ca7a355d19a3248349772006025c29714f88b4189f253414d0d981cce9c8d428

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260717-sdrylsdy8p
SHA256 ca7a355d19a3248349772006025c29714f88b4189f253414d0d981cce9c8d428
MD5 9ef7737fa782ec96fd1dba939a14bd01
SHA1 5075b1a231360ff9e4938237fda314c5c1fb651d
SHA512 2929423d0cc07931de79bb097221a3cd6e657adec68680fe53033f4c80f414604ce4a7679dead0f98ada0a5cce95c0bd147c5102038283ef341fa492fdc03172
SSDEEP 49152:bI+w9SQ2geHU2Z+80Hb2WMn0fWE68xpH3LfE9yXxcdCdRZCaxZTpVnDmg27RnWGj:fuExy7fDXKQnD527BWG
TLSH
T1B7168C0BE7B940E5C4BBD03D8A569657FAB27849877197CB43A0871A5F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2728	elevation_service.exe
4012	elevation_service.exe
4028	maintenanceservice.exe
3680	OSE.EXE
2908	PerceptionSimulationService.exe
4484	perfhost.exe
3696	ReFsDedupSvc.exe
5720	SensorDataService.exe
992	ssh-agent.exe
2264	AgentService.exe
3748	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74ae8c05238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007364a61bfd15dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d05795ffd15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a435c1cfd15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d667d1dfd15dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f782831dfd15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
4012	elevation_service.exe
4012	elevation_service.exe
4012	elevation_service.exe
4012	elevation_service.exe
4012	elevation_service.exe
4012	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2728	elevation_service.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2264	AgentService.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: 33	3748	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3748	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3748	SearchIndexer.exe
Token: SeDebugPrivilege	2728	elevation_service.exe
Token: SeDebugPrivilege	4012	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 1520	3748	SearchIndexer.exe	99
PID 3748 wrote to memory of 1112	3748	SearchIndexer.exe	100
PID 3748 wrote to memory of 6016	3748	SearchIndexer.exe	101
PID 3748 wrote to memory of 2460	3748	SearchIndexer.exe	102
PID 3748 wrote to memory of 5680	3748	SearchIndexer.exe	104
PID 3748 wrote to memory of 3844	3748	SearchIndexer.exe	105
PID 3748 wrote to memory of 3900	3748	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_9ef7737fa782ec96fd1dba939a14bd01_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1509a743614edcdcab0bedbcbf11d3c129920b975a55e412113149c4c58f71ad
MD5 71b42d4e20edf473e6843676415c052b
SHA1 2c87b09b3f782a8c719adddc555184d8f9e83c97
SHA512 bad9decd2e95ee5ea3db6599336b5ad90c55a26004695022d96a0a044ae8c7c99452700dae5b7c4993e90e3ef0f030b6a5c0522a2cbd8e283df7418e33b07b96
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRDmg27RnWGj:o3q6sjBWD527BWG
TLSH
T13CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 47270e43807abbc44252fbd7eebb1890c40625c7ad5c4040fb30d3aedff05834
MD5 253bef4c73a0356c0d9735e90a316387
SHA1 7e25ce735ba0076912fb11fb1b3792214955e8bd
SHA512 c2c28f7518ae575f57dbf955759996a9de59decf49282185b6b663363e26ce088563c0ad0d69c3999ef98372d7fac3dbc203d778970a47ce822f843b5146ef3b
SSDEEP 24576:5XYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:8tcfDmg27RnWGj
TLSH
T1B865F129A3D408F9ED67817CC9A2C506EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7def5dfa0cea2ec924e5c857ba8018e79feeba9f9ad3cb214581dfec55bcfd83
MD5 85fbdb8104a121d52a7618972556fe50
SHA1 15b59ec451c979684e6961f0e23f4ea6c5173e54
SHA512 001ead7bb39c56e5d2fc6ac1307292f4ca15d63e29e9245439376608b1cb1b9dc2db491625e211fffe961bf1389c000d54ba5db74b506ff6172dd4332c32478e
SSDEEP 24576:y0Le5ji0hmxxrM1sqjnhMgeiCl7G0nehbGZpbD:yPji0AjUDmg27RnWGj
TLSH
T158859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d6dcdb04500646f390ec5cb4b7696aabcc6c6686193a70d6d5c510883ce67c15
MD5 0930f54d687959eeb6644e9da31c35d7
SHA1 d985a3dccbdf690d88f0a258997e7502a89fb8e6
SHA512 7cca919f5dc0c25b012213388aaa19a688f875d2a6b9b0e6cb8e3e4b62e65f5f88ae302513c603ac69a2b9183ac8f4af9be88925262fcbda627e5e09b9470dd0
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyu7sqjnhMgeiCl7G0nehbGZpbD:C/ezSC6vUzPveHjyQDmg27RnWGj
TLSH
T1D5755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dbfc1871d16528b9073745d7ad0213da76b5c1f0c02ad0d17562741c686aa73b
MD5 9faa325c243d68114d1b04235d2a5786
SHA1 a23c50417f86cfd23905160cbf953439671d5962
SHA512 5aad04ba02e6f917378196fdc908359d91e4903e46bb9123de5f72835203953b51590c21e7e5e3a24d92b83e8418fa08153688ab3dbb74f0ce1898682463f49c
SSDEEP 24576:xVbqPb88hv/l+YisqjnhMgeiCl7G0nehbGZpbD:xVO88hXl+3Dmg27RnWGj
TLSH
T145559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ad952d946aceb8d54930d408654ca49ae7747bfe5cc8a157e523e7df0d3a7539
MD5 5c9c601c6096bdc1bd1d30432e6f3081
SHA1 c6b8b4554d58af29144c50df16d35f8e82865723
SHA512 abe9ecec97aa9ba6e67577c8b478c5e9a6ca9e43b540832aa2a790a1d78a520eda6595043e57587802f2f34b84ea99b58cacc1caadeb1c8570701777adf85df8
SSDEEP 12288:/LZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/LZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BF964C50CAEB7608B5C3E9F15EAC137E56982008536AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2366e20f7596e5ed294461c36b21feb36f449b6809ef5e10f80b9c1151a107b4
MD5 1c046c5f1bfceb4d06b224ece05cbf5c
SHA1 6dc93955fbfcbb7f629ac5fa9facbfc529e40a65
SHA512 ec4750e6705e36065318dbe2bd405f39aee2db914bf97eb236c74833df616ed0ff4b2f04bfc794e68907f2865d20827c2959f03a890dcec64168ce4384928abd
SSDEEP 12288:ZeBNUbTVO86UKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:ZJIUKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17465CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b539b4388cb1d0763a68e1bb060e91f9df6ddbbac4fc6b5970358eb9fef8b9c
MD5 a6e2ada187535db10f1c6c49325b4d98
SHA1 3da25f978744c3792d6b75871549eed2a989a37e
SHA512 3bd656ca83dae19b2f1b4e76e4ea1c098692105ceab4b353dc971253798265e7387a9a8338592d6ba0a093b32e9aa7b7cc6d8b3fc00f9dcb9a4ccb60b1a7c2c8
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:8QvGAdlCEL8c/DRNw5C/D527BWG
TLSH
T18A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 308dab9b66ced50c15bf31aa209f1196c9f661c2f4279cca8c10245a3074a01d
MD5 5753327a4c9e515a15548b75acb44b89
SHA1 13c5e96778f1a4f19e3e1210d610c45f6cc76226
SHA512 d3f0361ae2256502d9d2d3c20f7f5c1ca2b634de3dea9df272ab1b0ed703bd61fb18c635d018b0cd949c7b72bd7a1af2d957f2ecc39bc2bd8746dd82f29a1437
SSDEEP 12288:MAwSfxL/2Dc3RDLLmt0LDQewsAj4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:x0ewsAj4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14275E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ee0445e5b8eb58404be2f69e1b8c4d48cda9d9df8653e61e6662e5db4dcfc3f0
MD5 9343e571e6dc11c70822bfeacc5da492
SHA1 c6b2049cfe75c6b4f6ed9f149a6c5f504a11afb6
SHA512 c068ad40e29b1213be29fa373270f74c1cd40378ae3405135f71f767edea0486e3745cf18eb180b0424bd03947e686665a3eb5c70aafb3e178eba001e9dc3075
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHMVQBWG:vUEtQevvqc2W1cpV2tI32TB
TLSH
T15D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 97becf31a3da218c800f5f19f57202cf4c5e565771abd7dda39cba571194bffd
MD5 cae4592d5b1d4b41f6ce0384b263e5de
SHA1 a48e0bc84edae78a8bca68b2934a2ad0f4fcab12
SHA512 4205e0d9a6ef8f6f671d07f1ac97ea1e5bfe0be6a20d87da6d09b122d5bbebbd8e6dda612019536fd47ac71913c6215f5fdc6fba38c630bc6ab1c5617cd6c030
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zEDmg27RnWGj:4oquVjnmrD527BWG
TLSH
T1B2D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 40dad69efb2da358e45a0009e96652db65fad2a7bb6c9f8cfd69129d7fa69800
MD5 b1bcd272e4baea9bcd47e01841205d09
SHA1 848d9dc7d6b9841ff557f190d6dd71e02bd94c40
SHA512 05ccde4a68fe24e82a0853c1f33138a20bed0fcb5e6e136ff66d5f24c2cb01beb542b3d669ace656b1d01d266a4f2c0d0ec83438756851deedab591787587eed
SSDEEP 24576:/AhGL3IFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:/AMUFoiq57Dmg27RnWGj
TLSH
T1CC359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 89692e674d34e763a24a829b46003590f65a778fcb0e92589621c09e86ab7ef5
MD5 4c69241cdb62b387a68d72c62ff023a7
SHA1 52e86d73e7797c1bf7a467c04900135c44aabced
SHA512 655d1277dcacc2432470ddcf57b9cc4db9c77747425633e7f9b386c8adf217700bb5e8c5bc4a70f6bc56e5fdc145d5082d0f763a36ffec2ea44eddfa9a8ddbe2
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twu4OWUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 45e6ca26c1d9e93ec17f5b8780d28dfdd2182d134a68f033fbd4c2e99a83019f
MD5 f1e4821b2c8a1bed6f55d296b3485f05
SHA1 3afd493c508a722ce0a1004e305d8713d00b98f3
SHA512 4085101e133a0331a7ba372f7d4d21a57890e999a2cb1a9420c46b5b794dad532ff02c99afa50502dbc8ac1fc6934175853afae6c7fbd4d8008aad27ec3b5b7c
SSDEEP 12288:LeZ1IyIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qZu9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A5512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d2a09c183303371880e09e3d2a59abd6031b963c3994fdb407dadfde7e4daa93
MD5 99a8b031bc3d65b5bfcfe9adb40088ec
SHA1 7a8fad856658944a96c0da437d2c9e520247b670
SHA512 04bedaa072c9eaf543727b6f3d8131feba57d9a6d18f87240fa165703a6430bc65af251575d45762ea8586a8a05d64f7c57460c335e7ffb58db042cfbca3b836
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN3KD527BWG:CQyiKa/X+PN6VQBWG
TLSH
T1A2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 89a11be023c2160210b19509db8e2943cee0013a30ddb1e8bd59e65096dfc58d
MD5 d3c27a2997ca75db1bdc438ab62584d4
SHA1 e62b9fefa2955378b8d2446bd368972d2410a8a2
SHA512 fd8982e5a39f82544d3f8877507291b082bd09b9534bf9b2ecc36f5495484aeb7fb0ec4ba5d4a8b662b0cce6bd53f87f39b9e6d8b818bd00b6de6b1fc12e600b
SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN3KD527BWG:7QyiKa/X+PN6VQBWG
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 56d9a48dc9cc8ea38b3fa238fc46f8351ec3837ee4827f5c4c498146210a18d4
MD5 c18cae95e176f5d48b53a66c9aea03ea
SHA1 0281fd9666c1716e3ff57b16033cc572c4ace258
SHA512 fe15ead4ca0a4ddcb396077ca52f0a7a7de25832961b270e2e5078864c88afabf4d4a090089b09b06a9a3103afc454d4dd44ad1c54e828fcdac12c0837d6d0e4
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tsqjnhMgeiCl7Ge:f68Qg55nhceWu7PNU3/UDmg27RnWGj
TLSH
T1E5B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6020a5b33e45727b6d67f7276d2ffd298dcdaec1f40f21b8cc9ffa153628c18e
MD5 abc7ca709fff2b22aff344c0abf70866
SHA1 7802fcefe001fd4cb211c1f71a4c8e86a643e5ca
SHA512 2037017836d7b266051bdd973014a8833813b386eb10832caa527bfd0cc6582e4d618d870c4fb0d4b7f5171c461d54f7bfa8d24552b3fdabc40182dff0372f7d
SSDEEP 98304:wy5112gYy5azzVvt69nLKnhZdD527BWG:JLIHEWhTVQBWG
TLSH
T12F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 34fd579709174cbfaf68c01cce1e2f2587da62b79831abbf3a3971498d5a38b1
MD5 b2f99840628a57864ee87717f6e0e478
SHA1 187dc0356f18fc2ddf54e22b6cd3d2f30174dfd1
SHA512 ab6fdba41c0ec095aca295a4cb2c2ac51e666950edc1da08cf7c6610eb6add7a90fa4c56e5683eddf539444b1c838d3c7ff5470c1b8704acc0fb62d2eb03403d
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGDmg27RnWGj:3u6Jmdxd2dGD527BWG
TLSH
T1CCD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 83d29148201eae853199a71c24197ea27a264f066a7a693207e72fdd255467b5
MD5 66cac2eb2657ba76441977b9f31f1542
SHA1 c21a8ab4e634ea0e0f2407edfdc24dd1d383afcd
SHA512 b5cc0770ce22e69eff4b355c8d093b9165b1196cf42d91d0ab5089d1279d1fa521a383ac8059ab7a9f613b7618dfb4b5951985d6378ce4f98e8709c0a32fd727
SSDEEP 49152:K1hpsNoJpF1A63U44CwH7R4x+Dmg27RnWGj:KmifPWRrD527BWG
TLSH
T1E4B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd32ce5a5ba67ca35e7e9fea11c655473644c9ec939be5ee364406903630e7fd
MD5 893799cac327bf3c4abb7e5779b7d075
SHA1 20f0f20a83253ef2170a1805b1553f3b44d698c2
SHA512 caf6da45515c868e9d9089a24629fe7cd699c0e5856f21192bf831c6b1f2ff72d44c3ca0af12b68580b4d464ee71fb6e5449175b9e5e461c367b8d7c0e1e9cf5
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqhDmg27RnWGj:B5dKii61hD527BWG
TLSH
T1E1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c4181ee623508ecd05323488ac85016b5a0c88d6a40d9b4179b714f994aa71e2
MD5 ab596dee515e95ad284eb26468416899
SHA1 3d5468b47b56a4fc84075ca15d09cb55773a8037
SHA512 753f2f64a509d454cf51191b6b306f22a5ef96e34d368028b97caff2e4afe2522af142ce0ecb81cb9b774f5fd691cb135db0143256f59960bfcd1c5f0469586f
SSDEEP 49152:HhtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:WX2imphHD527BWG
TLSH
T16A95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 42d05aef7c328e028fc23f25f55fac6919d983fa9101605ec6c1c929c3a52c39
MD5 3b639242963897b0969f84309ea84f11
SHA1 2b07bd0d4e00450a25e996c469b4571bbe940201
SHA512 c2e7e5cbe8102a147362a49bdb7ef315be91073529ce7ec026ee5f0f7c4f3844e5ced58980aed2a1ac736e39037554f9cebf71cd1b69d65a8cca98328d3c0f93
SSDEEP 12288:oBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BF964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 09ee458d985da6fa8e5387041f3483c14104d7629c4703c97a2359fea5dd4241
MD5 7100a589f43e20e0bf3bc07617d0bb8a
SHA1 4550afd3e14611420f667338c89c262924cb806f
SHA512 739d3a3aef0baa35a91112838366ceb5aad5b932728b01e2e4695413802b6aef981ca089a32e3197622ae44f3506c3bc6f56c301dca9bb90f34c058426aded70
SSDEEP 12288:VsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5f8d931b8e9a97c28d850c3f1e92e192594bb361df61d34109fbd8214eb36da6
MD5 0e2b0d939cd04f579da00588b5da9bf4
SHA1 4eca25bbc65b90b7f2fa7aec257cad1d18f80167
SHA512 791a8aa0212b69ca98457849f557a168a5b465daf994c5b697379dac82e31c5c2db277099039f3e42b86fc1672115276130812d9907bb6d6b373900329e54e87
SSDEEP 12288:7SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8918e084edfdb2fcd92e734fc50c55a8b65761b0bea6ab08595c072312e920fe
MD5 741fb6b747ef02c7700224f170d156a1
SHA1 aec2e4f35b2f0ecb589f6d887f36a8b41b89f57c
SHA512 6f49c831760daae62b609aa95004829959c661880be22a6763d92d3cfe1ee884bf971ce1859dffba7f026c2b7432a697d82d2607d8a12a71e01e7150f5473d52
SSDEEP 12288:VVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10845236F675C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 91dd40a346dc5f1d844c667e95b5e5771628ec87ec90d08d5dd4847a2d551ffa
MD5 f7961e37283428e18be7f179be27af24
SHA1 a96cbdf78896040918aa2dd520591c61457b6043
SHA512 4fca95e695d8f79770810a23492c55a37d053d59ca5b565eb0ad1a053c3630b1bc90242379d258945a29528888507c33153f5079a7b6d3e17611567204e4c472
SSDEEP 12288:qPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BF964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9F7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c31ce177d6375aaa346082d6cd9e94dbeffe543b69537ef116f39b287c0e3b10
MD5 59c7f3df0ab4d72b8d1b8211301a1e99
SHA1 e65060d6b7a6bccb7b0aa6e9f1eba7b4eac569c2
SHA512 6940d933229daa3b7a1b1df99eb0d09673c9390393ca888ea2e997d6d1571151c96e6b3fc3eadf72de98a60b69e485275db8cf64798c9b3195a6b2797b8e714d
SSDEEP 12288:jgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 96dce91f133ffaf458b89bdfcd4947abb7be33b60751fe8603b4205bbd1285e6
MD5 3538dbe974770ae4427386f37e10acf4
SHA1 4ac0319224c08cb7f03ccd07c13fab5813138f8e
SHA512 b199761050a487116079afcead7661fd763d8f26d5493a465d96197b20f50d14c7b4857c16483562c37d64eca2d1225c9e4f877aa4c8516e2782a1373189d2f4
SSDEEP 12288:tEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BE964C41CAE52644B5C3E9F14DAC073E5BE9200493BA9B7CBAF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2aca7dd6984a55bc80d5aa41466a8df1ab16d51d08848ae40cbdd454d422292a
MD5 967c8c03e03f7aa178994f46ff36456e
SHA1 aac9acc23557b307c080e3614d569b4dffd7b965
SHA512 1fc73fed720cedd83f1646e81fc835edac962e4ef3d4245643d59d9fce1bb1bc26ff70a5fa44942a468a159cf507da0dfbf4d1f8ea34fdcf81f4cf5a89e6d3c4
SSDEEP 24576:wZMRzFVSOMsqjnhMgeiCl7G0nehbGZpbD:wZMRzfsDmg27RnWGj
TLSH
T1206501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b3c948c09b5f03399d51b4cad32271fead348d9afc07528991524fa18361787f
MD5 d67368df50e371f9d88ab6cec7c5fd7c
SHA1 cde493f8922f399ab96d35ca37353e4e144f9f06
SHA512 d5f680ab951612395c08bd6befef309ff26700d8db5cd59098e0f3d28e4a6d3f7f0ecbcc7e307870a925a250cc91d8f4ba6e902f41745a5c5879d72902c61ad2
SSDEEP 12288:6NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BF965C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c36f335700717994a3111c6c65c8720a2e31cc5015fd5e48b033c64234c1dc07
MD5 aff46378fc8e7376565d1b831cd7e31f
SHA1 8f3dceca7bae98069b11bb116992ee20bdb8b2ed
SHA512 3913adbaead00e98721e4b2aec4e3c2a241e13287306b1f91ea870ebe8e5dcc527564e2769753d147d42ba9c27b16840f935655e94891c3f3fd5f8c60bdc51b2
SSDEEP 12288:jpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BF964C41CAE62644B5C3E5F14DAC173E5BE9200483BA9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4c9aa3648a5b162dd68bdc3c96cd53e09346a68b3b18afc4869ae33255aecf44
MD5 f6d2947cad991d8139e037f24fde38a4
SHA1 bacdecff7154e1988463135a29ffa99ba86191dc
SHA512 7c35832cc4d0b978a623ff00a7d8df02fb1631741d58e6ff6d8869a09a9b176e083f7a87ca2461d3843a1ad8b544e81d231d59d877e84bf7ca6cef0f9dcc2109
SSDEEP 12288:yyPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5c2a4b1214b80e80625ebe51f44ff527035305d88f5efdb943e95d81ddcbc27d
MD5 f8726e33ab4f79a3c534dc1b868cc289
SHA1 b6c15fad0d5e790d2a9f28826982f9763c8d789b
SHA512 42a1ca8c2482914110fbfa5f1c8ec78f16b89ffaed6b3c887b88e7b3d56da9179c7ee1e03a05cbbb06a96f6f148e46081b87969d1fd98e8061a840d42cd38018
SSDEEP 12288:gNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BF965C51CAE52608B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 38ee11317318f0f33b7cfbb8841260f088271eb710bcc6aaf0fb3e7c7d7d6625
MD5 b5adef5b8deffb36329296b14984013e
SHA1 3d74d0e9bf0832741303e69a790afd318933b57a
SHA512 251491abe7326683b19f114ed7fa46e123e2848fa2edb217ba939fca21d6943e7ebd53f8addc6845156f2f89510c4313dcd766cfb34e2e952189e590d9dd9c9a
SSDEEP 12288:WNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BF965C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 dd7d4650ce62a5242a71be1f7a3238d17d0799cd96db22658e79e55514625e3c
MD5 1fe8f7dd7f4a5925b6bcc2ea9ae39f92
SHA1 95430915f35f5a65ff91318ad2c12695539bf6e3
SHA512 62ad139a6c4d29dd6d8d075e40a8d845be13c635fb1dd0dd5d76df0e83aef5cbc2b0eb895c17b8f6ccba64582d627a4e9a1cf8998a8f30a43647d5d514f37cb7
SSDEEP 12288:4yPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 aacfc42a4e4e54903960625bcb82d35039a4faa3348ef6d4e478369591c14961
MD5 a2fb9dc30b0c59364fca6961160e50c0
SHA1 e7de74e124a0793d649deaa039b8cf1b43f7433c
SHA512 52a1f5b2d3d6218a0e24647575be16be5af5e703696c27ad6752cff13cc47f4868670ca7187832e6cccafc6d064826c800f52cc8452253de2ff522edd031a20b
SSDEEP 24576:BTDaLl3z0zDCsqjnhMgeiCl7G0nehbGZpbD:BTuLljvDmg27RnWGj
TLSH
T1B86501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a713eda4fcbebf80d7e180b9836ef21a5c7d9261cb1ab47d0a27e42189647bcf
MD5 f3944e4012934abb0108b4529c213e1e
SHA1 f1faf1c65f48fc939bb27e957d496131c8a99b63
SHA512 12c81d245c398b0ad604c188c20795e19527376cabc806fcdf44ff6f3ef0f8cb02721f2b17b3e07f2d4ac256bad4f4b7ddc9ba66cbcc274a0928e30c3bbc3a0d
SSDEEP 24576:P3vd9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:fvd9CHKyasDmg27RnWGj
TLSH
T15475CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d8e96ffcb87ad41fbbaf576b25ed7386ff2dbdd9a95b8d85c138ee9b074a6754
MD5 dcba6ea257dbe58f716943a93575849b
SHA1 135f6094435fdf86fc1671f3012869d9c20ab6b8
SHA512 faffcb16387a0fe51734a66dbc73a84ad0cf72a1abd34fc29721387e72ed677e7b5e325efe0b42902b3397c11ed63973566f1de548fc97df2920f1e659fd3a73
SSDEEP 12288:vyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vysqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BE964C41CAE52648B5C3E9F14DAC073E5BE9200493BA9B7CBDF7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 acba84cdc0bf7f8f8016f4cbfaa25ecafcaaf1bc1d270847c7e662b55dea1db6
MD5 db23d3b076affb6fc2a5fde383267a7e
SHA1 015c795b85ecfa9f47e4babd243522f36d7359ba
SHA512 e322b5bad8341370f40d60e551db01122a95442e5ff932a0f513bef4c46dc3e65543e24dde6edfc643a05e9909bd23981089b39b6201ef44d0e82ebf74dca45a
SSDEEP 12288:0oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BE965C41CAE52644F5C3E9F10DAC073E5BE9200493BA977CBAE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 034bc433b054a8269ec1e577a60d12b75308ffccb5aa30153f90c3c86d4f5c56
MD5 178ab3070d0605a7a36d3c57a20f3224
SHA1 7ab82f0909bcb09fce34198e73abcafc5778496f
SHA512 1c534a8e3b1db1392ace23ba601bafcc9b9fb752365267d70e2f8e52cfc108320e4719b76573c183a48631d34562db1f0404db6e3c62848c8b4ac414c28aa787
SSDEEP 12288:VTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BF965C41CAE52644B5C3E9F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9ead236817865e25334fa21189fb61cbd60ddcaa5326e093e608ddb7b1f89c0e
MD5 3c66d99230f28210bbcc368ab25238e3
SHA1 a8d582116dc835b3f847bd170e4eba189ac5920c
SHA512 69932c171ba4a37c749d88ba6d8ac2a776106793bc73116f4ba31dd569fbf2af9521649215b8d32f43b54a995122bd7d7e980c0cbae6dcdac47799cdb9d112a9
SSDEEP 12288:XNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BF964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 512f811be7a63632da3cdc53318206b17b84e71cc1a9933793e517df1491dc29
MD5 b446ca07506ddfdb848d536876e21027
SHA1 cd4d44b228da34176c207356e114c308571b35d2
SHA512 6ea5082c805dc35a8d39b33e54274be20526d23ce6400ba26bac9c3414d4f2a37f985877c6672d9eb380a468f9192e1da2a6cd91928b4e430d03ea9c02f74457
SSDEEP 12288:5yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BF964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f84ac6d0d5fcdb16c64206534caec147c9e5d5052a494123a17c4ed4cc1f176e
MD5 04b406d89d0e5335b700326e76dc421b
SHA1 921931e2a567d0903cd0df318fbef08d5a2f65c7
SHA512 84f4ebbda7307546e3161f61b98921dab43e700562c5f1aaa0a68a3b8d60902a84f59ead1e8110982417e7e060cfbc9feba9f848c8248738b70ad96bf04ce9c7
SSDEEP 12288:VlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BE965C41CAE52648F5C3E9F11DAC073E5BE9200483BA977CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8c983b5e9ace976eb28ca2cc398f9701888fd7cae717290d6d946e0854e4f410
MD5 420970c30f6b02ad7fd02c465a4ec629
SHA1 1536fa30a0ff520a835c153c13f395556a19f58b
SHA512 0d4b5c3364a5481891bb66cdf50fcca1462e5241a89b6bcdcf5e1eab937557c3fcce2d26248591511cd386217b3af1906ab919ff4c500e0473778d2967211a98
SSDEEP 12288:7PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BF964C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 dfee3d8230659da192a08d5465f859b12b2d2eec15e483bd0c501070208c9e33
MD5 77a0542284b33852566789b1e4c49548
SHA1 64e171e4009ef43639aa4ff4bd3eaf07471178a9
SHA512 c721e12b8c9b8b209fa04f0d18877d56735a757d5d3c983ffe65a81785d2125538bcf199ca6dd9573c3504cd68453946ee8888541e2deba9a383fecd69d6abfe
SSDEEP 24576:ufwvUk9RX6wkyAI5sqjnhMgeiCl7G0nehbGZpbD:2MnYI9Dmg27RnWGj
TLSH
T1AA85D029EBDC44E5E177913C89B7860AF6B178691B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1002198def096507e9345181a34b51cc1f32a950c7348b86ea5ce824cd97b732
MD5 c5d59c344b970146cabcb209b2bb5d52
SHA1 ce93a7ac0a9666c3bbb7dc5e050936974b35915d
SHA512 373cdfd2b1185bca36b732db30a029cace3725c1f89d6c86bc0676070b837b7844216ed006ebd30234137828784883e1585e85f82cf3349628359dd2b661a287
SSDEEP 49152:XYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:SySzPqD527BWG
TLSH
T186066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 445a5ec5da7144a24589ee8814dbe6e30d3fd1a72903c5c27e94e1c860b429e4
MD5 976b2cb4b5a1e94b0c4b03a294e2148f
SHA1 b6e2eb7d5f8fb11cb8113e64cca81501f3bab7a7
SHA512 bd2f6cecb0518fbb0d511920fd60546d957d65d028c7461bed88e5dcd7e5c45684a472ed67a61923bb93c7b89b22237006e4df72bc56dc28df0df0eb88d11669
SSDEEP 24576:A47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYcsqjnhMgeiCl7G0nehbGZpbD:A47JUQjTirIhCnDHUPfF/CDmg27RnWGj
TLSH
T1CE65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ae03a75c5f513a7e9963afc052c928bcc70e6cff7d678b9d26ba51f7a555def0
MD5 1f64266649998f98fd13be1d6b1761c6
SHA1 205955b38fd3fd6a503aa11e4747eaa931a080e7
SHA512 9e7719200eeebb744716a249dbc55780817834c992c1c67496abf4de285daec9810572787ed3d6edb46723b34b6aff2d6103f61b6b3db01c2d76d5c463191bf4
SSDEEP 12288:wbsf9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19355015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 07ae89602b7fab9d5e30a9ed7afabf34e27eb9781868ea00d53cc5f6ac350f86
MD5 81ecb7cf9c6dd8008556b27df97ee2e6
SHA1 08eed92bc9fa4b5271632512e21c8ae04de7c0e5
SHA512 b8bd2be512297bcba52ae989d978731373ec62009b9b992055baca91c165e32914e0d60a12b29b69a4baf0e84cd62b4acefb31e1368e9d00e24e1bafe32fc04e
SSDEEP 12288:wpjy8cy5Nr841psjg7DYLKQ2SBN4MC1vUpARM16d2wCz:Ujc/4vG89Q2ENLC1spARMEl
TLSH
T188551850762BC75FC6A940325E32D2CCAB707D05EE056E0372C9873FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 aa8790b80837f1dedc47c1e57899f163364768fbb4719357668b55cf7232d102
MD5 6bae99a59b58c3d6522e706f5f4d8ce2
SHA1 e13d219ffb7ad3b4d3a62c1b88ed89863eacf842
SHA512 bf28d12d8c55f33a574daa2f43931a2ce8f156a9d1346f3e96c4f72cebb9931d179d2b5c800979ce0e123d63cd5a1ab8a24278a30891d63e39efe70656bb790b
SSDEEP 12288:prarsPrrrWlIr6N4ppaGrVyDVrciVuXpn2nbtKrj3rrMr5RurwWr586oclJpDe:Glz8paxeiVuXp2nbtAnKRsLoAq
TLSH
T19165E8819137A39FD5FB603207299B4CA774EC02B7096F16B3C8053AD86A725B5F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2bc86f6f871fc1209c0e8a68e7b43bfd0d02ddbf94f722134d008351f3109097
MD5 05e061152dcd9d46b6330960abc21368
SHA1 65d041d4c214c3ac5f29f3fdb274a881ba9deb93
SHA512 bc0c81ea2baae9cb64352b17ec194f788c5d7803ab957774439068d8f4bb8c3c0a1e6db6e5f2d652a97009afdf19c40cbdaa01763c5a985ed3b2f1f680fc388c
SSDEEP 12288:H07VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC45237B934C518AE93609B482E9E12D680B7E669F1044C3BA4778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1b914a7c4e4f3177ea012b394767b4871da4a7bf2dd8f99de200e025a5bacae5
MD5 1e9a367efe2b75bea841bb37c6138ecf
SHA1 78fd0aa26f8b89bcd86d3de368e8b8cc25e6cf27
SHA512 ba1759af770febf87c8a66cd327e0766d74670de4e370ebc062d2f298622fab753159ecc62644924ac7e711e5b64c9993da5d53d8359333a019de445bc30fda4
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY7sqjnhMgeiCl7G0nehbGZpbD:egb4mBIBhGFIDmg27RnWGj
TLSH
T1E7659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f074b587b4b6b71de1ed0faa57790a1aa7b089e14dacd295c0931cc1df320cdd
MD5 eea13839b76b2219c9d10803c32c21d4
SHA1 fd25741d8d233ed39606bdb724b389c3e99ccc12
SHA512 0624f8e437e2f8db109243159f9585dd45f6a0677e96057dbc69f8545d3cb33fab9321d0bbaea01fe9a90bd60e5f31f6e22f1ebc5d77da5943131c081c9bc011
SSDEEP 24576:NG88u8FpJqH1bzria7/mMsqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVea7/3Dmg27RnWGj
TLSH
T14E85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d88a0ff47e99471ec998247ab778df133f7d6c3a2077553e87005d3a98493254
MD5 5093291a8f9c6aedcd30bac9cc8748ca
SHA1 32888b86e186171ff1557d124604b093a4b97c8d
SHA512 c68b791f5cb8ab6846b7c2700abce95281a3a043eb86c6a5e44f986a7ce5f3786a3c59fb46fc33aae876b0281cbfb198d0a2756c1685051ad40d33b1fcad6578
SSDEEP 12288:dHvUrBFrEjwaQwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:dPUr+NQwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 da745147e1aa846ec1fb9f7a1569aa012257e6c06551f946f6ee62a910d61743
MD5 0e7417b2590960413d8053922e0220d5
SHA1 9b5448ab7e001e414e42c27770b97b404d85700a
SHA512 d5baccb56f7c391fefd5dbc329f3bb616f9c9dfe2f24bab5673c3a7190a43949f54a381113718a240f226d198b474da1db439dfce24c61e15a44e40cb6694626
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:iG05lO43blD527BWG
TLSH
T13CD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f257a522d6cf2c04d45402cf60afbcf135081ca402d0b321605e53af84752051
MD5 204df54f51b0ddaca33570d32cee3c7a
SHA1 48b82b2ba1258b202a02883daca32c5df97b5e72
SHA512 f63b012c0cab073b7d5b4d600d00a22e04a545729885b12114d8bf8a0118226350a57764570be817d64067a24df7caee3a0e5fa85c6f85f7d7c85698ea3781e8
SSDEEP 24576:Ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:Ma5POZ3BJt2pasx2+mUDmg27RnWGj
TLSH
T1A165BF5EA7FC01D5D179D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5fc7b00d9a718a7faaca0e81bd0243a8eee6bf727c6dbeb8b76b092b52eb4f11
MD5 9add61e5c23b84673434f3d6b4f565ee
SHA1 4cfcf792937097292bc23850df2c3a638227c232
SHA512 cac440fa6eae7817100632a8a8856d2bfb3b50bdba452d5e66020d84920959e61d1c66cd9638d8400cdb45f3c8cb61352d74b76a14413a46c1796a9a84e747fe
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fk0sqjnhMgeiCl7G0nehbGZpbD:UNc/zEOVHFXDmg27RnWGj
TLSH
T15C857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 76c2984514a463488d708fc5987d4f45bca8bd543fcca46ab73e1bc4e74e42f3
MD5 821e9b09da48e03e9b0ef93b9f4ce39d
SHA1 6ec7f617aed039e96c6fa6d8e8a6b695b1c9db00
SHA512 29cdc26db65621d7613dd28f806914f9fb148bd3d91d087d4fe5c9d7c0ee06a0d6d53995162b5130f94caabe3090289c082c8a1a3750e46132508cd0d2f0cbbf
SSDEEP 24576:OTkNvNnaFeYhJNtmZBmOsqjnhMgeiCl7G0nehbGZpbD:OTMwBtOmiDmg27RnWGj
TLSH
T1D455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0b94e3925f16db0c3f3f2ff48ea806fabccc9770ecf40baf54809e9250d83f59
MD5 44ece1ba0a28448648a2d0edcb7abee2
SHA1 1782d0bdc0509d2432782e88265abe9d5f13e59e
SHA512 979915be956d5b52cf1cfeb5d2eddf274667546a8a52a2464beed74b2d0b4da22dfbc98986dd81f6676ddbb81b3ffa66b745dd7e89b26c13cd90c9c5a4eed074
SSDEEP 24576:3D3FHshBIYQgAhsqjnhMgeiCl7G0nehbGZpbD:3DVHeBIAA1Dmg27RnWGj
TLSH
T16675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/992-319-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/992-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/992-118-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1324-36-0x0000000140000000-0x0000000140405000-memory.dmp

Download

memory/1324-0-0x0000000140000000-0x0000000140405000-memory.dmp

Download

memory/1324-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1324-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1324-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1324-32-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2264-138-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2264-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2264-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2264-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2264-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2728-30-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2728-16-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2728-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2728-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2908-298-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2908-84-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2908-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2908-78-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3680-66-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/3680-282-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3680-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3680-72-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/3696-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3696-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3696-332-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3696-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3696-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3696-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3748-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3748-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3748-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3748-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4012-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4012-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4012-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4012-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4012-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4028-61-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4028-51-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4028-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4028-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4028-57-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4484-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4484-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5720-104-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5720-110-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5720-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-316-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5720-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download