caf3790e4ebfe489ba0ee831eb9ec28e8cc621c3e3cad9e213ba9c08ddf6ad37

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260717-vwzsaagx3j
SHA256 caf3790e4ebfe489ba0ee831eb9ec28e8cc621c3e3cad9e213ba9c08ddf6ad37
MD5 1f1769a22c13cb4d89ee2dc6fd68a64c
SHA1 d0b0d28deef5fbc4be64300ffccf98d3a3ee6cb7
SHA512 df18f7c88765ce1f3eb09e383d320dff017a709f516f974a165ba1148ef6528f1404c070e2141d25c379115570cf2d7054c84d3750abd25a6400444ff4fa3337
SSDEEP 49152:yoQynEIJx6iEdOXdgh73Faz9wLXoDZoaLOGpyE5QeaXTMc8aTyuPjSTUEj4MYPV3:vFAeaAAVl
TLSH
T1E9267B1BE6B940F5C0BAD1798A57951BFAB27819873297DB4790431A1F33BE09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4956	elevation_service.exe
4908	elevation_service.exe
2612	maintenanceservice.exe
4168	OSE.EXE
2644	PerceptionSimulationService.exe
2120	perfhost.exe
1108	ReFsDedupSvc.exe
1292	SensorDataService.exe
4796	ssh-agent.exe
1816	AgentService.exe
4072	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\89efb248763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-17_172111_1912-4952.log	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d89be7f41016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041963cb41016dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008978d8f41016dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000123be4b21016dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1912	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4956	elevation_service.exe
Token: SeBackupPrivilege	1108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1108	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1816	AgentService.exe
Token: 33	4072	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4072	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4072	SearchIndexer.exe
Token: SeDebugPrivilege	4956	elevation_service.exe
Token: SeDebugPrivilege	4908	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3432	1912	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4072 wrote to memory of 4416	4072	SearchIndexer.exe	102
PID 4072 wrote to memory of 5760	4072	SearchIndexer.exe	103
PID 4072 wrote to memory of 6048	4072	SearchIndexer.exe	104
PID 4072 wrote to memory of 4632	4072	SearchIndexer.exe	105
PID 4072 wrote to memory of 2344	4072	SearchIndexer.exe	107
PID 4072 wrote to memory of 3300	4072	SearchIndexer.exe	108
PID 4072 wrote to memory of 3416	4072	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1f1769a22c13cb4d89ee2dc6fd68a64c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1912
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1912" "1448" "1320" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:3432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4c3107ba6b4a379df34de5873600fa05571adfdbe4db9a60fb50fc685a509a58
MD5 38dfcc1437ab51a275e0ae1cc8c3ece3
SHA1 8eae341591015dc05260bc958f9480ee3e4b4d9a
SHA512 9bccf92776fa4b892872e02cb7e45d972b583e7b494b46b74016be6d1c2fbc7ea1fdcb8d4bc5cc5503e331e6c1717bb87af20903ad02d132ec0c33b7a2772792
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzj4MYPVyGL+:O3q6HjBvVy
TLSH
T10DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dd01a558ca87136737cfc90c5e9b86e392d9a3693d100cd1c71ed224ad42864e
MD5 5aa6ef814653496857c90bddd14491a8
SHA1 683ccabeb8a6327c63fc891f6421391d841ed59c
SHA512 e358466342cff7c0d616128db1348ae5d32c19197b2ef15f1888dd4f43f047caa1c973aebc9747c9fd0d7add46a0ee40b762203dc0075ecbcb6298a9485689f6
SSDEEP 24576:MXYfDtczAOSnnrFb4PM4MYgLxEVyGL5K:rtcWj4MYPVyGLM
TLSH
T1FF65F12977E408F9DD6B8278C9A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7c4972c3e42ac1391e236324f2b061201890b5a77df377eda5a3df1d3f6dae9d
MD5 148793fe283735c3ee507b22ca773160
SHA1 4889b678a1389c4f1a3024b6c2c4a40abc9d7525
SHA512 51563856dd38bd2ad715d7b2225e060e26957e8556acb3e4280136776fc5d5f27c7bba794f7cab5c146f5e6b7987182fd521a0636f81cf40011f503c0a9526ee
SSDEEP 24576:G0Le5ji0hmxMrM7SnnrFb4PM4MYgLxEVyGL8:GPji0AyPj4MYPVyGL8
TLSH
T1B4859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e6761a1b4260dddd67bd1fd5e4eb44e0d08bd3e3216310c6d05d76274cad0930
MD5 a745335f00f0ab432cb002a5e4685b8a
SHA1 b3dfc54035ede368d65c72f086cea938688d5a9d
SHA512 f8a417f2673fc90f2fa04d5f1cfb5df12354f2a7ff97ac6b7041d645234f0a7473ed964bb152e4af58a24e68ab0d2b90e0fa142a66d3d72180fbc68fba1ee2b6
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyuNSnnrFb4PM4MYgLxEVyGLz:t/ezSC6vUzPvxHjy7j4MYPVyGLz
TLSH
T145755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 52c4bbbd59951876ed3e082cea3a9b244bea22c2ebce3ab9612af99f72674158
MD5 ee695181b5014d476f52233576b10193
SHA1 1d3cfaf1aeb8d7c90a2531d14bc0e7ab2c4a5c67
SHA512 b3ffa1bda2aaecdf3e19810ecaff6f8502e33a350f3ad5a89c8c714de3d3f0a3bdd336ccc2b8a341599e87184218d45390d4c07e3bd0776853abc80d419c4008
SSDEEP 24576:jVbqPb88hv/l+6CSnnrFb4PM4MYgLxEVyGLY:jVO88hXl+Qj4MYPVyGLY
TLSH
T180559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ff8227f593f67ef3e9cea89bd4e3b264df268052fcb96cdfe790fb7240df4bca
MD5 21f09799f7816d5b2a294331ff07cf59
SHA1 bee833d62d82c657e57180ec44255dd8a2d0a668
SHA512 a6c39928c63f5e5beca3ef84f510f57f743b1a853682e4ef9f1d38fe4d6784e2702075ecd89cf864d521793e7ad78ff3064af8d7e7a8a7c0f8f34ce0df37b835
SSDEEP 12288:qeU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:qefSnnrFb4PM4MYgLxEVyGLs
TLSH
T1F34523A71BDC10EACFAE15B0D1B96AC8E605BC61F875B20B6751785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f33c616f533c347792b3aaa935b4c93f48fa27ee657609822b1e11bbfbd2ae7e
MD5 8fde35aebd2b84f94fca7213f748fe2e
SHA1 8adf6fd791c464f76c25a59fcd5ee200d4c2660f
SHA512 5dfd36869f7f87db63ee93633b148692ac63a110cd3be20d30a40d59ba5738664adba5f9f35f28ceb1fb5dd91a28c220290e681d03c55997d88cabb8e09a8178
SSDEEP 12288:leBNUbTVO86U934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:lJIU6SnnrFb4PM4MYgLxEVyGL5
TLSH
T10C65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2478f577129b225db036f96b6e76575c312aa1fc1674191cf8b41280d1a2ba43
MD5 280d42e4a731108b1642a110f2686728
SHA1 175d4a34b8c63ad2691e36a4b4d9203d882dd249
SHA512 d0de52ab6576dc01b07445b1c8a96d7dd5688c157e6bd106ccb5f964edb82b8a88aabde363819cc79024ac60072ee35b127449d189e2ff5b2e2739233d1582b7
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:MQvGAdlCEL8c/yRNw5CHVv
TLSH
T1EC267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d7a25b58474c252c1f8dd7ed6274741f0622650894db76e0fa909e45cb87ab53
MD5 ab229762b95d15ebda68cd677c4fe36c
SHA1 d935ff7ac6e93f40bd2b39146f1153cc18328b6d
SHA512 f5d413fa23b52ff6a2a2f56537be7c778516e21d666a7362c3517f1113395251fdb2811ca42d0ac0db1a9b7b11c7f4b07e6e76dd9203f3ccabc0332d0f0ccc10
SSDEEP 12288:SAwSfxL/2Dc3eDLLmt0LDQewsAjT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAG:X3ewsAjsSnnrFb4PM4MYgLxEVyGLR
TLSH
T18E75E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1cb7e0e3b5f248b524ba873f70b315c7c495b11c673041aab3b9e894573a3917
MD5 34ebef66811812c92214b39d889c9a68
SHA1 6091a47ab185a715b4fbdb785b99dbf2eb28622c
SHA512 0569a2b77fbc3896eda04fc84e83a861ca297689462f909fda6fc3da63b89076a99f967dca438e1beba71bae855475b3d8877d83a77b9d8f61b6233aa2bf3981
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:pUEtQevvqc2W1cpV2EI32
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b55998a4dd9b2ba1dc2513c31a8a00344c481897a52430ecfa836a52cb48ddee
MD5 113daae1ea28ea7f56d26f3293c32724
SHA1 0d9fb683174634a9fcc9b17a45db85cef1ce6895
SHA512 f31b01eb970d136d1ebf49f19a02cdbe34666a3ceeee540dd89202bbc3102ca86185baf5e8f7f0a5983e442f12c004f30b36d5f85c53b3d0cbfd97c49a9c3db3
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/z/j4MYPVyGLb:poqtVjnmzVH
TLSH
T13BD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 52b604552322aff100a15290d7585620f31a7f0012c00e6d778a5d4d5fe1b1fd
MD5 565481f4b567aaf9e68ebeb760962668
SHA1 06af98a500e13098350cca63e26d77838c70242a
SHA512 a129fbb991215d6110ca155318a6b7472aac4b0bb3b72ca784b6af03132136148d91ed500e10b2d038163ff26f17f74ed3da4ce820d55678ef9e389b6c361bfc
SSDEEP 24576:AAhGLJIFoiwtA5l7S53pSnnrFb4PM4MYgLxEVyGL4:AAMyFoiq5Sj4MYPVyGL4
TLSH
T11935AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c63a1020cae0def0c054c64af1487ea2350c6270962c52fdbf1ae8860b5a8892
MD5 00698075c5fad22259c56ee6bba56606
SHA1 c471923de47564c5e30f2e7d8cc7b44cf0bca285
SHA512 4bf3f7c242406ccecdc7a69b4e870915f30dc7703ebe81433564fc4bd169e98cd8e7fa678dc4df2d0f48735cb58ed7976156032d97eaca108bf161119cac93d0
SSDEEP 12288:kmw5HEjsChN8BFgl0WDm+C234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq1:BwuxOWISnnrFb4PM4MYgLxEVyGLb
TLSH
T14365F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 2adda0a961bdcc8983c2f7e1bc3d5e17871bef86442379d797e32f7102bd4276
MD5 659ce0b5d23aa46514a4a3d20c06589d
SHA1 1e8f779bf69981b0a4c92b8bbe8eb609675d30b0
SHA512 76ce738ef41dfde15bc35f78bba6592100e20c2552d932f3761d3de672771dfef3f574ce0fd09f4a9c715a11bfefb1494842749edf55f7eb562347ad44021e7e
SSDEEP 12288:q4Z1Iyj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:tZuzSnnrFb4PM4MYgLxEVyGLl
TLSH
T1715512AA37E820FAC6AB4274C4F55688E3227862B77293CF1750655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f137e7cb8823c5e482e0e1762cb209f9720322697acd0974337710bc4dc09629
MD5 8ccedb6097168869f228447ee896a475
SHA1 81d560684e6c1967afca03e547f172b0cfd7ecc5
SHA512 6318027dfefad22cf69b2d0b0ef5d1956840ff25822ca1d4a8b6ca49ef00e30048f374178f83f3fde37c4a8f82ca800674cced061ac4ceaab7b043ad1dde8ce4
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:EQRQyi36YOcPQLvw2gAf+PN36V/
TLSH
T1C1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b59838f4fa07d9c992b7cc1240d6f87c1eb98074242bdd2d2b9f8b11976ad775
MD5 b8e07489233dfaa5d6ee686d255b72cb
SHA1 984104a6f526ed1a2c4054bde6aed74ce56a2aaf
SHA512 670fb8b07bbe5a96f284188dd98da13ab2c09143f4274838409715706b7b4b92bade24e67b09e4c6ce105b6a622330a9666da274ffd5ad91f2dfdf7e61824016
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:gQRQyi36YOcPQLvw2gAf+PN36VD
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b61b050e3ed577a2e74092aa36a4078ab5b1b7f216845eacc68bd7cd17b8d76d
MD5 1589817695765569b49a741eb7bdb08d
SHA1 f2609f8fc03df82ffec66a7d3cbfd203847ffa5d
SHA512 78aa6824d8c5b9eca31a814251bfc412533cc2d9915bef0d9e6301d2ebe23cb8023f5c7fc741b000da8983272548f1774a8621ed15f3694c5092b61cd809b883
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jSnnrFb4PM4MYgi:768Qg55nhheWu7PNU3/Pj4MYPVyGL9
TLSH
T10EB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 34d875821a1fc1d737aec672c2d85554a8db203d6b140f6084bcfefba50ca3f1
MD5 9aeb542e54c26ba936044e6d8b53edcd
SHA1 f138eb5d7b8d20a11958a0f6b6ec4fd057cd1ced
SHA512 76604c271214b92139a4b25c2d09e9966f82d07b33235f714761e2a7cf4f4911719ea894163e99a49d62ac001b82f746b693bc0adb56a5c8dff119d19ebd7a45
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:jy5112gYy5azzVvL69nLKnhZFVM
TLSH
T130167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6cb49a85266b2376f2a1274e21878c2c41c3bf6bf09cf50f7715a4405677dc28
MD5 04fe043bb1b30fed3f8bd19fe647d726
SHA1 112935c5195c426499456c453f727b17dd3bce42
SHA512 86f53810fd959c1e16fa303917b8094ba0ec488370e2059e9524162d10dbe2f4848c93dd6da09bc03fa19b49f8e5933adba39e8547f48aa1a6c2d8eaa7c32d98
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6j4MYPVyGL9:ou6JmVxd2d7V5
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ba888e9bdbec32a0aff30b448a08669ce41e9081fafd6ac2af50d0ea081a5f8d
MD5 0fffdd63a4d0366c84c57a3514197caa
SHA1 a957bf44a413a4d877fea9c1fe32a4e806e3eaa6
SHA512 9fef8915cb21274ef669b31a9d58ab1d70800f782b9e2b318263197591d38b74891e04692ea3d36a53e613493c9f27228998b3932bf2b704bbde8f230fcf3cf5
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xVj4MYPVyGLu:hmifPbRzVa
TLSH
T138B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3f5e177b3916f70dbf1cf23b8b046a13357a5cfd3551a0bb7ef70960da664f25
MD5 eec8f3cd7cfcff969d39fa4e52515ec4
SHA1 d5289ac00bbd27525654ccb5653ae373ca767ff3
SHA512 d02ae3b51d4b2f49216dae99b115217f13d53458a0a9f852f7f1c580ea1b31aa1d45956203e2b6536c051d5eb4a41026941f8f83a4c31e35b5196ce6e06f4c3c
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHq8j4MYPVyGLS:K5dKTi61pV2
TLSH
T13AC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a14754bfe3cbee107c079c99604f1b5ff16043d42019d8b3b242e04af3fc6554
MD5 d3abfd6b64d69b95a656da655655aab6
SHA1 6c456d08776b24713d311f455312ed21efebec85
SHA512 bbfbd59181d7bec1f619d3ca44dd88ebfb6cf75010d5b9e516e9461db6d7a61add729ec56357b9bd1ff485719edd51c6ff8bfdcc9a924fc6f864d6620c1891fa
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wpj4MYPVyGLq:ZX2iyph/V2
TLSH
T1D695BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 24e0cbdd01226ea4141a192515c94c5b7e07dc8dc0ba389e85f65c75e91f2095
MD5 48bfc47e7d696a2cd4db04a3b20f3432
SHA1 3b3c35609b835ceb6247b460021a367e55bd7c3e
SHA512 4d4aec1e266ada818469310d30beb7a5023e0b403ef805ca0044bb610d0fab11518ad10e52418d7de94cbc6ee865ada3a54ca4f172e5c1e872d4deda32a4dd9f
SSDEEP 12288:MM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:MXSnnrFb4PM4MYgLxEVyGLn
TLSH
T1CD4523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c200b8aa4168023d59e39c6c499e42421e75a71b84493b89d1f160e01ad62288
MD5 d412d784b5065be834f42dfb804aea2f
SHA1 062003682bf38733155507098678d4081ada6bbd
SHA512 49ccc5cb522e340fd65e0ecf6c0b3f9687ad0d0ef4479d1de5e4089f9b666d609d6e2d89628bb65b5c124bd052e63365f6a649e2eba70a58d3f84d516e48fd16
SSDEEP 12288:6v34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:6wSnnrFb4PM4MYgLxEVyGLn
TLSH
T1AF4523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ecb405980085dd55d71baab683e33562e5fddeb216321e24ff1babdc409a3fa0
MD5 8fb65195ec3e59455e8504f9aa103418
SHA1 d00dffd1e1ec912c5465fa610bcf970d331c66f9
SHA512 bec8ed8c6f0237e30b9b1740f24eacd09a8107a9d0083a304bbdaef2a0a0f1864e33f3e77241d444fae4d5a68c01a9adbda1f5ec21098635e398fff6c0cae1f0
SSDEEP 12288:l134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:lySnnrFb4PM4MYgLxEVyGLd
TLSH
T1974523A62EDC10EFCF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6446c1a87026797e72f7f8dd6c03a3d52f47b411714ce52d10ba222bc83102f3
MD5 d332b26a674cfa6592faf3332960cf40
SHA1 34f4f526530e7e6d8cb577b9ecae173f9d443f14
SHA512 c34431dcedd1207af25b6821e5e5bbb63bea9d3e526702484864ac66d8f2710a7ef3eaefdcfaa96112b2358c9f0cf17525f5e23c762fc097b75d1f0ae5e34303
SSDEEP 12288:ZVa34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:VSnnrFb4PM4MYgLxEVyGL2
TLSH
T1914523662BDD10EACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6b0fc9f64a57cc8708d10d705d949189d3416edaf13e2f9864d1287ebafb13bc
MD5 8195dd0bde6409b26b0570593a98cb22
SHA1 9ebb06a143c8ee45d46d5e1642880851723e5693
SHA512 f9383a16086b7c0eea318381ccf68d3dde0afb4526f355fd6c47a1b6fbf30d9b7c9c920c15990d50b2c7402c0c461cc566dec9ee43880b675ea7d1a2872947bb
SSDEEP 12288:wi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:wxSnnrFb4PM4MYgLxEVyGLK
TLSH
T1414523A62EDC10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3e49c73caf5a4267bbc24523f653962447ccaa96820d0c7833b3dfef9c50363a
MD5 f0ca608235957509e575bae68e0d6604
SHA1 4f7a60813b083c5cd3fc2d5730a212441a95380b
SHA512 628c86f13028c58ef377f5c3f41034335f302b889c158dd3993870159965088fe3a54ff7b616b5fea7f4c11a1f6dc49960b2daf573226632a82e6c077a25289f
SSDEEP 12288:Tr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:TkSnnrFb4PM4MYgLxEVyGLK
TLSH
T11F4523A62EDC10EFCF6D16F0C1A566C8E2097C62F976B20F7B4574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d06cbbb81b8e5fe6a89140eb101fe7518bdf482647558056560cd7a10dc4f182
MD5 a101b3dce5fc32bec5623d090aa876c8
SHA1 11ba4f61f28b72526acd97e6a8facfb4afea2dad
SHA512 59285e77bc73a55b266677a46c057849b75bcf89835c0dd1703be2c557269a51c4656f26665fa28b3688b137aa54787fb96fb4c161d707ed9b773d98e47513c9
SSDEEP 12288:R334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:R4SnnrFb4PM4MYgLxEVyGLd
TLSH
T1AC4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2e5c76ea062a1c5a8e53982560141df5afa401112aec0123d6a4ac3aab0f3cdc
MD5 261acd2e503f974b0dc6f94f361b946e
SHA1 e98ddacc94fdcbbf1c7b748c85b0a3c5f6b7f4dd
SHA512 48c7423336ce233fcd5cc247bf1fe2b88cf46fe08860d9db0a800c40de9dc2d2cc997591ff5c6a939f4d53c06ec4896f4c7af32fe3973e0c2259f5d47324d594
SSDEEP 12288:NiZwbQzzFEoS2cPvyP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2e:QZM4zFVSOQSnnrFb4PM4MYgLxEVyGLb
TLSH
T1396502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f98cc5c43970f93869eade36fbbd154ff6ba2a8c8c0c868261443d802f213ed8
MD5 f561586af2924f0a2b7b61f99815ed17
SHA1 a5a5b046715ad942c3404ebd5eab5f9336b29c82
SHA512 a52662fdebab7c5f0281f912ca062a37d6bc003a11d630600099eb2a4848b7e751acda68ef4f7fbd1bb32be20714e811f81cb9979de4e0031f8e461202f1e14f
SSDEEP 12288:0w34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:0DSnnrFb4PM4MYgLxEVyGLI
TLSH
T1AD4523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bf503637c282460ddb98ebbdbad35f33ecc7ffa3c0ec9528732349a5f63a957a
MD5 2f866e161e1044d95e31c0d67c0a7955
SHA1 73a1e10eb0ed75dca5142e11dd5a718f6f95be43
SHA512 3d631a96f28b49372615d6d71afb0f0785bf3e74573f13456d37fd6902228c8b6a34d0929f0c73e9994d8056dda831d0ac373fdfba321f7cb96fa3184337ca4d
SSDEEP 12288:Tk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:TvSnnrFb4PM4MYgLxEVyGLI
TLSH
T1494523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7f559628deb08b0c3ff5b071a7077c7a1d0703b800a5ca2b07e15b2f9ecc78af
MD5 7cc83a068afb8b142fb3d07aa26fc5d4
SHA1 2ac68b70fa44524a526abd2aad5b07ed1d9f0256
SHA512 35408bc808c4f0f82ef4ff20bd623829a97bb7232637708c19b72b2fd374d87eb76d3580922bc5587a6bfc693f28897ef2a4857ace5cba7f92c49a312bbf384a
SSDEEP 12288:LyPz5L8j34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:mzy8SnnrFb4PM4MYgLxEVyGLu
TLSH
T1A255025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b475dd32e933c37db67252687b11fd7db22142796a62a251be356ada88652bea
MD5 50c1ee644ebe0513a7b85f3b77fdd152
SHA1 0c41a83e926f8a48f36815c86b566f51f50b6678
SHA512 ec74f54072e68d88da731094f0dba865683704572b9394a14e361430466c4ad71e2b8d22134a27f3db2cb3c1df3ae7f26ccbb4771a0991d36f481bef2e403300
SSDEEP 12288:jw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:jDSnnrFb4PM4MYgLxEVyGLo
TLSH
T10F4523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 65d1fa9aa2ce571759659e5e08774222682504f315de7d48fc0c0e20534450bf
MD5 fe4a9781116d2ae380d975ac74b472c3
SHA1 9ac1e1ee698546cc00f84fc1f046f67606035cd5
SHA512 b07d446806bbba17f5c8e728b3abdfe9a183a8095220e277c2340720cbc858ac9087b28d1ffa75ecb33eb9535770cdeac38ddc2211e508cdeeab12443cab4911
SSDEEP 12288:rw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:rDSnnrFb4PM4MYgLxEVyGLu
TLSH
T13D4523A63EDC10EECF6D16F0C1A966C8E2097C63F976B20F7B4574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fe88c66162a5c26cb954567f8b75d7972f859e35ec625aef07a3d3baf8211bf2
MD5 0d5446b347763c8f8d5315cccc057a04
SHA1 81ef45c4e8074b0a6656eba626c0af0f47a4facd
SHA512 6ad30c0a0dbdee4a98314cb15249a344cb623406ee9c557a66603afde5f049f224b139b070ca9875dec6d0ce7d234066ef64f7ef6efb91ccd5cd33a27dfa3282
SSDEEP 12288:8yPz5L8j34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:lzy8SnnrFb4PM4MYgLxEVyGLY
TLSH
T1B755025737A530F9C67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 34867da4296924c380b600d388cb39c349c8f540d8cb672a9cb193d759e50ca6
MD5 67953e83362b6ad54d5b9389d2be4e43
SHA1 754225b60a4fc66c6bcb63038ab133168a776c85
SHA512 443a988ba52078bc0be3fb617996fcf2ca8b0e3286f85fcd95d9ea3409e12c4c67c8e5594feba8e19fc0378a3bc01347ef139b41e2107d0c9d041b5b8d4230fc
SSDEEP 24576:mTpaLl3z0zDiSnnrFb4PM4MYgLxEVyGL7:mT0Lljmj4MYPVyGL7
TLSH
T1226502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4026f7f49a5a79b23c8431debc232483cf8d4dc96b6661257b6fabddc0822fd2
MD5 90b08359e63bfebd1d8e4d18ad759bcd
SHA1 2244285bc1823bf15647a952bc2fbe05a63e2054
SHA512 b5a5e44f4d219db4bf17daea058a23b90cc71d1dfd536254496c21f01c9b0b230f1c501eb49c451f154238c916ce32c70502252d57b739e7e46e9cc38900a704
SSDEEP 24576:H3+d9CHKy7GZGSnnrFb4PM4MYgLxEVyGLY:X+d9CHKyanj4MYPVyGLY
TLSH
T12375DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 36a337fe29c117dc94aaec1941707dfbd5e2d00117a930aac140793b3c00c2cf
MD5 b2c6578cc38fc86d2b9ce1793cecae31
SHA1 4b7ecfd72f870daed77bd1d82520ca396a06d1fe
SHA512 497555c80f33f8dea54804514d2d313e4a204f1670072cb816eb14638cca4fe3d72e6bbfb5a184b3aa96515df991bc8f0016a376b5f6763a3b3e75d978a1d48e
SSDEEP 12288:fV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:fSSnnrFb4PM4MYgLxEVyGLY
TLSH
T1324523A62EDC10EFCF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fed5035755591356b32793fa89eaee5334902e81f973e99231d004bb5d8b2f11
MD5 20d12d567bf52fb671cc46135d306dce
SHA1 6a5d12b87142465fb9b17b37c9357624bc407203
SHA512 492de4e372a7e289db67f1c2773c4a86d271a3f735afe29a7b3f052d7a0e9a74f69cbb86bff57cb4b6cc56ea06fc7c82c521c5d093505c5300799aa5b2458223
SSDEEP 12288:GD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:GcSnnrFb4PM4MYgLxEVyGLw
TLSH
T1474523A62EDC10EFCF6D16F0C1A957C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3f1bc8a67f3f9f883c45d6148e4e8abe7c7c5cf87a38c72dad3062b673421089
MD5 cebeb30d51ad5857530428365e9b9547
SHA1 55f6e80594c1ae1b1dbbabe4e374219141898b09
SHA512 2eb265187d3c4d15bc7641fab4c05c8e31b7d4c8b20a9fcf9fb54415b92ced3875f77da1664260ef585fbe69a27e7f396dbf1958900db7e0a3d2ef0330a49410
SSDEEP 12288:s+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:s1SnnrFb4PM4MYgLxEVyGLk
TLSH
T1274523A62EDC10EECF6D06F0C1A967C8E6097C63F976B20F7B4574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 231568216353ea9d7368ac60eea77f96952a2fdfb3755e157f108cf90ff57633
MD5 0d966fef82792df5cf90e9fe53ed9524
SHA1 3911be7a63e09c1913f59838160f57374ad6e4af
SHA512 6d8250be9266a03445b9f747ef469403ddfa78e1d04a94fb4c5ae3c1feb63ebceb53d3d657e40af7faf4072edd972b7ef47d619aa2f9ff52b7f06dc260282b8d
SSDEEP 12288:nw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:nDSnnrFb4PM4MYgLxEVyGLG
TLSH
T1F94523A63EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9a64f647a42772661b17ed4c1be028b7f7b01e51de11ff646debf806e8b0a39b
MD5 acdc8af15ce70a810e549cadb75d81a6
SHA1 1299f99c642c8ce95349e5efc30f3209c08bd937
SHA512 e6df6baac7dd73772b09a17c81269dcc1aafff21a2e1b53fdd04596fc08c1f30a6077c83417cb68581dc296e0783e9a753fbf74d6e6a6239a2e70e020467e12b
SSDEEP 12288:BV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:BSSnnrFb4PM4MYgLxEVyGLt
TLSH
T18F4523A62EDD10EFCF5D16F0C1A956C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 aa2583b0fc33ad8e32c30c543bdeb51fdb259aa1e685153a36a14cc31161cd84
MD5 da468ac23825ff252a2807a987585c86
SHA1 98f6eba6c7393292519e955ab3ed2184aaa61499
SHA512 1a7d7bb3c338651399f585ca88b1a69c05f8963a8747cbc433446fc14892508ce1bd1c4379c3485c157f59ad0b0b909d9b2743ae432656a2fac5c823213a93c6
SSDEEP 12288:fY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:frSnnrFb4PM4MYgLxEVyGLR
TLSH
T19E4523A63EDC10EECF6D46F0C1A956C8E6097C62F976B20F7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-17_172111_1912-4952.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-17_172111_1912-4952.log
Size 1KB
SHA256 5e38583155ae4d80e58f327643d4c285ca8a7306ccd8459f0c29fe47d76a0a43
MD5 1627a55a42e15cb79dddb99357f382d5
SHA1 8dd15a2b8c2350b7075daf63c070a9484fe417c0
SHA512 b65d9c0570d80e5eebf4e173bdb1f3137ea50ca331bbe19386a918f27061d0b98e98a357646b9edd60cd86fe7b629bf10a6ddf3647a4dab8c1b091e22dd7fa55
TLSH
T1A621AF2A7BE81A05FFFBD9929AFA15539E3978956C30C60C00A4424E5831F41FEB035F
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c4e4c52e9198f6aff7a96d5940c9005854f0a626676cf1d551d18992e387b9ed
MD5 092016f5bd91ba22f65eaa2bc241c6ed
SHA1 2fc117fad9f036343a92eb169f6c7591f5a6d48c
SHA512 deed61d3ce0ed8de61be79d94284722cb528660f57ba937d7f87828a05d54cd5df2e39dfb87c024c827cdbe5e5311dc246c2894a028f2efa7039ba16041dbaf7
SSDEEP 24576:+fwvqk9RX6wkyAI/SnnrFb4PM4MYgLxEVyGL6:gMnYIYj4MYPVyGL6
TLSH
T10675D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a610f9ade5047b4613703f466af70b931d1b227cb82ec349aa973ca45867b1a1
MD5 2e7b978c316e4f5c4fca776df59d1a1a
SHA1 feb8ac32e7fb998433f9a65b9820d33286ade9b0
SHA512 11cf07ffd7d461e49acae738f1d4197732afabf4f51b9930facaeb2b27447ce66f7c5a8a69df195dd05f562ed21abbc8cff8dab759c3196eebb113d9fbc23388
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jj4MYPVyGLF:hySzPaVx
TLSH
T1CC066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 24a6a84add486f4c62179479312c3031159c2314253d54efd47c684a8e087372
MD5 c65cbd5bd821c607c5d9aa4b3db65f85
SHA1 0a0dae3c01c32c5ba6512b29f4f988b174d9b059
SHA512 a164aa408fdf07e32e47bc07201ee903c4cf41647e0262e2efffaa7989b9fe7841066adabb6c69a23ced340fce5626951cdb9f7adec14992f5b775c9a2dca151
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgSnnrFb4PM4MYgLxEVyGLY:W47JUQj1irIhCnDHUPfF/Zj4MYPVyGLY
TLSH
T17065BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ad2192eb46f3ff60e576ec02ee926a7823fbcf3679812f4263577d5fc55423fa
MD5 0ce62792a725de5fdf544a134d657f49
SHA1 2e1c1331999ffa1f112752367b0133f36e248f80
SHA512 c14187b016dbc61883146cffa78879472a1b74cc7f6b4c163de0c06e2f4b56cfc00b73efb3c3b1e5f8fca7a8e613fa4b9233fe6005ed9a2730f6f60130bb9c6d
SSDEEP 12288:Wysfg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:KzSnnrFb4PM4MYgLxEVyGLY
TLSH
T18055F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1b5e19fa7a6020d302862ea6f4d4b95e4808ab4484c87eaa336eadc597ba5982
MD5 b092db600b2dd1d0faf5f511a729aa0d
SHA1 00d6fdf4b141e82426fa4cb3ac16f476306ac456
SHA512 c7210782288d907bfcc3ba990fa2ca337194fc3083fbea1c6f6db44d07728c67efb01f6f4d1ffa18f78d2780f68df1fe599447f38404ce39ea0b4e8d763191a7
SSDEEP 12288:gpRjU3fE+emUBCj3lmobYz8EkyDgdjbVT:gp5UPEp98j3lmo08EtDgnT
TLSH
T122351851766BC75FC6AD40321E32D1CCA7707C05EE45AF0373C98B3E8576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 76a2fe1966cb66a2c54056e5f5973ec2a208cf45793c58212d2032118ae59972
MD5 a0101591f788dce41b2f36b98def885d
SHA1 93fe502df82499003ae006e1be3bd331190851c0
SHA512 3bc63fe95e251aa95f4731018d7f2a328674095cb739c9bfed3dda6a321808a2a09e16f335b160710ec0aa703d6cbabb7414667b80eda22db98abbbe2d39e585
SSDEEP 6144:vXdCRWiqeuH+UU7WZlZ8yAGvsPfsPbo3ZuPUUBXMytMxRMytMx5gzwiLhOlSAYwH:GyAGUZCd0zwiLhaSAdqGJvtd8JG
TLSH
T14D65E9415437E38FD1FB6032072A5B4CB764EC06B7496F267388453AD86BB61A1FA3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d4a95b33097fc982746297b2ed3fcb26e190984a7c3ce0fbc46799d8081d9f87
MD5 b23aee11c8e8d54a1639147b60ee5083
SHA1 3f391c1f36a7992954aa03a2c475af510e7c5876
SHA512 49b8fa01235ccd2920d864b472667cd5a6104820d86d249add873c03b8ea91edf956d9a49248df0c75a9579c2d4b2a630981167ceb6eaf19108ed9c2f94c8174
SSDEEP 12288:B77I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:RbSnnrFb4PM4MYgLxEVyGLd
TLSH
T18F4523722BDC14EADE7D16B080A95698B209BC71FF61F18BB74074463A3B68C9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f8e8b46eda10e0bedc3aab016a1e9632c0290b63b2a0d7286a658b7a5bc387a1
MD5 d700719a7173f9710ae5f2fbd636683f
SHA1 1a810e1c96962da77f0dc3e89157a9d4a3cd8f62
SHA512 26acc545f684a8b0c189e229d81faddf1c712a61bde8bff4cb3103d9717276397eb50ebc70c21ecc7aa07aba285c6127b9ce7076fb3a43ef36003148458b6921
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYNSnnrFb4PM4MYgLxEVyGLQ:Rgb4mBIBhGFzj4MYPVyGLQ
TLSH
T18265AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cc6cd2faa96d1c976104fd85087fb92a18a6fbc24654d89db83174b486074c9d
MD5 76863e6a195decd7bfeb5a9c5e6dc360
SHA1 6a8a00ff215bb15ca2d43f1dcb247fd140d50125
SHA512 8d34a096a51b90d067a67adfc7278402f476693a2e5e10edbefa3749979507e09d4ce63ad92c4c03b3fa4ba3cf5db4c5246967f85bc13e0d97f1a20c01e724b7
SSDEEP 24576:LG88u8FpJqH1Nzria7/mQSnnrFb4PM4MYgLxEVyGLo:K7ZFPqV0a7/uj4MYPVyGLo
TLSH
T11C85016577E401F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 40a31fb43e5d91a36732201c3e8407fa7691b57c268e3a293c639aeb1e50f4e8
MD5 a30e0ce0c4456fd2afcd764866a9b1c2
SHA1 3c3fe589001d118364435a4d6a3ba7457ad10b52
SHA512 8ce06d029361774085ffeeb51a71c2cf5096edeecff511e06882c08be3403049225fddfc95c610f8fc84d42d5f09b9430369ecf96617df9afa30171a9eaaa631
SSDEEP 12288:RHvUrBFrEjwaQ734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:RPUr+NQ0SnnrFb4PM4MYgLxEVyGL1
TLSH
T15165E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 47e519bd6cbfe9438b9a4f2c5f39f196ef8f56c10c1551fecdf44a1e12316bc7
MD5 3fd9019231781e77d7635084440e1ef8
SHA1 aff3a1c27ce1dd2a809c8025f2b6f77682fe0e12
SHA512 1b6ca3a11b13f529c7aeeb936e6c6ea2a4030c5c9de01d404efe828515d0ccf4acaf42cc7e136c92cb1173bcbd77bd4c996618d5db5d3d22c6c7eecc73181b69
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXj4MYPVyGLf:FG05lO43b9VT
TLSH
T15BD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 173523c44cbe62c0629c8bfd3fe5fd7c3b6b1e6171389b7f6ae7baac6504e4d0
MD5 e66ce8359b14170b56b89e06fc501799
SHA1 a37322c783c672ce119d7d02cfce6ada4221ab54
SHA512 737b0bb89a096e5f86d3588cbd59bba1d62fae67c4ce9ae78edb553fa14ad4d577b12c242c5919165aba365a270ab2b8fe2ca8fd3c9d6317253257ee654b192c
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuSnnrFb4PM4MYgLxEVyGLF:sa5POZ3+Jt2pasx2+mPj4MYPVyGLF
TLSH
T1FF65AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6d4e35bcbbd5c2555aafb201c8dfc42155442ea1f7e199deb23e44cbaf395a5b
MD5 70d62b795bae76ba018c6dfff79bc39b
SHA1 db1d78f4dad345ec31c89509b83ca575e3af4fa9
SHA512 d66e4bd7a1061c57e84b9044cf0ef78606711780156ef3019eaa07ba87a89927d59873ce4c18ab2f1017035d77e7166a2d1736bbe360f7232fcb375c123d810b
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkoSnnrFb4PM4MYgLxEVyGLV:INc/zEOVHFOj4MYPVyGLV
TLSH
T1DF858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d59d38052d1eb6458a89ba09f7a5cc66cfc5f962b5190621c005942dbcb54161
MD5 738791dcfffd1d08d96a9cf3ae264965
SHA1 5fca3d10b724bd58cb0b1bff28f75f02ce6a7848
SHA512 43535f1092c3f3fbdc42b695cb69d0f9f2bd1a043d5e3e388d68a99d51e0db7e55c6e0129b5fcf1d7ba11dd61ed1fcd9d743ac6248668503b38820604886e1fa
SSDEEP 24576:48kNvNnaFeYhJNtmZBm9SnnrFb4PM4MYgLxEVyGLt:48MwBtOmWj4MYPVyGLt
TLSH
T122559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 77d6bbaf6c432f6b4bd2ea83b85ff40cdad595a68026c47b698775d6db333e10
MD5 b4d6ec027f7f748b55ec45a5e0daea45
SHA1 d28be367868fbcf32d93fa984bb90c1a1d67674c
SHA512 86b0fd02b05186be7951c8bb4db9d92b1c8382d8e68d295e1f2a1ea16f19a3200fe80151a0c7267ae2f856ef968e92f0e805bc6fc1835ec6df9995e9674133e9
SSDEEP 24576:mD3FHshBIYQgA3SnnrFb4PM4MYgLxEVyGLN:mDVHeBIAAwj4MYPVyGLN
TLSH
T1BF75E17EEA9C04E4D57BD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1108-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1108-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1108-337-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1108-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1108-103-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1292-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1292-321-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1292-323-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/1292-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1292-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1292-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1292-115-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1816-140-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1816-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1816-142-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1816-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1816-134-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1912-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1912-43-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/1912-41-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1912-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1912-4-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/2120-86-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2120-316-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2120-87-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/2120-92-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/2612-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2612-48-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2612-61-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2612-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2612-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2644-76-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2644-82-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2644-74-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/2644-302-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4072-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4072-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4072-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4072-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4168-70-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4168-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4168-63-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4168-281-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4632-336-0x0000022500B60000-0x0000022500C0A000-memory.dmp

Download

memory/4796-320-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4796-122-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4796-129-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4796-128-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4908-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4908-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4908-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4908-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4956-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4956-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4956-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4956-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download