b714a6bcbadcfe0df5514de8989889
SHA512 81bc8743a8dabb1e19d46c6e6b78a3d1893e4cef0f25f65e9846807648dfad2bcf8e56dc7069a8c23c663ed392b56bb9449081282503ee29fe4e9e299cfa3e21
SSDEEP 12288:3+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C56523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 70eedd522496039fefbdb7fd5b2d6d33457f514a341697472eba7a3e282cd56e
MD5 f2ca4e43e856c9532a079f8b063fe038
SHA1 24dacdeabad97e1252563b4e410a9f63c9c9f43e
SHA512 b85d03368c8ca93e2e0600e0bf0d1f7093c963b5447080d955512368448f918db9f2e9cf2e1670282b03cc270706b40371694f2f6139b52e6ac4046dbf7185bf
SSDEEP 24576:1zyZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1iLNiXicJFFRGNzj3
TLSH
T115750247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a5fb691da7b5291080eb201f554595db346325f4ab9d7bf74fd5e437927ac6cd
MD5 2e53025bfd3dc6137df63a01de4d873d
SHA1 a26daae82ec7c68fdb7c1c8266701f41cb5b8734
SHA512 d565e2ced08e9bf668ddb3dbef8528b2ca28014ef9dec858286ff139d651a1b05888e578d3deccf2026bf9e945ae2b2f5ce76e6d6fb21c174201ba2d8d365205
SSDEEP 24576:2T6aLl3z0zDv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ThLljqLNiXicJFFRGNzj3
TLSH
T1558502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 9a6e57288f37a027403ab8e6694b5347c23c8c99dd0571254985dfb3f1958509
MD5 7f62925c4768f81b41b56bc48e82e9a6
SHA1 0fb5736e8b517b5c9753cd4b176fde83570a2311
SHA512 9bd21b98ba9ddfa1a1e5c040d0833646e4a224382a6f343cd47c04f637b1c5a42ac11b2c9270bed94dbe266210e87fa2818312c384785a0c2f6fe763e485fdb8
SSDEEP 24576:730d9CHKy7GZj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b0d9CHKyaxLNiXicJFFRGNzj3
TLSH
T1DA95CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 8a7605210bea15c80e9c3a1c0ad48283548fb6ec34be8943369269d16de1763a
MD5 0f6f7bc7bfb9621a75936b8dfc7e4d82
SHA1 20e1805f7ec5b01ad5c1ff1a3627f44aaf5cef6b
SHA512 3b1de691bef0d8814a39cfef011449ba298f5508c785b9b035dd58a597f3dd295817b4996e14656d2ffaec280b177f786b6db108fa6a3389e2eee52f1e293bd4
SSDEEP 12288:XLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B6523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e22e1bfd846a0d43ac82e63e3737afaf36295ccf6b28a296c5be43bf553ddb90
MD5 d411f717c5ec10c7827d1e37b6996517
SHA1 ff081ee2c70279d38eaaf3163e0915a3c6db4226
SHA512 eb9929ecb170d4341c9a1bfd20b359e6d58c7a8593f4f3be654b70cc6408392f5098358d47df8d9af539405c54922b7c9b335b985298cd7fbe686f6b9c0e9dd4
SSDEEP 12288:oViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C16523D2558955B1FABC003986764428F5882E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f09364735d7226338c38020ee36533abad49617a2ad21537eeb670620769598c
MD5 2824d0733521939076e78a8143564857
SHA1 bbf0a9d4ddf92bd7470718584853618c9d551b09
SHA512 6ba99f81ce05e095371896835ee6baf326969404d498f4e0786112e8004422e07556a1fc13556f44991f17180b8b7efc2755d124db11ef878352d7b6599110e8
SSDEEP 12288:WgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E6523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 88369ffcdcf0db52d265c1d6573e7d5611f3e5011574d209b28b9d66da9daad4
MD5 30bc3ef60b15077ae30c8cce756fff1f
SHA1 fada63f39c075415ce7de5bcb3a94cd8b7cbc773
SHA512 91561c6d411bda5cf164a538baa890c573e1535d9b233992ad522e5eb03acf9637a4311b0c6f05baa4fb06249ca0b60e0539759e05598fab6ed51aafd5c11799
SSDEEP 12288:v+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1746523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 7f5f8bf81bd4c2c9522c656f2352a917f11c7c1a7d129afdbae17a1d1c157b47
MD5 76165ff75dfc45b699127a7dd2f472ae
SHA1 d75c88577a700c7bcfab80472ce6f0c3c12da24c
SHA512 a46d23fe6625fb7da0c78990c068334112e4dcc4e57df9dd9745663afe0dfb050d01e3d42941fb45382fdb8a3ef8e2964428dcb28602ce5c16e5596f4e37b8ba
SSDEEP 12288:kLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A76523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 54ce61ae4d81c87190433d5466f121c27b3efd2a5867ac38aec15cf150585f37
MD5 b7365060729a1070055528d5c8cf0e7d
SHA1 859b566be098fb8738ceeb1999332e1b3b6ceedc
SHA512 40d87540d41df578bcb3084e07665d1dc38b39c0c7d165b6078bb06c6a365e41de08d97a00ef127cfffa4a76049bda019665404432c51e2b9f575c4a0b851d91
SSDEEP 12288:AmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1946523D3548955B1FABC0039C6754428F5882E2DEB5655E3E2483D1EA278FEB8F38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 7dd328268bcceea832952af97de99ddb3b04d3f7219b12d78f079351ff9d5f01
MD5 903deac21d144535922d804044f4634c
SHA1 61198585722fa5e71ca5f9b2dfb19e9ab9e6e858
SHA512 bd7a72de1c1d0a770e80327f2fb023ffda2e9f67a26249bb7bf3e2997b0c7d07b8fa8548ff02aa4ae3de31ad227c56ddc8bdfa2224a47030c871867641b96dd4
SSDEEP 12288:lEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1776523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 3d49c6688f929a7d921151e4f8015b679bf486cca0fa091b0eda962f16e2d3d4
MD5 26ab8a2776d7fe106d5d86c183d4da4c
SHA1 75b85a1665737ba550ccc443be67629ff49b400e
SHA512 31ca3cb8673e38d35dd45952d6960e5eb90dbf8f0674e8cb4194f1b862845dba227130f52a804265c1503a8534218c1810b9912ccaa5b6a61f982ead553c6c75
SSDEEP 24576:qfwvBk9RX6wkyAIU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jMnYIULNiXicJFFRGNzj3
TLSH
T1E295DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9e66ec7faa6073ea158e5fe6f2f538a4b7b480293706e163e845ba0e662ded27
MD5 c9ac0f7837e0a9a2f65b9103ed99b774
SHA1 7ac757c8cc90379bd1a1aba56635d7f64aa3b264
SHA512 d444403c071194c6fc1ff1e8b9fc7bd851187b1e44352da12c13063d02587a22b03be714e1edc09c060815734994821f43a42148e6d482456ea8074773c274eb
SSDEEP 49152:wYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LLNiXicJFFRGN:PySzPj7wRGpj3
TLSH
T18A066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 541e52cf25c3eae649cacb993b33706adaa84c90ab9f3f20da0a1f83feb1b533
MD5 a04d4dc93a0e18766a2d1b488bcd2e14
SHA1 5172a136b2478aa45a3eb2643cd6166c1490c7a0
SHA512 e27b90c8dd81d019bb301fa8ab0faa925b4d0775e906e68401da9b18720f2cf6a3f9de972fb70b5df04ce33acdfc20a2dabc1fbf8e0e702720736607b3e1eeb8
SSDEEP 24576:t47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t47JUQjqirIhCnDHUPfF/bLNiXicJFFS
TLSH
T1D765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 a3de2159eca8f0fc05a8bd2e059485bc30c6e775fa203f276ea6db160e3abf9b
MD5 c985a6c45a9e0358af2afa9eddef128f
SHA1 1e2520b47e41285f1f1b6232e7aafffe4ab9bc9b
SHA512 718b4fe06008355f38be226d23d4977d14a0e75fcac74ec3432b70a7166aae714aba0b7c2a87688a5c69e441c515d8207774734f80879eecba9a8b2e5fc604b7
SSDEEP 12288:bksfOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A75F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2ce0c79768df6c75a15707a07f303587ef452311e9e71797ed793524ac4d61a8
MD5 659bf76b61f6fcb7d25bdec5c664b0cf
SHA1 e23cf07f067c2846d474b0a7598d64458dabcf40
SHA512 ef32ada513f6fe0b8ce80ab7d32246172e6d8ab858f8d238292764bafdc70f137f60d9071434746716b0124678c65d8cf7d5d06d7f5496a3dd927a339c4429ca
SSDEEP 12288:gcDeUU3fNM37C8MlYngqS8GV9vIOwmCEuOOj61mjIqpsLmxHhz:gcDHUPNM37C8MlCxGYOzCDO+IiIksLmX
TLSH
T1C8552600B626D74FC6A950725E36D6CCAB70BD42EE44AF1772CC473FC476658BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 34f357f8a631e4f70986e14386c0fedbca4c1a029d4c42de02422fa4e77f4abc
MD5 4d2061be4b39bcbda459e68b77fcecad
SHA1 01b2b4375ed26c7c2c5fa6d8849210afca8a6c96
SHA512 a18ed626e21ec8093872513a465f764e842121d9ae2697b0aa0439d8d2165ef935908b74409c395fb1b6073775023c0352c7ca52c7c398a96e57c9e1d49e26d0
SSDEEP 12288:79QjJJhYZH/v05rxq8PPDUpXSbx2fPM1f/QAoATSdT/NG1VGcmRQuG2zIA2:79QjPWJXOVTSdRGojXG2zIA2
TLSH
T1F8753B416577D34FC9BE40774333968DA7B4AC02BB852F01B34C893A98A6A6DB1F63D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 25d5891e7f443c01d24d2590acc827d966f128ef1ef0d5e2166557a129170008
MD5 d1d96e2f6ebf7a63e50e960bc427db8c
SHA1 112c8b33ff7956e2e162aa73d02c5c283f1b76a2
SHA512 7e8f844f37eaedf164c4a904357d6b909c9ff9f8b69e61650751f0c7adee1a8fbee6aeaf79c350fc8138c8bca4c839b06aff40ae7e284fdc2af78d897c07a867
SSDEEP 12288:/c72iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T123652393468D59B1FAFD0039857A8438B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4e2c3dedcb094a38efffc79a80604853560bb01271968c46ada0e04e488e184d
MD5 0bfba0bd82bd7b6c5b296be64aaa455c
SHA1 40eef672f0ca0ebefeb01a0b8f2a39b34abd44cd
SHA512 0aff0d4acd47a3788903a28bc4621d6a852acfa1ba340b5ccecab58d95d6f5c8f440a985a73773c9abfdcfcd1beefcf9adb20becfa13fc38e9f218036c6640b5
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ngb4mBIBhGFdLNiXicJFFRGNzj3
TLSH
T12065AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 b0210bae368e7cb7b5fbed7475049e002e42b1d694a442f3fd8108a0c3c67241
MD5 f8632e9f985ad220970aef771cfb1ee2
SHA1 7e613500733b111817c8d8754ee8dc4644279ccb
SHA512 7cdaf98868db24b0ef7d5def96d108383772a2c09a36568d71a89a93dc9d6e7f38183131445e796c749e9eed49ab78f7666ddb3c423c105228af469b59681dfd
SSDEEP 24576:DG88u8FpJqH1Izria7/mN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y7ZFPqV3a7/SLNiXicJFFRGNzj3
TLSH
T1F995F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e39f16276fb6ea5517637bf351b6bac824852c75b85c657bc00342ac30809f08
MD5 d2418102908a900f610ab6b023b606a6
SHA1 93875f131693bdd2e99d3ff2c8a8f88173e29232
SHA512 7bf59f0cc2d375002afb7550cdd2cb9f0fed5948fac8f1bbb45ff52dd7003aa38d30203819496f86727cf5880eb8efdc8ec1ed061816be892dea32d402a7bb6c
SSDEEP 24576:qPUr+NQx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qJQxLNiXicJFFRGNzj3
TLSH
T1A475F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 93b6932e2359b23d1478a8de1db9e810b8c866316eb6aad2b7d25f64bdc0a895
MD5 80d207159120e49a0bb99c73eee5696c
SHA1 4132081aeedb9dfcdf40916994f43fe90ca28d90
SHA512 acd0e281a3b58f6d5d67851bbf4b67462cee035a311950e78c79ccdba48b4c29e1d0dc87cf209b47ca4cbb108459e4bec3638d018421862976205c989f0f8462
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhLNiXicJFFRGNzj3:gG05lO43bc7wRGpj3
TLSH
T1F3D5C06A62EC11F5D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3a887c2113b63c940d0b654b546cebdf6114bc5cf42cbb33c1d28f46bb50f675
MD5 7224600ed50b728a39352f462e1b7765
SHA1 d58902dbe9ebacf010617190ce90baac7e73a49f
SHA512 4640ecc17ae9aa1ad62555b383d03eacd2c8b614b90f39cd86de8a3c495556b534e8f8b0c3b23d93947cf6b25c07e07473699180337a65f7c56152537928a116
SSDEEP 24576:5fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnL/TwSfVcYG3K/cJHlnFR+IGNe8jg:pa5POZ3lJt2pasx2+m5LNiXicJFFRGNf
TLSH
T15465BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d0fa89dfee7adf9c40ed16c0b8fad121af78819863926bb244adad765af915d6
MD5 42790e62789c81a634cfabeca0821609
SHA1 7f54d1acf8b92d1732ef2122abb89791560fb6bc
SHA512 5bcf932a109703186512ba94bd8c789af60b8d079da0d4c69e1999b505be728ae8b3411506ec34155c3db0c0ae460078529bf6ceccc67049baa65e30eb7ca681
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fkl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sNc/zEOVHFyLNiXicJFFRGNzj3
TLSH
T131858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 19145615a130ad0990e31666fd9162162a70617092e80a06e0fae1dca8135cc6
MD5 17374974f84ac3150133dae60cd5a218
SHA1 c12cb531ffd2a785843f2d5e6bf3188aba08dc9e
SHA512 f65c1c16c71222f2a5609a1682ca7f4c678dccfc17e2abdebfa6eda343568035bc7041fdb850b1c8bf4af1e079e7736e63462825390a9dd0db5cc543a69adb3b
SSDEEP 24576:JzkNvNnaFeYhJNtmZBmd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JzMwBtOmdLNiXicJFFRGNzj3
TLSH
T18355AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1e3145899e01d1811f526eecdf201dda08d13839d13871eeabfb4f30fffab751
MD5 592d9de76b7f49a5f0c69d699a166040
SHA1 d4e7616b793731ebc057e352aa3b1f28efa34f10
SHA512 4dfefca04757072b0781333f6122d00ce1c13a466f5cb97a8080ab6e623e6022893a6b035caff03d6ec6b7bdfda690ee7a3a2e9614cd1c79df3682e60a18df1f
SSDEEP 24576:UD3FHshBIYQgAs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UDVHeBIAAsLNiXicJFFRGNzj3
TLSH
T16E85E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1084-100-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1084-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1084-106-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1084-339-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1084-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1104-78-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1104-319-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1104-76-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1104-84-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1540-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1540-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1540-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1540-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1576-20-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1576-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1576-22-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/1576-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1576-0-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/1576-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1596-304-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/1596-65-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/1596-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1596-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1708-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1708-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1708-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1708-146-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1708-144-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2272-123-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/2272-131-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2272-326-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/2272-125-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2424-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2424-32-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2424-31-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2424-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2424-25-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/3084-118-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3084-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3084-323-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3084-112-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3084-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3084-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3092-89-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3092-88-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3092-320-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3092-94-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3240-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3240-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3240-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3240-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3240-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5760-405-0x000001EAFE640000-0x000001EAFE8CB000-memory.dmp

Download

memory/5992-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5992-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5992-50-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/5992-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5992-63-0x0000000140000000-0x00000001401AA000-memory.dmp

Download