fd9f20c3706a1833d183cf16989e8546a66a99cb0368be1d2226cebb46e9971e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260720-va21hsat2y
SHA256 fd9f20c3706a1833d183cf16989e8546a66a99cb0368be1d2226cebb46e9971e
MD5 e82270d7b9217ebecf0f8ab52fcb4ca7
SHA1 496f02a4b09615d1ba0ba7a6221c54c25c146d99
SHA512 ea7b1de113ba0217d882d6aca185c8a3f386b85f7603e8dbdf6bdd0c1da684090185e14ea9d3fc3c45bef3c0056c8ad85258923f11a5cce1972830d028e5f414
SSDEEP 49152:I7mZ5UxCNBjHYi3ScaknEOyq+VPRT7uGAc9e7ao1d8bSTJGJCYtS6KFdi2Ga9x3K:EO2sGJeDDHFdi4VEk0V
TLSH
T115167B07E7B940E5C0BBD13D8A579657FAB2784A877197CB47A0861A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2636	elevation_service.exe
2784	maintenanceservice.exe
4084	elevation_service.exe
3432	OSE.EXE
1780	PerceptionSimulationService.exe
1280	perfhost.exe
2908	ReFsDedupSvc.exe
4848	SensorDataService.exe
5204	ssh-agent.exe
2232	AgentService.exe
4856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e07357fe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d0a53936718dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b5d15d46718dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8d824936718dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f12a39d46718dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006bafe7926718dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2636	elevation_service.exe
2636	elevation_service.exe
2636	elevation_service.exe
2636	elevation_service.exe
2636	elevation_service.exe
2636	elevation_service.exe
2636	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5956	2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2636	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2232	AgentService.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: 33	4856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2636	elevation_service.exe
Token: SeDebugPrivilege	4084	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2816	4856	SearchIndexer.exe	100
PID 4856 wrote to memory of 3116	4856	SearchIndexer.exe	101
PID 4856 wrote to memory of 832	4856	SearchIndexer.exe	102
PID 4856 wrote to memory of 5352	4856	SearchIndexer.exe	103
PID 4856 wrote to memory of 1496	4856	SearchIndexer.exe	105
PID 4856 wrote to memory of 4900	4856	SearchIndexer.exe	106
PID 4856 wrote to memory of 4908	4856	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e82270d7b9217ebecf0f8ab52fcb4ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ac101b0eeb157ec77b000556c81f9562b3ad1773f934231c4d3920e2cca50aaa
MD5 a2c5364caf930f2c31efad02c6fae896
SHA1 e45f8c43b7e5476e71b94ed368da630bd7676e58
SHA512 7eaaf805e591c8e1d2b59ea2da35dc6ff5e1e01b8a1eaecc5cdad1f074e1b8a03a31ffa4a1c95877425e8455ffd9305eeb885b668d0867e91df7ccf42e9df751
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnY6KFdi2Ga9x3Ek0V:V3q6sjBFHFdi4VEk0V
TLSH
T100D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ec5173ab2dfb981194c109a467ba88bae7bd18f461caa284a21ddefa62d75232
MD5 b251ef8bb1271597de2e99312e554e32
SHA1 479526b9473d37208daf568e1704a889e6c54d81
SHA512 e58f2353e4f734c4be4ffae0d4f76bf6b116df2a5e997b10abee4e3f3f9ee0b6bcb3ca0fdb56a30b77b85974d01b6e893fb499348efec32ab32fcddb8644819f
SSDEEP 24576:NXYfDtczAQ6LaRFdGJm0Q3WKVSwdr13Ek0VA:Ytcn6KFdi2Ga9x3Ek0V
TLSH
T174650229779409F9ED678278CCA2C511EA337C944760E78B03E49A660F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 06a92f21bcb426215e76bd75a428f4126aba65260979c0dbfde961e9130440e9
MD5 02f166bab56b657b2138cd4690bc0ddc
SHA1 6ceaface164dd8f0d775347274e041124e6b545a
SHA512 095beee28c165da752033f92bfd48bf5c36c2bf5b7df6521ec7632c2f2c089b2f829d82222ea4069d6fa87d5baba92d39904b9c430be5faa8af22d22ddea687b
SSDEEP 24576:G0Le5ji0hmxxrMF6LaRFdGJm0Q3WKVSwdr13Ek0VA:GPji0AjO6KFdi2Ga9x3Ek0V
TLSH
T106859E16F6748735D073C0B9C5D2A69AED7230851B308ACB4286D77C2F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0fa763e75483ff0d36d9534a49997c09437a10dd58753fa2705544e819159541
MD5 cdf794eab0c848070234fb225680ce33
SHA1 a27c38b845915f56e704f68c48636876e780a5c9
SHA512 1e3e458e5cd607a5fe151d6a2488fb1fe720e4a9e5655d332e21b927c0086c9152a41a81d8c831226dc9de61c46c1b07a437e7b39aa9d5cce1083cb00ffbb2d2
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuX6LaRFdGJm0Q3WKVSwdr13Ek0VA:v/ezSC6vUzPveHjyy6KFdi2Ga9x3Ek0V
TLSH
T1C2755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 87522aeca8f18745beb982ab0396a2b20861995021ec8564dbafb1bcfb52218e
MD5 1c4898c1d67240f614aa0f723453abe5
SHA1 6f28dd39a44022849ca9374e739862c37e7f7bbd
SHA512 91b1fda22ec4db67c4b6de6e20004c80dc91e11f2e951ca1698b43443ea4f11752f87b4c606c4a142a79b005ca0a5d4bf35efadadef21fc8925699dc39b97011
SSDEEP 24576:EVbqPb88hv/l+Y86LaRFdGJm0Q3WKVSwdr13Ek0VA:EVO88hXl+f6KFdi2Ga9x3Ek0V
TLSH
T13A559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C2F67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0df2cc35091ea5e3236ef99a9d65cb2545070747d29a511aeaafcac45083f928
MD5 3013e47011fca3e1ba86bd9cb5435d7c
SHA1 50f49a1a4d259a8d3d206cf99f75587ccb472985
SHA512 3f942121fdacdf8c1f6bdfa8a55ce037d3d6a1a389a72a72253466329ce836d85e87163b9d5f1a7811c340108b6ba7f3c329397387a2225975a55b9d129a4207
SSDEEP 12288:1Lh6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:1Lh6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1C5452313BA041915E3AE42F1CDD987715E16BFE82C48524A4EA5378A473CFF5EC68BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 444d1c6d269395232e26801af741229bb37149ad872ad481106aee9cffe9c38d
MD5 f4a59fa8e539a0a39499329d1f205130
SHA1 d600cfa0500bec4d1ef1878f1b11ed293c228548
SHA512 82833689920014bb949a8df8f398f47012cbdd493c0bca7501c29d2700b0c4aa2235204a228e6c7c560c4bd7e372f43956bf18bd02c8725465c3f2c6bbb241f4
SSDEEP 12288:NeBNUbTVO86U06FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:NJIU06LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T11165CF3BEE28FCD2C27E8DB95A918700A77278704F51A3CBD165830E9E275E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e11d5e3d0469ce006b3f6a85b847dddffc2a2cf639338f46ddab92038758dd92
MD5 1386c0f8e720052204a475b8610a53d5
SHA1 05930f1e9b83e9c9f8d0ef83c7b07b1465d27bb4
SHA512 b9e8a95e541e3694fa0d9d732a581ec369be27aa0b6eccb8e8733e33cec39e097bf391942749ee007378c6464034d207c4476054a5f36dcfb60bdff662f8c7ee
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:0QvGAdlCEL8c/DRNw5CHHFdi4VEk0V
TLSH
T1F3267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 54cefeb46b4aff272ca08fb362eb8124d1246a34e8ef43529bc4c479ed2868e1
MD5 70f2c7486a5bb73727b5150fa4f3c111
SHA1 f1cfd1be618e59f1fc8e5fd1297ecf6087f4c8fa
SHA512 1e509e83158653ad811718e8cdb9e3b92036a5fd969a8caf3c56725f8e21fb5cf1fc0078c6abff7c520cb2ce4dad79a14c54aa076d295041c618c7dab74b5521
SSDEEP 24576:d0ewsAj+6LaRFdGJm0Q3WKVSwdr13Ek0VA:Glj+6KFdi2Ga9x3Ek0V
TLSH
T1EB75E031FE74E436C3BF0DB21B26C716182DBA604B511AC3E3E85E8E59346D22776E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6250a53a0f1c8a386e7cf1278e2e6a61253feeadf5ed34bd5b8ab443ee85a2b7
MD5 08a9cd9fbff298beba7c484b8ab9a445
SHA1 acb73bd0b5b5a75e3234f7dfa4f509e9d44790f8
SHA512 c0a633d63024895ca8fbcc68fa351aadd3ce3850339ab748bf718743d5259274e6b33b5bb4890c77913f4895154d5707164827760bfbd8de2cc065222c4fd3b6
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGLiJk0:wUEtQevvqc2W1cpV2tI32GLkk
TLSH
T1EC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bbf6d118cb80acc8b6a32a3a638e938aed1e2540f5e05b28b9f14c12bfced3e4
MD5 a64950a6409ab5fcadeabb1cdeae9876
SHA1 9f9a04351d514b12d78e3b2cc1cf65e38f2f6602
SHA512 1eb93d4352495455826b55db58c9be1152fd35e240ece2f9ee1191593cc920f16d65f9794c073358ce1afcd052511413d01a5716adee568bac2963fd57dd1b55
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/ze6KFdi2Ga9x3Ek0V:YoquVjnmbHFdi4VEk0V
TLSH
T12AD58D0976B882E4D1F6C77886A2C647F37178154B3497EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1af4470c80ac0f4cd1cf4693ff005059d97d57962d51ad724ce4ca0dd74540bb
MD5 da65f44ca3884674d4acdcd6d7d609e0
SHA1 b99714929ccfb9c0f4ae15da931065c9994147d5
SHA512 3ade53a148cf82cae25e98d50cef3860a1d2ff9ad6e3e4ccb2de6c0fdce67cfe858089b2d0d5e6f63d55e50d08a6e0ebb32fc693063ac224d2d84d97958d8b66
SSDEEP 24576:xAhGL3IFoiwtA5l7S5376LaRFdGJm0Q3WKVSwdr13Ek0VA:xAMUFoiq5L6KFdi2Ga9x3Ek0V
TLSH
T169359D81E7F955D4F5B3AAB89DB68171EA76BCA95E30C20F2150920F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d76b7507c43cfce4d827e0bde38492df94a8de92af281aa204a1b8d90ed77dff
MD5 2ca30a3375b9aee29c8029e39c2ff816
SHA1 a13c666a67e948f54cc785bf5704e75542990915
SHA512 191260e7ca8e6c9026e381ace79fbc6126c7854c7e815512a12a8cffc0f9754e0ee75e9f97bc08e2420cc148d29b2e7199ade71fa40246d8f1f906e6cc8f7b83
SSDEEP 24576:wwu4OWS6LaRFdGJm0Q3WKVSwdr13Ek0VA:wwvOv6KFdi2Ga9x3Ek0V
TLSH
T12F65F14676A40CF9EAA78239C997C132F7B2BC512A24C71F0760C65B5F37361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 aec3e1ce60e13f72d26ca2c4db55fc0af57032088adfafe484e5aa637f318849
MD5 95918b17898055ceb4cc9bc33815fe0f
SHA1 9c5122273e47f223cd9e0825930985d758fc36d3
SHA512 02cbcc81fca9ab840609616b63c5e4a81f2561c7ff43dbe3b8b00637c5c01c61b5238a9a38f78200b1014257f22b1ec124a0cf53f374f5dc49c88305d4a0e007
SSDEEP 12288:MeZ1Iyu6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:VZu96LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1FD551257339421B9E3AB42B9CCE18611E77278A5273543CF0A61039A1F3AFE16D38B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d277f89d46133527fb09d0826121cf9f64a5003759a9901feac92929581c6d9f
MD5 7d2ac9dc54affecf49e2869c3c5e97b6
SHA1 04770410825b4aaaf05135dfed7fb2268c0ffb49
SHA512 48bcc5aae618cc7f13394a4e08ab87fc4ea8e9fac4c884e3cee55b0bc4f5e58bd8db36a6ff518bb5ef31914a7e68e922d353773989864ced46dce7e12216dedb
SSDEEP 98304:HQRQyi36YOcPbLvw2gAf+PN3IHFdi4VEk0V:WQyiKa/X+PNYLiJk0
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b39ce1a568976f96f1cd2cd4014f774aacf217c68aee65a15d6d5cc24e16b458
MD5 0861d73dc5bccb1970c371e467970b79
SHA1 5cc9878dd0b4deefcd7d1949c478662a6730a001
SHA512 6c24ec15b325d96490cfa36e213cf5dbc6ae6574eeb176e090ec4ec64923e1b5d5800757f201d484bc793ee79d32a93d31e369e789ecccb027d863293b5d390b
SSDEEP 98304:4QRQyi36YOcPbLvw2gAf+PN3IHFdi4VEk0V:vQyiKa/X+PNYLiJk0
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0098a272b5984a705d5b60514c0272a2df90144027e8d541e9c13472a2aa3559
MD5 9c81bc9c876c288d8313a8d2d1de0e82
SHA1 47978daff933f5e4840c0b4e52c6a199697accb4
SHA512 d79c1f8b4fdd3f92bed22bdcce704b4f60e148d9a04c70a14ed86ba36f9f747e31e091122356c36c3d40ca2ba469d74b90e24efb5186c10943ac9d901d5d5a4f
SSDEEP 49152:S68Qg55nhceWu7PNU3/O6KFdi2Ga9x3Ek0V:QthLRc/OHFdi4VEk0V
TLSH
T11BB54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 80dd8bdb77659efa7d57fd1c22946930ecfa703a4e6a9cf711ab4dc047d4cd04
MD5 6c5e38a4f97e6fabef0be1fdf5ffee69
SHA1 fe903486172b52d3f63ac8b0e92668c44af9f542
SHA512 44dd1ddd69b59fe26ebe7debc354d5b9047b0fa974a45ef99e8d89036fe79df0899fbb4d320cb034918020700a69e3759dabe46fdfd5e864a5ade23d8a1cbbc2
SSDEEP 98304:Gy5112gYy5azzVvt69nLKnhZhHFdi4VEk0V:3LIHEWhDLiJk0
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 676d72af7f10cfc852449e591a9c1cfaa556b9cc90619246823e541d56b25817
MD5 65e99a097665ac86f20c9cb2973362be
SHA1 e5574784e20df9065cd566d596c1d463fb37e380
SHA512 c6d25cde5871609afe5feea9cbc141ba357c4a5be79911c2b2b0ad4dcba0cabfd9a326551533cb6d39f11467d44863cc140dc2e5391855b6e1f07c6f66bc5c2e
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl56KFdi2Ga9x3Ek0V:Cu6Jmdxd2d5HFdi4VEk0V
TLSH
T1B6D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fa000dc3cfd9c514d09768fbb621493570ce3fdf4d31a90e23202f78c65fe246
MD5 3dc862277f2950a8ad633caef66fca48
SHA1 3a563723eddf737d6a8f2e1dc4da914c78bdcc8d
SHA512 288e5bb6b3faf372111001dd8b6f678dc8cadc895483ff1ada8b66be2b4d3d867bb89d83111d242364c89f71795fe882ade4a049c397c11b5fb9399317200aeb
SSDEEP 49152:01hpsNoJpF1A63U44CwH7R4xU6KFdi2Ga9x3Ek0V:0mifPWRbHFdi4VEk0V
TLSH
T18DB5AD13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fca40abfb6ad3e3cf5254d072cb042e3653b8ccbd653d59a7b8cb750691b67c3
MD5 1b299cf891681f140e37fc5d1a7b9760
SHA1 c3a3afa2373fb74da43c3a9eb07c56e20dd53ce9
SHA512 73de263ec89a7a52a72d03c2666ebebeb617a6bab3c14cbb210197e209bd70758b8a1ba3ca2efe264e609211c96370a3618c9e185dd773e128729c36f9f31331
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHq96KFdi2Ga9x3Ek0V:H5dKii619HFdi4VEk0V
TLSH
T159C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2317d9216fad043bf46518bca0582e16bbef915f531478138613841e2e71636d
MD5 bfce82afa0b0341f8e65b86699777e2e
SHA1 0ae58e6dd85c0c0c0e7d1d8d6913b79b667c39cf
SHA512 741ea69e4ab1b970901896d82ba750a77d40333b45782ac8c1552d32425c6e379a295511c8472a1658b6e945f3cff9bf12699231853f497eb668423632a97c9f
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5wQ6KFdi2Ga9x3Ek0V:gX2imphPHFdi4VEk0V
TLSH
T1A795BE13F2D901E8D05ED178C7468632EA62BC150B38A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d6de5412ebf61230170a9ea5cfed680b7ac449caa5256e3351e52466dd06522d
MD5 59669f1a9a1534ee48f85e454e7ccd76
SHA1 bca75bcba9d9fe8630f42764309ec68716e1343e
SHA512 739682162f2fbb2ec32fd76058027e1f915ac94c401949a325780d48faefa4e92081c64f0a7f05db32284fec0b5ffc1691778f38d3010b9af867d35a3e2fd9c9
SSDEEP 12288:sZ6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:sZ6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1FF452313B9080A19E35942F2CD8583756A19BFEC7D58024A5F9A2706473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 66a5b9d87c793ecc10780892cda0398be968b73cf53f670f61a4ab3cd1ff9ce5
MD5 2e87b377f17b7e0dc6deb164de91f8fa
SHA1 8e559e380d9871cc942987c136c65a3ca4daf121
SHA512 2602f8d6cbb18a9ab6ecf3677fded1d0f5f5b0502fd04bd17a7d3b0c884ebb435c9e5ec945200b32e15d7ab3785c1c230067d4ec01d522e4f7dac37317b45fce
SSDEEP 12288:Aa6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Aa6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T198452323B9080A19E35942F2CD8583B15A19BFEC7D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7e1235dc07ec5af6e8a763d815c5003ceccf32ecf8cac7138006639af32c3e00
MD5 d6de39ce82578e90b93fe4822e3a1b96
SHA1 dd9df8d0bdf6201797773bc5e956330ebbf89ed8
SHA512 716a5d0fc1d244fe16a60d3621061f8378610d063fe517d21c1bc89c51338093798d6dc47ec9f8b8b4e4661dd63370ba22fcf1e8ebfd58b5b396f2df67fa5193
SSDEEP 12288:wM6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:wM6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1D6452323B9080A19E35D42F2CD8583B15A19BFEC7D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ca6cb330e299e2aee0955e5b5057d9ef157d2b28f32aa72e1badefc2832881eb
MD5 21d7b62c7d1eff3529b1b5eb449243fa
SHA1 6de8ef6d0c04995e4087950a60be5975b05efc77
SHA512 874024e8b46882479d58940b7204f7ddc8026287ce514080882ced5a6699a92c1d8a6ac8db131431b301cb8e0f0a523816597664910ce295dfd95b73b3896b02
SSDEEP 12288:bVb6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:96LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1844523137B180595E36A82F1CD958271EB66BEE86A24538F4F51164A0F39BF47C38FE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bddfaf332c518ec9f5084a99417b1b44fa08d867e1e21c69a0f895a879bb8684
MD5 1644dec12e8c6c32628f24727097c7e9
SHA1 5b7cb6ace73b98ace617642c95709fb3bc8f30e7
SHA512 229408d4c0560e87338e596e382b6b76db390bbf4e0a10fa58da088ab3e7eed62858749be1cf32bd2c9f91deb98a822ee67259279eb88a0e1fedd6f720ad5608
SSDEEP 12288:Vj6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Vj6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T17D452313B9080A19E35D42F2CD8583B16A19BFEC7D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9abf9dc500a6761b1038c12869199902213a9afc6699379fb8cd1fd5dd8281f6
MD5 64676022f05a90ce56c6d0761163ea12
SHA1 861c4c82f6e46b962a33214a238dedb1f68754c7
SHA512 1484e2174bba201f8f19a699d9f90caec3386ec2cd17cf30b8b4c6313310b3396751bc6e2fa45635b49d3364716f3a130d1a1a6faf6dd5940f43d6e3e376187b
SSDEEP 12288:a26FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:a26LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1F0452323B9080A19E35D42F2CD8583B55A19BFEC3D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d191cbf8aad8171c260c9e37313cc418cfdcf04aac54958b21445b3eeb5eacc0
MD5 1e21cf17fe419c3412a8d0548428d868
SHA1 5985ea71f0bcbc069fd1f067b8980fe07fc2c2ff
SHA512 cc0ffcfae1871585b2cba674dc067e7b33cf38e68087d74c6df3fa68aeb68938875469218b1e583eeb2749d7a261f6f0e9fedccc1bb6d7ecbd11731f1c6641b5
SSDEEP 12288:Ti6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Ti6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1AD452323B9080A19E35942F2CD8583B15A19BFEC7D58024A5F9A2346173CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 38ba8d76535dba265cb6de11f3dd2f1688ebb8b1a304447bad8b082477fa8e72
MD5 89cd88c3b36beb082b4a048a30db5df8
SHA1 f2289067f4077831cfc5cd6159409719e84ab653
SHA512 58d3fb5f749f6be7360bf74593920835dd26699cdad07c81b25ec6ec5a55bbee1b960777eafebf07cf799fb1eeb028f36b36fcb330a1fc2fa73205d6554f613f
SSDEEP 24576:HZMRzFVSO66LaRFdGJm0Q3WKVSwdr13Ek0VA:HZMRzfm6KFdi2Ga9x3Ek0V
TLSH
T1106501A6B35008F8ED67827ECD558916D6B2BC690B60C60F07A4362B1F377A11C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 449200ddb814b2e85b53adcec7e2e3ff6f1607b09acc34d4d6b6d65f4d4c1bbb
MD5 e6b487096c89236b0b550bf035e1c541
SHA1 73cf3d1eaa2aecfc84f8418bc4d996f742c02f97
SHA512 1b860a6f2fa1444346dd490771a012b2ee244894db7cd75c2bc68c84bb54732eb452243064d2a513e98b0bcd65c9b3bd29067b68ef29b83cec444d52c8ff01b2
SSDEEP 12288:Ht6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Ht6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1E7452323B9080A19E35D42F2CD8583B55E19BFEC3958024A5F9A2746573CFF96C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 57f4ef970185428a585928304945d49d66f2af6bf3801b901382f46b736261c7
MD5 3f651d557f4ab5c548fb12afafc7b31d
SHA1 16cef9ef61d0a0c589c00d66ef11c54a465b8647
SHA512 7ff31733fd72c1c22d6663a3fa2ecf200a8688b4075bde84808e9cd80bea0de302a52b12f5c01c726c7df0e26eaaa0149a332e038ed4baa64a371a362b3fc1a5
SSDEEP 12288:9R6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:9R6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T197452323B9080A19E35942F2CD8583B55A19BFEC7D48024A5F9A2746173CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0f1e61af96bfd8f437a5fe5c2256422ed043eac3ef03742a2569b07ce852e5f8
MD5 46d449d82c1a1c5753e9aa419b31ba9c
SHA1 86f7e55bf201c81b18bf66df95172e4e1fb35d58
SHA512 2578a6b673ff00d9f91ab1d71118c893b21314d8eccffa9a988cbb9905d0c9655dfb73a00ddd1d88c7ac29b125ece6335096736f518988da548a8d89bebe3b26
SSDEEP 12288:hyPz5L8u6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:wzyu6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1A5550217776421F8D26A8275CC920A12F772BC751B248A9F17A407761F3B7E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b4223beb620c76ddba4040ce21d9abb04627dd13d9a501d5883b181e4ecba6e0
MD5 06f1420894aef0d2f713c5e365085830
SHA1 21455744108c7a4a45facb123a9f7b5cea160863
SHA512 b024995e52afbc3f6f9c7b38bdfdacc8b2cb709600d9e7c2cd62cac140e7531d99ea14638b7190f4de311129ecaaa4c816c981b94ac10e8b6aae27eea3e4638d
SSDEEP 12288:it6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:it6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1C6452323B9080A19E35942F2CD8583B55A19BFEC3958024A5F9A2746573CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 810ffdeefba6867c4f3a5cb1816f24903e116d73182485c20c4166804dd8b790
MD5 a9cabea86a696c5769f6d5cfcdeaa6a4
SHA1 8bd617d44f5beda9e12270f6afc98bc3c9bdb40a
SHA512 716988da7205071f1bba16ee631d12faa943322da38db9c6923d85f54a3cd5e8889b42f2e15abe57da673f23b300a592fa164f8b8e4678b1c2f430863dc96e22
SSDEEP 12288:Gt6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Gt6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1F1452323B9080A19E35D42F2CD8583B55A19BFEC3958024A5F9A2746573CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 70aad61fd10fe6bf6cd9a188adf0a14cc38e8c76a7e6ebba3ed2b98f752ea606
MD5 229807ae8d11fc24a30050284db3bc8e
SHA1 fd04de8f41d2ee09f1a6d07d5724ef961f775e42
SHA512 cdf31b3db07a2406f746b257694fa422d60935b14e23387faf232ff14520ce84300ec1398041b833300944c78299271109c34409b4b61e2c8f83bfef4f878b03
SSDEEP 12288:iyPz5L8u6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4s:/zyu6LaRFdGJm0Q3WKVSwdr13Ek0VA3
TLSH
T161550217776421F8D26A8275CC920A12F772BC751B248A9F17A407761F3B7E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ba483b64c78b9f851baf042159bc0bd87a49a031506ac6cbe58ba45d491a72d3
MD5 212d8e0bc4dbf70dc6b5cee2bfcf7ef0
SHA1 b0dd7bca64a81f907f9b8a66327ec2f7a10c9d6c
SHA512 710a7d08a4bd23540ce36e0dd94882028f5437de1ac3e3b3b0bde4f61cc384305e40550cff6cdd7b64dc92b59da27388d610c5c5ff158945b7a815eb8afe153b
SSDEEP 24576:jTDaLl3z0zDc6LaRFdGJm0Q3WKVSwdr13Ek0VA:jTuLljX6KFdi2Ga9x3Ek0V
TLSH
T12B6501A6B35018F8ED67827ACC558A16D6B27C690B60C60F07E8365B5F373A01C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a6af688a644da08294f4049272ce51a4c0ff73f9ee2ad7093795314536cd0ac8
MD5 c9616f1c2fba293a02286c608e8e9009
SHA1 52ccc55c1b21bebdfcb196feb6da1ea03dc27c75
SHA512 5ba4b739c6191115e4698a843e97d6e9225c250284903d4fe475df2cb2c074adbc3a7cbb1e9236b0e784be7124d1991ae83574ebfd73b4aca528c4fc36a5ca36
SSDEEP 24576:h3vd9CHKy7GZo6LaRFdGJm0Q3WKVSwdr13Ek0VA:Rvd9CHKyam6KFdi2Ga9x3Ek0V
TLSH
T15475CF91F3E414E8F1B78A75CD768511DA767C991B21CA8F03A4261A1F33BE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fec4b77a1cae292d1b94600fef9a6aa6a29e70f39370538b53034c62ad078553
MD5 b0db383480b10c595b9a3dfeacdda811
SHA1 e338b9e39f838bc3bd2b75c6e2399ddfad51e6e9
SHA512 9cbbe2068a367884a4551dd0c83c3dc53cc8c89b7db3db65b341088289e86f9ed59b074fd80cb9f9c1f1f4967ff9708449b3ddca1189b18ffe4f2cd32a1c2c8c
SSDEEP 12288:Ys6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Ys6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T173452313B9080A19E35D42F2CD8583B15A19BFEC7D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9a13eb8246d55fef1e35a0fba9319fa89ec491487189610228dd8e1d1b5b7503
MD5 67169bc2fc1ca59956834cb994e492fb
SHA1 d33dee7f2f18c8e7a291df899ffb8885c9d3e058
SHA512 c5d79d1bedb5c7a83fa163f6d44a0701333aef3f1a0144adcfc1f3603f9843a8552466ecd7801f4bacf69a0206b11aa0abe0ef9561966e9fb1587197035a71cb
SSDEEP 12288:/O6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:/O6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T10F452323B9180A19E35D42F2CDC583716A19BFEC7D58024A5F9A2606473CFF97C68EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a0ca619077e2948b2e5aac621a212c3b76089def842b2f7f3054c32d0d49ec4a
MD5 79e846e05b6f97378b8d8a3a635cefba
SHA1 305397e2d3b03e2f8f5302dc0486649c1f1eaf9d
SHA512 322c86809673bde1004554ec6734f64037837da7764aec6b7fc8f6a6b40b39a4d085a595f5b223e64bf43acfc336c36c14b28544a7e243a4382df4168ca97b86
SSDEEP 12288:b/6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:b/6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T17B452323B9080A19E35942F2CD8583B55E19BFEC7948024A5F9A2746573CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 77d7147fb80a4b48553e0c4f74c68cd4ff1ce1d7e0813bd016b60942c880bd6e
MD5 afe42e90e8fa90c06fec24a51264e6e9
SHA1 f74cb84da8a99acea572cc0d695eec93dec1ee4b
SHA512 025fd7f2741bed730f4a7a65630af76b7cb1a1d70886238d1c20f5256b88002e4fcc4b1d866ccdd33f210aff2fc18c57f0e2d401a1af3579832bb662002ee0eb
SSDEEP 12288:yt6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:yt6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T143452323B9080A19E35942F2CD8583B55E19BFEC3958024A5F9A2746573CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9ccc93772a838584aca407b4498c189b0ca8febf018baf2d905c994d19192be0
MD5 f49fb644cc74947f16053bfe374f9873
SHA1 eb3099b6cc652eb75d520825f7343c1012b3ec21
SHA512 30ff74586862f87367aab1d4a22fbab505c32f746dc01b2200aba46febe1443bcbada754942b8ddbaf32d7821b33124cc3f08b53c6019cfd9e86bca98f6bd1f1
SSDEEP 12288:us6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:us6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T194452323B9080A19E35D42F2CD8583B55A19BFEC7D58024A5F9A2606473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2ca19c9ae118eaead41049226c297eefcd991992dd5a82fec1b1c74726cfe6ba
MD5 8a9e22cf79371acca9e1f5011d174aa9
SHA1 fafba258cf15e5201f1b50632daa56000e73ae35
SHA512 eedc0b29b0a5c7bb6b0f448276db6ae5d5c1f899565b0c66d7ff52ea2272c913c55a500cfaf5f299dcab2e8b01128079c0ed876e02dedb8a18d27bc35c85f0ce
SSDEEP 12288:UV6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:UV6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1E1452323B9080A19E35942F2CD8583B15E19BFEC7958024A5F9A2746473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 27638a41b684cd26f6a8d00459f70ccb12cc6b9ad70d9512e45b23c5d8637c64
MD5 7e6efda3f8c289897e667663f2762c19
SHA1 24b120d641d931475c8d6a715e2823ac630c787b
SHA512 8ea39bf0fea4e5eba5c599bb4330a0bd98410c131cbb890578093ed96d9e7abefe3f47425d38e68edb702b7f47ef0996dbd57396df27e742fa4fbff70eeb6d2e
SSDEEP 12288:4j6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:4j6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T13F452313B9080A19E35D42F2CD8583B56A19BFEC7D58024A5F9A2606473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 336db450df8764e06a05baefacfdf01b84ed2d79e588d0f9b1ea49e015bbca6a
MD5 e0659110273bec86e159ae74507635c0
SHA1 ec24229416cb0abfcf0605cd501b062116aa7c95
SHA512 fdb94bd652ac9d78ff003a2c72eb8eaeee7f0dab25f43a2294860a16e9cdcba75926ac83c485a73bd14ccabb04dc5a9fb08a198765d11d3c31d878f86203e3f5
SSDEEP 24576:qfwvUk9RX6wkyAIB6LaRFdGJm0Q3WKVSwdr13Ek0VA:6MnYIB6KFdi2Ga9x3Ek0V
TLSH
T19D85C02AEBDC44E5E177927C8DA7460AF6B178681B31C2CF029A536D0E37EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 99b21cedbe3117093843fba51a7328dc753e9bb366f3006247b9ee27efb360d6
MD5 2b9985cc61d8efacce0ee105ea4c1aae
SHA1 3e70505e0c4c42bf7ddc2c6c623f57bb38a9f67c
SHA512 7f4dacdeef7edb051c6426cfbb6842c618f54ca94c61e084967f1a0584154d6be2117e21490a37c2a331395b3cf1db381666cd6db11f77268bc074fe7065518d
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0w6KFdi2Ga9x3K:xySzPoHFdi4VEk0V
TLSH
T131066C56A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6169c307bfdc06a9b0a481a00911f2c5fbca0b995ab3b16caecdcf91223c96c1
MD5 6495d391001e9af45452ff9b2c8ccd5d
SHA1 48b628d2e74336e5e07f0d48859ab6f99093f28a
SHA512 cc03640c8461e6d5ed3782a36311303efea1597b079911321f2d33e47746de263d12435895c9f060f1382edee9563db31fd18fb83c805ec9d8973097fee13dbd
SSDEEP 24576:b47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYq6LaRFdGJm0Q3WKVSwdr13Ek0VA:b47JUQjTirIhCnDHUPfF/g6KFdi2Ga9M
TLSH
T1D965AE1EA3EC01E5E1BA827889154A5AEA71782D1F31CACF1270437D6F27ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3a1519fbd059c42baf645e3caa67e92027e09513e380e555813ae3518a3b3f07
MD5 4016ad31ef70f2fb1b2fd9b547032b62
SHA1 1e917397a70c99775619f43f24d52586968befcd
SHA512 faeca63778519509a25209c7d8483a7359e4ef6ddf79d59b5a340288f8af6f8bdcb88d6bfc5f1d61c3f0d86eb5436d759ad5c75258c0f618aa1a09b49d995589
SSDEEP 12288:Obsf96FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:V96LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T17055011AE24802E8C16E5275CB468651B7237C6457E0D3CB57D0F63E0F3AAE0ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 854e49c688a69b819303b248e0882b186bdbf2239648db483a8f30a9ba735f4f
MD5 4af77c273f46a772b4b69be34e54ee7b
SHA1 e1db7ed7ab418d76aeb1574729762bb18f358384
SHA512 31f6e2cb8e870414a1d12b7e4208500e75e0209fd1cba1dc596c1491a163382c71421d4dbf29e011e46094d81c0992e62b5efa59847e36afd7388eee8975031c
SSDEEP 12288:E7p5+kU3fLEupRhNIJdFBHXYMx/k8YsnFDxx1u:E7jPUPVR7EHH588YcBxP
TLSH
T1F7251710766ADB5FC6AD40321E33D1CCAB707D41EE059B0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 495a40ee7fad86b8209024971a5ecf85f18fd6be1229be11a2396a5760dfd560
MD5 c504f89a6c31ac61fa52be25a71278c0
SHA1 956dc97e0ae766ce9cd0d2bee9f3194d73ab6175
SHA512 34953b2f98919cffe9d73cdce0762b99804bb20d4397f31871ca67625e0d8292efeea3a768b74829136d6682b45e7038ce73efa8ce497988a13d3aafcc2677d2
SSDEEP 24576:J6iykMsqHkKm16hwaY0YuitdXeSrSuTRcJR3oZ/qXpYDrBsVxxJHOWEU0CYA9:J6iykoHkKm16aaYVu4dXeSrSudcz3ICr
TLSH
T12A65D8816437E3DFD1F76032073A5B4CAB74AC0377495F26A3885539D82AA26B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2b92841bafbe3b8a66f3e930d33f9c27ffb86e67d1d49437413b2cac6e69386f
MD5 afc57f5b458264548a740636b6f8fad8
SHA1 5837f7c6371dae27217cf9edc8a0f2e88df9c45d
SHA512 886573786e064c5ca80af847622785735dc651b17e8facdd51e5f79563d6b5b045b9fec060743ad36941a3463cc5b46f97e302aa34b3bf190625f222b27f1a92
SSDEEP 12288:W07l6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:vl6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1D5452323BA081A15F37D42F18C99C2316A1ABFE82F0441CBAE552746573CFF4AD78B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 94e1cfbca7ec6a1ffc457dee6386ced6b3b4992af54a73aba12631666de913a6
MD5 12bc2eb02fb92638d78dcc0cfa4b40af
SHA1 3429e4bf2671e7ba9b4b09a08c4aad0efc3627f9
SHA512 0c01ea8ee3b6bcbf90b4fd0c0261b920b8395bd5b0d9f7b8bbe7f61d375857ceeb1b8f7d468b63e395ba2acf8357af12e6f799d0df20c9d45e45d35d6b342863
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYX6LaRFdGJm0Q3WKVSwdr13Ek0VA:qgb4mBIBhGFq6KFdi2Ga9x3Ek0V
TLSH
T19965AE1E22EC02F5E1FAD2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 38cc1b3357e8baea94fdbfc66ec6d6c52f1a066aecb78b79c01dd6a917c7c6b5
MD5 4fe3063c1f16cbe18a0b41872d8c042b
SHA1 29f86af3bc7ee6b12b3e3cf5c72660289030d7b8
SHA512 2adfafeef2a84fb5bb7ba2fc0e7e1575b0058c25086546f9f2b1cb973d0501d6d8a5f0c92a9e4e33cb6098035e09c6eead890574aa0d37384d858ea1b9c1f39a
SSDEEP 24576:DG88u8FpJqH1bzria7/m66LaRFdGJm0Q3WKVSwdr13Ek0VA:y7ZFPqVea7/f6KFdi2Ga9x3Ek0V
TLSH
T1CF85F16676E001F0D47BD13889864663F6B2B8251364EBDF07A88B551F23BE54B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4574f0273d1f2f86c983e176b51120aae1336e471b209b0bd52894047f6f3c5c
MD5 ec537f146c692a829365686354694e70
SHA1 0cb11557faee547117a5f05cf3b2435272b73160
SHA512 c435d84d9d14dd86a232951d7d9fa5fcc19eddfcf666ff15f87e0320e88228753820629f6079b7ec7cbf8f1c86052a9d16a5d76b99ef1d16cfbe6923a2ff3a36
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj26KFdi2Ga9x3Ek0V:nG05lO43bJHFdi4VEk0V
TLSH
T133D5CF6A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4bfbbe6d8d8b05427ff6e25104bd9a9715a62c73f6b16de20d026437f3dfe2e7
MD5 1a280a125ed6ed200432a7d238fe365f
SHA1 5bdea9b6df25a6e63a81459dbf623ec3fe4da047
SHA512 69285e16539d1b9235fafd135269947c78c43dc96baa9cfe4793fc32d2646b24a41b0c968c6c0df0c54fb0499314af8623f6398efb9fa18a02f8292a96228d0e
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnw6LaRFdGJm0Q3WKVSwdr13Ek0VA:ga5POZ3BJt2pasx2+mO6KFdi2Ga9x3EJ
TLSH
T1E465AF5EA6FC01D5D2B9D17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 80ad4010a0084d7672999bb28b72d88fd10918301da7dff92fd29640b2b3993b
MD5 ee55aafafd10761cdf8046f06d2af613
SHA1 b6c1d4162258d5e6cff24918623b5beb8dfd0a82
SHA512 a22abe4b03973756fcd55e96aad9938519a3df9062b5d7b5ad3f03e9adbae5258f145b683e85572fb2dd812b9a60b43ed59449fcb0a89155d9719771418013b6
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7Fky6LaRFdGJm0Q3WKVSwdr13Ek0VA:+Nc/zEOVHF/6KFdi2Ga9x3Ek0V
TLSH
T1C4857B2623E901E4F1BBE1BE89679546FA717869173486CF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dddb584b0900a8dbb5df779a6c558212f4f6dfe66a465ad1facdb539aa076f89
MD5 93ad294c5841e42caf7c0a5ba110ca17
SHA1 965958bf44db0b7b4d0ac0fa160fe6e292b88819
SHA512 ab38a18934d546743bf09b837ca47582f39bb1bb55cac457bf14b8c4f7b2f3c4d169fcdc9127e979daf974ee855290ab688e05d145d79340e22f458518139fef
SSDEEP 24576:PTkNvNnaFeYhJNtmZBmN6LaRFdGJm0Q3WKVSwdr13Ek0VA:PTMwBtOmN6KFdi2Ga9x3Ek0V
TLSH
T17A55AF2EBAB846E4D1FEC6B5CD238512EA727861173253CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 245d62cd9d84def3c163133975eb3cb976113fc20bc8a034a883d602085be440
MD5 f0357a0a927c4b4c23e0c2f793ff8329
SHA1 21fb5838db72e9c008305f22eddf3b65ec11b211
SHA512 3a2d742c545aeb4fdb2461f87bf3e2495b74a0d33d6babcc1a57b8e99db4bf859a00411f1e1f14268964051fb8211fe7c15256a8bd3960de82f324840fa7b50c
SSDEEP 24576:wPUr+NQm6LaRFdGJm0Q3WKVSwdr13Ek0VA:wJQm6KFdi2Ga9x3Ek0V
TLSH
T10465E12F76A818E5E67AA17D89828719F771B861171192CF02E1417E4F37EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f76d64c7e5605d2d3cd8d0fb93f2b2f943495ba8d5696e814bb86dd67817914a
MD5 ac526851bf5805bd99f6bdce07c08e07
SHA1 3f4896b0ec4e84897fee68c5ae15521b08d69cee
SHA512 a116ea5b240c429880f6f367e88672ca199effac0693a9cb1db1d76ca77d51b00400565d18cffacfcc1d503777abfafbbef243f8547c0d010474dbcac95c50b6
SSDEEP 24576:7D3FHshBIYQgA56LaRFdGJm0Q3WKVSwdr13Ek0VA:7DVHeBIAA56KFdi2Ga9x3Ek0V
TLSH
T11A75E13EEA5C04E4E57AC1BCCA538A06E77138A9072156CB06D481BA1F2BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-89-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1280-290-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1780-272-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1780-85-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1780-77-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1780-79-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2232-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2232-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2232-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2232-131-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2232-140-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2636-21-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2636-22-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2636-15-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2636-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2636-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2784-51-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2784-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2784-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2784-42-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2784-62-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/2908-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2908-332-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2908-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3432-73-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3432-66-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3432-67-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3432-203-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4084-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4084-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4084-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4084-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4848-106-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4848-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4848-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4848-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4848-111-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4848-317-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4856-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4856-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4856-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5204-120-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5204-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5204-126-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5204-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5956-0-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/5956-36-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/5956-37-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5956-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5956-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5956-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download