a8a1a06f20bd3662ebc1bd1e4c546f54748dbfeec2ba0e4b7dfe29864333976e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260710-l8wrqaas9v
SHA256 a8a1a06f20bd3662ebc1bd1e4c546f54748dbfeec2ba0e4b7dfe29864333976e
MD5 af19ff7c3449f590b41e4de204ed0bec
SHA1 ba650c9df1c469e84a7745187a74c4a7b2b8ac56
SHA512 755b827404259bf9d6fb2cab6ee8ece0de28cf473eb745ef9de2d53871c719b69ba575909aade11668c185639290ce5c09999ed2006eb389b587242c3eaaab97
SSDEEP 49152:F7mZ5UxCNBjHYi3ScakVEOyq+VPRT7uGAc9e7ao1d8bSTJGJCYtHFBURPcyJpaNX:vO2sGJeD7Pz+X
TLSH
T174167B07A7B940F5C0BBD13D8A579657FAB2784A877197CB47A0861A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3592	elevation_service.exe
4792	elevation_service.exe
4208	maintenanceservice.exe
3212	OSE.EXE
3464	PerceptionSimulationService.exe
3668	perfhost.exe
4368	ReFsDedupSvc.exe
5584	SensorDataService.exe
300	ssh-agent.exe
6004	AgentService.exe
2296	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a862fd183806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070914eb35410dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df7b80b35410dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f42494f55410dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c9d83b45410dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000960f1b25410dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb1186f55410dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004af07b35410dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3500	2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3592	elevation_service.exe
Token: SeBackupPrivilege	4368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4368	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6004	AgentService.exe
Token: 33	2296	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2296	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2296	SearchIndexer.exe
Token: SeDebugPrivilege	3592	elevation_service.exe
Token: SeDebugPrivilege	4792	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 5528	2296	SearchIndexer.exe	98
PID 2296 wrote to memory of 3616	2296	SearchIndexer.exe	99
PID 2296 wrote to memory of 6100	2296	SearchIndexer.exe	100
PID 2296 wrote to memory of 424	2296	SearchIndexer.exe	101
PID 2296 wrote to memory of 6020	2296	SearchIndexer.exe	103
PID 2296 wrote to memory of 3248	2296	SearchIndexer.exe	104
PID 2296 wrote to memory of 5016	2296	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_af19ff7c3449f590b41e4de204ed0bec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 125a9e7748f81da53f68284f6b9260cdb47cdcb84620da2804aab3dd0a0b3e1a
MD5 7c167f8d588346acb02d3a10e00396ab
SHA1 3548f10c49430e6b27b428ce6895c23573096eda
SHA512 600ed9bb32b28a9d845ad9ecd40404198cb7bf126e4e3280fe57f427b3aaed8dd8cb877431d1e43ce57acf2e0f1262bd6d01de5bd4567c462ff3242c9582f6ee
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNFBURPcyJpaNIK:/3q6HjBZPz+X
TLSH
T1F6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b1c3ac4a4148cf723f50f33590bf703871d030948f14e8b311781d1a80dee279
MD5 005cb9e6d73eac08bf9d0c2884dcc5d7
SHA1 4ddc086b23411d749a150d9536eb4e9a823e67d6
SHA512 f7e389f326510945de08b1da8378c95a6f3c0c71312f29b8ba8c71de431e3a1d8dbf5edb0fdafed9d95968c9315c9cf43145455b0d477725d90dd08025274c6b
SSDEEP 12288:H1XLsswWkxy2lRq2czAy4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:VXYfDtczAZmlbBW8sRPEbyJlTaN8D1o
TLSH
T14365022873D548F9ED778138C9A18416EA73BC9587B0E78B03E499261F332D85D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 431d69ba994572a6bde96e3119ad2b74824b681f69e743654073162974b2a324
MD5 69b544fdbc57a6355db27c7f206c858e
SHA1 d1c1de387b5aff8939224edd7d8627110efb3c1c
SHA512 7f61a6952ba6cad8300efd704d574c6d5f83a309bbf054c83d9c62f4b0be3644906bb110fd90617bb7b80f5721e74b62b8532a0ebf0c264294cc87fd2fa742a7
SSDEEP 24576:Y0Le5ji0hmxirMcmlbBW8sRPEbyJlTaN8D1o:YPji0AcSFBURPcyJpaNIK
TLSH
T1AA859E55F6788731D073C0B9C5D2A68EE97230865B308ACB4286D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 175a6e956d25cc974d34301e50ad89bd1976a86e633e921667aa061dd7e1bc69
MD5 172d9983367653fdd2d3faf754044420
SHA1 62f757f42ffaf911ae1e7ca4bd735612ad248127
SHA512 4a4f7a3860c6d3121432cee488b262c96a199f7605a2a109f224e166330ef6b86c1193cf1ab5a6f9d3010cf4c041f2c46b34b970d49dede6f473e27f780b4786
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyuCmlbBW8sRPEbyJlTaN8D1o:h/ezSC6vUzPvxHjyuFBURPcyJpaNIK
TLSH
T1DA755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2daf2c3004eef3b70f6a422618969681ab51a142dca8be3c7f77b59593ee7c7b
MD5 891588536549e4ae48229b9128842df9
SHA1 6a5a82a62741048d55b9131594362b189ae6f8d6
SHA512 bb1ab6b50d59ef40e11b7fee5b191f031c882343c41123ff8aafb80fbdf36203fa431d2c292b9a2f4e1b1dadb629ebcec5d911cbae5aa7792d242bdd6ef5efc2
SSDEEP 24576:+VbqPb88hv/l+6VmlbBW8sRPEbyJlTaN8D1o:+VO88hXl+xFBURPcyJpaNIK
TLSH
T114559E65F674C331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b3d9e4c84d30cae4c461213d83fd54091bc6d3471a811ed1838bee9b9e72667f
MD5 b20669563b4de6624d8831da9e5703c6
SHA1 87cb55cce72d2e5f9da569c135ec0f66f776e61e
SHA512 8948c7a2355051ca9bb69ff0f4c09e8e4500f200ac78e70bad5fc7b25d9aaf0ea8bbeebba530d43252d4f67062591aeb129f0b2fdbcb5c76c60ab55ca28a4a46
SSDEEP 12288:mRF4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:mRYmlbBW8sRPEbyJlTaN8D1o
TLSH
T1144523C8174FC8A1EBB789312524241FA959CEDCEDF5E9069B85BA1B0D380CAD4297C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8926ac280bf1c0642beb54ae6a17610d618fc16c1631ea4f8e7e6d9758eb6e71
MD5 d2cc1ca7c585868168085d681371b822
SHA1 1ab7ec93e6d17296c8aef9989c7a484fa672a84d
SHA512 155c0242cb6b0bad8a518ffba455d04288c0f7de57e01e5e88f542c77a7fa3dfb4fc16f5f860dfffef16f650c1c0109a90bd8649625893bd07eabbe880a47b9b
SSDEEP 12288:LeBNUbTVO86UW4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:LJIUtmlbBW8sRPEbyJlTaN8D1o
TLSH
T15565DF7BAE28FCE2C27A8D7857508600E77278708F62A3CBD165830EDE235E55D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2e99d4101432d23748adb156328fde110147206d010778d661bc7f210ea44ba4
MD5 c320ee22a902e3de41e5e4b80bc24e1a
SHA1 ff664f2c6f6f896da231f592c87a4cf38a2f875b
SHA512 5767aeee7dc0413c05d8e7d2e8409493bf7f4925683205b4a3ef809fd066c50f2d741db980c369b3c1d38ad12320af3bb45c9d5cb5856426022e50fe5319312b
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:fQvGAdlCEL8c/yRNw5CUPz+X
TLSH
T159266C656BF880F5E0B7E134897A85B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 60772f909b35244c1fee6634dd2a85f154a0f18141ae78b96cd4d6d6abc5c040
MD5 8cbcb3b7d0231a5064cb66df189ba7e1
SHA1 0bf35b8de9100dacb7c06ddcc91ebfdf0b06a1c4
SHA512 48b7c87c32912aafef14770b659bddee123a6982542d1aa1dbd6360c2b2629472e357fd51f0659a45ba6386b43d601aa7d8a50e59f4468bc5d1591dd91ff8523
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAjU4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DU1:bdewsAjbmlbBW8sRPEbyJlTaN8D1o
TLSH
T1F975E030FA75D432C7BB0DB21B35D71A542DAA608FA119C3E3E88E9E59301D26336B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 785e4c2e6581e133124c42b281b59d080ab29b88ebab93052551321d11853fc5
MD5 739cd3929e8b02e1c433300f5be6f337
SHA1 ef426f862ea0f73e73aa78cc7f5a67a8600fc5b3
SHA512 2ccc02979e10c57131bbab9a4dcb5c0430015b9beb0c500e79c46a1fd8f8e8218fc1b79ab1aa497cc26c47239536c7bab535789bb3d43f1a36cc606f93a6f7e7
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHT:vUEtQevvqc2W1cpV2EI32T
TLSH
T1D6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dc2c08bf10056af9fed18f4942540b3a8a082d840fc349f1284d8526509cecd2
MD5 20856235b2f1db7bf344b8f92153a81e
SHA1 5bcc217deb14eab756084172ea6d400469512482
SHA512 53bd323cfbe6e01894eb11770dbdbc99a186f3c52206526e8b54073ed479b4d94a721cb82255fb11a84f89a3a486e020e7fa9bc5c12e6c8f0c2f823164dd21e5
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/ziFBURPcyJpaNIK:foqtVjnmgPz+X
TLSH
T18AD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5725c27d24d0821160e5d9cf6f98a17b027c9774e40adf2cc8729f6789d5d9d0
MD5 fa19b35f6b1851a7b653a6c32925fc35
SHA1 86ba3045d84b26f8564d40f8bf7e7294cec3b5ee
SHA512 9c4f0fefcbf59dbe8bdedcc505546503dc9296f980b023e05d316c6fa9f08c871780000eac528135638a74df97b5fd3d312c936b27be0f9a774512f28a01abea
SSDEEP 24576:/AhGLJIFoiwtA5l7S532mlbBW8sRPEbyJlTaN8D1o:/AMyFoiq5vFBURPcyJpaNIK
TLSH
T162359D80E7F955D4F5B3AA7899B59171EA76BCAA5E31C20F2250D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9df7a7138a63f8c473d3d7d85525dc9d3b33eb4559fa6e9e0856f4306fb61919
MD5 8f11257ccc4c48a2b797ba59a772a08b
SHA1 66e469692c5f219822861c4f72ac9766711c0619
SHA512 b52fc97c1d22206947e5708c9f4784fb57c1885caff6714acb9f8d5b093f183fad4523fdc824d92866e0601e1cc74f67342b1cb9ab3e26ddb1d486c24ca996ec
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+CX4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:UwuoOWvmlbBW8sRPEbyJlTaN8D1o
TLSH
T14265F18933994CF9E9B7853886578036F7F2BC452A61DB0F17A0C61B5F37261AC2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 605124cf8722ff3aa8cd26d6c47139854ff6dbe6eb272036a52fa2bde76d18f2
MD5 efb71fb7c5cfd112052ec45d48d42e7f
SHA1 bc2884dc8e90bfae9b82f4088696e49e0333298f
SHA512 f2faac72d6f1b0add6caa8f15eb123a11449c83ee80c68b53747c1fbd2d968ff10627bbddaf317ec7ce97c121e95348891ba90bf8dc980fd73cbae4464be79b3
SSDEEP 12288:SBZ1IyE4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:8ZuUmlbBW8sRPEbyJlTaN8D1o
TLSH
T1E05513C833C9A4F5E2B3853499B0150AE772BC9AABB183CF1754466B1F329C65C39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 622a4a32a8ee58d39858d88abd0705d0fc28bbdf4b08e2b277d63e0de1f1edcd
MD5 e15db0b326ccd62a1472aabcb5e2a798
SHA1 5ee7bcbe64df726cb789f5ffbc3bd55d4942398c
SHA512 62b3d059d95c503d4421a42db9a0eed29247f16eb9085a89f26f03cd3eaf7217e26c4a4cdcf865832cf31e507118ae0e8ae414604806eb24fa7168e2355028ae
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:DQRQyi36YOcPQLvw2gAf+PN3dPz+X
TLSH
T12D667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e0b7317e71b8820292d2e68fd38f0973d83caafa46c44b906781c0e82e5bd8ea
MD5 e9e78533760836ceade097af88cd7ebc
SHA1 5507a0efe2e0fc05c3a6bb57b9f88735e470ddcc
SHA512 df9760ade8dab409176c96eb19f51828c7582ba9b9b938d743db876d569c0c1158906832138fcdf67d08280412331d2e17b3f53cf5573f307f6023f05c27d251
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:YQRQyi36YOcPQLvw2gAf+PN3dPz+X
TLSH
T140667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 17750e6ce91c0a4305da9f8be160de7f583cac4878a2f5165b06ad3d62664f8c
MD5 34544961e494ff0446109e76af581ad5
SHA1 20806f3ee13fcc8baecba1744dc00db85f7493c9
SHA512 8a923e7c8e6f6dca2388dbc1606006aa08630317e211b6678ede4a4a01394e5a9719589682f0741b34ffd45482b38ba9f69db0205047287243aeda60f6d555a0
SSDEEP 49152:O68Qg55nhheWu7PNU3/SFBURPcyJpaNIK:cthWRc/LPz+X
TLSH
T101B54933B2F600A9C45DE1769F4A972196D27C75CFE0E3DB850172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a29096703fc99b8491309c8cd3d58601d02a2de294ce716dede5ef530ab6a116
MD5 c77a20f41bb807cca5d0ac1847cf0e80
SHA1 3c8060fa65510aa86dca549b23565282ad1652ea
SHA512 6dc996917c762fcc01ee5868035e756cdb13d3a011ab6d8d1411dcc1800867ddc49e54b361564c1fdfc21b0407d59ed010913f94dca4aa7aa0439e639c1dc70f
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:Zy5112gYy5azzVvL69nLKnhZuPz+X
TLSH
T1E7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 efe19896347d95e7b6032888b377af5405391439837e43fdd56c7412614b4d01
MD5 dcf0536b4908b7183b6e3bcda51a6fe6
SHA1 b40135ce091307d1a34c5b301c870be24c60ad64
SHA512 6653feda06e635493d2e269e22f7f5397a26abee8c45e5528bef31c1bc914b14ddc5fdef028a72ce35a99a8e97ed42dc3248a9f0ff8cea99f3089908aaf56479
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbFBURPcyJpaNIK:Xu6JmVxd2dsPz+X
TLSH
T103D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 66989c892280f7635539d939e23fa09c879a3d62e80b68bdbf37dfa9d3c56697
MD5 5a550cf7b372c683cab26007696df461
SHA1 b377b737c6fafdd7e2e3ba51ea38b45e1141c282
SHA512 d3e7cae8e6cf9d2370153cbe76853def722d2b87c2803b26bc12466ad58e46a2065f309ab43bed712a208c0e4a03c3b7b0c6e6ac8e886985020803312f04d8fe
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4x8FBURPcyJpaNIK:jmifPbRgPz+X
TLSH
T18CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 853146cb57e07f3b1dc7da1f13f323b049bf23e7db86768a0cff60ffdd73643e
MD5 532001eab45da8bf8ab0d07ab7d152e1
SHA1 002930c35ee1897426e17cadfd03b74900b3cd46
SHA512 75ef8c515d7ceec89f9c4163d854d4b147480b113924fb51dc0887ce98c81e9e07bcd88331190ecf72a00bcf6f2345601bea18959ff8848273f39ace940aa5c9
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHq9FBURPcyJpaNIK:d5dKTi61CPz+X
TLSH
T17BC5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 66b7f7ee7b944bb0e8c5bdd77a4972fc26a9407319acfb438b53349de919f1ec
MD5 0838b1fa0d190d732c323e1d4dd88daa
SHA1 2bbef3d4b9b6afb1ad46e4cbf5d877dbc38694ea
SHA512 deeadd7d6fc4bc8c71311b6a8131e36b17a4df191c3d3fc766d22c42986e0b424451fd1a4d9dd5035aca90dc4e610757b4e0c803905fca5f9ee7fa91bd1270ce
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wQFBURPcyJpaNIK:tX2iyphMPz+X
TLSH
T1F595BE13F2D900E8D06ED174C7568632EA62BC160B35AADF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f63d47157510fcae9c23bfc1eff5aec5558f9bae3eaaeb6cf7212987fc2205b8
MD5 50478c1950037525cd00e5d71c9ec221
SHA1 20f9c666c875ca113b150407728468a6bdb3355d
SHA512 1ac8bc7768332110a7a49fb61691894c8c3ea00e26d2b6aca10850b81251d8e62d2dd986ec015e236d9caadad56431b8e519a14e41e6575e53d6615e96cab88f
SSDEEP 12288:i94aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:iwmlbBW8sRPEbyJlTaN8D1o
TLSH
T1A74523C8274FCCA1E67389311220245FE459CEDEFDF6A446AF8A651B1E780DE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9694e63c6b38aeef3405f2579b1df97bae2caa911f0aeddb812a4fd3bec72982
MD5 3cfb90053e7e819be3274d0526234211
SHA1 7035ea02ff20671df5bd3df94beaccd1649c1163
SHA512 cac3af2ef89c44d02b27a39ff05bb047c3dcd82e364077a032ada7f2f2c6f83b3d847981c5e7c1dabb1e589586cc456ddd088423f32652cfece60649324076b6
SSDEEP 12288:Cw4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:C3mlbBW8sRPEbyJlTaN8D1o
TLSH
T12A4523C8274FCCA1E67389311220245FE459CEDEFDF6A446AF89A51B1E780DE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2c0f26355cc3697fc702832d442226adc7bd3bdfbf37e0af3a586b725c686607
MD5 4ccac30567c4507535ebb404e8d03bd0
SHA1 16ac9e3905fb099dd921eb68bde61d8e00caed83
SHA512 d2cf4adf047420df90d65c74e6535783499cfd67824272dfa0d6425e940c2e33651886ca4973e9d66550b8c84c369f6a826ce1d4cc73475fb447f1579c809860
SSDEEP 12288:5O4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:5lmlbBW8sRPEbyJlTaN8D1o
TLSH
T1F94523C8274FCCA1E6738D311220245FE859CEDEFDF6A446AF8A651B1E740DE94287C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b2a102ccacdcf4440b93796247d7c7c8c40d064e5f6facebbb7a60e621112e55
MD5 7a3f6f34961ac252176e913b213fa8d1
SHA1 500cb4f3cdcfaac6703c588fac7a5b214c81bc38
SHA512 7a6b1f3067ac24ce705bdbd5350dc09da28c58522bb7677bbcb693a095d3d3195f67a2da7c38314879d22e6810b87f3508b0c200bd9371b9a6e4142866909339
SSDEEP 12288:8Vr4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:ZmlbBW8sRPEbyJlTaN8D1o
TLSH
T1C7452388274FC8E1D973C9315520201BE5A5FDDDFEB2A68FAF45191B0E702C9A834BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3f47cc195379fcb8fe05253262b0fec717663032a9f0fd7158ceefacfda018bd
MD5 387e53e0caa6e69eac9b41e17803d0ac
SHA1 39a99802b6aa77f58fa3dbdf732283be9f7a43cf
SHA512 c4aa481630fca9b765f2611ce71b5a0e2b70bcbde4c9de684de656fad5efb90bc6b4a437959458bf49967d54bf204a4a5d2e0303acfdb542b65f2658e7e0c281
SSDEEP 12288:8z4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:8+mlbBW8sRPEbyJlTaN8D1o
TLSH
T1674523C8274FCCA1E67389311220245FE459CEDEFDF6A446AF8A651B1E780DE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 97308627c2eba397ac8ebfba8feb167211f7510f8c875d7e1f9dd0b313ff69dd
MD5 e9dc296310fa1cee3513d5b66242c7ec
SHA1 c3c79d616868e960c7e29f809d7762ca0bc61b28
SHA512 f4460b9f9be2b6927395b036ba2fd6b7fb79d6695b9ca3f7e5c13b2443f450c7cc13f8d110a25a1decf255bf446917316a0bbcac4e27aa5e0eb0441a715ead2f
SSDEEP 12288:zs4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:zzmlbBW8sRPEbyJlTaN8D1o
TLSH
T1284523C8274FCCA1E67389311220205FE459CEDEFDF6E446AF89A5171E740DE94287DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 769b66c42fdf3cacf321960319388189f0b93df711a7298b1e9f29170b44c92c
MD5 669e57cf075a9aedb2a9b30c1a9eaf55
SHA1 aedd47a35e0a70f5879ede1deb8affb1d03af992
SHA512 d2133d88bce7dc4467eaa7c183a16d36b842ce1f012e78d22bd798bf597758e4bca8177a51c864593e62b9142e1cf28a557fadadbffaa478bd6bb344369012a0
SSDEEP 12288:mY4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:m/mlbBW8sRPEbyJlTaN8D1o
TLSH
T17D4523C8274FCCA1E67389311220241FE459CEDEFDF6E446AF89A51B1E780DE94287D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7bf24ae11ed026885e8c07aea5785c0619dad77bc1ea48ec08d037417d1bd9c5
MD5 894e67056360bd82855e4ade8c4bfb98
SHA1 ca6d685d0dcab2b2bfa7be2497f9bcccf1192044
SHA512 c0a409b1c0e22c20faf3b57c9875602e60c6f82625ffedf794caf4a62e64ac0d0099f6e39d94bab2618da7ce7e30be1ba4d0a3fa4e041f1d886ccb89149e0724
SSDEEP 12288:DiZwb6zzFEoS2cPvyQ4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:uZMSzFVSOXmlbBW8sRPEbyJlTaN8D1o
TLSH
T18865019873554CF4EC73853A8924590AD6B2BC5A5BB0C60F17E8362B1F333A15C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 12da0e1382f4de66a72585191323ee6bd28ca6d458de47bd0e35a7404f116306
MD5 aaa3de18f120e079a49e8fba2658326a
SHA1 aebf5d0495f0de5f971010c456a6b6b30d3d9b68
SHA512 46f06d7b92677ff9cdea38f59f77b0fc982cbaa2d467b0616001eabf06f018d00496cf7c9552746c50adc53a1cb09a77c165818edf097b8424052ff1d64de2be
SSDEEP 12288:Qh4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:QEmlbBW8sRPEbyJlTaN8D1o
TLSH
T1BD4523C8274FCCA1E6738D311220245FE459CEDEFDF6A446AF8A651B1E780CE94287D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 621213785fa95ab67a7e0fd01078c7481589337d65aa67bf7ff85843b7a01022
MD5 83baa1ec9d8104fae05afbb76aa7a2ae
SHA1 f2c7c67c15406aaffe310c41320e1542fb5e1ca6
SHA512 3acb680cfb5585f9c468316be0f4e4666549c21dd72359d6929083188fa55c81e0ae72a597b5826b8c02a1cdd7d40c0eaa50b4e2319d7860b92b8b6c16cf75c9
SSDEEP 12288:J14aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:JImlbBW8sRPEbyJlTaN8D1o
TLSH
T1DA4523C8274FCCA1E67389311220241FE459CEDEFDF6E546AF8A651B1E780CE94287D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2e7a7df62529ac9a364bbadc4a260d74a1e4cadfbfbd203077c411477779c892
MD5 16e2947baff4d5e316a6df01ff33578c
SHA1 52a00bfea9a2c31bcb6af14f82ea18a1d810121b
SHA512 635bd3d756c4729a7d0f68cc15290f43500436897d099782180ab84cec1d49b70a17f94ac15733513ca67250f67d44c1296ee13fc7013834f3b66d3035a135f2
SSDEEP 12288:hyPz5L8E4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:wzyLmlbBW8sRPEbyJlTaN8D1o
TLSH
T1F255024B339660F8D177823489601906F776BC7A9B709A8F57A4073B1F372D19C3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 aea8c8dd18f89967990ab7e603972a88e395db5023f218bd3ca75d8762f3b8ce
MD5 5370a03309b4509cba2c78b565c0f8bb
SHA1 5ab93ca3483724b61f786152cda76b92b3f2b087
SHA512 2329f2c1a821573d9c7624f4c8b549e69df54c2ac046a40c9aa2951cfa32edd5a29bb0a98612e67788bfc65d517ef18b3041b82aed3ad57b40fc51dcef6735e2
SSDEEP 12288:Bh4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:BEmlbBW8sRPEbyJlTaN8D1o
TLSH
T1C34523C8274FCCA1E67389311220245FE859CEDEFDF6E546AF8A651B1E740CE94287C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d89022a447e47cbfec9ac5258f111f56c556e7cbe8049df3c1002a2802ed882d
MD5 dc6d7023553a0da034173f82b157ff26
SHA1 581190a20dc1870db772626f32a96509e728a944
SHA512 e88b828025c55f3000a1e61ca71214b0e96fe1ada204845623e8c7b782044aeb822b56dd4830b4f9173fceb260b77427c561b8acc9834e41718c9d550fa50c78
SSDEEP 12288:ph4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:pEmlbBW8sRPEbyJlTaN8D1o
TLSH
T10F4523C8274FCCA1E67389311220245FE459CEDEFDF6E446AF8A651B1E780CE94287D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 28b8ea0c45e8fd7b57aaf1eef4abd5aaa8f7836c45d1915cd85fc1ca4d85562c
MD5 12824fbaed4c8e0937a8cf57c7991c6a
SHA1 202e6732e45a65a3021b9e638091bd0c7add0675
SHA512 98e8615b1bd62af8f04c81e9c001a4051979818f3b14b972429ae402d53d15c18de2cb454d9942a4e6cf815d4b541c4c51ecc132337d68af3b597d57c70bca1e
SSDEEP 12288:eyPz5L8E4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:DzyLmlbBW8sRPEbyJlTaN8D1o
TLSH
T14655024B339660F8D177823489601906F776BC7A9B709A8F17A4073B1F372D59C3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c6af1f9e3a40ba3ea4ead8a123d0918fd9f4e5dcb2ad9d6836fc85f51a35a883
MD5 b17e3db12e6255b3e72dba572fadce1d
SHA1 8349911cfac05c6a9555e29aa9a5756632f82ceb
SHA512 21057b3d0026f75970d562fd708a6e9daef84f9fa4ae01dd35b1cad0193bec0cc44d21110203306b13451e05103b606d96033dc82c524b1c202156a0f8aa8ed0
SSDEEP 24576:GTHaLl3z0zD1mlbBW8sRPEbyJlTaN8D1o:GT6LljjFBURPcyJpaNIK
TLSH
T12465019873554CF4EC77853A8924490AD6B2BC5A4BB0C60F17E8362B5F333A15C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9d4da29953efc87122f3338766686906a69e82d80297a66f353cd2b66b7b3f10
MD5 6c0a01780e1e864cf8a84508156ce849
SHA1 17f22770bcb9cbaebb58cb4227fbcc8bbcf399b7
SHA512 8ad9d87886fce12876d6f4bd119d2351e41d05290223bbcd6c08d2a359b1e703952a35bad283842d2a79347eb82d970a754266e3cbd34f882c792ee5e468e13a
SSDEEP 24576:x37d9CHKy7GZRmlbBW8sRPEbyJlTaN8D1o:h7d9CHKyaqFBURPcyJpaNIK
TLSH
T18175CF90F3E814E4F1B7CA3589715512DAB67C9A5B71DE8F03A8261A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c5abb47760da079dbf499f70d97a7200e37cd3b8657b3a0020e32199a822cced
MD5 f181c400b851a627227873ca1e65ce4a
SHA1 7405a80fb957cf3850276a0cc8ae8b0f454fa6f1
SHA512 4577620fc35a9d2284c66f621ddcb969d0b7e7daf9aa043c80c0c193a38d693cc501938a30a7c09b89d73c9e93d5f06d1f7e0975145b3804f9e5c210f803f864
SSDEEP 12288:qu4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:qFmlbBW8sRPEbyJlTaN8D1o
TLSH
T15F4523C8274FCCA1E67389311220245FE459CEDEFDF6A446AF8A651B1E780DE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f9a307ff9fef132a692e37e312f4fdbfca15096b23dd0138014c123e806389ba
MD5 2e0d7a1a800de8bfd068ee0fa60f4040
SHA1 3942a4ca90bb2455098b3b8c117ec827606e454b
SHA512 493474972de1c6289d4107443a76b101fcaf48379dd9b8e1ad9219614be9e39e8aa9ace79d7c388991d08701a8f3d94e1854d5e88abb99dcda2026ddd4d590e7
SSDEEP 12288:yk4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:yrmlbBW8sRPEbyJlTaN8D1o
TLSH
T17F4523C8274FCCB1E67789311220241FE859CEDEFDF6A546AF8A651B0E780CE94247D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4a6c638275df02f4bd48a65c9a95305e404cbc5745f862c91d777c1157869495
MD5 8090e0cac43d21d3f7a1980487726c0f
SHA1 83ca4af89d0f5538b1c923035ca9982396d04898
SHA512 5bc98cb53bc9735a96d62e9faaaf26ed62069e60c85f5eb47207d3c1e5fd5512ac55ab873f653dceca6c6af24eff797437892b2ff49a9ea50c03787a0f14e96a
SSDEEP 12288:6f4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:6qmlbBW8sRPEbyJlTaN8D1o
TLSH
T14B4523C8274FCCA1D67389311220245FE459CEDEFDF6A546AF8A65171E780CE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 65afcfa83ffe5b4197968cbd955d20156219fca4bfb3207e843c0584ca991b65
MD5 56fc957e4f5be599b43e9ede97c647f7
SHA1 45f911dd90dc95084a3afdcc13cd37cc597d3776
SHA512 ab8f1e843033ebd116340a316afb974cef969f06e4a77aeb2721f63ce96d6571debb8bae8c2c2a8361a3eec5eef2933f7717526310b9367274a6f766bb3f49ef
SSDEEP 12288:Zh4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:ZEmlbBW8sRPEbyJlTaN8D1o
TLSH
T1834523C8274FCCA1E67389311220245FE459CEDEFDF6A546AF8A651B1E780CE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 aaa078467bc6f8741bd2aaf0c58d8631d6ef37bf5be657db0e15b1296312f9a5
MD5 91174884eb776d895151b0ffe50bfaeb
SHA1 d2f4a1102ae1e934040541c01b28329b927489d8
SHA512 d06041bf3047eb3321d0d7b0c8e90911fdad873255b7bdefbd4b71349deb19bde38d35529f57ffc3c83e5de2faa5317ff385b7eea1b649502cf34aad8fcce686
SSDEEP 12288:6u4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:6FmlbBW8sRPEbyJlTaN8D1o
TLSH
T14B4523C8274FCCA1E6738D311220245FE459CEDEFDF6A446AF8A651B1E780DE94287C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f9ab621e4c5417c18db9d38a6fb0c499f2aee393e6d20945ff8ed3a8e73f774b
MD5 c210c94d38640785844d823d58c546e0
SHA1 211b807fe508a1f2a9c63eeda79188fb01116b78
SHA512 dd3cb73c1a9d9d29d88eab733cc4eba2fb37e662726bd806aa1b0f25046fc23c515ca31548b6027e852a818d2428e3ae3a19e681f075780cc8de83f2fd3c129e
SSDEEP 12288:uJ4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:usmlbBW8sRPEbyJlTaN8D1o
TLSH
T1914523C8274FCCA1D67389311220241FE859CEDEFDF6E546AF8A651B1E780CE94287D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e04d779b6d2488b9106bfd9e07f900e314a9887572e99af654f6369adea48055
MD5 25896f268e5fb538f48a16a5e6e1aab5
SHA1 650c789b2ac716ff47d2e52f2f33cfc4b45b21ea
SHA512 42d01755efe37f51c6e76959ac16b1d711c35b3f1c0e68d1bc3478d8421cb9a2a6acf762b9b4b49eff87c96489cb45edc27898712adce4c8abee8ce871dfd8ac
SSDEEP 12288:1z4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:1+mlbBW8sRPEbyJlTaN8D1o
TLSH
T1D24523C8274FCCA1E67389311220245FE859CDDEFDF6A446AF8A651B1E780DE94387C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4e9b454e3ebd11da4035f44c43f618dbebd8d7f53ef5e941769b07e818c34d02
MD5 5926f58f0b336b27896956c32ccc9bbe
SHA1 edfcf49029bb5c9e54ce275feebb2fae76abc761
SHA512 34ddc50e707778feae9133f9730d09586b9329f3e9d7f68f5213c132ad049013f08c485efe200e653f0d7c5dc3c29db6414a71763ffc36087717b5df2d13159c
SSDEEP 24576:kfwvok9RX6wkyAI4mlbBW8sRPEbyJlTaN8D1o:EMnYI5FBURPcyJpaNIK
TLSH
T14C85D029EBCC44E1E1B7913C99B3460AF6B178695B31C6CF029A536E0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f8b3e20f17eb4175dbb2e54ae16e99a90f102cf005ed87433ec5a5954e7dbcea
MD5 40dd9b106c6edbe8ee2d40936ff1887c
SHA1 537b08e767b8a9c15a55ad318e265bfcc3633161
SHA512 78ee84843b5530e386ac3c4617aa6b340df441a2394b955a9c4a655818253968067cf3d21eb0ac9c654776582d6df5a4959dae04b72664b38c15b5f4e7c649f6
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wFBURPcyJpaNX:SySzP9Pz+X
TLSH
T18D067C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b5c887677aa6e622fe71906b101c91b4b8110de3eb9c56c626dcf4e34f4c48bc
MD5 b83a5a02ae414903628a8e05d17131a2
SHA1 c8f7caeaf9b11d90211c21b1695fee0ced3c1090
SHA512 5e790d66e6e45edba411cea586fa051a3d586206fffe28c3e5156442205ca52c6c9960770fd6bed84065caaa03d48ca7db8005e60546fc4276d8966c578b0c93
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYHmlbBW8sRPEbyJlTaN8D1o:i47JUQj1irIhCnDHUPfF/gFBURPcyJp+
TLSH
T16A65AE1DA3EC01E5E1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 766450aec7b19baca1d0a5643766fc6ce3a98c2b872c50935e79c30a7493099e
MD5 108bec6ab6f2c5c961ed29a6a3a29e67
SHA1 b8e86bd58ffbab9c7ceca4af5788c4c48e4e66ac
SHA512 7c5fe4598d3f31543765b760b0081ff18a149aab1404ef65dcca40e5aa80a621dc014a72f10cf32fb8d363189cfa785b3edb8d5b38c3b1e1c90695f8e2b80ca4
SSDEEP 12288:ONsfx4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFio:3UmlbBW8sRPEbyJlTaN8D1o
TLSH
T12955F048D28981E8C06EA131C7505A46B327BCA99BE1D3CB67C0F53E0F756D59CE9B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 9acd5e930be86469330ce0d939f3eb07836e37375c7f4a814084ef6e3abcd3d8
MD5 65220c20d839dcbc98157141b8eae0f0
SHA1 5b25b153f9b310aa8464c2b2386eb3dea2d80145
SHA512 f0cc55c43c8f7b6528f53f4e589c96c2c9b4e0f88d4aad6e6801c9619ce363a4fb8a7cc6c6bbc01f787e835c66695ac0d8dd8367cdeef6fae0b1330503b87d20
SSDEEP 6144:LsBC2na9nQ8R9yWocbPotMxYybSU3fUkPNp3DbbTeIcyR91/BHNY43co/in2/4wB:Uyq9U3ffn1n3co/j/4wr8cy2cH
TLSH
T176252700766BD75FC6A944321E37D6CCAB707D01EE459B0772C8872FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 398KB
SHA256 fa33d68cb6151897c81ec9ba1847f461a79a80042f2c366b85d7229a82d40369
MD5 9c2b0d1302219bb1e45bfc13473c1f51
SHA1 3506b42a27c548be0f9dd7cea389835d39f58a53
SHA512 cda096aae5b5c9af762ca99ecb5c3e6524c81dc3876b4f86fe0ccde11af1dc9a62096d084103bb050a5598cead09f49cf905d51b01bbd2cbba60e6401f6d4af9
SSDEEP 1536:Tiaf5kE+GIEU7flDQYwz5sN7Jeh33M8QHpcKeh4ixelw8UPqjDtqPPiHL3:+aa5DQaN7GAl3j
TLSH
T1E3840841B759E32FC4BE407748719A8EAB79BD12AF12630737C44948C8B226E76F76C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7145e862e05cf0d75e82a6403d2b866107d44127697a1e68f547d2cabbc64c13
MD5 7cd589f898507c8501b42e11c47c15f3
SHA1 27cf6de342113cc6c5c1be1a8b77c25cd28995bb
SHA512 e6639998588a27a09a371578b971808734f481f2bfa599b94a5156ac481b5c21a3ad15befb1d9a66c61c9bf290e253d030ce6d6430fce5361963573e9908c3be
SSDEEP 12288:aM7Z4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:X8mlbBW8sRPEbyJlTaN8D1o
TLSH
T144452284174FCC61EA7799301124602AB51EEEADEFE1D4C7BB49661B1E344CA9C347CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ff91e71474e58fb516117f5a34fb55ebe66dffe56728220edc73cb61d2be0e66
MD5 4a6f2576f7e3aa1711c8630f91dd7e56
SHA1 6f7b12d01509f8014e49282ba2528080f768cb62
SHA512 93b07f9ea91777478d9939c54e95adff30333d3c7dfe1aacb28ea83a7067894c532d25b0b2b04860d285998ef1766500dc355a870ae25a32fda62e210226eb41
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYCmlbBW8sRPEbyJlTaN8D1o:Agb4mBIBhGFGFBURPcyJpaNIK
TLSH
T11265AE1E22EC02F5E0FAD2B89DA64417D6B278165731D2CF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 438a2b9aea9563fcbaccb8bcb132a7eed3143a3a955118502c086998119b52f6
MD5 6afce92b1a122019e1dede7151775a79
SHA1 e591a91794be0ed22968c528d082813f10acf2d4
SHA512 802074926287f9fe5d272fcc4c4aced99aee387b23f889c33d358967568dabcce1b1be1c9d2d2a9a510adbbc953674cf93fd30c1709c1f3282b5aaea3561c81c
SSDEEP 24576:wG88u8FpJqH1bzria7/mXmlbBW8sRPEbyJlTaN8D1o:j7ZFPqVea7/LFBURPcyJpaNIK
TLSH
T15C85F16477E501F0D477D1388A424667F6B2B8251364EFCF0BA88B561F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8095c81fcef3c6d841b0aa834f8b31f1508abef7bdf9d421cee1743993a47167
MD5 30f064238c62307e87b1f85cd0c6729d
SHA1 35dfa0f9cbbd5dff0986546ee60f04fc8366c8e5
SHA512 16c9e560fbc3ba3553af26f587ce1785cfe9e19e11f3496f3d80fbe899ee2986b0fd719349e55299278593b74271872fdc1f72217fb8d8c9c81257b76d6df79d
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6FBURPcyJpaNIK:ZG05lO43bGPz+X
TLSH
T1ADD5CF6E62EC11F9D1BBC17CDA86460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8d1a7b7318f2e948e6431ccf4873f50a8ed6678d21055ef1a9664804822ec1a9
MD5 c1193a9da7babc32b638fa29193c822b
SHA1 389751152325d583ce9f9e5e081ba597df84f5d8
SHA512 5bcbbb2c415f4db4777d6a66a25c7cd35f44b684e8b3f6aea835a32cfb69bdaaddc3431704345c5517be0dd010434056d0d0ab10203893da45904abbfda0f2ca
SSDEEP 24576:Ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidn5mlbBW8sRPEbyJlTaN8D1o:Wa5POZ3+Jt2pasx2+mSFBURPcyJpaNIK
TLSH
T1BA65BF5DA7EC00D5E5BAD17DC583461AF5B1342653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1c603bcf824c15c69c6a5be034e4c6a60794253c73be7a2a0e90f36a45f5ba27
MD5 1955d7cbce8c3bbd1764537f8c420e6d
SHA1 4e749cbd16b8766d6fb9a14f4f7685619ba0dcb5
SHA512 017aaf84013045bd115c8b4f5505b374466f9e3003f37678d0aafde6cefd060c9faef178aad4cf1eb5fddbba2426161b830e09782a4ecfe1c2308c9acefc4701
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkPmlbBW8sRPEbyJlTaN8D1o:WNc/zEOVHFrFBURPcyJpaNIK
TLSH
T17E858B1623E901E4F1BBE1BE89779546FA71786957308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5d748759e70e19105ab8c6a7b472f4a23ee41ce320de6935e36c56e726e8dbc1
MD5 e2bf259ba3d1d763e89d61eb35e3ddcd
SHA1 78dcf7bad5c2eb85ebd1d837dd4402357dcfea7f
SHA512 bd05b5c884abf2abec5bdf15c26bacf76f79b20ce2cd4cb40d8e790de8aa73889300e927b3a977ffa1fcd7a1b936e9f3b87b9d31ecabcba9e1364f12fd574067
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmWmlbBW8sRPEbyJlTaN8D1o:n8MwBtOm/FBURPcyJpaNIK
TLSH
T1AA55AF6EB6B846E4D1FAC6B58D238512FA727861173293CB5390C13F0E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9cfa29db7a198ee9968b991fab81bec4fb5b6b8db1246daf11b9a908e273fb78
MD5 b8c19929ffcb7dbf335c6405c36162d8
SHA1 dac58b0c82d4894fd36d364cfa8c3b29afb3a50c
SHA512 75aeb6568a78f404ee3eef498792e5c7758e515e8a8d2056f3ba3303abd96742efac9c92300caeaaa7d9a223e397d935eb4e708251e74b1954b2a4876fa62798
SSDEEP 12288:9HvUrBFrEjwaQc4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:9PUr+NQjmlbBW8sRPEbyJlTaN8D1o
TLSH
T1DB65E06E229D18E5E677E1398541460EF772B8665752E2CF02D0813F0F27AE8BC3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ac8f421e899bf1129ce934b49fc2fe08f48dbcb6da3f6dab1441a84c0ed50e72
MD5 d65666a5e5a2b1ddd0f879b9eec55100
SHA1 baf7b6c48fb0160757380449dfafdefb2e3265e3
SHA512 27a1b193cd8704137fa54338832b590efced7558e3efa8ccc6ea17ea181dccbe6ce7849edb6813c5dc9e7bc5a97c348e9f8a9b842f5f6b17f8c167c5b3307d16
SSDEEP 24576:kD3FHshBIYQgAQmlbBW8sRPEbyJlTaN8D1o:kDVHeBIAARFBURPcyJpaNIK
TLSH
T18D75E07DE79D04E4E57BC1BC96638906E67138AD073266CB06D481BA1F2BEE46C39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-132-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/300-124-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/300-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/300-321-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/424-344-0x0000020D897C0000-0x0000020D89A4B000-memory.dmp

Download

memory/424-345-0x0000020D89B50000-0x0000020D89D1A000-memory.dmp

Download

memory/2296-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2296-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2296-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2296-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3212-287-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3212-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3212-72-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3212-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3464-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3464-84-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3464-78-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3464-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3500-8-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3500-0-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/3500-23-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3500-7-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3500-30-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/3500-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3592-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3592-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3592-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3592-32-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3592-31-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3668-89-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3668-94-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3668-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3668-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4208-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4208-57-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/4208-51-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/4208-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4208-61-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/4368-105-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4368-347-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4368-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4368-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4368-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4368-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4792-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4792-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4792-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4792-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5584-118-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5584-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5584-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5584-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5584-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5584-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6004-144-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6004-138-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6004-146-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6004-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6004-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download