386d9fcff6a06d6ac34621e0d80e32556d75134f4e1787d8378dfd6c30e56ce9

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260709-vs87jsev2q
SHA256 386d9fcff6a06d6ac34621e0d80e32556d75134f4e1787d8378dfd6c30e56ce9
MD5 6a033ed2f0e391118eb1259bd8ade8c8
SHA1 ac2f7ffbe95fb3ae377ccd2f1cf2b9f97ec5a0f4
SHA512 b25d4e2086848345caa7b76dfd9a73051b5151c5f326d1c124dd9084899b74720870bdea3ba4be637e8860e4162b46be4d15d10c17ff02083fb71af52e022281
SSDEEP 49152:9oQynEIJx6iEdOXdgh73Faz9wLXDDZoaLOGpyE5QeaXTMc8aTyuPjSTUYT/UzeK0:hFAeaAnTyR0
TLSH
T173267B0BE6B940E5C0BAD1798A57951BFAB27819873297DB4791470A1F33BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3772	elevation_service.exe
4768	elevation_service.exe
1232	maintenanceservice.exe
4116	OSE.EXE
2544	PerceptionSimulationService.exe
620	perfhost.exe
3572	ReFsDedupSvc.exe
3160	SensorDataService.exe
4804	ssh-agent.exe
5068	AgentService.exe
1064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28b2bf0fe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000869277b5c60fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008efaf2b6c60fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d1a4eb6c60fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000274f3cb6c60fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001144a2b6c60fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000106469f6c60fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4216	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3772	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5068	AgentService.exe
Token: SeBackupPrivilege	3572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3572	ReFsDedupSvc.exe
Token: 33	1064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1064	SearchIndexer.exe
Token: SeDebugPrivilege	3772	elevation_service.exe
Token: SeDebugPrivilege	4768	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4752	4216	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 1064 wrote to memory of 3584	1064	SearchIndexer.exe	99
PID 1064 wrote to memory of 1972	1064	SearchIndexer.exe	100
PID 1064 wrote to memory of 4372	1064	SearchIndexer.exe	101
PID 1064 wrote to memory of 3600	1064	SearchIndexer.exe	102
PID 1064 wrote to memory of 4516	1064	SearchIndexer.exe	103
PID 1064 wrote to memory of 3860	1064	SearchIndexer.exe	104
PID 1064 wrote to memory of 2484	1064	SearchIndexer.exe	105

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_6a033ed2f0e391118eb1259bd8ade8c8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4216
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4216" "1388" "1380" "1336" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1232

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:620

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bcd31e7e2f216449683bb0b640b18852b2516107e601b1716e291751b2ed1ddf
MD5 44834510c0c489f42405fb9d9b6cad65
SHA1 9be6e58fa15af647109bcc4614de3f127834f0ea
SHA512 d76f70fffca7da33d636a24f73e9873938a3bbe8d2cf94dd34601bc9f7f2af807dce0a9624b2a0e85afa1fe3934bcd3c9a492b1db462f1a9ba2d953de89338ee
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUAT/UzeKZS5:h3q6sjBHATyR0
TLSH
T142D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 904f86ad686f4618aff43db4c5256f7d203a3cd4ecc7b07e11d3e5aa9a7013b4
MD5 d7d996c3b278dbb6ff428cfc0e5d88c8
SHA1 8d0f9ed3cac3bc27b0515b4d52710b350dd1ecbf
SHA512 ec8eb878114fd6527bc53c7d077645987a1930bc59ca2af0d910c3c7bdbac36932b6f72beb01abe32d3791c2e129fd39d040b46c3d1cb42e4b30e0e9de1ad672
SSDEEP 12288:c1XLsswWkxy2lRq2czAFwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:qXYfDtczAFh0K/6nWrpAk5dKFvHPdY5
TLSH
T17865F129B39408F9ED27817DC8A1C016EA73B88187A4E79B03A4DD655F337D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b90d079433499a585a486a2a1b98adbf45ff38695d031add3a8dc7f411fe58b9
MD5 edb81dee11f5674b9444bce50e1da4cf
SHA1 d7db0bd6394fd42df0d8d5612f9ce2b5c20c5065
SHA512 8edd591cb3af70aa5174be0d48ac2ae34c713c25969206e42b4941907d4e9c71d1cee125045d4bc90d85d2089669706f8f4f35b9b576794e82bb1213ec2dd7a3
SSDEEP 24576:G0Le5ji0hmxxrMsh0K/6nWrpAk5dKFvHPdY5:GPji0AjnT/UzeKZS5
TLSH
T13A859E16F6748335D073C0B9C5D2A69EED72308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aad9f96ab644851e5a9fb4772553c5e6d50be99de0f29d712be59737210309e0
MD5 4dbad364a8a3237f768a84ff0e26300a
SHA1 a0228804b73a25c842f32907784bb9ca302c2e31
SHA512 11076183819316bced333f4ab1589eb6a61b0d6c9dc2db8e0fd08886b31ae56f07bcabaaf2dad219115ac8c2dca84e9414106b9c7a650a9d007bc36a5d663cb9
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWn6q8wyuSh0K/6nWrpAk5dKFvHPdY5:y/ezSC6vUzPveHjy7T/UzeKZS5
TLSH
T105755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4fd08a54f456b80b7dfa22305d9f43b67a884291caeebc20c1673bcda1e5ba16
MD5 7825181624000988b83f9b1aa07b71d1
SHA1 f6a1d4b93b53439cafe7ab412ad76b3622bcae26
SHA512 01e4bf41e71a189518cdd3c6a7c5d9c1d4c5c51476e13c3ce1ffe22e079c369c4014580fc3500d8749c909cc22d28b47cabd846d14d365cebef26b78634a7e6b
SSDEEP 24576:tVbqPb88hv/l+YRh0K/6nWrpAk5dKFvHPdY5:tVO88hXl+aT/UzeKZS5
TLSH
T138559E66F5748331D073C0BAC5D2A69AEE3234424B31CACB1246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bb78030bdd4c59795f8912f23d8d9122cf5dd124ffb731f414f4543cc1157cf0
MD5 69e00fcc46212ec645024a0004b1b093
SHA1 c3ddf08ff98dbd05fd1a467499c9171ae57e7234
SHA512 c4c8bb455e46a890004117da496d0bd344c2b18fb30cfe557434f91253f1b9b8323bbb9ae7c90d9b9a535c9170776e6bb12919b4d12159eee927b483497d428e
SSDEEP 12288:BLYwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:BLYh0K/6nWrpAk5dKFvHPdY5
TLSH
T17F45235AD3085826F737087E3194D05AE972EE80C4CEC667AF22FD91A432EA5EF7D141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5cb318034a25d0f51d8bfb070e83f9cd9988ce6ededcd9fb273c0eaa159538d4
MD5 ed022b69c4e0ba2b5b5505522529914a
SHA1 e919173391c5c0b3b32d55977da430427e5a8f4d
SHA512 fb02bcf3c692a01d88f487ca0de3ba7500428b76617560a99b08a139f86e6aeac203a38f53826ba1a567b1fdebed0e7a41f1bb5db55af7398d2f25e196a7f6dd
SSDEEP 12288:KeBNUbTVO86UJwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:KJIUJh0K/6nWrpAk5dKFvHPdY5
TLSH
T16765CF3BEE28FCE2C27A4DB95691C240E77278704B52A3CBE165C20EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c41bbdd50080c3edc0e9fb6f57713a07cc0d9e95fab69d6fb4b9d5ecb77f92c6
MD5 164244483ffc41407d81299f886674ac
SHA1 6ad40dc00919946c3787c33f779513c3adff98c7
SHA512 e70f5950ef4b18be6f6df56cdf99ecc243deadb3e26c748cabdd4bbb4653df5a0710b4a8fcba9284ec5160b08dc2164c969a7ed0b2e6da4c36f13a34ae3a1c2f
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:JQvGAdlCEL8c/DRNw5CiTyR0
TLSH
T1D5266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7d1f9c94a299ed620865d45844bdff74a2174f4e0f3778c2b1349b528a288b4a
MD5 296acdfd099451c0892a16cdba97e079
SHA1 6199faee827eab75e69d8f6070747e8f708338c9
SHA512 6e42d8bed22621155d45b6f33a4a8a05b477e671e68480aec16210ed3dfb5ec57734db3764a11a367d4f6453e448668940a5ec9d07c5b17dccd35112b61af70b
SSDEEP 12288:8AwSfxL/2Dc3RDLLmt0LDQewsAj3wk0upay6nWrNHh6koEddKFfnzrXDTG3XItA1:h0ewsAj3h0K/6nWrpAk5dKFvHPdY5
TLSH
T1DC75E031FF74E036C37B0DB61B25C316583DBA204B961AC3E3A88E9D59306D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c122b8dee6563f6b59bbe18750ba1eeff5d6b360008ae620072e3fd493860ce4
MD5 86dc36ccd914ad543ea5d86046d895f0
SHA1 4f1af56bfa8b4228dc6db8fcfbdb3af7acaa7f68
SHA512 5c77cd027d2d7ae1e3d627ccf9ce4e56f2a532a2a32615b4005f661d83aae8b9e9ca3b2b318fcc2af97550ea49e68e9bdef4a546d80f16e69eedf8a8324ba5f1
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfTyW:ZUEtQevvqc2W1cpV2tI32f2
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 068aa130e62bc4a330c2bfd47839f4ac7ecfaf6601b946882a5f1fe696d325b8
MD5 8d995f1a6d61c50d135758c7db743058
SHA1 8628f804bf77052402a050aa8b104a568d9c5347
SHA512 6df4bbcc9dfd74b9a28306e18bda815a9287176b2f89827ab29d547885cccfd923db4427ccd1d785fdb85be081b984b80a66d29b10aeba0d3012c09345cbcac2
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zXT/UzeKZS5:uoq2Vjnm2TyR0
TLSH
T1C5D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e34425d485ab728b22670b433481d117d0c44cf72b7588bcac7b688471883a2b
MD5 a698f1931114314c28fc680276ac1238
SHA1 b162b39ba123b95af2dcb83f701c55d45f8f8d67
SHA512 56f0aacf95f7bfa042853e49b7a820b0481061a2a5d450358db097992a89dd9ade3953cab9fec6987035ce00ad04ffcd7daf41afa2a929cef8f222c8aba0e811
SSDEEP 24576:kAhGL3IFoiwtA5l7S53Wh0K/6nWrpAk5dKFvHPdY5:kAMUFoiq5GT/UzeKZS5
TLSH
T18535AD81E7F955D4F5B3AAB899B68171EA76BCA55E31C20F2260D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 63d60c2f910a021866f6a4c2a2197502436a0cdc170de04aaf6399a91127afb3
MD5 510c893f3348d912d60cc8706ed21373
SHA1 1a3cb9022e42269ca5f8a6477e8e310bf928f82b
SHA512 d216b5b62630cead3a125b275b16db0bf81fc3f6b7bc101f4b56ae437563e228ce0dccf86ed2f6ec9fcf408f83945a877dfc65307a91f3e1e89cee442997e6aa
SSDEEP 12288:Wmw5HEjsChNVBFgl0WDm+Cywk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSI:Pwu4OWbh0K/6nWrpAk5dKFvHPdY5
TLSH
T1D465F14A73A81CF9E96741398597C036F7B2B8012A25D71F1760CA5B6F33361AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2701a6927d55b88f0c456b7ebfcbb3f6aec14891703f53bcbc79de3998445d6e
MD5 3ed045637ff2ccddc7e5b68f0bf16904
SHA1 e9bdd10b23a2a982270f55aa1d6f662fbedcfc42
SHA512 ffe2233a370752d211b05968343b5b17074bc2a1ef73e57dc329a63a910fca936da68ea514ba48c043762045a63f5a5b5594e94963cb0e95ab0cb88361fb045a
SSDEEP 12288:6eZ1IyHwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:XZuEh0K/6nWrpAk5dKFvHPdY5
TLSH
T19D55129A739820B9E273413D95E0D146E772B492437A83CF1B218E656F33ED19E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 baf9c14c8bbe3fface939327f16946235a845a16fef8ae3ce3f77492468bae83
MD5 0f815f697def9799da6c804f7f49069f
SHA1 8daefea40395aa83f7f1be079ebab04ef8cf4c2c
SHA512 1bb2af6af3c0ba09104ce8b8b38cee60b3c514ff71adb5603851145bc525e9b8717917786fc5427942321c70bc967d6c645df8aa795d18aa9905f96c633dc47e
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U5:CQRQyi36YOcPbLvw2gAf+PN3dTyR0
TLSH
T15B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0c90362a7f6925cba1063c36b34a475c2e61ce0856a4403b8c7439ace52f8867
MD5 82d28b32cb985a007bc2d076cdc17459
SHA1 bc260823476013acf98c7901fd2196308e5e6eaf
SHA512 585cde5c623f9b392d6b9573c20f8a34c0954e49310ff5068e70fe27370c6d5fc2810b17b735ad54827d0233eaf3e335e506b39e9d9e2c74961ff1136ce1ec28
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U5:pQRQyi36YOcPbLvw2gAf+PN3dTyR0
TLSH
T164667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 14c771792a69226701ca39c162259dbfcae756292ab186d6aee85a9887541a4d
MD5 8efe1b3da7d8c27499467822d8cebeb8
SHA1 9b166d3aaa5280917002bcc277cd64e6a08dfe57
SHA512 110beef51b73673ce26c5c0dca31bc686109825f45263528558a3c7d723c920b6330a29a6f0228272d6817f87172e0f2cfa8e93aeb9b146eef1762fc2b10dba4
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL00h0K/6nWrpAk5dH:/68Qg55nhceWu7PNU3/nT/UzeKZS5
TLSH
T17FB55933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5de80b3cdba8d385b1676a87738c937017c6947eeff40f8b91930722a4be3989
MD5 4e110d4726904089b66b59ed91d0736c
SHA1 72a3e7d424b79a55221ebb40dd394e719e9c2ced
SHA512 14abb996bebc4b702acb4d86aa2dc6ba40b8f1545191ecae6d17b4c4ab14eb582c41651ce12b228e4a66daaf934cee4188c11c1ec2c4d1376ab153182e1f9968
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99z:0y5112gYy5azzVvt69nLKnhZYTyR0
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eaf010f142ac6723144b4a696ab8c37c497808c65ea5ab7826e5c4975c29bd9b
MD5 c280860663a465d0c9e775a03aee8791
SHA1 b4f2d277bb2a20f9bd5088ef8cafa70a69aff31b
SHA512 2ed1db095520573dbb90e449938c7da67b62019429bbedc8060d619f12e516ce7fd8b8537f4fe8153aff20a3a30d786b987d4a58e005400dd781905ccc7660c0
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDAT/UzeKZS5:ou6Jmdxd2dDATyR0
TLSH
T1BAD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6503634006dac85c314a77508679f657dc8b8253da71f7849979c1dd11ef0c01
MD5 e6e45a10e9c12e933554771e4a3496c3
SHA1 c2d3358bbe1abff0814b3ff1bbf357effda296e7
SHA512 e57506747b510471f54c22f3338f59a8aa7db5d67a224cc2c6dcfe6120e00fe21c4428239bf01485662ef7dcfc96d5e39da2923fe3300a132df4ed300d768a24
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xpT/UzeKZS5:9mifPWR2TyR0
TLSH
T1FEB5AE13F29901E8D06EC17887569232EA62BC460B25B6DF0A90B7961F7BFE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aa6288908ce00679d2fd4e34a933477d66e7ece7094498f91ba06a5690712bdc
MD5 37c0702a76c26157a5ebef477e5349c5
SHA1 99cae70da90d5c7616b044ed96c03f71942eab5d
SHA512 19baf933109e271b6546e7752b8deee6f6840e522f4efef1bc06be587f18c560334f0084f0e4cf749e25039c704d8f150c7008240a741a90ddb35c6efb50a985
SSDEEP 49152:RSuZQIY0Be2KcRVtOnks6NMHqET/UzeKZS5:/5dKii61ETyR0
TLSH
T1ABC5BE03F2E941E8E0BED67887659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6e4e820c447a88d3a986e0df0640b52f2434c3fb72f68353d4feab3d4f10e642
MD5 1af273a58a1e45b9cf64471ef206ebe6
SHA1 fc3ecdd74d6412246149c192b95b148f52f0ffc7
SHA512 c3a3788d1f046718f551e9e029b51fb3f1aac62de5b765eaf0a0b1dfbcdc9f8f22731537a84396751fff370c4e4d9056e6a1fe0f479121ba534c8b09385f62c7
SSDEEP 49152:RhtSn8EApI0fig3giDn0AP5wFT/UzeKZS5:AX2imphqTyR0
TLSH
T1F895BE13F2D900E8D06ED179C7468632EA62BC150B39A6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 17f3934eac1d0b27d9fc53718d52b9e08ae2afd7b661d344f0db2c88ad901c2b
MD5 53e77f0f2b751998ace5ef44c362b908
SHA1 d61bc59b8587c52392bd1ea27ea815ed98fd5c39
SHA512 1634a303b548740784164a4b2b6a24c29c82321e2944cdbc3ad04d3285626309ca8ee9325ca419d652aed54b6e3f4eeca4d8036e3f5fb5730e77738e3024903b
SSDEEP 12288:Gwwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Gwh0K/6nWrpAk5dKFvHPdY5
TLSH
T18945235BE30D552AF233047E6144D09AE966AB85C0CFC1A7BF26EC11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4f351e0a3a8146b0ffe9cfd14bb7161106e3aee439b905dcf2eb3e8f6a663656
MD5 b55344d3f5ef68accc7a8ff0f2f21bc9
SHA1 cad3449f7c50c053da2b9c990f275db30f2a7465
SHA512 98e7bf18e7e153ec5f1eadb647b94a4be72e9e2a76e048fcf153f7884434f9de8da71c72d1521b2daaeba05d8ea9f1cdcb6248008ce989a68c9bb6e115cb757d
SSDEEP 12288:Tjwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Tjh0K/6nWrpAk5dKFvHPdY5
TLSH
T16645235BE30D491AF233047E6244D09AE966EB85C4CFC1A7BF26EC11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dc24ce47e48163f61e77adb2ee7cb3dc4e6c35baf08fe90e7e3b585218340c90
MD5 f7b49f0409a456d7218888acf59322be
SHA1 0d2b5b7967cbb2ea842c8e1b7104689fc00303ee
SHA512 867931416551567d9e424f5687c21ffa884145772f34f1f94f7fb046b8066c01618ac6550ff32aabdf9af250d125b3258dd7a316ba43afa1982b417153b54679
SSDEEP 12288:+Bwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:+Bh0K/6nWrpAk5dKFvHPdY5
TLSH
T14245235AE30D591AF233047E6244D09AE976EB81C4CFC1A7BF26EC11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 07700f06f916b5e9628d3d42ff61d56a28d835a31d3e3b722bfaf7c8974ee6bc
MD5 a7f9b849f66f9473df4fd3915aa5f99c
SHA1 a53d38bd1a9879525c9a799abb9cae6b4b70c354
SHA512 efd1bcbfb2667c5283376f805b6e2e2cb8bf1dbe653c31a33e6e57c9329002a962f78f63b86e7bd430d0189c0e90faf049e6b556682ce88b08a6624211655913
SSDEEP 12288:TV2wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:ch0K/6nWrpAk5dKFvHPdY5
TLSH
T19545235AE34D0496E533857D9190D05AEAB2FEC0C25BC3AFAF11DD515E32BA4AF3CA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b9b970fb8725cdeab341f151969e4564717707e76b80f24f9beed5ee7764feb7
MD5 3c9c1d59b7a61455600d322212a8754f
SHA1 8e4eb0c1c088dbbeb0ac82463cd0d5630103a54f
SHA512 472e9131cfbd096a18b4da43f35667cd09e724dba5f13139def3df0dfdcebfec0d86d37060cd14683d2f8de36d3dc1d7e8c46f9507dcfdd59ebd0e81eb523971
SSDEEP 12288:b+wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:b+h0K/6nWrpAk5dKFvHPdY5
TLSH
T16645235AE30D581AF233047E6244D09AE976ABC5C4CFC1A7BF26EC11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 85745e815e4c2f86865f875af39ed5678cab46e7e7d95e76efde75c6d80c2ad2
MD5 7f4d8ae5886b41205b2162febaa784ee
SHA1 5997f3923a6b3385b66dbcf452b6eec90a896dd3
SHA512 a88e3ce91cb46a544689faa724eb7187ced8cec0dc007c7d970623f1d78aac722ea4241a9f85c14250680b671940cd2a20b5a3e40aa0c84a1b388efa80950164
SSDEEP 12288:wvwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:wvh0K/6nWrpAk5dKFvHPdY5
TLSH
T1F645235AE30D591AF233047E6244D09AE966EB85C4CFC1A7BF26EC11E532EA59F7C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 60db7ac1bbfbae34be7547b970d8bf24c7b691dc86a4324541acd0b7dcd56969
MD5 b84fd82f4055c2256109e2767e6a07b7
SHA1 2a229feeede9d9ea6c99dff63f3f4f900d808ff7
SHA512 d2239dca7de31c109e3b01745af2d82b8b3077da619cbe82579ddc1888596098c02d3f6e0d0628e482d1550839df638d1155c1529c7db201ef7c446e246bca85
SSDEEP 12288:sLwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:sLh0K/6nWrpAk5dKFvHPdY5
TLSH
T13B45235AE30D591AF233047E6244D09AE966EBC5C4CFC2A7BF26EC11E532E65AF7C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5e456735cb94e59620aa62892b815430d2a372f147c02df6b6ba8ac8befc5e3d
MD5 68745e5c6b4bb6ba97484aa12945d948
SHA1 c0146b1db54b61d3894a06b864a04757758325be
SHA512 e6d37417081ac521f7c7c8c28ce15781d48a25f00e562d03127b783a64070e520caf8b989423f12fb6b20dc560d0bff4080a65d52e232865246bdab50b30616c
SSDEEP 12288:LiZwbVzzFEoS2cPvyDwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:2ZMRzFVSODh0K/6nWrpAk5dKFvHPdY5
TLSH
T132650199B39018F8EC23813EC955C806D6B2BC5A4BA0C61F17B43A665F337A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bea8b80e775d8072d42489102188bc739db7ef6d381b6fb061334b2f84ea08c3
MD5 96b861d893bfba8b1ce839367254d353
SHA1 2b0717a48f9209d18e362943aba05b34af926fbd
SHA512 d363231da1676cf8bed335eaca9b8fb38fed46af4e1c53a7bbff004cbaee4e91caefc62f127f6292c6652a0d947cf8aa48e9263eb7f5ce4e10d9bf9177bc3d77
SSDEEP 12288:bUwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:bUh0K/6nWrpAk5dKFvHPdY5
TLSH
T13045235BE30D582AF233047E6244D09AE966EB85C4CFC1A7BF26EC11E532EA59F7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 53350350f140434dcb1c983454cf68277ac1c0a556383c1551985c5ccf600d38
MD5 9599f35a71a963574ebbe7c7ec086365
SHA1 3f135806e0b15832fbe284727da3e5af50a95fed
SHA512 4529554f88cee63c1d142068a63f89c98bf7e6222b31e8cec8ea0df3543389630365ecd51f9703e91c8b48bb7ff3c99de6f3d3dd981083dc97b35817ee6c6b06
SSDEEP 12288:1owk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:1oh0K/6nWrpAk5dKFvHPdY5
TLSH
T10445235BE30C592AF233047E6244D09AE966EB85C4CFC2A7BF26ED11E532E659F7C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 11c72bab36379abc774c65da105a178598ead7f30777b79552e7cc027fb10418
MD5 232cf46c98fed6d7895b6884aa05eaa8
SHA1 ea4c7e6d9d482678ded519575f6c3c840de58c33
SHA512 976b44ed5e8a5883db8e5a7c1a162ef642b8307c6433700ca39a0aeb9f1bb3e4e1bb61b1b0bf31f8e1ce16f4e374565759131adfdaed0334ede34ae601e0752d
SSDEEP 12288:jyPz5L8Hwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:OzyHh0K/6nWrpAk5dKFvHPdY5
TLSH
T1F7551207B39530F9E137813984919506F772B8724765CAAF57604E726F33AE09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 44022531f1f7f26425ccf208834feb4e41dc140f663bf104f46c27b6cf28f8b6
MD5 cb2d7203ee778715b26161479edb137d
SHA1 5739159d40c3b7eb4ab38c93d468694ddf0d1eb2
SHA512 7de0c1cbf2b19bd200c9699fc1caa9af38088cef9b5c81fb04d0a2c6c0d78630bee26febc35d70e815df64fbace3b3e45117ce0d6ca731a760c5b1aa5bfd9eac
SSDEEP 12288:3Uwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:3Uh0K/6nWrpAk5dKFvHPdY5
TLSH
T19345235BE30C582AF233047E6244D09AE966EB85C4CFC1A7BF26EC11E532EA59F7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 20ca3135133435c890fd78332c16e54eb8f989415874aa5319bccc3865700750
MD5 d0f09aea3350497be06a54d20de0a96b
SHA1 d9ce80180781ea9e966adb0472ba70bdbcfde650
SHA512 1edc69a8c115e0b75734f4fc9b2216bf8f42a759c8505995b9b85db282e63c7c3297c6eba344c3f2132e9b2c104cfc993f5e19eaf8dfa8f1215be794dca9326d
SSDEEP 12288:UUwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:UUh0K/6nWrpAk5dKFvHPdY5
TLSH
T10B45235BE30C582AF233047E6244D09AE966EB85C4CFC1A7BF26EC11E532EA59F7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a226d5f25b8be14aa0d17eeb2bb485830c28eb6f48321cb133ba46606a51536b
MD5 79b577561db359d0e8c1c357c4204eca
SHA1 90fedbc90a81e01793ed8a4ed2f731064ceaade8
SHA512 d6a7e6addd41e3e5d022b30f4e1ea6b0a8438647cda6835168ec919a4044ecc937561d47432b2851835e09c598dcf376413bf46e8e4060edb4491e2d05fef852
SSDEEP 12288:byPz5L8Hwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:WzyHh0K/6nWrpAk5dKFvHPdY5
TLSH
T1CC551207B39530F9E137823984919506F772B8724765CAAF57604E762F33AE09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7257e46b3ce1aabe5161dad85aaf0598a4ec1f389d60dba7d200da8e23241fe4
MD5 4d33bc2dd92e888905bf4dd4233fdc07
SHA1 2cc1dc802587d96a5c398b6d375745590a89f7cd
SHA512 fe52d02148840b2f4843773865014202944fb74f9591afd83d7b7a8abc42a34208e3dccb8cb93a8646e8db721df2d16714e383795f50d833427d2d6e47bb6b96
SSDEEP 24576:WTDaLl3z0zDxh0K/6nWrpAk5dKFvHPdY5:WTuLljST/UzeKZS5
TLSH
T1926501A9B35018F8EC37813EC9558806D6B2BC5A07A4C61F17B83A675F333A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ab43b70b2dd6325a2da752b7a5c2fc5f80a18d8898c7b566ea1f2c15205d9216
MD5 25f9484d008def4ac7ff7f47d98089f2
SHA1 54cad874b24004af8879aafa9b1c9078512e4ef1
SHA512 73947c33a1eb389d6e643b4ff8e552ff797fb8e97689598a48dfc6d185bc62f83eeeb582f35add16c5b3aba7883a518851844f67e6bf683c285af912d5560bf0
SSDEEP 24576:C3vd9CHKy7GZ9h0K/6nWrpAk5dKFvHPdY5:kvd9CHKya/T/UzeKZS5
TLSH
T18775CF90F3E414E8F0778A3589758511DAB67C995B71CE8F03A46A1A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fe4edbea69ee595ce97b1b309b7b000ac1ef02ec0a49db1a575d5e10ecff1664
MD5 be61988ee346e2ee7e8bd1cebdb02340
SHA1 d781198bd51b5d5e2ec6f15cf3bc75209511ce88
SHA512 42eda61921850fed4590855f9e13359fadf09ce8fc043b22ebd51865c1dfec69cdb96df3f473820b5221dfc4ab3e0950965eb575e791506da99a8459c69b9d74
SSDEEP 12288:mhwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:mhh0K/6nWrpAk5dKFvHPdY5
TLSH
T13F45235AE30D591AF233047E6244D09AE976AB81C4CFC1A7BF26EC11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ccf9fd0e87ac0818187a306888857cce3faa6eeeef70cc4b25f21486cf30f9e3
MD5 55f4d990ff673240a89989fd8056173b
SHA1 82791b614d742d2c3d77c07902bbe4dfce1a9d3d
SHA512 55e2758fe9a0043aafc86814a50128beafe247656a7d688ed22b45afdf37d2fccb70ee4251265e88ca32ccd527a6f7830fec581875a4d58dec8ab3cb8850f55b
SSDEEP 12288:Ynwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Ynh0K/6nWrpAk5dKFvHPdY5
TLSH
T1ED45235AE30C592AF237047E6284D05AE966EB81C4CFC2A7BF26EC11E532E659F7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 746cdeb28c1278f79ed1bbb698a72e3298b87d0a77cb5c73363a1fdc4ac89d87
MD5 97514e242a87f8bfd74b27872dd59217
SHA1 1824a1bdbb5cc337fd5b01ea7116618c84924c0d
SHA512 cac6f8c5bf183753ff825de85df1f90ebcdb3b1e17c9d787fc5954851fa2753f2af14106c5fde615ccc543d5a9a630d7063e88355d54a55f25142132f0ff7623
SSDEEP 12288:f6wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:f6h0K/6nWrpAk5dKFvHPdY5
TLSH
T11845235BE30D581AF233047E6244D09AE966AB85C0CFC1A7BF26ED11E532EA5AF7C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 eea6e0cdee17adc33c181418b70c80fb3df1c58bdde8671434eea854f8357f23
MD5 2fbb26fcdbd738571d9621e8803f7563
SHA1 b793ad4060a60b285fd2261110c7869674bbe607
SHA512 73304f637ababf14c37835e63ba331724c06d1f4d8ff438e86bd99598ee2f4b2454a4e5c919d03861a5dff543aad4c5a48c17d630202cd1c86243ab2d3e7b4ba
SSDEEP 12288:7Uwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:7Uh0K/6nWrpAk5dKFvHPdY5
TLSH
T10B45235BE30D582AF233047E6244D09AE966EB85C4CFC1A7BF26EC11E532EA59F7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 844fc3a6a459ee7c4acd8c2eaf01e6a28bbadc2a1e3b6787f23aaefd2928a58e
MD5 b787ec13acccfa55e9de3c812faeeb86
SHA1 bbe0b1d16d9e3045d2e20a27af0ef4102fce4f42
SHA512 dce35ebba5c51cb6c6f1d2ed4bad2af3115b727d68958d008fb293f8c11ed6ab71f36b1829b44273ae8d75aafa999a186af0982257e5573c776915f8abf96f82
SSDEEP 12288:Thwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Thh0K/6nWrpAk5dKFvHPdY5
TLSH
T1D145235AE30D581AF233047E6244D09AE976ABC1C4CFC1A7BF26EC11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 80ff9d1238f92550914e30f4f2eb12d7ffbb2d8421cdd9bc294006b1a4dd034e
MD5 5543ba9e38e759235a32e84e5b83bb0a
SHA1 a471d68608685d7abebda96f3b5cf7519bd005c3
SHA512 8f11b7b9fd22707b7aaa28a1dca6913c9a3acaca20b63124122c1bb5aa09ed71998f1f3068bd592f948cb976c5729d75cd219b479562138b2d00a8c7316b3e68
SSDEEP 12288:Ncwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Nch0K/6nWrpAk5dKFvHPdY5
TLSH
T1ED45235AE30D491AF23304BE6284D05AED66EB85C0CFC2A7BF26ED11E532E659F7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-09_171625_4216-2704.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-09_171625_4216-2704.log
Size 1KB
SHA256 1ebbbfac9a0a57aee477da742321f1ea562a513317762333b84e585d51468eb8
MD5 14863b5aab0e7fe936790f1b63a6501f
SHA1 24b8c1d7628cd2e9247e9832842f762f687c1506
SHA512 1364c57f45a7ce432460dfb077acc85020a36e31a24caf3b08b3aab68fa4972ca582ab480e1f83bf2165541bcb4ed3ae1b8e5c5e563796c92c0e9424d1ba1aa4
TLSH
T1F221A26A6BD40A05FFFBDE8195FA1143AD3978966C35C50C10A5424D1931F44EEB032B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5c337a0f3b8e79a22c6bda80ca9bd0e32fc1318ac4a27ec4485914b3a3f777d1
MD5 6e476d5bb15dd12ccd1385d359112c0c
SHA1 8a3814a5c8d43f7bbf2b05d565b5762f1d2c9bc7
SHA512 d7064ec220fd0e38f91b6bb8256f47443fa15f24567038e58e700f4207d2feff778432dfbba4afe9ad0df6be2fb136c5bc62d92f63417d8537c327fdfd797d9a
SSDEEP 24576:TfwvUk9RX6wkyAI4h0K/6nWrpAk5dKFvHPdY5:JMnYI4T/UzeKZS5
TLSH
T1BC85D029EBDC44E5E177923C99B7860AF6B178590B31C2CF125A53AD0E33ED4AE39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9252dc4b43dcb202efebaf5bcdacf559b370de46be53573b76de7f549098df55
MD5 e0f6a158d69f5fb1448d2d1f013cb4d7
SHA1 c4547d491f53be9ae42dc6587f80c5bb51d8f1d4
SHA512 e48ee00ccefe674962b86eae1fbd23d7eb3943a8d07b522ce00ee9d993fe265980619a8c697df540b8d8612030fc6e5590d8f85a148467650391b66cf9253adc
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lT/UzeKZS5:BySzP9TyR0
TLSH
T176066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 59e9f27da84fa69d409ddf1177005cc933903751f30cfd439b1a6086acb48013
MD5 73eafb15da14414279a00698116a1d4e
SHA1 879e69274cd53d57f7d5b7dda5db3655bdb66c27
SHA512 8b47d7e1b229447206c99978dd3ad4a2548ebae96a3a7ab3e6997b78aaece1d5bd747c0f8b5a85c67bdf9da507fbcaeed7d3ac920d018bdecbee41cbb4cf3d1f
SSDEEP 24576:j47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTh0K/6nWrpAk5dKFvHPdY5:j47JUQjTirIhCnDHUPfF/1T/UzeKZS5
TLSH
T19365AE1EA3EC01E5E17A827885158A5AEA71742D5F31CACF2270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5ad8efc5840931f161b6efd3cb5996724cca3126b6fd107bdc777076695be86d
MD5 0eeca39cae8450fa23e3bd46beafa87c
SHA1 496cc4ec8b369f9bbdf7014ab238315989c55906
SHA512 ee70af992e85ec8fb45fed38897c811d4c0101cc669d0f657fa729690ce3f20c00a74dd2aab3715bf5cd17ea0d6765c3d4e7818e813f879fc5f425d492b44df2
SSDEEP 12288:NbsfEwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:oEh0K/6nWrpAk5dKFvHPdY5
TLSH
T1F355F01AD29802E8D02E517AC7558541F7337C6583E6D3CB67D0F93E1F36A909EEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 927b294b36b1f528563dc995d66dbf90934b3840cb0ba306adf805e763a608d6
MD5 ec0ce8a884578b3329ca77e372e0db13
SHA1 ebeb83c551789258557c4606012b69767bd735c8
SHA512 70179bfcbda72a1eee5b455e0e4ae2d4f931a15286fe3ee4f7b25d61fd1197650366de31e96d614c17a6dd0492a4544fc7991ab5e14ac3eeb36d34f0991700e7
SSDEEP 12288:Ul12R4+yU3fKrHedz3/nU1BUmDH3eXhpV1YTzSDj:Ul12CFUP7zc1BUmDHOXhj6T2Dj
TLSH
T193352750766BC75FC6A950321E32C2CCA7707D41FE05AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1a70eb5e2f44a3c2e6e9cf92190caddda57528b4f0299f2e728ea6c8076fa92d
MD5 5355664bbbd7e4d098945304b0a5ac3c
SHA1 e8a3ab64d906d3b6127c8aa2936e42f214ccfc86
SHA512 8db9f801f30d93947d8614476e8c0ccdf46e0b6c739bb5c85254c44c16380eb51d4616168e5accc54348e18902696ae208b15f4ae1e4c8c91b0ef2946a05ebbb
SSDEEP 12288:oXHDCx8LA9sP+3vaWBkUR7HaLecU2ionp4LecK:MHGKpAeH
TLSH
T18D65E9416537E3DFD1FA203207269B4DB764EC07B3496F26B3C84539D82AB2660B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f8cd66b743a98ae2dfb292457f462aa468169b3d7a61a33eaa44b7a846546f62
MD5 6a681710c5c9c8909a045959d9146706
SHA1 8ed5f17bccf189c84bbc683ed47eebdf586f3b28
SHA512 8c6824b3d751a27cc55e3a2f7da439222ab6fe1780ce35e0604eacbbecaa59c617b2556efee0befd666c3794dc5ae3f30770d3050d678497d90a6669b8ed74df
SSDEEP 12288:jF7Mwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:5Mh0K/6nWrpAk5dKFvHPdY5
TLSH
T15A452356E34C582AF537057D2198C029E92AFA908B8EC1E7FF12ED91A432ED5DF7C601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 32de59c685a1d6de47ca0187017ed9ada47afc3d031d4b46c4e8641e97442a80
MD5 e7beaacd0f46a9a5600f71cc0cd0ea8b
SHA1 787c4e9a9570fd1d4ddeffce961f3ca82638ded2
SHA512 3e0b6da12dce792c81ff58b9aafc0cb7bfdc1b81741004e2bf058968a406e7802b00bd0465f40bd65a4a074abe7b6bc7e61061feca0e2b700f1cf65a71b12312
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYSh0K/6nWrpAk5dKFvHPdY5:+gb4mBIBhGFTT/UzeKZS5
TLSH
T17165AE1E22EC02F5E0F6D2B89DAA4417D6B278160732D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bf49cea88c65c1289f045d6014f9a35a34269b6ec4fb423fc1b4962381e3cc93
MD5 2a41181e1fa87175a42debaeb7869abe
SHA1 4566c2ace21ddfa0146c2acefb84c31d694e0661
SHA512 6b019f0c28d22371ea5ae4e1aa5efefae25a11d4b142225b7bfd5883be5424427230ca3ac3e85f903332c669675b0a47176c978df46c5dd4bbf3e2515ee05c7d
SSDEEP 24576:pG88u8FpJqH1bzria7/mDh0K/6nWrpAk5dKFvHPdY5:87ZFPqVea7/aT/UzeKZS5
TLSH
T14685F165B7E101F1D477D13889828663F6B2B4250364EBDF0BA88F511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bd8cf3b359fb27075bbc60b0691dabc1d87055dd6d3d7d0e3cc31f66ee6c27c1
MD5 612ca10cbdc8547dd487120a914c7d0c
SHA1 b4db7b6494db7016cd9f492ad59fcf014819225f
SHA512 c778f47f5b7356a1d93aac8ad6642181bd70deae3840026c4bd43f530786db80d5f02b8e4c2591ce2189ed9145c6b802d03f7f958b4197e1e0286447b79200ec
SSDEEP 12288:jHvUrBFrEjwaQ/wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:jPUr+NQ/h0K/6nWrpAk5dKFvHPdY5
TLSH
T19E65E12F62AC18E5F676917D85828219F772B4620312D2DF02A1857E5F73EE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a2287e7107a57c7e13555a8b7b142cc7e96b4b2e7b0367b550ec74a473e9b780
MD5 6abc91a43a21569ec89bd4d85c7ed6a9
SHA1 3113cba6237fb557664a46f4ae41fa1dc596e87c
SHA512 0dc487628271fba1c9a20a9f37750f35d9edaf46ffb4ff45e30ecd6243bd81b8f1456a9781a06309a51cb08224a6d011faa70f22d1ad02ef65ea6a13d0a102d0
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvT/UzeKZS5:JG05lO43bATyR0
TLSH
T11CD5C06E62EC11F9D1BBC17CD9C6860BEBB23415032556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af5e3780b7d61a20f81803bb2074e93f0161258231686c52cd193b3735353d84
MD5 5e2dbcaef126296afc5f6a2a8131a7e7
SHA1 0bc3b8d18aa4505db3289f478ba74180510b2d85
SHA512 56b2c373ae7fbceef8708ae3f9ed01cb01ac23dddfe932a0330d53e502f6326c8223817ac8139c1f74ef205cd043551571baefdfb4ed0839770f4c0b05f2caa7
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnlh0K/6nWrpAk5dKFvHPdY5:ha5POZ3BJt2pasx2+mnT/UzeKZS5
TLSH
T1F565AF5EA7EC01D5E179D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9252f3f741e2677c3c9fb2da22f4d769dc58dbe553776c01bcc9cd9b36f995f8
MD5 d9bd139657960277ce373fab730a275f
SHA1 0646631fa72d6f1555ccd11b192147255e347bce
SHA512 f48d7286db87d18297f2d5eed2832d6510df484027cc250b6614ae90fe1a9c9da3fcfd893ed295ff6bcf39f35488ec8a9bcfc0c312946907a232d81a7ab78415
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7Fk7h0K/6nWrpAk5dKFvHPdY5:1Nc/zEOVHF6T/UzeKZS5
TLSH
T13A858C2623E901E4F1BBE1BE89779546FAB17865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7c80e62efef5c470a543e02802afb82fc1f854bbc5885f1e8948bce188629916
MD5 cf5c7e61059d99844c935462ae04f2b6
SHA1 5296087e667127ce1b83a16146cbd24c229307de
SHA512 12e9a30eb5540eba721d70546c260396e3f2b0386e43d8df532c6dda5242b90945e7cee1ab442ec4aebba862b8dca2c4aa2b0643df9a653db44c632accad73a5
SSDEEP 24576:fTkNvNnaFeYhJNtmZBm/Ah0K/6nWrpAk5dKFvHPdY5:fTMwBtOm/AT/UzeKZS5
TLSH
T1C555AF6EB7B846E4D1BEC6B58D238112EA727461073293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c9d369f849bbbbd806d98c9764bd98bfdd264c2da4c8a343b98db9598dff60f0
MD5 6454240588f8bfce1beb10696b68a1ad
SHA1 b2acfe3903355180ff0f6e29f5a3d18502f293ad
SHA512 09ed5802a23bac668f57260f37342c436b4776451e40ce376b43a5dc4036cb14bf2db3a5dbde0896d9a5ad4895d33cafb8020aa12d2e03fa26ffa618bff83357
SSDEEP 24576:GD3FHshBIYQgAQh0K/6nWrpAk5dKFvHPdY5:GDVHeBIAAQT/UzeKZS5
TLSH
T1D575E07EE79C04E4E57BC1BC96638506E77238A9032266DB0694C1B65F2BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-93-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/620-88-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/620-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/620-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1064-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1064-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1064-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1064-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1232-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1232-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1232-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1232-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1232-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2484-411-0x00000152CF520000-0x00000152CF74D000-memory.dmp

Download

memory/2544-83-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2544-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2544-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2544-313-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3160-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-110-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3160-116-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3160-321-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3160-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3572-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3572-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3572-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3572-338-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3572-336-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3572-104-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3600-335-0x00000294823B0000-0x000002948263B000-memory.dmp

Download

memory/3772-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3772-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3772-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3772-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3772-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4116-300-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4116-71-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4116-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4116-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4216-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4216-49-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/4216-0-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/4216-40-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4216-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4768-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4768-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4768-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4768-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4768-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4804-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4804-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4804-130-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4804-323-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5068-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5068-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5068-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5068-142-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5068-136-0x0000000000730000-0x0000000000790000-memory.dmp

Download