8147ef069d0bb803707f41a9499bfa38867598ca31656b9d1a18ecf473daac26

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260719-xe2xesbz7s
SHA256 8147ef069d0bb803707f41a9499bfa38867598ca31656b9d1a18ecf473daac26
MD5 b959456dd7e862208871e3eb12977624
SHA1 a138889222a920a095b82f2082d09c1ed2f14278
SHA512 c6422bc9b074d31e8a7794d9b466daffd22d32236d1569cf156a126f8f3e46e7785c5e98687e4a83c1fd6b96244a7fecc3a55f7e425a818ccc53dce36ff6cbb4
SSDEEP 49152:c0V8tmfJCiulRM6Cm33aC0npmZNkj8A5cfi6jQCw2OzKTG55gek668zNkMpMEQoe:RCJxAUdHcRkeMEQoba
TLSH
T15E167C0BE6B940E4C4BBD13D8A539657FAB27849877197CB47A0871A4F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4440	elevation_service.exe
1924	elevation_service.exe
2004	maintenanceservice.exe
2412	OSE.EXE
2744	PerceptionSimulationService.exe
1640	perfhost.exe
1360	ReFsDedupSvc.exe
5692	SensorDataService.exe
5780	ssh-agent.exe
5936	AgentService.exe
5584	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\97874c14238bf42.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-07-19.1846.2196.2.aodl	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000725bc702af17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b394c01af17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f117c00af17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099019900af17dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0aa6001af17dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2196	2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4440	elevation_service.exe
Token: SeBackupPrivilege	1360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1360	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5936	AgentService.exe
Token: SeBackupPrivilege	1360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1360	ReFsDedupSvc.exe
Token: 33	5584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5584	SearchIndexer.exe
Token: SeDebugPrivilege	4440	elevation_service.exe
Token: SeDebugPrivilege	1924	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 2640	5584	SearchIndexer.exe	100
PID 5584 wrote to memory of 3944	5584	SearchIndexer.exe	101
PID 5584 wrote to memory of 5568	5584	SearchIndexer.exe	102
PID 5584 wrote to memory of 4976	5584	SearchIndexer.exe	103
PID 5584 wrote to memory of 608	5584	SearchIndexer.exe	105
PID 5584 wrote to memory of 1364	5584	SearchIndexer.exe	106
PID 5584 wrote to memory of 2788	5584	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_b959456dd7e862208871e3eb12977624_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0ee421a209d89583caa975682b7a3186bb70ffd7a5405dde041e3c1a182e889e
MD5 21273973eaedb5b2f82136b8711b5b8e
SHA1 464817cc25d031e34d1bf2d9f818b4b0931fa6eb
SHA512 06b4ed7500627dc0975590453ef041c9eb71ddd2574c1c149dce81941fd9bac7e776abc43634b61f09793495c1ffead56d37a5288504ecabcac8dd7a0d08125a
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnF668zNkMpMEQoUwa:o3q6HjB4cRkeMEQoba
TLSH
T190D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 de8fdb043e7635446037d27f02050b480b8361af32e4ea4f1c92b3216c5c247e
MD5 1ae87504319c40bdb8901cc580848866
SHA1 b6df6440bc8e7d2d9b840917792ad7a9a44989ff
SHA512 76086b49df8e0922f9775586b261b280b5640d5a4c4199f3deb0aa165d291fff113914426831ca4085af90be7def92e829c5ed312c104bfa2e2aa97303ef7ea0
SSDEEP 24576:gXYfDtczAI66sW6RzzJkduZbME6DoIDwixj7v:Xtc/668zNkMpMEQoUwa
TLSH
T1E565F16973D509F9DC6B8238C8A28501EA33BC914761E78B03F4AA664F337D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ecd74bc4181cfa748920adeec743eaedfe3036623fccf73ea944e0ad9404f529
MD5 0b77aa02a330870f587a91cea5fa8ea4
SHA1 2bd86a791265bfc1711895215abbf859594d8e55
SHA512 ae558fc7147464f5d38b3bf643adea5a01900985855b4e92cacfc64201114c097cfb4afea22b7d9c8cb44e78c044a273002be18a062397db23e5452fa94ade34
SSDEEP 24576:N0Le5ji0hmxLrMN66sW6RzzJkduZbME6DoIDwixj7v:NPji0AlW668zNkMpMEQoUwa
TLSH
T1DF85AE56F6748331D073C0B9C5D2A68AEA7130821B318ACB4296D77C6F67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e04e17d28a9bcc6fd74a562e33a8672d3a171dc2a12d9ed49bf199f4aeb4d78b
MD5 628c20e5634e61f3b9b5ae899b73d975
SHA1 b9239fe5a6d5ed2721b933b854028097d05fc7ed
SHA512 166b9c5298641cc5d1741316578182b3f62a1c48551c4f2c0c1691fd1271166c3f47681ad3996acccc14723ee9e50f7881dc651a88543d398ff423ee3eb23a76
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuv66sW6RzzJkduZbME6DoIDwixj7v:R/ezSC6vUzPvxHjyS668zNkMpMEQoUwa
TLSH
T12A756C55F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dec66f9ffd31c7d0ce8e38f5d1d24a70cc6e414f199b8511559a31603bd7ec81
MD5 b12130035b8c2c75860e76cdf3247a4f
SHA1 b71756a24f338dfa00171002dab22e639d733cb7
SHA512 05a1019294820f8add28566b5c72584af12e4cbf8c9a497ad0fe05aecf5dcf3d1740b4f08b64b2895b0b7e8d86aeefad0d4aeec7779594e28054456fd55538aa
SSDEEP 24576:LVbqPb88hv/l+6s66sW6RzzJkduZbME6DoIDwixj7v:LVO88hXl+Z668zNkMpMEQoUwa
TLSH
T190559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cff5c15ce6a11ee558e864a80cb0d5a38cefb73bff8965616c8cb228c81c845b
MD5 18b4a8de53c6e46956cd3c8e2714e3ac
SHA1 f862015f635843eaa8a470519031c992f79f89cf
SHA512 d69bf15fb7005fa2167d60a7c317d9d4ad06977be6074eec95e96a32df6fc421e261b49690e42a9dbec42d50cd2401be7740d45d3e3c8941b8fcc2a97de98244
SSDEEP 12288:+zAO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:+zh66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1185523C6138A97D1DCAF1A3115EA1C41D76ADFE46D13A70BDAB03FA68D3CA91DC01172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 da083b56c316f9c0dc777e529f848b789163427a843a307669f7693cf4c119b9
MD5 edb63edb4f2a2fcfaa3c27dc3ec94227
SHA1 f62c572740ffb15f7556dcd45d8805ce263a072b
SHA512 eef755733d64fce0f5d9737c9e48a643c215e5d4971b511c67af262ad8da0d21ec7d08969c3ec7e353678548d411e297a609bb2c7c7a7ffce7c0719123e879f9
SSDEEP 24576:uJIUk66sW6RzzJkduZbME6DoIDwixj7v:uJIUk668zNkMpMEQoUwa
TLSH
T1DF75CE7BAE28FCE2C67E8D785A918600D77278704F22A3CBD174930ECE275E15E75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ed606667c12b8d6576f5c510244afa21dd0b848a6f9beb37dc2bea4aa8c8cdb
MD5 4880235482e294b49afdabd8d3d87f5f
SHA1 688601edc50bbdca81e282146ac4bde0cd7bd5cf
SHA512 5f9765ddd1cee73e682fb6188931fca9aa7be060f68427040628e2bbd3c570e9c1e496c4bd497a7de9b70deeb3ee9ca63823b5d010c964a7cbbe02555618fce4
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:9QvGAdlCEL8c/yRNw5CfcRkeMEQoba
TLSH
T141267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0a916adc6f345eabb5e9a3172a0c504d25693a6fe86d72a6cc0833ea7fae17fb
MD5 bc4ad3c21ea2541c4eb17d4c918de77b
SHA1 89a1757f5401026a6a7040e3e9fe28a369d4e279
SHA512 1b67f644905448ee2f703800a5a833a5e45ddc6f073fe4d206ce4cb5c511f7ccc750bacde8135cd72c449fef6cc7296707cd597bb0baa4b5f0432c452566e87e
SSDEEP 24576:5QewsAjG66sW6RzzJkduZbME6DoIDwixj7v:uljG668zNkMpMEQoUwa
TLSH
T12275E071FA74D032C6BF0DB21B76C706542DBA604F521AC3E3B85E9E49342D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f36209d6c90224046ac9c85b66a8ae16e2c12e16a4db405b860de1c3ab094c9
MD5 9a6b3c8192aea3a1ad743654d005583e
SHA1 0d53f4b898e5a8cd622e0d53b542cd207de33906
SHA512 d49bd826203214cd8bffb90231204871fb105a0a6e01fb52d6bfac9038a3c6db5773668fca95915fd8877b55301c9c4310b30029e5b8dcbe8d33a2d7ec8d541a
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHucieKh:XUEtQevvqc2W1cpV2EI32u9e
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c66a0f2ce83259ceb9ebb18745915edc607c0c234f95820a456daa4b2465b262
MD5 3c34ba8c01ec0130c2a87f0257ce3dbb
SHA1 c14e07bd26d4905f8c831901f01e3b62ef8aeea9
SHA512 51ab311b1a8a73180c37c248f3fa6f73ee9cc013767bed27692e9f92ddc9467d18d4ce9c42ade7dc582fd28ad055c5e6625f3bf691eea828bdee3bf211c41c18
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/zm668zNkMpMEQoUwa:ioqHVjnmbcRkeMEQoba
TLSH
T1C8D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3b41e1cf5ef6b3bb641382d07795900f8efd8e00ee5e05c83f66c33dafb4b1bf
MD5 57ec20dc266fda4e597ab682deace463
SHA1 ae90a1b3ddb48d01d518de04bc1058a58bc5410d
SHA512 1369222789482d74f58703d90d572e2bfb98a8adeebf9484a0eedf8c4cf1f778dcfe6e5290be98d84e5532c787adde875a329ee0c9c08c5ce1b23f997c85e29e
SSDEEP 24576:mAhGLJIFoiwtA5l7S53766sW6RzzJkduZbME6DoIDwixj7v:mAMyFoiq5L668zNkMpMEQoUwa
TLSH
T1F6359D81E7F945D4F5B7AA7899B68570EA76BCA65E31C20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 239c4d82330e345c914f277e4fc41cc4e264d89d77125209cbbb7ba5500d6d57
MD5 699f6327eabd4d64bc45cccf67d5355a
SHA1 b48eb81a163390214207fcf03ce91ac1c03c7d90
SHA512 9211bf8d735246b60d84d0be30c6aabdfe4aac22575cda46372ca6d49c9ea1c6295a1db7fb7d4cb4fc6d14c2b22b72a77486aee6cd57988462860a7da9739b59
SSDEEP 24576:7wuHOWy66sW6RzzJkduZbME6DoIDwixj7v:7wsOH668zNkMpMEQoUwa
TLSH
T1A765F18633E90CF9E9AB463885978532E7B2BC112A22D70F5770C75B5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a0ea09fd07d58e39b91f9370b820a748bba4c7c3b30c0d9a40159503b4906a8e
MD5 f69b70d0cb1d4a91607f6f95379aa715
SHA1 696b130fe2d265e1d0512fbe94e013262f9afb69
SHA512 47f05684bbfdefdf6c063776db98758624a89eab189757622b89b82642f09b66db591c936783ca113e4e33f4096246dc7a8a00eace16491ed744079c23657b29
SSDEEP 12288:FXZ1Iy/O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:VZul66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1C05512CA23D862F5D4AB463888E51901D772BCA22B3393CF567077A64F36AD19D35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8b2b4b243c252e9882d5aab3d09ff9e170189968185f7876d9ab5c2d75bf60aa
MD5 71650f8a80035396b02a1e9c179dee2d
SHA1 4c37be1fac9e5690fef55cb30028592b69846768
SHA512 f7d6289bb9e8769cc7f4f838ff6bc4cf31e6124a879e304eaa9dbc851de3d56666068e8f6e55d0c4b643cab680a3385b89395726c8d8bace025b5f928e6d747c
SSDEEP 98304:SQRQyi36YOcPQLvw2gAf+PN3AcRkeMEQoba:JQyiKayX+PNQcieKh
TLSH
T119667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6eaa94ff36b05d41e9576e402867e750f72afb5d5ec872c0363ac025da7131fe
MD5 a6f1ec696d0240dfaa3db4a843898147
SHA1 1f92b8a37c9e19b8c0b25262434d68745f457c76
SHA512 6d4178ff7f118a06b24e0797799cbeb9dfce8ae102d0b1efbf6b5a89c0eab699b85a8720bdd489d0d22c2103a49ad53f8e2db9105db42239d7bc477200aee925
SSDEEP 98304:FQRQyi36YOcPQLvw2gAf+PN3AcRkeMEQoba:8QyiKayX+PNQcieKh
TLSH
T1B8667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e1df802b49dd62433a7ae57cd4ddbc5ce79db76f6d97300d0857ca4a34415a45
MD5 f7bd3e0555d0a336f538493b502b7eb0
SHA1 069c52fdf2f4bf276e7815e9bc9577254782f488
SHA512 ccfd0cafdb5fec9fd0e07ae9247337369840bf3116b6127732d0874c6a08efd091550e2204642b014b622bf39471a98360ee0f74027378d05c30cd9570fef2a3
SSDEEP 49152:S68Qg55nhheWu7PNU3/W668zNkMpMEQoUwa:QthWRc/WcRkeMEQoba
TLSH
T1EDB55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9dd2d1e92ea2a74cea1ad87888faad8bb2fb32644ef51c0dd91195cf83dd5d07
MD5 06f26f5c1c6661c7ddaf90c608e8b5bf
SHA1 f8857b9ca4ff4c8ea4105aa1ff95329c85858859
SHA512 b3700b461643e7760233390a760bfb9314827bad877809cf1d354e37a04e544d5f4f427e8d0f53c0da12a415ae5eb1cdb7e03bbf9a3ff6a60d01f185ee13d917
SSDEEP 98304:1y5112gYy5azzVvL69nLKnhZhcRkeMEQoba:YLIHmWhjcieKh
TLSH
T1B3167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 057a7cbaf5589b76cb60a8bdc1ed8c28cfd68d9d3dbe25117e5a890b88432fd0
MD5 65b0814ce3d7d3f2fc8342b8f65b7bfa
SHA1 0df8b92fc4ec36fa9ddcea78cde3d879836328e0
SHA512 2146183fc6013a718b488e200bc4bd11b73719c9fee50280d7c7388b285e4f9655d9a35cb7f72c92283587f5f7daa3ccbd4ec7e136587449a6873d33b1428123
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glk668zNkMpMEQoUwa:Pu6JmVxd2dkcRkeMEQoba
TLSH
T1EBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45b4afbda41cd8b7b863780fba4777bd0b4b10da495522596da4df33555dfa76
MD5 bcf9237b6e4a4c3d1cadb09a0b67868c
SHA1 9bc06348ace6a7020cca1536556d797a544697d7
SHA512 ac2951a87578eb67f1745c82ca023c134a6aa75447b9164393609ae77cbc7f7ea4f96477dba6f1d736795d72ada9314889472bc8b5e3beed80888ed239581740
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xE668zNkMpMEQoUwa:ymifPbRbcRkeMEQoba
TLSH
T11CB5BE13F2D901E8D06ED17887569232EA62BC460B31B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 05e77e8381cdc525c45ecdce5b0c3e1bb888e90d2cc509c1db98c4d5ed4f9d1e
MD5 149382712711018c586fd8666ca4ad4a
SHA1 bd13468b14fec731042c4641be37ab0025f3e815
SHA512 7212f6c27aa8571dd17d2d1b7912eb663475d9300eecd91764faafda7be62b70af280832f12b1ba61138b5c6ab9cd41508575c47ec167ca528a3a187dbb61a21
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHql668zNkMpMEQoUwa:i5dKTi61lcRkeMEQoba
TLSH
T147C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF065072551E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c79781a1afbf1354b7d14a537d33ea4e6c42c740617b9ce7497f69d0c41a87d3
MD5 794ca540a5c9e9907aa4cea8d39bf0d9
SHA1 04e10d9b32261706b68cea9abf9382cb5a89828b
SHA512 21100c0b7f8ea65b08786effd1c82dea763a1100125bedf2744f957a10c2b65657f59cb19b0f9b19b34b115769a031029d115ea2c1326d6bdbc7f340bfc76784
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wI668zNkMpMEQoUwa:AX2iyphncRkeMEQoba
TLSH
T1CC95BE13F2D901E8D05ED178C7468632EA62BC160B35BADF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7abc57dde655b40fe005e0b641327345bb91fe78bfd9059e64298efee7791bb1
MD5 b6766e259d31c4d222748b28a88eb209
SHA1 d2b94fe23628e493cd321ec58278a28d002a703d
SHA512 ae5b546789cec2dc92c92a0aa9c106738db3bdbff9fa62cb5098a977b2fa103d259e21c92b53d5b75c6b63e6dee323a79d959e1dbd75c345a5df31fb9e819417
SSDEEP 12288:6oO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:6Z66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T14D5523C622CB87D2D85E1A3155E61941D76DAFE67E13634FEBB03B628E3CAA1DD00071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 849bbb74fee1c42556ef4041ac8d1b9ac95617c2eed81c5f1463c482edcd4cf5
MD5 77e0df85452a4eb3adaf55dffcedc0d6
SHA1 158268e3c26ac99663fdce81eda5856cd59cb3d8
SHA512 141e27f7c813e4aeeeafd2e4d0ddcc783f871f4293cf03d4460240a006fd1733deead86f2898b8c4da2794e20380eeb1b0673aa6ee4b7e501584fc95ce4bc22b
SSDEEP 12288:ejO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:ea66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1C65523C6228B87D2C85E1A3155E51841D76DEFE67E13A34FEBB03A62CE3CAA1DD01171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4199d09da13ac988a58fcc725c24390626816ea50006a3322e4e9e492a549595
MD5 4cccac0f93ada62a575ca183e9f7cb83
SHA1 55e2a8e18223738ca7266393818380389c9c8802
SHA512 56ffe2921df87cb73868aef5d275df218e012c2c8e81226f21eff3ae48a4521e35511c1b29a87cbff324357df0ac9b934fc25e5d42c7a4ba8694ace0f735e6a1
SSDEEP 12288:TpO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:T866sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1B65523C6228B87D1C85E1A3155E61941DB6DEFE67D13634FEBB03A62CE3CAA1DD010B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 eb889939e8893bc4c15cc8b4db7d0ee83917c66d7a40ff3fb2960f8a163109d8
MD5 0479c78a8a027c0768aba8058f2e8b7e
SHA1 7051c7274bc2ca1589f49cc9cc52b9fe8848f20c
SHA512 05b3b71a77878a90497b81503c81ae85790c622b7d65cef89314f22574978cb152bea3148f36ed9c53fcfac48aae7795beee606d66311b8d7ae1e1856130c6d4
SSDEEP 12288:ZVuO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:366sW6RzzJkduZbME6DoIDwixj7v
TLSH
T10C5523C6238A43D1C86E9A3189F61841D779FEE5AA23A34FDB703A564E387D0DD20671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8c8211554db244069314155c942d406b781480c6d42f8c146ee23d9136413f8c
MD5 896d804f09b827965f7e46ba744704bc
SHA1 319184ba1694bc2f8ccce6bf498730fdb62a8014
SHA512 5a01512aaa8d141cc340aa2018d0a2b29879b98b0d7ecdaccd63344fd7b11958dba9bf60db957918d26c38c32f070f414b6083b354ce8eb5783b36b9a4d96972
SSDEEP 12288:qmO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:qD66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1475523C6228B87D2D85E1A3155E61941D76DAFE67D13634FEBB03B628E3CAA1DD000B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 752c717fc135f72c73181b2d7daac431010ba34c80db70ccd999c655ff788c3f
MD5 7865324f0b0383db1370157c96f77a5d
SHA1 3a742371f37a395f77d9d3f25b244127fa4ddb1b
SHA512 499867dc5cedd7087add9591b30f62c5319af469851c49bfb4e975adc08f365da16fea97352b6b621e62592f7807e5fe9ce6b2ba5b04219ba920f3983af85bd8
SSDEEP 12288:13O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:1e66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1485523C6228A87D2D85E1A3155E61841D76DEFE67E13634FEBB03B62CE3CAA1DD00171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d7b2ca7d55f23c40ccc0b0f2ddfa02b138c9f9135f321338186a9901e53f2807
MD5 4223cbf06ccfaba8640d9eb35bc3a034
SHA1 34cbecf59cbc575500b2bfb5c090602b38608878
SHA512 f373c3c1583c7a37e0e7779ea6eee6da5833be675a0f1668654a21a3a80080d9934c3a3c0c5c13a330419f99113baca351943ee234b6d46045c7d3b8fb61360c
SSDEEP 12288:a7O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:aC66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1F75523C6228B87D2D85E0A3155E51941D76DEFE67D13A34FEBB03B628E3CAA1DD00172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d370ba2502839356e21d41bfb2e218276248b015c5612847cdb6867dd0028dea
MD5 27f0891f0502ca8f0eb3682dc9e99491
SHA1 ffa5b49346a8f7c40a6290f86b3eaab7225546a9
SHA512 dda24ea984785ec8e3ac9f7f6d994daaceee6e031f98ffd32ba951a9d6a1504219f5c935d6df0d0bcf56ccd956c7b70da131fa66918c12b65fd6b59064b7c793
SSDEEP 24576:wZM3zFVSO666sW6RzzJkduZbME6DoIDwixj7v:wZM3zfO668zNkMpMEQoUwa
TLSH
T11675F1D5739019F4DC6B823EC9A54902D6B2BC6A0B60C70F53F436674F373A15C2ABA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e8355108397e0c5cc84a0844f0ed049cc3a3092a24b344993903bf4ac7a139b4
MD5 85362c0de2732b7a0d5f4f6f99972c25
SHA1 4a4bceb6d2ff72b540ceded90ee1fcfb759f4d7b
SHA512 fb863459231524c91bc5c52b5e8d9a56f9e59a5050f4ac70f23efeeaecac957bfae71debb7ceb160e6cb5cfbd76156a8e9828de6f1dcd6eb685f68606be11ed9
SSDEEP 12288:UkO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:UV66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1FD5523CA228B87D1D85E0A3155E61941DB6DEFE67D13634FEAB03B628E3CAA1DD01071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1d74f99298aeea2e327418f8d84daf2c1c9586dae50349294199d42eebb9b133
MD5 85bac94d25aef3e9c5fc2935c1ccc425
SHA1 cd48a5e0212603d278cd4658ae471de48aaa5716
SHA512 69b30b6b619127d7bd7e476ff4d97b7aa96e30e44e36af591d130951b315d48f307fadd694f8a7182ea1542f9ce094df8357da96f524eeca0532052d97b49233
SSDEEP 12288:HwO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:HR66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T10B5523CA228A87D1D85E1A3115E51D41D76DEFE67D13A34FEBB03B628E3CAA1DD00172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2970f581c6cf99b08eb7e347b2179075d3895bb8decf36e27e6d3bcdb52f48e6
MD5 39dc7d916b8dee51822389669affac39
SHA1 99a4c33d2d70b9499078f70e71a8a184dfc4d8c6
SHA512 658b1e5d59d5bba28b9198c7c4e4460f469df4f5d0376df8f1b4014cfca50da113a17498db268321f75acfd0bbb55b78185de926d0d02227e2a2d9fb76d30d25
SSDEEP 12288:ryPz5L8/O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:Gzy266sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1F3650287339621F5D46B823488A21901F776BC721B229B8F57B027765F3B6E09D3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 59483ce17a6205662c38c144f59c4741d7d79e3127ec3a3fe85c68114e09766b
MD5 60d2ffdda87b393746e4b39e1a451f5e
SHA1 0180ac7734bdbf8c9d5b20c8e867329685362db0
SHA512 81a7b0573328e223634ae2a9438deb067099dd356bbfed3a382608b1970c790f5db51e3c5ce7f9cb6cf1b5c800d32d3ca3b973ac98ad7799f98aa236330c0baf
SSDEEP 12288:7kO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:7V66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T12C5523CA228B87D1D85E0A3155E51941DB6DEFE67D13A34FEAB03B62CE3CAA1DD01071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dcb68f9ad70d2c371528ac26c889b2f36be8b9d8712bb57e8e07ce8f973bf69c
MD5 60fe12a889daa2e8c37954b03412d041
SHA1 47ec653158268c6dfc893b2014fc6103e8e66c6e
SHA512 a62e73d30db012285ddf0e4e23eb6c1550abaf6306de0ac621df23535d3401c312828718397b6a34e48ad849a2031c7a05580e2f103459ab1b2a25ac4935c3b8
SSDEEP 12288:TkO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:TV66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1DE5523CA228B87D1D85E0A3115E51D41DB6DEFE67D13A34FEAB03B628E3CAA1DD01171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2728f9584fdbd446ea7e0999d3e1e4405eacb6f07cc499281ad2a8d32611c78c
MD5 c4deb5cafc836b86e09187af81c8331c
SHA1 f8848951117e674416cef8f9cec437ebe886c55b
SHA512 d3ffd3595b1b4e72face6c4d6b6b71c11fdf31d1a0b24cd05d516209de65439a68fcf6cc89ceff065086c8f774e0a0c344313c8c5e3440b986f422ad17abb1cf
SSDEEP 12288:XyPz5L8/O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:azy266sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1D5650287339621F5D46B823488A21901F776BC721B229B8F57B027765F3B6E09D3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 946ba6096de0459de287788ed7073016ac4543d7d075782f1d96e4f50a6cea4e
MD5 9d3dca42f1e07e0a2acff2dcf1e921bc
SHA1 f2274fffd004a49b8fe68002d643581825132ecc
SHA512 6170cedd32f3dc0bb53124aa3bb027023156e3c6a17887f451d4113a183d8f239467e891619b72d808b6e04ce2120b9e0735cd201f5497a908d94d2c9562ca86
SSDEEP 24576:iT0aLl3z0zDM66sW6RzzJkduZbME6DoIDwixj7v:iTDLljv668zNkMpMEQoUwa
TLSH
T1947501D5B39058F4DC6B863EC8A54902D6B2BC6A0B60C70F53F436674F373A15C29BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8f547c0ee97671d8e8d4f18fcd1ef61d62fe76b3a33e13a6f5ab3a6d7b8bf076
MD5 a8d63a871429d16fba91c9fde95eb6ad
SHA1 c8ef65cd8d7c7981360e59a44a9d484bfa254767
SHA512 f31b790ac8c259c423790c771c84df3aa5910d727b4e5967bf4b7bf5293ac5e06bfab9916e23df1b1336de09e750c433764ea9214b213d5280efb0bc55b5bce3
SSDEEP 24576:C31d9CHKy7GZg66sW6RzzJkduZbME6DoIDwixj7v:k1d9CHKyaO668zNkMpMEQoUwa
TLSH
T1B985CF90F3E811E4F0B79A3589764511DAB67C9A1B31DA8F03A4265A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 622781a24cc38661ed06d81daac4cd8b529a8c1039b9cc7c10fc8999b8b23b64
MD5 3995d5a3da67445e3adc6d9164879e6f
SHA1 6c2d39d8d594736d0ff50e613565325feead320f
SHA512 c9b20c67cd52c83484c52baca74d241c3932964dd4690bfdcaf1b56d8b2ed04ea79a83f3d460212f1ee3a51093cadd654fda8d92e6cd8cff436b7ecb9b6ca6c8
SSDEEP 12288:aJO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:ac66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T12D5523C6228B87D1C85E1A3155E61941D76DAFE67D13A34FEBB03B628E3CAA1DD000B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 44e36fc6aba30f7b2abbdc60df1cfa148622eacaef3de8b2ca88ec761161c4f5
MD5 61b929d368b0fb8de6fdcca6cc7be6b4
SHA1 d255760fb5066eb9819080495453c254adb8c9a6
SHA512 5b6e47e55b2be319b54e7c5d71e6b997d0927810d778d41de1135f12e75979cd17fe90f8238928130367d1e0c3f9e313488d625f349d9bc2dd414a2643b4d343
SSDEEP 12288:vfO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:vW66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1BB5523C6238A87E1D85E1A3115EA1D41D76DEFE57D13634FEBB03A628E3CAA1DD00172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 63a54fe72c5e64c558bae200522c721754e36db7ef1c7617e8fdf10116d519be
MD5 173b600172e5beb0b557ad4f2aa6f345
SHA1 b7963167d755ccd691b0c930d9e70535dd4f1c8e
SHA512 05d63d078322cb37d3c14ebcfcf1400157f28971e8418d8fba2d52db283c1dbd665c122c77d2886988992728e0df0b4159482229e4a53de6c46fd41fdf993baf
SSDEEP 12288:B6O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:BX66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1E45523C6228B87D1D85E1A3155E61941DB6DEFE67D13A34FEBB03B628E3CAA1DD00071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fefcf10d9662e5f911251047773a939b082c55b61d7293242c075bd63b67acd8
MD5 a7aead88a750fcf4d728ec9f0f67766f
SHA1 926dd9c05082e587ccd12444e7d0d7beb349bd68
SHA512 f5bd9e36ebc3375b677f71897555c7bb57b485a37c5236691241ee441e7833c08fc013737fa2db2f04ad5113d38a36c5d761f45636494878964f6324ccb6295b
SSDEEP 12288:nkO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:nV66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1A85523CA228B87D1D85E0A3155E51D41DB6DEFE67D13A34FEAB03B628E3CAA1DD00171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b7d48fc998f86dcf4508edb0a8ad040601a8fb66960bdd65d83a4baf70b85b00
MD5 4a33b864b2d885d5f4f9c75096224b48
SHA1 07d9447ee303a83fe30b35e29fd0bdbfd128d355
SHA512 59104bf78e76670cd66e61dd442f81a7d453e8d25f5183491912b146effc1ab63b3016e95eb5872efb4ddf8f4c49bb002d3c9a3be434825ed625c4c0ae21fba3
SSDEEP 12288:LJO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:Lc66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1745523C6228B87D1C85E1A3115E61941D76DAFE67D13634FEBB03B62CE3CAA1DD001B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fd41af722296348aeeae9df6edf4e01b05f559d40ed673319f9529d3429cfc85
MD5 f0085faba67e97a1106b7fd4bfd31d1c
SHA1 7e108210fae249b444490cc263b064ecd81f2d25
SHA512 e0b085bbc08c964ee84d0e798110c211c77169fa7016a819c4722fbd025afae003776ffa334b717305ac4dd249d735eefcad7e51fd84d018e565015c7109ed79
SSDEEP 12288:FcO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:Fd66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T12E5523CA228A87D1C85E1A3155E61941DB6DEFE67D13A34FEBB03B528E3CAA1DD01071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b5d84612381fd5826e97b1bbb178dfca257f333ad9aa8d76f3088021060c963a
MD5 a309c1f6d975bf41838124fef0d712a3
SHA1 9ff78e5021b927c3fdb6f6a9f4595ec03dee66b4
SHA512 f63a836ca3aff15ffa34b58bba91f90d9f543ed74d3720a963f5c99f96f4d1a6868b4ae3e25b7eae127b682b7836f4b52415fe4cd38b67b145d3502c6b1a86a6
SSDEEP 12288:omO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:oD66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1B25523C6228B87D1C85E1A3155E61941DB6DAFE67D13634FEBB03B628E3CAE1DD001B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 08e7182bf3c0994a470167d3213cf3c2a100a653835bbbd6a54dc38506af6f92
MD5 195d891e7b1c8df49d5d1a7274bcd0bc
SHA1 ea98bca5c154d82357d0d26e3b24972dec3a8852
SHA512 20d90698ed39ae69d6edfca8fec08be2922fabc17423c3b814a2132f7af7f759b96f06303b597d3ac2832ef72baa02fd64e2d65008f134e6142b4df38f902d1d
SSDEEP 24576:mfwv/k9RX6wkyAIB66sW6RzzJkduZbME6DoIDwixj7v:9MnYIB668zNkMpMEQoUwa
TLSH
T13685CF29EBDC45E1E0B7923C99B74606F6B178691B32C2CF12A9536D0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6a3a2215e1097cb2239af82dba4401d4b48fcd6e10d6c05952e4fbd5b794861e
MD5 a3b7989ec2ebc89dbf93ed81ed4ae0eb
SHA1 5aa41f515c3d07fd05b882edb7a70501ddcab62d
SHA512 fa1a1b9964a9da7a00bd7f82c3941b9d4d3d7b51105b803743fdec040d4cb4c749f3319a90de46b81798f280ce0bda8e99d265849b3f813926725778bd88ab93
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0o668zNkMpMEQh:MySzPgcRkeMEQoba
TLSH
T18F067C96A1A801D5C1B9C1B98B1BCC17FBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 59118c80f18f2c12a99505958007aafdfbdecc30653fe728801d4d49d5ecd1ea
MD5 70e5fbbb6760e7af21adab545c19ac9e
SHA1 42f0c08b6df7400ef3d0ecf2d89b03adaadea9ca
SHA512 2df3d7daf67530900fdfb71898173dc4aacf2ff03570c12094cd61ef3d519a317d033d061d3239de455ac87e1b32d86e6e235e937814909abbea979aa4565cb2
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYq66sW6RzzJkduZbME6DoIDwixj7v:N47JUQj1irIhCnDHUPfF/Y668zNkMpM1
TLSH
T19965AF1EA3EC01E5E1BA923885554A1AEA71782D1F32CACF1270537D5F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 286eb386f49e7fcc1050425ee9c62297989ffee439b417428dcf6be5ddc79299
MD5 15ba78f82b45770585c93dfa154cad87
SHA1 3a35456610cf9e769968257e3dfc32b6d746b2a6
SHA512 ddaa4df449e6060647424d64091425166d420d48f0b08a80cbae243a261b0974f88e52ec6b6df09cecf40ddc194b0b8e55a547891e8a7591450ef1f8c32d2060
SSDEEP 12288:Kssf0O66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:Ml66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T13965F18AD28842E4C06E5235C7960A41F3377D6597E2E3CB97E0FA3E0F396909DE5613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 87827cafaa622e377f9cfbeb808d03239dd09608ad273c61a4bfe232ede43a4c
MD5 d6fc55a41d5453c0163bcce8c3e7e3b4
SHA1 db19607825d31f79a8fab0253a5dfa79e7155991
SHA512 1d425bcbbe3ef5a3fdcf2173638acf5f2cd311891db2c6cf2dc3bff4a8af74f771245c0286fb1c5f6eff35334cc588ce21ddb210a9c404fd4b6a1077e3187e51
SSDEEP 12288:Vj9gby5C5lxvRmbIqrrM4RMfezQfGei1:VSbtRDq/M4RMfecftg
TLSH
T177451810766BD75FC6A940325E32D2CCA7707D05EE056F0773C88B3FD576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0bde3fcd9435a35676c96826a8de97087859e4c8e4158396e193d3128d7242fb
MD5 c98fa63e3ee2850457cafa3f82efd044
SHA1 57ec2085e79d0e99b8201f54dbf7a981710ad365
SHA512 e1b7a756501e5b2f66694503ebe5ffb39651993bdcd54a22bb37ceab8bd50f56ed3a5fb89d8ac05ecdeefc9559ac6003b05ba4d9d7535f7028a20aab79eb4031
SSDEEP 6144:gIUToHXDikPI6vZcYreF4qeOmmnFqKDexHyeyWcQahpnaNTz9xNqKDexHSA4p6SB:z2Cv+We+LAQ/AiX/7dm
TLSH
T10A65D8819137E38FD0FB607107299F8CAB64EC0677096F26B7C8053AD86A715B4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a53efd3f9239b7f24d14e241a5476021a44aade789a857a36d7c68e508a3bca8
MD5 23c755fa526ec30415a0bb84c07989bc
SHA1 1220fff549df57345dd89c8123830b9873e7bec7
SHA512 6d4060d6c83ccfec6891fdd7cea6e439547d5d14f59fb363dcf5f81b76f9f447e4c186f50a772fdcdbaea4ad5548b87e949e2e04b024e184a872d87d8e09aa22
SSDEEP 12288:2J7sO66sWl7wRl1qSJjodX+Zb7rUEQHZjjU6oIDwhHcxsI7nELPqCU22:Wt66sW6RzzJkduZbME6DoIDwixj7v
TLSH
T1325523D6538E87D1D87E1A3014EA5810972EFFA55F13A2CBFA703B968D38AD1DD20172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 444d993168f3e69041aa64556f137294a6954bd293406d0875a766be7aa658d4
MD5 4a47611510257ddde9a50db6938e3591
SHA1 da58e62b2b40f59f68a8aefb3ec4d36323090ee3
SHA512 291743cfe0973be30f05ac1f4a3047c2fe1f76861b6638700013ed951dfa256cfdacb0acbc6a338fe2a043931a455cd5d81dd5a8d3fa9bdd400fd0bbba6517f0
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYv66sW6RzzJkduZbME6DoIDwixj7v:Wgb4mBIBhGFq668zNkMpMEQoUwa
TLSH
T1FA659F1E22EC02F5E0FAD2B89DAA4417D6B278161732D2CF1151427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e7e5a5ca386fbe66dbec6fe3ee6158f343c7e3cf7f7d6aa8332a3260237826d6
MD5 e65bbaccec91c2f065282934773b5daf
SHA1 ac261e107f99bed4ab2abbaf08d88d1a935e3481
SHA512 11885acbfb05a62a522f73a648d9bced62f16dcf322c98ad8e73f0fdb2ce8c4bf6158ca074a7803e0fd699c872eaf7646b8e343361a1500f052b07eaf492aeab
SSDEEP 24576:PG88u8FpJqH1Qzria7/m666sW6RzzJkduZbME6DoIDwixj7v:+7ZFPqVva7/3668zNkMpMEQoUwa
TLSH
T1C385F16577E502F1D47BD13889864663F6B2B8251321EBCF47A89B510F33AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7a96773cb81da08281065643991a6c6a2d7473b7f799230d6796eb11bd3bb034
MD5 4692b13a35215bc3422f7c673149d519
SHA1 3111c23bd298fe2b3fee64096b6c3d449f77f017
SHA512 84278f45360430d52ad1ec5466135de00be2c9831ebc9f4a82a9b362bb78de41d42f145d34ebc435ebd621edafff5b6efb52c99e36c2e4c7e43d3fb2db3b4ae5
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAje668zNkMpMEQoUwa:BG05lO43bJcRkeMEQoba
TLSH
T1C7D5BF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4c4d5de97c5a918267f260d2f1f2c8f687b6cb7270b1b8245e054f51c32a4e15
MD5 68fb9ba05b9b51d1aa3ade3180a1540c
SHA1 6d25401d509772b7423f0b5f5c99bef6c71c7668
SHA512 5ba2e4d9067552cd46ffe02f497477d22a7411c013f61ea56fc7decd3629436557e49aa47b34215f7ecdc4dc0a3109f0f5946e067da9773a6a70b97316f1549c
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidno66sW6RzzJkduZbME6DoIDwixj7v:Ga5POZ3+Jt2pasx2+mW668zNkMpMEQoe
TLSH
T11665AF5EA2EC01D5D5B9D17DC5834A1AE5B1342153329BCF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3a1120afc62d172864eb2352414eded42e69cc4322c018d790ace1be561140e1
MD5 0da39e51a8761a62a98d0e2ee14a90a9
SHA1 6f754e6feed6344e0ff8218f523f5ecb970416c9
SHA512 4c7e7067b819831ec3bedf9085585f4b8c53dcea8a64062b14d7b533e9d0f07dc372fb6cd91c91f9a7cc72ee07b0890db44343d35f97f9e40b6fd2a6a2be2caa
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkS66sW6RzzJkduZbME6DoIDwixj7v:2Nc/zEOVHFX668zNkMpMEQoUwa
TLSH
T157858B5623E901E4F5BBE1BE89779946FAB17865133086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bbddb1c350f05d66b385a931a01aa09deb3ee4f5b877768620c8f0a0dcceee6f
MD5 d4c64cabc7274729fa37e97df7b00cec
SHA1 fe4dc6e6382abf517934d54e341663188a37be4e
SHA512 63bba88c8cf9d0419ae6cd0c1046ea5c65a2e608050c52c17e845ca63c3b8270af80ac9bb5596f0d7b0327bdc28409ba02b4543f448cd478d072b7db20e87495
SSDEEP 24576:d8kNvNnaFeYhJNtmZBmw66sW6RzzJkduZbME6DoIDwixj7v:d8MwBtOmw668zNkMpMEQoUwa
TLSH
T10455AF6EB6F846E4D1FEC6B48D238512EA727861173293CB9290C13F4E279D89D35F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b36003e4341a24df01c14c19ca365e21fe6435b09528d0b3673d1ba06f97cd9d
MD5 71834801c75689cea69a7c028f805b2b
SHA1 1f2851358bc252f9b2bf2f5a720c7dc1f2c8bc6b
SHA512 339038c82ec252c4ae8fdc8e3d2d2ab0a83db77c5949c1c8f6f4d2d5d5dec3e14cfe6e43b26ae2c0c407267c6045febcac6affb3a0191d403db2aef443c37163
SSDEEP 24576:FPUr+NQO66sW6RzzJkduZbME6DoIDwixj7v:FJQO668zNkMpMEQoUwa
TLSH
T1A665E15F22DD18E5E57AA13D85864609E771B8621712E2CF02F0917E4F37EE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 56c1c73377346ba1ece94a6afd5e6382422d001883817644040b1a88c8bc42d3
MD5 5630398d2d52b271b641ad18a3f71fe8
SHA1 8923c39999ddd90aa5cb2c30c0cec77218242367
SHA512 63e85c6abc694a6b12493bc98ef19b9ec5bdfe67f785b9fd25d3fe04658355534138b216caa5cf971967241067c5a9fd22ba2d7167eb8c3322242f41b1553943
SSDEEP 24576:gD3FHshBIYQgA566sW6RzzJkduZbME6DoIDwixj7v:gDVHeBIAA5668zNkMpMEQoUwa
TLSH
T11675E17EE79D04E4D47BC17C9AA34906E77138A9072266CB02E091B65F3BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-338-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1360-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1360-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1360-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1360-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1360-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1640-88-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1640-320-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1640-94-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/1640-89-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/1924-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1924-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1924-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2004-63-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2004-57-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2004-61-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2004-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2004-51-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2196-2-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2196-1-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/2196-36-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/2196-33-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2196-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2196-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2412-289-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2412-72-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2412-65-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2412-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2744-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2744-84-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2744-305-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2744-76-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4440-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4440-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4440-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4440-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4440-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5584-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5584-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5584-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5584-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5692-117-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5692-111-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5692-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5692-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5692-323-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5692-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5780-130-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5780-124-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5780-133-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5936-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5936-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5936-142-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5936-136-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5936-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download