6457211e0b87338156f3bf035ccde6851e2f065dc587a881f704cef143aa3adb

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260718-c3a4dsg17v
SHA256 6457211e0b87338156f3bf035ccde6851e2f065dc587a881f704cef143aa3adb
MD5 aa50a6e441f84f3cbeb050a2554dcef1
SHA1 912a19bb6177867be99d98e02429c47a8a1d6abe
SHA512 d20415bce791a4927cdf927ddbcd3930747e7cf7007c41cc9143037cd8ee3659ef87601930ab8eeb9be13c48c6db09de708ebd6241489c0366034ecb8004c900
SSDEEP 49152:8474cNEpbt0rjQsM13HbDRKbFZNi4vbkfcdC5r5p3mATY002Dmg27RnWGj:QsnQQh002D527BWG
TLSH
T1AD267B17E2B940F5C0BAE1798A579517FAB2781A873297CB4791474A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
252	elevation_service.exe
4316	elevation_service.exe
4704	maintenanceservice.exe
2392	OSE.EXE
1364	PerceptionSimulationService.exe
3532	perfhost.exe
1064	ReFsDedupSvc.exe
5060	SensorDataService.exe
2812	ssh-agent.exe
3728	AgentService.exe
5868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1922fa123e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053010f2b5e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005949df6b5e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000345aa12a5e16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056846c2a5e16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009eb1556c5e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d5afa295e16dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efd0642a5e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	472	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	252	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3728	AgentService.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: 33	5868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5868	SearchIndexer.exe
Token: SeDebugPrivilege	252	elevation_service.exe
Token: SeDebugPrivilege	4316	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 5056	472	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 5868 wrote to memory of 4964	5868	SearchIndexer.exe	103
PID 5868 wrote to memory of 4652	5868	SearchIndexer.exe	104
PID 5868 wrote to memory of 4548	5868	SearchIndexer.exe	105
PID 5868 wrote to memory of 5156	5868	SearchIndexer.exe	106
PID 5868 wrote to memory of 4620	5868	SearchIndexer.exe	108
PID 5868 wrote to memory of 6012	5868	SearchIndexer.exe	109
PID 5868 wrote to memory of 1768	5868	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_aa50a6e441f84f3cbeb050a2554dcef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:472
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "472" "1492" "1340" "1472" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2852 2856 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2904 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2904 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2852 2856 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 57dcb2c4adefd06b950879dbce8145b16f7f72b066c4423c57e2dbb87254a727
MD5 7e48e1ee2359c1d362e5d0e521fe3b2a
SHA1 1f9f425b2cbcf5d11bd3817ece48c8d923c8010f
SHA512 6e1886ef939f093986a2055d24dfbbd8ca00465ea04773052c035e85ce81613442186d8783310fbeef1f9cf256108d8e75d3cb3ed19b465eb001638727857719
SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHDmg27RnWGj:e3q6sjB8D527BWG
TLSH
T1A9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 daf15fe6a6268738a385382f4415ffb95e94f8c0cd4348d40876a2e58b2b26a8
MD5 0b809787743d6148b320875716cf4214
SHA1 e815e8ca2cd947416cb6b75331f0d4bea66fbd58
SHA512 6be2c977ae0bb8fcd50e57a4474a74a387170aaef30b3434f717b77efedd24f20e535b72f5b27a2924eb8d8f679c9613e8129f32565b0f1f6d9ddb22cb9ffa8b
SSDEEP 24576:/XYfDtczAMsqjnhMgeiCl7G0nehbGZpbD:Ktc9Dmg27RnWGj
TLSH
T19865F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5f9db3fd642b6173b52fdb7ad1e29919debaccb42c5d63d0483caead9fd3793b
MD5 54622ff8dfa5102a51b3372a1b6be3ee
SHA1 08776de977e4fc9bededd540870dec22ddc2c37a
SHA512 037cf4fb5b82cf15a86813d59fdd5eb01d99d4ee20ef7a1f4ac06c5a673308ed2f1b5b5b0772d473b6ec6923b3f20e3fa38b26aec9da3ec86ed6a55248f8e17b
SSDEEP 24576:K0Le5ji0hmxxrMusqjnhMgeiCl7G0nehbGZpbD:KPji0AjDDmg27RnWGj
TLSH
T146859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a83dd2edfaff1135959ac3f31ca878e093fdd9768729d7a1e3229d1bfa0d1ef5
MD5 48233d5ecd6ad0605d981eda6cb66ea7
SHA1 c016601f3665e75271b6b164f9857eac77de6fe1
SHA512 b070204a4c732c88187dacae88db6a78976c8b79cf1e524eb2a9fd22a5ea16413f8d519d984af3832d7e5c631c00b6ac41f0ab9ddf7d750a15a9b6984af48166
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWn6q8wyuQsqjnhMgeiCl7G0nehbGZpbD:Y/ezSC6vUzPveHjy3Dmg27RnWGj
TLSH
T129755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 021f3bb6128ad9601badfe83e2ad7db92729b5a019a88a1f6c30270fbd9ce21b
MD5 f767404f1088774ae22ad367107df4db
SHA1 3ece318a5c2d60f7dc2a2af88f682a712aa3f7cb
SHA512 a01164bce0b233fa1b8e6c04e6a529d4fc366c36ba3bc6b5850ba99400308ac475cf78617813c7aef0cc24fa39db5eece9a4f7547ef9486b22057e881f2744ed
SSDEEP 24576:cVbqPb88hv/l+Y9sqjnhMgeiCl7G0nehbGZpbD:cVO88hXl+kDmg27RnWGj
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e425387d73116a0beb8abe142db8e5e2b02c0452c863fbebb05e3141c58c4b02
MD5 805e2c57155ee3a4c26fc11a359f1baf
SHA1 3ff483efe702e451a2a451a6983b9b6301a98a7a
SHA512 a3076a01eea948acdeeb0f7fb2348dcfc7af8252dd7fcdf1a3855e99b867648bb9b0193e90d939fc2f9d27d0a7564bf464105d87b6a9fc4efeccc31df020a0ca
SSDEEP 12288:4LqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4LqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF974C50CAEA7608B5C3E9F11EAC137E56982008436AA37DFDE5B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a123ecc4f7cbb3aa368ffa1c26177087b20dad8b7c5ac44df36778eeb997ac74
MD5 18f25dfbf64bb56a1a75f6f7b526bb62
SHA1 18440460f01f0a22694dac480806e5ebdb792b78
SHA512 9e515aa6b8530810eecf3750c03ffd4cef41197d927593406e20b9f9402b6fb08e469d0fad79033fef10bfa71df243b98af75bb9d5ca059cc49d764e9311b8b2
SSDEEP 12288:NeBNUbTVO86U1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:NJIU1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D665CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f90c7c777d4d2748c5f173cb1315d9b9f131b9058b0955ca2b99cc8fdaa9d27
MD5 697ab23eec5f4571d8d965e74a9a7ac5
SHA1 5772f24f00ee8e6c25ee32a4d3b22259dbe0c9e4
SHA512 ab8cafe2fcb42bdb222d4a44d8f8d6a8faccc0ca06a98c675be009309534cef550c4e1d54877e60acc0229d6e40dd9b2631a3f0a2df9b5c56e34d5e2d5a2907d
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:pQvGAdlCEL8c/DRNw5CcD527BWG
TLSH
T18C266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5b109c6e3d8c7edb98d1d73e2deb6b28a66cf208ee6015cc5732e8a511cc24e3
MD5 b5ba8d68653b27d7bd09076c4bbbcd0e
SHA1 412069b588b6f771c04aaa0de3751de5d6814f97
SHA512 cca69c8c43a0f048626fdaa8e0ee748e355a8519e3ab2514ce21083865d82111ac4ecf9269a628f22463aec802a3c4c49077b119dd30ba3943e8b5df30c60fe4
SSDEEP 12288:CAwSfxL/2Dc3RDLLmt0LDQewsAjvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:H0ewsAjvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D75E031FA74E036C77B0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e96bd9d3dfaf8036c3ca85cf2ddff9f212cd5d414f9ddfb9bf97ca08ac771de8
MD5 1f8199779bbb32a6f790309ee83f31ba
SHA1 9f79defd3cfa6d1350942e0c3412f23ce3524b4e
SHA512 3d9b5df9e46654bd04ed8d1c3a43858e193b7e46991646d642107fb5394d732a4c7e2b6057714709ed251678fd2cffc21e516e659750d6be54689cd06f77a7ac
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrVQBWG:1UEtQevvqc2W1cpV2tI32CB
TLSH
T1CD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 67b3dbf4f99f80898231d6c5d454e3749d1de8f08e03425f2c5ab30871fac420
MD5 1f06129b8180d11a08ccb797d9592654
SHA1 60f545b1f762a9b82a917d42c75a5d3171877c6e
SHA512 830186db64155523ab81cbc21793132064c870a5978d218f96f641657be72c1cec72caecad8c6db52f02eda3319fa8172f6dfb65ea5f7831db306939fd0d4a1d
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zzDmg27RnWGj:9oquVjnmAD527BWG
TLSH
T1DFD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fc6ff91b10a168575abc2b5fad0dc8227f5f97a635366cfa7cbf253ff5634744
MD5 b38f24156cab9bafb43dd69c082c83a4
SHA1 8300214972d0a6f42c28b48b2ca5fac88b4c75dd
SHA512 eaf2524fecd86d8e66d00548a982dc1d593127173ede1ade8fec025a2b2093acd3b006ff2e44d45f10f82ffdcb448fbf7d4354ca95704f581c950109efad4816
SSDEEP 24576:qAhGL3IFoiwtA5l7S53EsqjnhMgeiCl7G0nehbGZpbD:qAMUFoiq5QDmg27RnWGj
TLSH
T1A5359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 80777318f7473ceec169ddd3331f3f0dddd5aabd4698660d1216d0953ebc079b
MD5 e10f1a361073b1260f491dd96a392c68
SHA1 362dc0f61534aeda5ef141825d37c3965a675290
SHA512 e205da365d07dca047f1af3219d5fcf090856f0114e8ad1a69f3d4521efad74c6f52fb5ca94913e94767d1221e89475e11ee78dc91f84e0dfcaeb865a1b9aa20
SSDEEP 12288:Bmw5HEjsChNVBFgl0WDm+CwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:cwu4OWTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10265F14A76A81CF9E9674539C697D136F7B3BC122A20CB1F1760C65B6F33260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 787c772a23b6ab12ae02a6a7f05d2a4343436cf8026c35874e5cdb17c8096c91
MD5 49cd1ea8324164669c5b7ed00a8b1fb6
SHA1 4b566fc79389f3dc2951e4aa604cebe054ce16e9
SHA512 b71071898233e841f64f536147f62824fdf0301b0dec5cb5d0831edc66d99eea30ceb154ef5697983d67a5f99acd04adf80ee172bbb1600436df6f12beda10fc
SSDEEP 12288:leZ1Iy/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QZuGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F15512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 50da8f0322f6fd5701a3cd2f2a15ee38d10130c70af72ec5225024221c251dfe
MD5 3bde89baacfafa81a8d3081f8642a7f2
SHA1 d93d9dc2db43a34e978303792d6d1cb13efb5edf
SHA512 e239dfc494f79eed95724f94e042fbdb233f9c05650e247494c72c9d0dc5c9ae72def6387d940660f91947de226a6cb577e53c1e43b08563a091cc79d2758b2d
SSDEEP 98304:JQRQyi36YOcPbLvw2gAf+PN39D527BWG:gQyiKa/X+PNtVQBWG
TLSH
T146667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 357db5d8eea0196a716743bdc9732e143a3e519ab804eb504a7a507f6fdedcd8
MD5 aaa031e4084e6de3a88275050732aca5
SHA1 9f032e5de4e7bcd363db7f418889c298207d1604
SHA512 8f6c069faf6a0f4cd7513dd5a74ddbed09515a14c0ad3d94ddcc2a6b57a8c435ebecf5e33180e40a38e2a45899d71e894868bf8d4aadc14c13635bcbf1bb8c3b
SSDEEP 98304:OQRQyi36YOcPbLvw2gAf+PN39D527BWG:VQyiKa/X+PNtVQBWG
TLSH
T1E9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a9c938bb00a6521fcca5b9b752fffebdef38ed59c9e6590478130d16209949f
MD5 b56a7d9764b706fea941e5c33da183a7
SHA1 44398bc2ae897b55d9c7c140d705bdce34689031
SHA512 899b625a51363770a43c99485f9c8511343f042374c96aa5335f2e164ef6e321d6176e48c83d8b689d393be9d60a79bbc0679a0ac95cead2cb1f2abd91fd9064
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL02sqjnhMgeiCl7Ge:B68Qg55nhceWu7PNU3/DDmg27RnWGj
TLSH
T1C2B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 402892e6cb745a41e558231c0551049b9faa97339cba415b108cb23f972beb2b
MD5 68736f301af055151c58d87a5c13c0f3
SHA1 1c37ed2234c32a4b979defda8051ba7bf658f368
SHA512 9edc99fe240807c869aebed5f6c0e818213fecb42dad176e222a7ffddff9f6ac27d90b8dc0bb051512ad1379e38f842379141db38d33ddddf24ff20cc80b459c
SSDEEP 98304:xy5112gYy5azzVvt69nLKnhZ+D527BWG:MLIHEWh4VQBWG
TLSH
T1DF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9048a778c551f2c6f88ff0f19e98f94479d54c115e37fadc422b6e9fbe816e54
MD5 8ea8c983c7ba49ce31a48e20410a63ff
SHA1 92b1cb7cdb45b31542b65dd6d5cb65f48b1ed76c
SHA512 c6bbb534c7c2633c21cdf9c6a0e0f7c6ea3f0c57fc99e3dadbe08f9811e76c3fb2e3879439d9c3a4d720d330813495b37288e5ea31ac3ae588a6598949a775ff
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glIDmg27RnWGj:Wu6Jmdxd2dID527BWG
TLSH
T187D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb2104f833098cb5b131dc87b9f246fd08a6708fa6cc2c9fef8af992065316ee
MD5 300e2e775e94eba9294ce8aaa24fea47
SHA1 7f0c188aef169a33427272b035e0fe14cb550487
SHA512 0abc14cb9648a3fa795b0bdabb6a91eaedce5c74f47ded4030ecfd714d27e9f89a3f3d23872c9d64982795edc2a99b8835991b328afa5de52283008b60b507b7
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xJDmg27RnWGj:RmifPWRAD527BWG
TLSH
T1C0B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 966676ecb184126bd1fda9ade708e2fd182a3a411e82627483e8badbc2f26ced
MD5 f5852470f86185567b930ac946b621ae
SHA1 aeb15312d99757badedd2f76d2f01e038c8bd0af
SHA512 052e670e59202e452bad9c2b315aa84e5ed687b19666f8f5e6832105172d86c6bfcadeccff5089c150acc71ec3bcb5155566854c9701154bc934aaf3aa5e68f6
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqKDmg27RnWGj:H5dKii61KD527BWG
TLSH
T110C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1848482950e33b71ac76d1c4560178e5e6e762f5f8f3aaf7931a6d255e932944
MD5 16fa707929db67c59b294d9ee6e253ff
SHA1 c566b6e3b438c373d4359d2024c6534bc2401bd0
SHA512 fe5a6e98f3f65d47476caa074ba9bc5bc6f1bfa7a0cd1b621d4d0da0463f32021d8e3f0a87fdfb15e7ec153c5c0a11bf55e2336c7eb9cd5ee0593e3c7d9dbd34
SSDEEP 49152:phtSn8EApI0fig3giDn0AP5w1Dmg27RnWGj:YX2imph0D527BWG
TLSH
T12395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2976ae977a93be1f4528295f489742a99a91f0d75125a809a005dcb5e5c0dad4
MD5 fa1a4042bce42705cdf31806428fc9e9
SHA1 ea15fc431f9ef2d7ad347b21655d7ed22129ff99
SHA512 cefb1c9b57a64e80e33b1d16d0b2e090d6b1c1c95cbe796afa61879a25dbfb99bfb61c631392ea9ed71fb00cdd80597ac2aca1a0a2db8f1c350c9bd0103c2a17
SSDEEP 12288:uCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BF965C41CAE92644B5C3E9F14DE8073E5BE92004837A5B7CBEF7B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8157fef0cc8a6d15d3fb7232e5aa75158929bd2d13d0e25496452d1cfb5de5ae
MD5 725bd069f98f246df906b0f708c3a78f
SHA1 e9793d247eced6378988cbbd38f1a1ec57e45c6f
SHA512 6aad430b7953dd6af420ad811689d64c3f5f65ff2ad11399fd57c3af9fc8bfc11f106506d49f13b3bb55ba104c683181bcaab7c9f550e35265c44517b79b6f6f
SSDEEP 12288:JbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BE965C41CAE52644B5C3E5E14DEC073E5BE92004837AAB7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1636afa71c44ab402077abefa349e471e11c85168253b70eb4a8853a0b3ba98a
MD5 3ee6e2f8b3578c1054a0f83af4f0475c
SHA1 54ea453786e68bb5adae90f965e21a3e009a9888
SHA512 e7e42f77bed62e67454a07e6288550a92d7f7c6dfc4fc9d9d98c46f0cbc99ced46ed8f587560738cfd56ee1f2ab25f7a83c35ed1b59100bedb80d1d7225820c6
SSDEEP 12288:ltXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ltsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BE965C41CBE52644B5C3E5E14DEC073E5BE9200483BA9B7CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 717f3ab045758cdf3927f29b0d25b5c81fc62db9363defdc6cdf3faa9d8ef9e5
MD5 49d55a746de230e7185c9399250d2d7f
SHA1 7e2d632dfecd35ccc6c1759580ffbca9c89e94b4
SHA512 d399fea61b0c5e28f9519397815be4308842745c677c087eada562d079706e91df9d3103153e2afcb7e929722c1cd3482474b02c2329ac2df4c7f36028f8f924
SSDEEP 12288:6VkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F45236F675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 854a15fa59036ee47b41b88a69e28c18d92ee3bce3b4467dd4a406d9dc6144af
MD5 ed16f58e95c62ab0f2723e48a01659ad
SHA1 3204df62673a64657a956c35ab2ad2215620295b
SHA512 d4cae708df355504493e34fa7632f8ee2c7bd4249a976b64ed915c75068a5c5ce95bedcadc7dd0a00dde9dd1292617ba059f7d606b1de33608ca6bc9c146f675
SSDEEP 12288:wsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wssqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE965C41CAE52644B5C3E5E14DEC073E5BE9200483BA9B7CBDF7B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b381ca258deaf551f716b32c8e6848f4aef63ff6a5d339b72a53dafb8794d8a6
MD5 20be2b909e5066eb1d29edddfee75bb1
SHA1 4f7e5c31986a35717763232fc404c1bcf4d61b8c
SHA512 e55e52c8f5f06aeb3bf5d16a3b8f28381de288404e448a8b05947076fec80c2cad648192b22273f44b8ede3975cf478727b2a5efa989e594a21a9d76c48d4313
SSDEEP 12288:knXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:knsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BE965C41CAE92644B5C3E5E14DEC073E5BE92004837A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ab3b254ac36a8b30f8fb15dff05db2e424d25316e3d1cf884eb18d1b8cfc1b55
MD5 ae42caad77bf47e46f39972c22aab363
SHA1 1ae17ceccb2727991c7dedac9434eeb2ea6d068b
SHA512 973f8518a2cbc4612d394aed4d82286a686f54d5082a2f2141d7cc7f45e5d587f9562938696276e69d4f23ca552f1e443e7367cab1d869fdf1313f9104181327
SSDEEP 12288:lDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE965C41CAE92644B5C3E5E14DAC073E5BE9200483BA6B7CBDF7F14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 db72bd30538f2ecb44b5d66760f448bc566ab3770bed622021e78bc9abb89dce
MD5 c912b0fdbbafbf33f6ce6585075aa8d8
SHA1 fa4c06151ee46562c19517d6cd17ac3a196ee4ee
SHA512 c7fc9c9c4526d8e6b7b63c9161fad94ebbe1c4f9ce92aae21ae6ccd6118103cce3f180acb05918168dd7bd73d0daaa0acc0e3da27fc25856175c94210523beeb
SSDEEP 24576:QZMRzFVSO7sqjnhMgeiCl7G0nehbGZpbD:QZMRzfLDmg27RnWGj
TLSH
T1516501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cc323b697ef0d701f824fce1bde4a83294852d20a7902b48d9712e02a10f909b
MD5 6bec0049341a41f5cbd71c1b3b71b0d5
SHA1 c54f194da71106cb432d1f5a5ebcc98e0043a217
SHA512 de381dd5aab6c12f76e818c39444c1e5fb2aea70d895812ef4cf0e528e266af828264a851fa2a3c548ff2fe0fb99cebb9eb73f979b59d30172f068df1f7369ae
SSDEEP 12288:EWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BF965C51CAE92604B5C3E5E14DEC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b3a75689d0dc316a73f2cd66b54f8c69aab8dbc3df324b0401b39c31131ae264
MD5 1395f138462a2ea6b18af3a2dd1e90a0
SHA1 b5857ed6b8d7ca1dfa0dca3e8f97de0995cdc80e
SHA512 7c0d54342de182cbc80ee80d475c48b39e1d98de7ddfe01608f52412e2e34b2c50fdca3e854ffe0762859a684abce56ffda0756e6ae6337e82f6adfbae9ba829
SSDEEP 12288:j6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BF965C41CAE92644B5C3E5E14DAC073E5BE9200483BA6B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f5550c21f475f074e1908f1e33d7c47ef7c5707a03188ad7f66562b3c8d18903
MD5 0229c09745a08db0243b5beb206794a5
SHA1 3a4f96740c8b3497fe4239cf5293b7b8afe055d1
SHA512 deb72760be7de2399e2abc47f4662f58e50ecc9625c33815be221c616368a2f78541bc8dcfa6d686446ba20843e9939600aaab775c2ec520e0a548e3d721e598
SSDEEP 12288:CyPz5L8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11855025B73A430F9D1368178C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e9e2107a522e372b9cedbd3ee9f7ef10468a9aedada42da2e91a1c8fba8243be
MD5 c9f990cc624019ad441797b0d5ab59d0
SHA1 68c1d2bddbf5711099d6668d4184a97e2a8b5238
SHA512 bbf567c76a13d6f90f4451e47f0baf4a84ba402bd7720c475ae37f681dabe54c7fced6305155bdd5e392adf4c7c43e75b6713f82c42c24cbfa67d72ec2a7ce3f
SSDEEP 12288:UWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BF965C51CAE92604B5C3E5E14DEC073E5BE9200483BA5B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2e147663b95cc846edb0d7001aec0b8e1cf420321050498c7d15ca39e5b8f86c
MD5 69f1f824d791e7fc33cb7f7e7afd202e
SHA1 7db3da38bd9c048749e899307462a5a58cad866f
SHA512 ca225cf3a3efe637265651b1d7554ae394639a1b1dafcc64b240e258e0ae18d0b04d7f492f13dd67365d4de0397b5d4b530b1cab923a0f3408dc4f764ccc3bc6
SSDEEP 12288:SWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BF965C51CAE92604B5C3E9E14DEC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 41946259b735f4adb79562d607a983b59104c2707635baa6b04c370fa6bc2ac2
MD5 8aa354f2e454ca62c816d6cccc10c7bb
SHA1 c76b1ce3bfddc744a7ca3c4386351e3a7c379949
SHA512 8adb957ae2ae2317bdae2f48b8934ad8cb0a7d6893951dd90b8aa92bf10b8a80f0794322205980fc2fb7a38c3a6b8834f003bcb97d4ccbfe6bb2a85faaf014f9
SSDEEP 12288:IyPz5L8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Jzy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19055025B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 486a248a87c827e763a72b1d9c0fad811c8d272a2bc831251e4aa2891c33f81d
MD5 341d0730809ce9c5ef16ea5f5f80ef7f
SHA1 944760b04182cc4a158bb02f6c1638b116898b8f
SHA512 a77e9601de772d367103daf2b834067963670092b09507dc14542b7cc531659eace4c5fcc93edbd837e14e541211ca14956ba98fa462b5d9fa75de9ddfa7204d
SSDEEP 24576:ZTDaLl3z0zDdsqjnhMgeiCl7G0nehbGZpbD:ZTuLljMDmg27RnWGj
TLSH
T1F76501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c93abc2d1ab6f678b82b05c0ceb638d6b60a4e827f0c431fbbb6bd2ac779252a
MD5 62e464419e802e060b810e6f7df33349
SHA1 08780a759b3b78ecb6331388d04bbb63e2313968
SHA512 8d4a4500ea89a85911e621bef7882b736af920c3c94a32560cf689bd9148e204dfc221afb995a11504d1c30e59d104414500ac1cffe02f5bfb43e60449a353f9
SSDEEP 24576:/3vd9CHKy7GZZsqjnhMgeiCl7G0nehbGZpbD:Pvd9CHKyaLDmg27RnWGj
TLSH
T14D75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 daccc1a78c2d6250e5fab37c5d8b05b0427c286d259bf7c9ca4ef6810aaca53a
MD5 40e290a6f4d99cee9eff13f9dd5a1f9a
SHA1 18105aa543baca6a5406fa260b7b43cf3590d238
SHA512 a24f753138b7591dd537b545926547de0a93dbb87f326d5df5db5af80623577d93787689b92309fb29d250fcce1cf0b0d47e0437e38078b03a47c8e6305bc884
SSDEEP 12288:lNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1134523BE965C41CAE52644B5C3E9F14DEC073E5BE92004837A9B7CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a0931602ac45386856ef37d387809bad038b7033486501aba8cea816529b53e8
MD5 2287e7bcdd143e6193b0d2ed9b8d0021
SHA1 c9fb9739270d8ea42f84ad210bfa8bbd056621da
SHA512 48e627577832386d0dba508d09dd7fa2fab8d30604e70439f6b28bde74f75d7594004dca96cd12e9b15b95db1d5269393716ae7409aeda1d4b107eec892ce52d
SSDEEP 12288:dfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BE965C41DAE92644F5C3E9E10DAC073E5BE92004837A977CBEE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 45282c0b0fa8d6c2c801e448d0422970b28e655c23b68e631797df04d3a67301
MD5 d6728cf2bcdb0abc5e4be1a355b95f2a
SHA1 b0f8eed84b82829ff181e1d13be1f66e4ffc352c
SHA512 846a1e1a7402c65d4d93c69443a74fc3b30ea8b4b41905465b4516f007df862171c873dcd3673ec574b82b5588efc107e7a6a0b851ca35b41037079a3a226647
SSDEEP 12288:1YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BE965C41CAE52644B5C3E5E14DEC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f94fb7d1940f644dca7315cc88922970947b854be4e92175bca70d11fed3fc88
MD5 7151b7bb9aa197a616c08f9f3e9b4d9b
SHA1 9f29a79ae61d77ee0ebd70f6677a5630ba1a0b35
SHA512 01c9df55a0d206fd9ec0a2f3b92c164fe71f69ae4ccfdc687acc1e8c2bdccf3359c6b7855708243e9cc3e6a32a15a6d5614b1ca71f6d0cc13e3bb67af2b73e98
SSDEEP 12288:9WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BF965C51CAE52604B5C3E5E14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d2951f6dfc9ca1cca69117cbd36609bc52c332296dff3bc1e0b22bf374eceb56
MD5 326aa12beb3f9505d9ef027e993b05a2
SHA1 cef759dc8f8c8a85eb0093f38b09af00038200cf
SHA512 4290f637be1a50e618449deb31ea74df2a7cafd0f8f3f357af6e6e5a063496d5cf43092763740cc36e968ce55b289c346e141ea097b9b000945cbded366f239d
SSDEEP 12288:LNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BF965C41CAE52648B5C3E5E14DEC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1d129032b458d8f4baccb94f13b2151ee8768b47abbd8946cef07f32224f437f
MD5 9ab4929bfa9a5c34b5114e5fcede066f
SHA1 549d08d4954f34db977bafefa8593c5c20fdb7f5
SHA512 6553024b90722d1b109a6fef2d0b531a3c07ba09f5315e8c6b11f1373e3006baad4f363e9f2c01df5205f0209540349252ccb58df72a044c8a3aba433426eedc
SSDEEP 12288:xeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BE965C41CAE92644F5C3E9E11DAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-18_023541_472-480.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-18_023541_472-480.log
Size 1KB
SHA256 2b91785696cf723cda102c922043959b9883c348eb5e6b8f0eaaa696789ea8ce
MD5 a5c7671050afc4efaed0eddf13064bab
SHA1 9b586f7b9e7ebcfaf6dde2622be091a5b3b0fc50
SHA512 a4cb63467eabd406ca4a2b0e074ef8624ee89074d282b060ee782c9dc417168ccbc608b64da12b9c52b01a5d95aa53930df723f34f50e706099c5949f4454b8b
TLSH
T1E921842A3BD81A06FFFBD9C298FA1143DE3679916834CA0D00E5524D0872F41EDB172B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4a3392721eb43fa8b972030e595c4e98a2c41089f9899cee0c085a629ca749cf
MD5 26632d80d41e5d76a8e043e76b120e11
SHA1 39ebf41351be4b990c21a5be3c494dbe89c39d94
SHA512 0e1aea00e84b82a19e82f590a731ed6f7c6df0333a197b9e5c8daf221b1fc9f1eb25b235f7f241c231fa3d06df0c2a2a28570df672007a978ea1546cb846538d
SSDEEP 24576:QfwvUk9RX6wkyAIKsqjnhMgeiCl7G0nehbGZpbD:kMnYIeDmg27RnWGj
TLSH
T15F85D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ec61675b3ec78dfdcaa83d7ea5fb6da48e9b2e07cce75e9f8f76b5046cefe2c2
MD5 ab1ab255d94afe7e677f298d4c64d8f3
SHA1 413d23f05d3295a651173c702aa657effd1206a2
SHA512 3db3a1f2d287f5b74d836570bea0e55ec9b708b2b9f7444acc23fbae2aeb0eac10f439988953778817cf41f9053dc75e06dbb9e289c5e2805e66fe889648eaf1
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VDmg27RnWGj:NySzPdD527BWG
TLSH
T132066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a68101ef36ec25d439d4926a72f112c7a329db74e63510ed8d7bdf7c15965449
MD5 024010cb8c5d2acdb14713254975cdc4
SHA1 b6b09c08662e49cd2c94589dd5195394f6222ddb
SHA512 5a23b7120e5b56e86250566c65881fd76b44985bf113ef61822a609c758b434da570eed9a51342515a5292478d85d2fc3c4a5fceae3f24c450d5faf662d60dc1
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLsqjnhMgeiCl7G0nehbGZpbD:m47JUQjTirIhCnDHUPfF/lDmg27RnWGj
TLSH
T17B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 222b8213aeadab28e2650cc2cfc517c6ae3a821bdf117f8ddfd56726b63acc6d
MD5 cd9b61c178cb45df9b57eb702639e792
SHA1 93f88c0e302abd20007b4d5a8beb78a68ff5d623
SHA512 6b601ab650e5a7ce80633523ad32e5481413b7a76b4c9448dc0fc4a9062176875e11dbbffd3f40a151306db4060457cc03d5c9e929a66a3545504ff5d1b42f6c
SSDEEP 12288:RbsfGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10055015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1f26cdac561c9d989be308bff3dda97be23e2bc9af3bf08d879025d3b537d61b
MD5 1b71fb7d66cd24e8096cccd0ad5c6969
SHA1 1b3f91f89e77f6d49aaf2d3a6a9c85e0aad8174d
SHA512 d0c85b632793aafe902e37a56d802322bc073bd6f7be838ce089bef7d779d71fa46c4b33114e87b62d64ab2028e65e099627cece4b5928e5a9d591f66d95ef7d
SSDEEP 6144:PsBC2narojydgPi/DPotMx67jgbU3fhklKCYCI12r2/03Af1ylviI1yPRO70pfAE:wSkAU3fiXYWrAyKAp0ddGj4iBbjD
TLSH
T1304517417626C74FC6AD80325E32D1CCAB707D11EE04AF0373C99B3E9576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 63e9aae92e3137d93ba4fd89d537fb92af92eded1c515cc2a2988ad5b56534b4
MD5 8b386ad301b4a3a69e128bd9f9cc4fe4
SHA1 464fb01ac4d59cd612390ecab306df55224ef33a
SHA512 a2612631f0c92db57314a7d24bfedf3908c35f925a4948a224f2183c98a44eeae6fa6b22821879532a896912354edc3b191ee5b050a3ece0df7c72869d65a84a
SSDEEP 6144:aZI6MAKeG03i03b03Rhrs67X+PP5Disntw+VI8oNXG03r03Y1D9tMxDzJw03o03o:9fhrssOPP5Dis6kJSKHfpr2
TLSH
T15C75F9816537E38FC1BA503207365B8D7BA4EC17B7496F22B3C9443DD86BA15A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 29fa9bc900380d46aec12f644e274160e220b1d1a3c73a38c9b4eca0c4b3dd55
MD5 a856ae93edce5aefbc6eb9a99eab2144
SHA1 2002857beaf8c128da7ccf2bc171e8996eea5e5a
SHA512 519da5f14d45eb5cb415964c460d0a430d723a259fec7bc613a67d0602f2498d19237fc287d23f343a384bdae95a0715b80bb861d4373b24f8ae0aa0e5a23078
SSDEEP 12288:e07OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19945237B934C518AF83605B482EAE12DA80B7E669F1044C3BA5778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9e2a12329b9bac85e8202ddfe15656e6e5f1acfd47aa685805ff4790998d5b78
MD5 0cdc506d578e23d42c1e6d62535a9be1
SHA1 611cc8d8aa64e929ac5dc4054b3c0afe4b2df0c4
SHA512 96762ac9a77a9d3a45fbcfa02bae90a543f999cccbf2c482d83e91c8f889ecd3475501b46173dc86178e1f469e0a35a9efdc9f9c2bb4de2fba7708471085312f
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYQsqjnhMgeiCl7G0nehbGZpbD:6gb4mBIBhGF/Dmg27RnWGj
TLSH
T17B659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e5d5f68928947a3cc7b84844ee51f2b11bbbf7d7ad454affbeb4cf72e830e3a7
MD5 dffd87d6decf714dc0f35c138f86c4a8
SHA1 b224b42edbde5ed779af01b80820d80c663a4327
SHA512 cc9f7c37a8dd21a700d0b70570ab39a60d0e7099c21c868296dd7bed5629aeecb43f4402613fca329428be4c882468670b0a1989b24435a76ab6dbccc1b2d62f
SSDEEP 24576:+G88u8FpJqH1bzria7/m7sqjnhMgeiCl7G0nehbGZpbD:V7ZFPqVea7/kDmg27RnWGj
TLSH
T11285016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9617b6fe6a5b761c82b132ace1c44d409fa03bb03ae3d13e5e1b2a0cae153b67
MD5 8afc94beca87292ac65359c88e9bf885
SHA1 5e1cc4da96e0605657c0ea72692e2fa7bc8e8024
SHA512 4c60bb898a36066693619838a75dbe2bde5e8e304699c3b0fbec2d704d8619c53919ddfefc74bf5b00b184400c489ecf7e75a7d4dece80d9958186ddee63efb5
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Dmg27RnWGj:JG05lO43bWD527BWG
TLSH
T124D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 04ba941859e8c36db8a859e5eda173808c724678d492cacd363da1c4afd61d1a
MD5 0f9c52303d71fbde082c5569afb52071
SHA1 bc420271e9ee2fcaea09fcf142bd131d552d4dab
SHA512 5e849a2209f4620eb0e83366501f6e8c6d8f50d64e2cb07a13556634c56834c3329a028bd2eb24e607e56ff82044a9160ca8e67a1ffb882c4842b80b9716806c
SSDEEP 24576:Dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBsqjnhMgeiCl7G0nehbGZpbD:7a5POZ3BJt2pasx2+mDDmg27RnWGj
TLSH
T1BE65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c822c225e18aaacb2dfb14f190b4640e4116c512c426a4685d0a34c61c666bca
MD5 b578f0afdd99c406ca92da36d09b6721
SHA1 9ef8b00b9e8106543fea0e76aa06dedb0045f570
SHA512 4af6909b6a562ba0bd7113c43037a0de17cf18f0b3751ba34608e25a4a82c62fd35393b878912a25115e1e9369597e11a682a5bc225eb70c8040202469efa31e
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkzsqjnhMgeiCl7G0nehbGZpbD:cNc/zEOVHFEDmg27RnWGj
TLSH
T10F857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c7e39e48b07fa1fc6d288e7fa5728c09dfc591f66b6f8d41a1ca9c1700cf5a29
MD5 b4b788ea092ce546490ec0cd8468d2da
SHA1 b5ee1c0f663e801272afaa0a41a68e307dcd5e18
SHA512 fe856d9c99c867da014997651eaf187a80eb0ab2f2acf8f00910fb4ad8430cca2c849dceae60bb9ba446d02ba3c52aaed3a78609f5083255c37743fa9139bb9a
SSDEEP 24576:iTkNvNnaFeYhJNtmZBmYsqjnhMgeiCl7G0nehbGZpbD:iTMwBtOmEDmg27RnWGj
TLSH
T1A355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 056b7a08f19528cf844f72ad3013e18bf8c17be4a83be272b22451e2fd50e728
MD5 1ce703befb39c8defc3236512ed59bc2
SHA1 d61dc2579e2890e8c526067d16ec695e0cbe3bb9
SHA512 abfa3ca26972a8236f29758e0d632f61fa49b57753b2b08a83b87a15613c1118c05fa18adfb5deff7de52ed60292e00dcf52dfa3ccefbfe194a2419efb7f1bbf
SSDEEP 12288:1HvUrBFrEjwaQ3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:1PUr+NQ3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ef3617a4102090283e4e3e0ca853a4f58eebaa5b4f2f42f868da98048308919f
MD5 e34e47cceace73bd3a3d0aaee0a21add
SHA1 06ca29281ef5ed7f569da29b84d4a500f5dc50bd
SHA512 adf4de36961d49ddba76acb532fc51eed587c7867ddd36c39c6bc42d0c5fb973f4d8c1e7241403c2871d4b42c91159d449958a165149850ce80b551fc4a1d740
SSDEEP 24576:xD3FHshBIYQgAisqjnhMgeiCl7G0nehbGZpbD:xDVHeBIAAmDmg27RnWGj
TLSH
T17775E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/252-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/472-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/472-55-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/472-0-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/472-8-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/472-7-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/472-51-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/1064-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1064-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1064-331-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1064-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1064-91-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1064-97-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1364-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1364-77-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1364-285-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1364-83-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2392-244-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2392-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2392-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2392-71-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2812-123-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2812-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2812-117-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2812-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3532-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3532-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3728-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3728-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3728-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4316-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4316-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4316-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4316-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4316-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4704-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4704-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4704-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5060-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5060-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5060-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5060-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5060-314-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5156-330-0x000002AD65AA0000-0x000002AD65C23000-memory.dmp

Download

memory/5156-329-0x000002AD65710000-0x000002AD6599B000-memory.dmp

Download

memory/5156-406-0x000002AD65AA0000-0x000002AD65C23000-memory.dmp

Download

memory/5868-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5868-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5868-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5868-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download