b43a30b819e31ac572f04c69933d571da9a81bfd88325054bf7b5d4e76beaf67

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260723-fbq73s1crd
SHA256 b43a30b819e31ac572f04c69933d571da9a81bfd88325054bf7b5d4e76beaf67
MD5 d1debe86e1f71f016aebc04952bac8cf
SHA1 c9c628211fcb86b278aa4c6e02da97633ea13c8c
SHA512 590ddd4031819f48c555e4f191b91f378e8b0856198bd2805f8ea8d33a5fb24aefe3f31a4665e4e145e3fefbf57c3b6aac2b0eeafc92d961b162c85d9fbc21a6
SSDEEP 49152:AjAcwW78XJzueqxE9XhKkH8g4gTS5bkeIz27ceT1Kk9qlHT8qJaB0zj0yjoB2:lF2jtB2Yyjl
TLSH
T1DC267A1BE6B940F5C0BBD1798A979517FAB27819873297CB4690470A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3436	elevation_service.exe
1920	elevation_service.exe
5080	maintenanceservice.exe
2400	OSE.EXE
4176	PerceptionSimulationService.exe
3424	perfhost.exe
3352	ReFsDedupSvc.exe
3656	SensorDataService.exe
1744	ssh-agent.exe
2296	AgentService.exe
5172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\95892172e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec072aae5d1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000772b75ae5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa8b36ef5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023990cef5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5452	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3436	elevation_service.exe
Token: SeBackupPrivilege	3352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3352	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2296	AgentService.exe
Token: 33	5172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5172	SearchIndexer.exe
Token: SeDebugPrivilege	3436	elevation_service.exe
Token: SeDebugPrivilege	1920	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 4576	5452	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 5172 wrote to memory of 5208	5172	SearchIndexer.exe	102
PID 5172 wrote to memory of 5260	5172	SearchIndexer.exe	103
PID 5172 wrote to memory of 3276	5172	SearchIndexer.exe	104
PID 5172 wrote to memory of 2844	5172	SearchIndexer.exe	105
PID 5172 wrote to memory of 2848	5172	SearchIndexer.exe	107
PID 5172 wrote to memory of 4428	5172	SearchIndexer.exe	108
PID 5172 wrote to memory of 4864	5172	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d1debe86e1f71f016aebc04952bac8cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5452
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5452" "1448" "1320" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bff27355b39733820921188fe7360b087886c7c738e0f0f28870e5464580bc77
MD5 9647bb2cdc52d4ece3556036a5702f64
SHA1 f09188d06465089e568089638b3cc95e550b0a36
SHA512 a8644c2d6a85637d4305b5577ecf80825dadc0e2636bd0e6fa457113ed7c6dc832dea04e74cdd4c882daa05f8814a7bbcf4f7bdf55c657bf9b795dd0582b53f6
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxniaB0zj0yjoB2:O3q6HjBWB2Yyjl
TLSH
T103D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 597d0fd398bbc3c6068812d4f875871859e5d0c8a157ada52be812266f74dd8f
MD5 338f445618414794a8b25f7912947a80
SHA1 90804f06c81175ac2fefe017bd39b1f80bdac70a
SHA512 1f1a66745f449375c662835b54577c5c704aec0734941f386a6eb162e4bdefd9aff77d9d84c8239990d8bf5fd0e7d743d1fc48480a0cc353121cdae517879898
SSDEEP 24576:tXYfDtczAnatr0zAiX90z/F0jsFB3SQkw:4tccaB0zj0yjoB2
TLSH
T10B650229779504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f943b116a9943c0dc1b671a8e91152d969ca8ace23aa48938dd4a5ddf742591d
MD5 258df36c194b0ec567d7d659f7faa99f
SHA1 ffa354cdaedccd48b9d2a89dc9e056d3633ac3a3
SHA512 1c7d12b269dd8c8d53c0308aff23e05090f3447d6c8d3272d535107d5331aad797225470bfec6a8ac0baf6c9206615cf88e214e382cee1b38bb24373a1a0addb
SSDEEP 24576:/0Le5ji0hmxirMKatr0zAiX90z/F0jsFB3SQky:/Pji0AcNaB0zj0yjoB2
TLSH
T10B859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c0d82c2ddb1056717a65f1220dec15d5a170426053a9a5b1eb2cbbd3a365cf44
MD5 ff68c068e52690461b22485e68a86f2c
SHA1 fd645b29650a9447c545a7a1c20a704beafe3418
SHA512 780df0aff7602f2c4ab45a686f3bb1187ea91e4712e4f5d5b33c0fbec14a90b4c79f66f862a678a2548e6912b1bb45e2b8f18d68afb158d6121f743444a7ebcb
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyusatr0zAiX90z/F0jsFB3SQkq:8/ezSC6vUzPvxHjypaB0zj0yjoB2
TLSH
T158755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2ac11b5ed062e61a03b76b1e33a20d7d56a817e9b4a811e7b0dc40444d1e93c
MD5 99de485c1cb9d0d940f4a2cba35f4833
SHA1 5053878d46a52a9f1ec6ef0340976bb15bf635e0
SHA512 48ec57318e5b6e4e970c81950f6faab085917ca48ca5e7c2fb68d6e1edb4fa7bdd76d455111a216316d33ba32011d82cffd0c2a9496608bb9d3b13fd68bc6f02
SSDEEP 24576:GVbqPb88hv/l+67atr0zAiX90z/F0jsFB3SQkq:GVO88hXl+WaB0zj0yjoB2
TLSH
T1A155AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7b3e57b60d368f7f68b9952aa3c41c72682e072fced1637813475dc0f81787d0
MD5 6e38736f33401d5eec9d86306ccb6ca7
SHA1 4e62de5f4cc0b99152e52af3f1f0856cee43eb78
SHA512 330e97ee2aec3843297f6a2d3595d90e4dc0ae4eab3fd13f87979127579701440abc150dd7073b4cd63bb9d0af281e508b32d109d5099cdf42a53e2f3d765bb2
SSDEEP 12288:HRG9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:HROatr0zAiX90z/F0jsFB3SQkV
TLSH
T1B045230B340E80F2CDC32B3566989C4B1AB99EB065E2AF45E2D13F4F9D3C1C696656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f9726354fa73f0dff78d7b97a822cffb6f4a971f9ac5ea81a6487962616f970a
MD5 7baa0991a844edebd482ea32d69b4020
SHA1 bbb13108ae62e3beeb420ded87ed3fc4bc365c25
SHA512 27fd0a00aa08d355fa1f256c1ffe55dedcba853a1dfc7acbfbaa005c13e1c77c5171f72b5a9214919d82b0dcf96f5c548a18449a26de2e80969e4be1600728cc
SSDEEP 12288:DeBNUbTVO86UR9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:DJIUDatr0zAiX90z/F0jsFB3SQkK
TLSH
T13865DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 758ba0cc5665eaf13426f235b57924ae808744da277caf11a06ede01672edf1e
MD5 d8274a3977fb1a2920fe3a461f337311
SHA1 ba29e2824353199e20943680f472d43a33f970f5
SHA512 e084c3056dc05e493bda55e8b1ccfc478662222dcc1ba846efaa4440d05388099a7f9eb2b6ea8d733f42c72d5a22cf96e2b16be2d55a2181c1a5243fd942e674
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:SQvGAdlCEL8c/yRNw5CzB2Yyjl
TLSH
T11C267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b0a4f7f47a8dd0bda4a5e5418d3265af2c3c76767bdbedeffb0f43f3d56f8d0e
MD5 362cd509be6dd9c115d444f10f5c2868
SHA1 2bd6c5c0e6529d7d4e04b2a42c7cc494e289c53a
SHA512 691801ace637234ab859edf76afeb4ff44656d6289a0932356ab336d6ffbd32db61df97503f28d4d50144543e74baff2336d12c1a299c1f410d45a71ace5de63
SSDEEP 12288:JAwSfxL/2Dc34DLLmt0LDQewsAjH9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3Zk4:6dewsAjdatr0zAiX90z/F0jsFB3SQkQ
TLSH
T1F075E031FE75D032C6BB0DB61B25C706187D7A604BA21AC3E3E85E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 830d06ca8009c2c4c2346d77ceaabc577862acb3c94acfb27b224a69f5e46ffc
MD5 6593533d0f9ab95363239608828f5126
SHA1 95d57fff2a7c39b99b36328e12a488b05c6b8e37
SHA512 5ba805adc2b3a7523297a5675aa9c69193148288b3de04b99da70955ffc4e9dc29dc9a3dacffe1b6dc5f4d8826b9bf3453f1564e22f49169a98d9f4f9dd1aee0
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEZ:1UEtQevvqc2W1cpV2EI32G
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7d764579f0ae2365583a07bccf6bb542013382a31d417afa3362f73ce1535d1
MD5 b4062d80c85308551e6b0120357898bb
SHA1 ae77a9066f723dc6f203761ef746e64c9f929fa0
SHA512 35982c9a2d1fc24099b9593c901e0002ea1ad9bed93efd8d80ef63e2ca1606eff11510136a76add1cc9ea35f6edd3d65fe4f1646b3c6e2351f41bbd939843a19
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/z9aB0zj0yjoB2:AoqtVjnmnB2Yyjl
TLSH
T1F6D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eb786ced15ce309d93c779bc9c4f896db32794bc982b57977e1622f649d46e00
MD5 e57122ffbeef7f395722a1739a063ee0
SHA1 69a13eb261cf34cf14e41bb34f4736d35666e36f
SHA512 09b0a8135f43761e5a6b2ca3e519c9d4e0de54786c55fdd4717c08a905860de5403d31444cbebad5af7d2bc20bf9c3dd0d6731ee4e09c15884c228453f8b4023
SSDEEP 24576:nAhGLJIFoiwtA5l7S53Iatr0zAiX90z/F0jsFB3SQk4:nAMyFoiq54aB0zj0yjoB2
TLSH
T180359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 071eaf751f41c26291e9eeafc38260f52ead591b638e0801608894f23f3a07d9
MD5 3606ee0f3ed782f9886fbb7b135de47c
SHA1 529d61743f4a9bd8bf763bac12d7c087623f562f
SHA512 30a974ff4119334d330f24196fc29f8ab45168efc86a2ef47a8bcec014b6754bc1cd668f1425272087b50882333e445ec6a9a8e2c7a5cad4d6c59f73c72b1059
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+Co9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:/wuoOWJatr0zAiX90z/F0jsFB3SQkk
TLSH
T15565F14A32A90CF9E9A342388587C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a7406ff1e5e94b4bd7d4b1fbb18761fd616749a0af9aab0a8ae5bcd42c3594b7
MD5 ced2e92ef2fb1662cfb40862e76436c2
SHA1 f880cc7dbe53337fab2397855a2447e195bb56b3
SHA512 a7741146e30a204701aac052f7f9e39c8986e41b4698b2223eaad3ceeb6429d8fd872fbb799a69871977c1db079f0cf27c8cd559af2655736b3b97bb48d4d138
SSDEEP 12288:WBZ1IyX9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:gZuyatr0zAiX90z/F0jsFB3SQkw
TLSH
T1DC55124B32A960F6D5D3523CC9E4490AD7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 254aad324d3189ee90fca255241a66bf4fa8b53a81607e635f6f0989384b4489
MD5 abe286aa19f46b863e51f3771b28ea02
SHA1 c677ee695cac04a533dbfd39d10f2bc572ef8520
SHA512 d9120250d45535b808bdc1ccf64073baa6dde01b3b913cffd9bad8e55ef77b6d68231a80d07e615a434f0c1e54210d4092b9110ccceeb78d901fe20269dc82df
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:9QRQyi36YOcPQLvw2gAf+PN3iB2Yyjl
TLSH
T149667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 def7add1c3b36db2c83b726904231f063f139bb8ee82dc09656dd9de0968d574
MD5 e99e4ab0ce6dba40f1149ab1d9a81a36
SHA1 55f7f55be811c47a54820a5607f1cdd377fa1573
SHA512 6f99474ebf29405cf9685bad30a819a2b396e1e6208d0d6cf19978a943c101921a0f24fbbd145814e2b3534483051371e43fa264796c8320dfc8a730521e63f0
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:HQRQyi36YOcPQLvw2gAf+PN3iB2Yyjl
TLSH
T1CF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 77fdc3d8a116cdfdb9d997a9681197192b1fe5aadde051a17955f667e8f40d46
MD5 c012be675a4d7d7116ed69b7bc0a539b
SHA1 f490fd7b1595db3a59ac58597ee346539704cc12
SHA512 c68081289deffb33d030ebfe1b7f9b10a394bd58f9e83b73b4e0e9830bd8acfd77ee61e3ea174e696bc5d4bfd988212074ac297c87cab17a8262dd0e048dcb11
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0iatr0zAiX90z/FY:Q68Qg55nhheWu7PNU3/NaB0zj0yjoB2
TLSH
T14FB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4ce4fc644b522bc55e0ddb4293883a2f98afce57c38ccbbcaf1ea52667e5bcf
MD5 5d345f8b0e1a7d93548a3360f1d836ba
SHA1 075a16bd91dd93f67cd2b99c0a85aa3a15387ef4
SHA512 a3deebdc738a9a80a44d524cb33a3eb8f8017461040f0dc74e145c1a85f89f05cb93878b0e88c6d1331a3d629e8e9769b2586ecc2a7ec2ab250fbe7bf569c2f3
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:py5112gYy5azzVvL69nLKnhZ5B2Yyjl
TLSH
T1FF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c4ffd082b3b4718a150986c09f3dc6a267d35c73643d86ab8c87475e11c57bb1
MD5 a2f5a3f2b5dab2258534917be5c4d20b
SHA1 5e3b31fbedf139fc5ef1eaf3853aed5e0c2d6c1d
SHA512 669cd114e41244632432ab2e957b918f3fc9619dd1a10de335483e27b93597909ebc0030749ed780290c5dafd2c62b24bff17b40b9a61562d69349dfd45e8aef
SSDEEP 49152:QB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqaB0zj0yjoB2:Ku6JmVxd2dtB2Yyjl
TLSH
T135D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7f521928cb2b094c609d79cc0826c76a0d872b136bf3a55d23755d29f6bfde85
MD5 7add1a9e9c0eff2f244d5034b3b26987
SHA1 f79fa3dfe22817bfa8c49c817db7a88d91b0f83d
SHA512 69bbb941aa5bb0664453344196b41fdb6a81c198b5ef2b3cdd38e07a09a74bd0fbf0c4233444d7f24106a101d4c231fffb7409b3010753d1c70f0f99f2fe9fcb
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xjaB0zj0yjoB2:lmifPbRnB2Yyjl
TLSH
T18DB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e56a33afeb39520df6a39b88b948bab5f2aaf8401f2ca330cab291149c8f72ef
MD5 45a07e02205a1c4951161f99b1788f44
SHA1 8d59b9866edc9e569d01121172fab9d3de6c1ab6
SHA512 5037d332d0b963467f4144d9ef641500ebd86cde091ee3a7cb7a5e5919d055de24e5f1839fb320c501b0bdff1ee57ef29d7f7aff982aa7de6dab559b9279ba25
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqyaB0zj0yjoB2:Y5dKTi611B2Yyjl
TLSH
T140C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 97775d4206c48b9f0e38019a3d98798377b09c8edb7df545561808757bb21f12
MD5 5c550f078437b50d4b28ed723395d98e
SHA1 70183be3730c88db31ccf2120dc960849ec76bd2
SHA512 cf992f624dbcc8ea84cb51c790ea89a62e9539077121592aa89af63d1e32e1a748d692a3a0cf54e01b73f8cf40cc5fcb0b188e96407225c52346215d6efbe3a0
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wnaB0zj0yjoB2:FX2iyphrB2Yyjl
TLSH
T15495BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e23eadcceeea57dafca0520c93c419d3c9466357fa88a723be96e9c59ddbe744
MD5 d5a2d9ac122ebfd770d258ccfebb9b6f
SHA1 8d15e1283f277656e680b9a914b995a61a165437
SHA512 726703d370c0e5513c20c2440b22a394b394e79d4c0cd58d8bc3a24e11e0523edb4440cbf63e5ffcbc019d1ab710cc5285d4d8d177e14c9acad4f1e2dd890077
SSDEEP 12288:cO9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:cWatr0zAiX90z/F0jsFB3SQk8
TLSH
T11645230B341F80F3C8831B355684984B1AB95EB4B6E36B85F2D53F0F9E382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8e61339084494eb2ebaf48a511d9ef8c33f4623744c9c69065f1f310b0a4b1e0
MD5 7c8a5e2b5d621a59aa43ff5b937cfd73
SHA1 89a5d18ec2fb1da9c6c8a81811d3f016439ac5b7
SHA512 a775f639f6c520eccb2a2da8f7047601949815b18b5f3d40a6c3879a8d21aeed95614961d685b004c62c58415a90ef6599aae24d24f9b6ef2e062641fd8674c6
SSDEEP 12288:rz9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:rBatr0zAiX90z/F0jsFB3SQkv
TLSH
T11B45230B341F80F3C8831B355284984B1AB95EB476E36B85F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a477d0834cfd3c5711cf1c1d1e0356b545a32db9cde3c51fcbb0009ef8c97d01
MD5 97ab35ff8bc18b371294b2ae7b03ad7b
SHA1 3e857347e2883697d2c41c1ec6d3d7a880607fd2
SHA512 e35147ac5a120dacfb862ffa005fe13656b713e28465c7df25b7caed63aa725a575af22ed3f99f5db0b8c819be666ee68045b2ab6ad05e7bef91f788d0580050
SSDEEP 12288:mZ9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:mratr0zAiX90z/F0jsFB3SQk+
TLSH
T1F645230B341F80F3C8C31B355244984B5AB95EB476D36B86F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9f946fc9ef5133303f6768cd610afc9865f1a47517d10b783e119f58ebdfad90
MD5 93923c893a368073bc5f12faf01f2a8e
SHA1 3b8bee6e3197d61f02b060d4f56cac4cbae0ab56
SHA512 e6541d3ab214055925a97cc7a03309fde8d57b3091ad963c09d6d12d0703b7c9cc5483189b5feb39acad60150d46f3ef5bc74152f97243ac9744256a50aea920
SSDEEP 12288:fVs9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:Oatr0zAiX90z/F0jsFB3SQk5
TLSH
T16E45230B351F40F2C89397358694984696B5BDB0A3F3AB9FA2813E4F4E343C56934BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cb4b4cb721ca53e8ae9067cb3209e1658c9932c574735b967e3d40a15e0487cb
MD5 94d5d6df8b3adbb22939e601e1d276dd
SHA1 4e8e764f9c08bbd9176c6c9487116d9ecc7981ea
SHA512 e15f2b8643105abfcbb5a46e7fb01d42950a9b7474105305a648e9198605a8b062071bced9dc6ad244702e2a08aeeef4fcfa2ea6617c9cc3894c334d4ca8dbb6
SSDEEP 12288:Dk9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:Dgatr0zAiX90z/F0jsFB3SQkn
TLSH
T14F45230B341F80F3C8831B355684988B1AB95EB476D36B85F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7bdac28a7d40a892815f78511f0ac1bea0b990722caf268da19ebb275533b4fb
MD5 1559db68cf0481d249d97a182833e60c
SHA1 c859bfd3c24f46276c1ffd0e559821c48cea571f
SHA512 df6b2b5737ece1f4f1761e0a78f6abb1627bb89449baca1636804d58e3f7ff576a35667f686046d1534e006a8ba52b5280b8ed302cba7c5be7bdd70f9667dc46
SSDEEP 12288:Iv9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:Ilatr0zAiX90z/F0jsFB3SQkB
TLSH
T14F45230B341F80F3C8831B355684988B1A795FB476D36B85B2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e716937351fd1cf29b487007cb34b57e2137dae2964d9a01680cb46d06de6c8c
MD5 8bae69276dd6d351cab4cf130c3c52ba
SHA1 3076e6856df50d94c8087d14aa572c4ee40e15e9
SHA512 d5a049a6afb411774b3d26a3e19786d85a650233ea23bb02d8ab5c5f7eb360a8e1e60b422d9fc4153dd5e9e0674d8a6f2d32d7a8cc830956344b50dde4e5a436
SSDEEP 12288:eL9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:e5atr0zAiX90z/F0jsFB3SQk7
TLSH
T1D345230B341F40F3C88317355644984B1AB95FB4B6E3AB85F2957F0FEE382C61525ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 df960c081b7d5dbcde3eda86f985c8ba5c503ebe089956f6bfee828bc1860e06
MD5 c45ff0e370b90b0557a8566ddf5ddc24
SHA1 026a54cb2249f8902024220649d78e5ffe1682b4
SHA512 8b87e42f40de85c22544c3a3e1d38cffaaade593de86302b6ef408fbcf553ad780a290ecece3166749ec20ef2ec4b25bd6ca6dbf5e947b8be30abdb5c46465cc
SSDEEP 24576:XZMSzFVSOhatr0zAiX90z/F0jsFB3SQkm:XZMSzf1aB0zj0yjoB2
TLSH
T1DD65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a17a18ff3d07554863c054dedd2e3c6ba3ec3e3f139b177f83fa98832932048b
MD5 222b6a7133fd902c20d13b055b5e9869
SHA1 dd0258a3092ddce32eeb35afaef0fa15b16f1806
SHA512 65d0b6669a87c7e5ee564de8c785f469f38a29a08ef41aaf1df06aa9d239db6beeca9ac9cfec62c8c555cb17053b8a308a083f850a5066651ead28a3628dd58c
SSDEEP 12288:ay9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:aCatr0zAiX90z/F0jsFB3SQku
TLSH
T10E45230B341F80F2C8C31B355648984B5AB95EB472D36B85F2D63F0F9E382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fec756bccdbc679334159e73a6b84189291cc8fa93cf1de3189c8e58f95a0677
MD5 a2fc79dcf356a965f41a0dea2a4b4396
SHA1 ea0af36204241f7252526e40833a64e5f62f08ab
SHA512 e63b5de890bfaf9bc21b0038a2703a4a7d20aa034be703db454a36d0909de7ae7157dc026e04b6309a0dd9808d0af26164f6b833bf6f0e2686d99e15cb6e049b
SSDEEP 12288:tW9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:teatr0zAiX90z/F0jsFB3SQk+
TLSH
T15745230B341F80F3C88317355684984B1AB95FB4B2D36B86F2957F0FAE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 606781b7938edd959bc678dd693a986dfb6abc5a4816f9c6afb736f45c041562
MD5 5113ac8d94ff4957ef13e795f810aa2b
SHA1 b95141c62f20d1f3700c543290dc959287d62c49
SHA512 a02a50916450e3e420c8eadf50911c2ed7beaf6a2b080dd6c6752ad17dbf8cf2ed9ceefa0aa716a75215323e322077408afaa389466b1cdddbe58014fea5be66
SSDEEP 12288:XyPz5L8X9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:azytatr0zAiX90z/F0jsFB3SQk8
TLSH
T138551207326620F9C4639238C9911D06F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fef9b738e492e7c698fdc7ccf586bb5cfa25f2b4210500fbed1178d6f2868bb5
MD5 f24558453e5a21968289e6e4666e61c6
SHA1 ff6f0fb8ec1e0c97a93efde1f1741803db69a605
SHA512 e1739a4b66d631b9c686b2b9903c2239ca4c8a12e538b33700aa331e5afafd8288219cebaa1ab530e3ed3239b325c253c50d77d8b9e9930a105cd94bb9527bae
SSDEEP 12288:4y9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:4Catr0zAiX90z/F0jsFB3SQk7
TLSH
T17F45230B341F80F2C8C31B355684988B5AB95EB472D36B85F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 060d7294136359775a827903377bf6c9823013ae5af8aa4dcb5ae409785b3c55
MD5 2e532d0b30a47728ebbd99171daeed80
SHA1 572179ed61e9a7e8e7f60d7ec829b414f0089054
SHA512 df164c4fbe1f2fa8579f549a1c7dcf0154b6f89571f2d18c64bc403d4adea211da1c032ccc522235512df2c1a8c3a8d84abcd8b929ba248ab80e5ab35b5e275a
SSDEEP 12288:gy9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:gCatr0zAiX90z/F0jsFB3SQku
TLSH
T1EF45230B341F80F2C8C31B355684984B1AB95EB472D36B85F2D63F0F9E382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c441f5b473d463adff0038cb22c30414c34e0c586f0c30719387779d9159d911
MD5 5df28ab6ef727f82c5f19bf53bb1f7d7
SHA1 018dad5074fd519e0f022f6d80ca49aee394eccd
SHA512 4b7de03d042e7502faeef1e3a74549957480b8fee6eba3597a85e465586440f736541ea6c5572c252834a79529ff65bdbb8e8ec9f5d2fec86a5a5c8437f5fbee
SSDEEP 12288:lyPz5L8X9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:szytatr0zAiX90z/F0jsFB3SQko
TLSH
T177551207326620F9C4639238C9911D06F775783117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 27852144c5218b97e0ffd753bc57f4249695620dd9f4e34322bf2974608ddb62
MD5 ac263817098e45817f078845ea3aecda
SHA1 02e09d1336e576c2378d078ca02fef2e1ec6c4fe
SHA512 af8ef082189c06288fe0bc283741515ecaa89cda21b99823dbc65549d0994193b22ccd691d0d1b8eb401a698d681feb9a1ef55ea181d3fec8490df687542bff5
SSDEEP 24576:vTHaLl3z0zDbatr0zAiX90z/F0jsFB3SQkO:vT6LljsaB0zj0yjoB2
TLSH
T12A650199735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6d5a8b0aa24a5aae590ba9a504fa529fb97895b4357c201eec2030fcd087f76c
MD5 cabc629e16abb9a92ac78f4f37ab3e24
SHA1 39cfe0b8cfa424796cf9ae364de0ddf604ca062c
SHA512 5ac50d5b198ba057491cbcc13e9ed0c6bcc1a5d4851286bd36921d5584df05cf7bd83256304a3c90d57f5802189c8b1312aa4fd460e6d64eb02003ada575e751
SSDEEP 24576:037d9CHKy7GZPatr0zAiX90z/F0jsFB3SQky:+7d9CHKya1aB0zj0yjoB2
TLSH
T1EC75CF91F3E810E4F0B39A3589759512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 64b240c8882e2ccd9738843cd5317d8bac5a59b28ad6cc9575096f520e2d85fd
MD5 e48c793166fd9e41788faa050d2c4340
SHA1 3f5b03413a2b1a1a8853eb280b40a88c315c471d
SHA512 1bba73004e6f28dba6548c7ebfb5020128dad862861deed1ecdf7b3c7a662b5bc664b15a64b44e03f58ebba0ba6fae997b6123f0bf47dff90569fa2367b90eb7
SSDEEP 12288:g59UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:gLatr0zAiX90z/F0jsFB3SQkR
TLSH
T16645230B341F80F3C8831B355248988B5AB95EB476D36B86F2D53E0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2e2714ad1967b72d7b7e600fa0532cd3ed8e24f5b9a0f5c2f74f75d811093cee
MD5 0668f727a28f50a752fa055c121528f1
SHA1 7072fe83a60d6d6ed1a5c2b8d5de6c88a540c262
SHA512 fee67fbc77977b68af6d8927973a337b7a3673aa0a3b05ec083b5d50042591547c000e34b51c508caf4f60213a00b8d411bc90c0b90c3705ddeaabbe52215de2
SSDEEP 12288:c39UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:cNatr0zAiX90z/F0jsFB3SQkJ
TLSH
T10F45230B341F80F3C88317355688984B1AB95EB4B6E36B85F2D53E0F9E3C1C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fc766f571520a1181d7686c6a42200b62476abbe06df571d0eee5fcdf446999e
MD5 302f692655961f22d22d82acc07d2e4d
SHA1 fe1cd6b30b6ade8f705afc68e5af00ec5b80a797
SHA512 caa9093b158d14e0511237ee376659168fba1bfdd19d7f3703d9f917fcb821068b5b58eab455e016207b8b24c413d69053c9695bceffb94818e3f70a1cb369c9
SSDEEP 12288:Xg9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:XEatr0zAiX90z/F0jsFB3SQkn
TLSH
T10945230B341F80F2C8C31B355288984B5AB95EB472D3AB86F2D63F0F9E3C1C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3849ec5591eefee3237b98fc98bd0a326f3240d94b240f8bc9e9085088b9ad1d
MD5 9292aa0a0047947cb4ac11535c85cc9c
SHA1 31abed92bf21d14796dadf598aa1427f9b0ff889
SHA512 81185a47e03f96caed1296360da30fff4001fb5df21c60dc4b5bc954294ade3e4359196c2c138080f3f5cc56fb833332bf2dd30e3280423ee82d49c50816d82c
SSDEEP 12288:Wy9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:WCatr0zAiX90z/F0jsFB3SQkM
TLSH
T18E45230B341F80F2C8831B355684984B1AB95EB476D36B85F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 70de07b279280833742e0f068c1b9ee6e00cfae8f94600bb72b25d97ab7c4c46
MD5 c038c14f585d6df3620e7fb4bbc94af9
SHA1 5efe498ed2fa9710ed06533d9787b5024ce3326a
SHA512 ad1afdfa39fe962d9d5fc326d1b69fcdbc007fc98f6f9ac7230bd6f3506dd24ab4350de2162204989d0f110ed8658cf6b9b95b0b028c3f2bf3ed919616090988
SSDEEP 12288:O59UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:OLatr0zAiX90z/F0jsFB3SQko
TLSH
T15D45230B341F80F3C8831B355644988B1AB95EB476E36B85F2D53E0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b4f06176e3265620f0425b8920358ff2f303acbf1333e2d65a977c7734c10fed
MD5 8265fd46b3d09fc90da5899ce2936d53
SHA1 328475652e79b614f935cd9c28cdb8fd0a3683cf
SHA512 9c98d4de4c20511f2979cea4f51dca3ef69a31ac705e2979df2d681f0ae86604a7077ca9b4739a9f538d25645e77086fcecc644bba7ca2ba22cb726e2aa43132
SSDEEP 12288:1K9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:16atr0zAiX90z/F0jsFB3SQkJ
TLSH
T19E45230B381F40F2C8831B755684984B1AB95FB472D3AB85F2963F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-23_044218_5452-5144.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-23_044218_5452-5144.log
Size 1KB
SHA256 600e25562449154b8eb32b037fb9c691f2ef4cdfa2be257d03955538e15b0cdd
MD5 b375bc4f3cf15d843cd8a79e9416fbd2
SHA1 5f91508ae69bb6a6f24930ca1de287a66e6611e3
SHA512 a832ebfdc724ecd77cd09a1744cf9f621b2641d7b851c767b1972b3fca1915526bd3f40f6d294f6cfa9fd8cb30a071d471b6c8637d13ab97596a2e4a078be257
TLSH
T1A621902E6BD84A06FEF6DAC298FA1153AE3538913C30C91D40A4424E4835F41FDB0313
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bc731c313144a5675042f6bc503e3acec7a4be84f1580e6cd11b97e4011926a8
MD5 3c6569dff60c1e01bd9ebcdb19b0a05b
SHA1 b4b84a16a51630c861b82a99f2b050dfaacdcbd4
SHA512 355adcab4214c8bd8b936e43855cacbba9d89e196d36feeebb0f79baf2408dfe11c99ff546d83a3d6d8e7d737fbb048d69d33281ac0a30359c7fa7e442b2c290
SSDEEP 24576:7fwvok9RX6wkyAIuatr0zAiX90z/F0jsFB3SQk5:dMnYIuaB0zj0yjoB2
TLSH
T1ED85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 144120f7be4a56d20ad7acf470a67320b774e5c336313f386a1e9050344a6678
MD5 88b0f82e7991ebda2c8591f74d0469f8
SHA1 e73d15132d7a82b2043c22941b65f08874c5fe5c
SHA512 2f6f17be6697c01aba5213d84133b23ee67fdc6b7f233ed9facc2b5fa70503fec824ae624ae0a31aa30323bb2fab4919f8b563169e9161842bd53c77a29c6147
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HaB0zj0yjoB2:lySzPCB2Yyjl
TLSH
T14A066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3298ac1dd1de8d28eee7896d74794f5f72482a041a434d6be7be6eec51b890f6
MD5 97c361bca3fdd8d6a1a93a38d44a238e
SHA1 97c0e48d7215d96ed691c92a9f0c2944e9541ffe
SHA512 9daefe875ea04dd6507e89f23e1bc12235e49d20af934900bc16c3969c5020be93d6915c10de3f22c907d7a5b1c0c811aedb8cc9eeec861cb09139374f598188
SSDEEP 24576:p47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYxatr0zAiX90z/F0jsFB3SQkK:p47JUQj1irIhCnDHUPfF/XaB0zj0yjos
TLSH
T19865AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF22B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ea10db45c8e063bffa1580a02c3821a1337a593c85bcef5399f6b990598833dc
MD5 c2fcf8d551a8ca9eda4aba918de2bbe2
SHA1 984ce5642665ebf9b8a73c56d310048fb60a8ea0
SHA512 1e5c8945cff22cb3c8b11121ab5168aab065eacbe7b714dcda3bb95369f3d9dc09e14a81b7f946ae7b046f0426f35560d19cef574f4c1b6d3d797a352d7ac602
SSDEEP 12288:XNsfi9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:Uyatr0zAiX90z/F0jsFB3SQkn
TLSH
T10955F00AE25801E5C4AE6239C7544A42B7777C6493E2D3CB62D0F93E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 7b65ae2548e1dee753bd473264713bc612bd577e18de78669fda2496978384a8
MD5 60c03af97a761672bd7371b73e569b7e
SHA1 df005d399fb5a9432894fd78f1e3395eea8be424
SHA512 4870bced129ed7395166e204a8ce168034b2ff7c605c946edc9e1f7c6fa23d0c686da0141ee94210be849fb62033aa8a741d4a4fb34b553ef6fcf361b618b6ca
SSDEEP 12288:8nYM+nU3fozr2xWF0qQh20hIdkeN6B6UtMdc3jozpOWu93T:8nTAUPrNJ6eTgp7u
TLSH
T19E252750766AD75FC6A980321E37C2CCA7707D01FE059B0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 99afba9f93bfb37914dff1223bf43da06b340fc89f82fe97131690645d94a5df
MD5 fd931cdb6967d6cec06ee67cb45e6f2a
SHA1 0c0eb40b001a1c9c8faed0285bf3772b21c00bbf
SHA512 43afd6e526d14ea9f8d89f6231cda03d7cc38d815ee38981a2bc2032e3692ad651874e49c476414ef4e0f6d0a82537d5df09c1596d61a81a9f2cb8b6878d9b04
SSDEEP 6144:Pg9D+q4/50RtndyJS6iP2xWFVCqQh8OCrYq/W6v1kq/D6MusvezQ5j2/AZkt/fUz:Y3/cw2xWF0qQh8OCdTVyE
TLSH
T1E555B5816537A3CFD1F76131072A5B4CA7A4EC03B7095F266388553ED82BB26A1BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d89591b468492fd278ea55e1c8589152038c0f8e79d0be98e2fb5ebc7f1cb8e3
MD5 a7ecb261c3deeccfd498c378de51f10d
SHA1 f59e83f0061c169f41660cecb571f2f617304448
SHA512 3e9553c97ccea2a134d958a597b086af3ff961610e6f8792951f5b75547641ecb3c1eb35d57f9b4493b25dbdf05beddf0deeafa3ad11b672ff76f6037aa46d38
SSDEEP 12288:hM769UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:6qatr0zAiX90z/F0jsFB3SQkg
TLSH
T14F452307351E80F2D8E32B3411989806267EBA746BD29AC7F1813F4F9D386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 63a2b3a91bc0686421c39d5f8bc761c5ec207046d6a0f065a27984be76bd330c
MD5 e104b50891f50f6a736866822ed03339
SHA1 f4a52ae25d4917e5b862e5dcc6a41ff7166e0876
SHA512 7373f275e6bdc6cd511742f11e2c87cfe082422b1f598bf0d473cdb17feaad5674333f65a3d86a4c778392bde9313fee0bd405490291a38533e3f11d9ccb4cc0
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYsatr0zAiX90z/F0jsFB3SQkn:Bgb4mBIBhGFxaB0zj0yjoB2
TLSH
T11F65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1c196ac6b8f0dc268cd8567682c7ed2c53beea5bf2a5f28a09cd5828a93409c7
MD5 9fa40b2027c296cb327fd47304919c11
SHA1 5c75312957e84b69f92475ae9bf1c482613b8d11
SHA512 4f1488f94ce4bdc0fe4c9f65ef1b588c2b8587dedf5c1881e3f637ef83b23336ee9e71d5b56441c37ca27c6f3409990be7101b6bba4e9c845fb865e3c343188e
SSDEEP 24576:qG88u8FpJqH1bzria7/mhatr0zAiX90z/F0jsFB3SQk1:R7ZFPqVea7/kaB0zj0yjoB2
TLSH
T1C085016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 389fd195457dbe3081063facf66075f033565c382c374152111b86cc89a38028
MD5 7f3ea210dbdfb6d55f10916400e6da15
SHA1 482cc5f60cbc87cc27180d1152e49e02b6a6b648
SHA512 ab0144cd76faac7791abe93877e42a0ee2a125a85e3f35e2c91283362b96def5105e2d654f0b612f5241af3cb5925340e1760a727aee338c24651bc9ee8db334
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlaB0zj0yjoB2:vG05lO43bxB2Yyjl
TLSH
T158D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 03d338df03c5551fe55988251d94972c0443e7fe29c3bcc2c6d87a68a4fd7b63
MD5 3c172373a3d3de3b7751e740e503a8c7
SHA1 5375ae8b5970aa7dfcb97cf35909e6f9f626b031
SHA512 df4c6db6312160772e45b05f081be3c13f044e1d000ee3eed4211734c6c903abe49a45fd1675442e47174f9b68684d1c68867b24ced1e346db8a03a39bd05b5b
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHatr0zAiX90z/F0jsFB3SQkb:ga5POZ3+Jt2pasx2+mNaB0zj0yjoB2
TLSH
T15B65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af7d3ee6e6bb764886c0f4ad8f68553c1c76d99b7fc1e729718b78725da2fbcf
MD5 f7c02d5d4b79c7573e47105731ed3448
SHA1 9c895c20582b68e00598c4d02438e3699a2bfd57
SHA512 8e68d3b2102d0107b5c487d60c338163b9b67007e4fcbb808de55ca11fec152286a28408a84a07119a75736144c527572c090c6e9bd5b82208c3fba1c4490668
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fkpatr0zAiX90z/F0jsFB3SQkw:FNc/zEOVHFEaB0zj0yjoB2
TLSH
T157858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 06acc6e8e9292f74709fabe0a0dee62b7d479f48292d378b03b055cfffcdede6
MD5 a60963d05de6cf2639f6f1f82d27a4e2
SHA1 55629ead00884cefd1635b95463e998244c2cbf7
SHA512 3163dafc6f01e545b0e0eeb117fc27448b81d4842e9e235a7d40c0ee9fb836e7197e51aed199dc1605d8e020c8333c72c29dfb2fc67eb539ad96fca3db6d0adb
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmuatr0zAiX90z/F0jsFB3SQkF:m8MwBtOmuaB0zj0yjoB2
TLSH
T1CD55BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e42f1784ed349428a31cefbbfb9aeb150c891596386789e7213baac68562d6aa
MD5 0206abd6810ce3ed45debfc2b34eef67
SHA1 eeedb17d208a54a6513841fd3aa14babc20ba223
SHA512 b988999ed201a751718c5cccf9905cad593ddc1883b0ae0982e9ed44ae5f426ee6ea6f287625c89d63085785aa16e53fdda89ecee8d5b0d77271e4a30021b072
SSDEEP 12288:9HvUrBFrEjwaQ/9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:9PUr+NQ1atr0zAiX90z/F0jsFB3SQkG
TLSH
T17D65E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3b6d724e8a57f9d351ee2fd1dd5e3560c289058e9a0ac00933f8796dd7595094
MD5 3397d28f673a1aaf3a1fdca81815132a
SHA1 7fb19bc70721251aaaca866534203c022f74afa7
SHA512 f7dc776267eff84eafb1ad9581c99e03a6441d4be6d18c3f81126e36be6c9da73586a20084760887da5bcbb5b10b464fe019fdf7f8da3b63d8ad36c4567e680f
SSDEEP 24576:6D3FHshBIYQgA2atr0zAiX90z/F0jsFB3SQkm:6DVHeBIAA2aB0zj0yjoB2
TLSH
T12775E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1744-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1744-121-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1744-320-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1744-129-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1920-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1920-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1920-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1920-180-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2296-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2296-143-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2296-141-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2296-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2296-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2400-64-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2400-63-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2400-285-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2400-70-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3352-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3352-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3352-103-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3352-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3352-335-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3352-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3424-87-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/3424-92-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/3424-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3424-317-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3436-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3436-14-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3436-23-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3436-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3656-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3656-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3656-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3656-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3656-115-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3656-321-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4176-302-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4176-76-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4176-82-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4176-74-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5080-59-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/5080-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5080-49-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/5080-55-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/5080-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5172-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5172-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5172-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5172-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-28-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/5452-32-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/5452-2-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/5452-7-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/5452-9-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/5452-0-0x0000000140000000-0x000000014046F000-memory.dmp

Download