c7d450a627f8548889e4c5e1f2c5e1df98da35a9b57ef2d31f7af8160ceb5274

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260723-jprmjsfr71
SHA256 c7d450a627f8548889e4c5e1f2c5e1df98da35a9b57ef2d31f7af8160ceb5274
MD5 5d8868306df8946be651f4a66bb007db
SHA1 ac353980461c70753239b7141a2d3a8a31205dda
SHA512 9cdd5934541388e1576e0302645d0d0cbeb2de70aab79f4a151d1036a6ba40d789b319446ae2e75ce1f98f4385f39448c0167da6d477df52272ed566cf9a929d
SSDEEP 49152:TieKCyPTDmPCOXVU7rtmcLLp94Mv+lklxcmfiNMjO8YT6EsaB0zj0yjoB2:1OhlB6wEjB2Yyjl
TLSH
T1FE266A1BE2B940E5C0B7E1798A979557FAB27819873297DB4790470A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4168	elevation_service.exe
5164	elevation_service.exe
560	maintenanceservice.exe
5040	OSE.EXE
1588	PerceptionSimulationService.exe
3180	perfhost.exe
5848	ReFsDedupSvc.exe
2252	SensorDataService.exe
5888	ssh-agent.exe
3980	AgentService.exe
4808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2ca0355083806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005c94d0b781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073ffa10a781add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b903eb0a781add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3e0820b781add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001576890c781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8edd40b781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ce5370d781add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
5164	elevation_service.exe
5164	elevation_service.exe
5164	elevation_service.exe
5164	elevation_service.exe
5164	elevation_service.exe
5164	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3500	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4168	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3980	AgentService.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: 33	4808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeDebugPrivilege	4168	elevation_service.exe
Token: SeDebugPrivilege	5164	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 2496	3500	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4808 wrote to memory of 4476	4808	SearchIndexer.exe	102
PID 4808 wrote to memory of 1364	4808	SearchIndexer.exe	103
PID 4808 wrote to memory of 1224	4808	SearchIndexer.exe	104
PID 4808 wrote to memory of 2408	4808	SearchIndexer.exe	105
PID 4808 wrote to memory of 1496	4808	SearchIndexer.exe	109
PID 4808 wrote to memory of 2248	4808	SearchIndexer.exe	110
PID 4808 wrote to memory of 2792	4808	SearchIndexer.exe	111

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3500
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3500" "1448" "1372" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5164

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3180

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9e0ac7de690b20148bb550ce4e5de85b0a2c4eda5cc9a4efeb9d52a69096f177
MD5 13c70eed7308c6414ddf4dcc9f7a6e91
SHA1 ab7fced7381fe53a97546822256da3711983fccd
SHA512 b1786f2b43d2059320747624b64de9d409e2e4eb02c13c7dc6d7d90943bc68605db90caee145f68909f89a3bff2f77be6db166eb3b1e25b59a3dab0a047f928f
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2aB0zj0yjoB2:+3q6HjBSB2Yyjl
TLSH
T129D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e9d501291dabcca064a0b912c1c54556788be068e460fa0e2738c979b1b15648
MD5 e8783e070e0c08d952170ece2911ec42
SHA1 31e8d1da8c2df762d14d0029cbf08c50584b0d0c
SHA512 c2ebaf78b9d3f22cd3adad6f51ed8d64d1b2db1303bc479cce4e8b3da21b2725764cc527bc9d464a21ff4600ef5eff8132e9ddfeea878b7c2f6bcb5640fb7882
SSDEEP 24576:HXYfDtczAAatr0zAiX90z/F0jsFB3SQk7:StcPaB0zj0yjoB2
TLSH
T12E65022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f3d26eaf58b693984d1dbadd39ee8c611cc3dccdc2a9734642da67c74e132b63
MD5 8552e2b809333bbfd4729defcec30aa0
SHA1 45efa880ba6e5d4efecabd6ff0654bbdbfdfed44
SHA512 c78f4f0c75a6db3817752d9650d8b4ef60a2bd15b866871d106700a1a2cc6528747ed39b46fbbbdf9ba94583857e57dc9122c62c6481070f12d3cff30d6bb325
SSDEEP 24576:10Le5ji0hmxirM9atr0zAiX90z/F0jsFB3SQks:1Pji0AcuaB0zj0yjoB2
TLSH
T1CC859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0e43bbafaa0021dd973461a7d16a8e89432e5fd333fb2b64992b374dfa193af
MD5 b04398a2fd341fb72107453b806b045d
SHA1 707efe2dce6946026bcf21819010e86109058e0e
SHA512 732c1cec429a4205e70e7dfe20051d755f46229db91032d366f319b6aa904813ecdd2697c16e2b49f356b00d5009f891d68d61b4c4a2796a0363a9f549787d57
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyu/atr0zAiX90z/F0jsFB3SQkX:W/ezSC6vUzPvxHjyqaB0zj0yjoB2
TLSH
T1D0755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 247f6e9d5e791e68ef70f35efcb10fcbfb017234055f0291d6a5061047397c22
MD5 b1bec6f9ea696072525d8637f298aa61
SHA1 01bfcba81d1fd904460ea0777fe730352bb9c613
SHA512 336b2c66e16fc6d6882e1e78eda52d53cc66d3fe4c9f33ab68315dc82760b11d38fc1ef069635248c85ed5fd2961041450a94668e35d15258b6ac25d753d5ceb
SSDEEP 24576:pVbqPb88hv/l+60atr0zAiX90z/F0jsFB3SQkx:pVO88hXl+JaB0zj0yjoB2
TLSH
T1B755AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 281c7377e1415cecf3f4482445ff28bf55e65c5972f867d8be7eb7ddf9ad4c24
MD5 fa218029142cd5f24fb8b3f6a531af1d
SHA1 9efe95db8bd9e426604e79148db272c0d32bd4e4
SHA512 8a36853863d60aadb8e1ad283dc70ffc99386ffefeae3586bc7736647e96dc4ec1038af29c9814a69ebca605b730abe5ea8b4b4f98e7001b143d68fa897411ed
SSDEEP 12288:HRxUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:HRxatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1B545230B340E80F2CDC32B3566989C4B1ABA9EB065E2AF85E1D13F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 eff1923ff3d2cabeac9a21f6f5c08c7df32058bc3169811778f7f19682711ff3
MD5 fd1d3bbfb47c361616a95c31b0692f18
SHA1 84c4f430c0172bb82bb55cb8098adc1136628eb2
SHA512 a9d57a7cf29ed11f7bbab64ace7505dcd9d44bbb294d3857d03f82f28791f7b57d064aaef9602418a93dfa292d9f6bc535fca2bb4e9c9763c5a4d1be4d462298
SSDEEP 12288:jeBNUbTVO86UsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:jJIUsatr0zAiX90z/F0jsFB3SQku
TLSH
T19E65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eeda5d93140e6cc79d905de7dda9a869c0434b8124ad3d27786c2d33949717e9
MD5 b19dd1baab23eea2a28afa074ccd32c9
SHA1 50bcc4c329263fb5569812768bd5a8176ebd3d7c
SHA512 db23ec6a7160c07a301fe6c654f7fc0b906283bb488f10183dd5d36acd85b42ddb129cc744ddf0d7afddc5be0a287deede5bd90bcf921d2c8e3f9027db7f27e3
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:sQvGAdlCEL8c/yRNw5CiB2Yyjl
TLSH
T1F3267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7cbe76fd2ef67d2923d530299d8eeb71f373f2fbc5df290b42857343cf98543d
MD5 14de7600eed0349a044e6c62a0f14218
SHA1 03def0efa4b39b6817ade202f5fafad5595aa6d0
SHA512 7278762fdea0d1668c44861d3820e88aa58fef5bf24f4943c4c06c7df61d064c81f17aa163cbe10c566465b3a09e181266b1583994fe093898b75076155fd033
SSDEEP 12288:EAwSfxL/2Dc34DLLmt0LDQewsAjeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHr:ZdewsAjeatr0zAiX90z/F0jsFB3SQkT
TLSH
T1D675E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d503f3c9e61781f4fbde3856336b929da3af5a5d09dd0bb5419150906a10332
MD5 3876e755f2e2df9f7cbdc98aa358880b
SHA1 2e1c25282ac76ec640ce4b527431d706259c8959
SHA512 32b8a9984031964226479eb0a0d998675e772a638026ee70c5001d0e6e263c22f01438d6e22ca68bde39bcb61701caf6cb518a23af30ea025694b15b24d36ee3
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxZ:4UEtQevvqc2W1cpV2EI32j
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 24c7374b67318dbccab467c9e919bce51f0c15a7a5f12a41ef0e73131ddd3a91
MD5 e7edbe3396849fa1af61e84528bb5405
SHA1 2d22a6ef1bae7eeeb848c5c42e3c756cc77f1c5c
SHA512 339d54f03cc2853565d797b86df015928509604452d81eb2fea245a9cd4f26c8cf2462b2fe782bc1b7fbcca253c839870aca16852175a5c618a82f806cb77d8e
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/z+aB0zj0yjoB2:/oqtVjnmmB2Yyjl
TLSH
T195D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3cad5ac5c18046c25196badcac07af08751f50dee4ec78399ed176209da8baa5
MD5 db12c8d53c256a45a99bd78e4325dddb
SHA1 096c177520f1ef9e26a3902f880d434a8c19215a
SHA512 85eb47bc98beeb7c8db360dd47dae1681b3d11bfb523698074b8f65800cb2af14142b29ef789b0248df6c178965ec7900f79849ec337153e62a3c68f8a84130d
SSDEEP 24576:hAhGLJIFoiwtA5l7S53batr0zAiX90z/F0jsFB3SQkC:hAMyFoiq5raB0zj0yjoB2
TLSH
T148359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8e9c0868d18e301ab7e5c9ceed65677eae82f51a8d60e3f64ba52471a7cc93a6
MD5 611c62d3c617fdc720d412f6b3aab5d7
SHA1 d772fe3c2f391de9c0bde7483280c7d8ed9765f1
SHA512 215d21631b06c10a452910ab3c227c4149874e3c2e861b12b55e6c2aba09779ab585bc8655c80d51221e40088d138ad49e4173821c95ce4527793284b98fa964
SSDEEP 12288:Umw5HEjsChNVBFgl0WDm+CfUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:RwuoOWKatr0zAiX90z/F0jsFB3SQk1
TLSH
T16865F14A32A90CF9E9A342388597C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 24bcd3d45e1ec0daa082b1d83374d9b96d1447c7635aa0a5a42659ffeff1f3cf
MD5 acbb946d019e77ccff462bc92e2771f1
SHA1 c27f167fe3eebef9f94125afb005c168a6c7607b
SHA512 e385e920e39752b56b7b93b76380b2b1a8e6eb3eeabf9f8b68729e4f335ac99c21dac5f7f3a28b088c27e9778af9d6130ccaa479dd32e6e508fe573e6c5b6f2f
SSDEEP 12288:GBZ1IyOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:QZu1atr0zAiX90z/F0jsFB3SQkq
TLSH
T18F55124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 297306dd2ac9dc494580663057b57dd2c79cebc9793aa152f8c55045f9c12fae
MD5 a27c314b49e43b1ecaefa2a033745a73
SHA1 31bb2e9cbd7da5d892aecb6d6a024534a38c43b7
SHA512 b9201c98773840856e3878f44c520c4f91baf1f0787d4d37676c844c3ad90a4ada4c627d50fd734e16c252f4a8557d6bd415ac676e42796b41ad75cc6aed9fb9
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:NQRQyi36YOcPQLvw2gAf+PN3XB2Yyjl
TLSH
T14C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b1692b0a289871e298098649fba3eb458cfdbf130c73a574c59190f2af4ffc0
MD5 a2355419134fb296d4ca93d67c9ce80e
SHA1 c8606ca5d064cf914c6aad040bca7cde4968e177
SHA512 2dc745c1195cc48e69bbb8c9a48113bf2f492c9832dff5c46edb47cd69cbf849734901e1fd3c904b1ab540179ceacf708f0896eb8156d5ef502177003118bc96
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:zQRQyi36YOcPQLvw2gAf+PN3XB2Yyjl
TLSH
T13D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 42d777bdbb3bf3f797415cecf0d6072b7b12455a13f0408538aca6f5264f6513
MD5 2df2746cb1f70fec431336704283537d
SHA1 4e54788498852f0e1423edfa40474e5f215161ee
SHA512 31c5b9f5df41689a07625de841fb4594ca13b976c7e07aa953e9762d214060349a3658b6e391cb28087f2b8c2ce6d29030ac7f282887733fc785f1cc49bb80eb
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Fatr0zAiX90z/Fd:T68Qg55nhheWu7PNU3/uaB0zj0yjoB2
TLSH
T169B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 66d9f08231bdc0c49cf7ebc96bd2124a7623cbdfbf7e57e0a228bbacd3ed0f83
MD5 568c435c0e0d14feba822c4888f3ab0d
SHA1 552c8b88de15aecd0fa619647d407b133d97a2dc
SHA512 24b4eed345fc324abec2b8699d4754b4b9e93af78b362e18c0d295837eb54daa7f84ebd346146cfb9bed3ce3bd079e31bb3b2d4bfbc8d60f1ccc284678a380da
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:yy5112gYy5azzVvL69nLKnhZYB2Yyjl
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c0df7eb13a2fb59ae6e367f7875ac8269a6ad727af42a8cdf7ed253991955fe2
MD5 673fa9762bbaa6b63b0899b38ac9ca20
SHA1 013ba584a0d1e18b47a4097eba1053f3106d67a5
SHA512 0429984308da79f715bceb74b4f61da4399ff36598908a28ce205663505d38498b4b156cc533d5a13cd499cecb9034d37f80ffc362ef796a24b318ca28e97023
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTaB0zj0yjoB2:ku6JmVxd2deB2Yyjl
TLSH
T126D59D13F1DA01E8D06AD478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1548ad4ea51b3596a4b17eb81469a6fa2083cf976962251c604cbde3ba4bb6e1
MD5 426914576a6b1d55910c655007170bcd
SHA1 c2a21365bd7c0d3ebc8f0261896a98929c43b162
SHA512 22eeb798882d70ff330db5152ab255d6e484682c8b9c0ab5a0b866cf22cab6316095f7cc8a7e72f9d513386f315c5de4b18b5d079aa32a5c18150105144c3b85
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xMaB0zj0yjoB2:QmifPbRmB2Yyjl
TLSH
T161B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 904cd41c1b12b0a48068f5a07e5015252f8f564878bb4136ea3d2b4b9c033445
MD5 47fe750288fa4577a8ffd63770d6e3f6
SHA1 6a886f8a8f8651758266de7893f58edec114ca24
SHA512 b3919964b115345206ea738291f419a0a38f0fab2c3cad6d76143a7ae697165ffd3f51ffcdac9db104da06aa2000567c6b08823a9f5049d4cd0e9eff7064b0ad
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHq1aB0zj0yjoB2:w5dKTi61kB2Yyjl
TLSH
T1C6C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 53fee52cef7f0ac85e512653b44b625a149787f157f9833c972fbdd971231428
MD5 e94fb5f28b2c414702c7116544577928
SHA1 a23e3285929aba1a46df0be0afc76e14f8f7d86a
SHA512 215e5ffba05b8a29558350db033d1d00932797a08abcddbcd3d601ee76f06bdd8b864305f97f90c5de0fac7348dcaf06ad25bed65b8e620a3a3edbc38473c1c4
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5wAaB0zj0yjoB2:WX2iyphqB2Yyjl
TLSH
T1A295BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4dc42c13545b1b6420a0b07cfe30daa3c071882542233d300682188d6fe88470
MD5 1d8325083f8379fb28e39dc74f891c88
SHA1 f20901a6ad773428ca04557911c893bc14041117
SHA512 49e61870156775369255938f1013693e7cabacc994da33ba6c3a5529ccb67fa64a1861c1a8af497c8bef82ce6607ea51328f9e9e66a76c52c084cf9961ba28ba
SSDEEP 12288:tJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:tJatr0zAiX90z/F0jsFB3SQkW
TLSH
T1DA45230B341F80F3C8831B355288984B1AB95EB4B6E36B95F2D53F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 81785e3cd44ce1672b60cd758961a08a5d8ab1d7e4f1e13cf657981aa838ffd8
MD5 52f09e456f8cb9a9ff58444b0fc7988b
SHA1 17d569847921b5b78d08cece224ba9dc5b47f1c6
SHA512 d91fee13b91c5ee4db580494e04b4723e5bfcfcd84291d33f2249cfa7fcf0ed11beeb173e61be2e9b694a2d5b76954c9ca7b714e326d211b017931ceed383ba5
SSDEEP 12288:MSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:MSatr0zAiX90z/F0jsFB3SQkW
TLSH
T12545230B381F80F3C8831B355288984B1A795EB476E36B95F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f1d77e5559f3d4a0468a5c0e539da8ed401ef220b11c0cb48225e4e7db72bb54
MD5 a1e5bc25d1454b92b594068a40a2166c
SHA1 42e73a1edc96b9199c56b2236ebda571dc6f9094
SHA512 9801be2f0b6adcf447f1504ce7be40f6c43b7c3fda0dac208b6535849c22371e9ab76ee65103a9efe47efd4447c4e92cabca02cecef9bb180d95ff01860e5b98
SSDEEP 12288:VEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:VEatr0zAiX90z/F0jsFB3SQk6
TLSH
T1C245230B341F80F3C8831B355288588B5AB95EB476D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 36ffb4823da4900c2c1d78512b3692bbc51cd8e481f479118e165f107924c3c6
MD5 8c0c8ce50cc1b83f08f6e8dea7edb556
SHA1 d4dec4acc35e10ed96d56a1e8175d475cab3fca5
SHA512 0bc3d9465c746b5fffb5de9958c125d83fb9c67bc7a373a705bf7c2453bd33595eff7ceb62db5dd9ce8c40afd3b255924b0907ffaef34d9971ab79409fadc3d3
SSDEEP 12288:kV7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:oatr0zAiX90z/F0jsFB3SQkp
TLSH
T12145230B351F40F2C89397358694884696B9BDB4A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eadeb6e77ba476a981ccae742d454b5391c9197ee9199dd480aae799f7ff005a
MD5 37f1f726ad0e665b4945779c7debaa69
SHA1 445065671a567ba4fa6ccc32f749e18dc53a59bd
SHA512 bec302bd71b4a7049e9e2373bfc3df6dfcb2c6117088ce574747f29a85374f486ec5a3d5405d766c5d65c97275cdd90075d185be87432c941258d7a3e6ad0045
SSDEEP 12288:DjUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:Djatr0zAiX90z/F0jsFB3SQki
TLSH
T1F345230B341F80F3C8831B355288588B1AB95EB476E36B85F2D53F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 69f9472ec57a4712786dd99d1c51506fd9e481d0f7339d507d303763ff4e9f13
MD5 56098ad2d22c1bd93da2359e80534a7b
SHA1 2e900b7e66c464376a42e3474510501309a16d9e
SHA512 1740cb4b4380bcb756be429731b81248f762b896d5650759b23be558b68919c81746f8bd845b67f0b3e2fb5bedb5920957ea1d123b50044c79c802c4c0503aa7
SSDEEP 12288:oWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:oWatr0zAiX90z/F0jsFB3SQks
TLSH
T10345230B381F80F3C8831B355684988B1A795EB476E36B95F2D13F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 53160e76999221645f7575bdbcfafced59b00a9c775e1112bedc252f8e52941c
MD5 06582509860a3c99985bad43da3966b2
SHA1 8ba006d32e3931f2b92fa8e317a9097edb5ce89c
SHA512 c6c84e915484c4b61db612d27483729daf7156019cee4615e2f4c7c90754274cdbcc384d8dd75d4e490f741d27c43584813e7e6f1186f74015e74b6ba62c27f5
SSDEEP 12288:0aUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:0aatr0zAiX90z/F0jsFB3SQkU
TLSH
T1DF45230B341F80F3C88317355244984B1A795EB476E3AB85F2D57F0FDE382C625656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 677a018a96a04095289654859cf8dd8c29dc9bdc7943a6bfaffa7dc8659d0caf
MD5 267fb29a2c5d1fd4120a587fce9a790d
SHA1 bce210645713dd6ed12483dd3775d5b4b80beb13
SHA512 693a59fe62ce689d9bfc740a6acedadac840927dd8529291f627050fba5fb14432c928d8afeed0b1263dea63f80ab85d9d076813a945bb69dfd7497c57876d6c
SSDEEP 24576:oZMSzFVSOyatr0zAiX90z/F0jsFB3SQkI:oZMSzfGaB0zj0yjoB2
TLSH
T10965019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 85a6966c6ed3e028b5a6bdb62cbf83ba27a0e454a630a1536ce29e288bbb83c0
MD5 23ec624f3c6cd929ea50f7c5a5d4c7cd
SHA1 2b033722079940f955424b5796ca4a9ccde49859
SHA512 0e17680b893a1b3b03d0dbf27512378a700bd20384c5d9e5ae4d1ad075e35796283246fd698a9b971dad324dee7834499f4e74e98fda8443b2b50c19005d0143
SSDEEP 12288:dlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:dlatr0zAiX90z/F0jsFB3SQkn
TLSH
T15B45230B341F80F2C8831B355288984B5AB95EB476D36B85F2D63F0FDE382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8949a879418c5db0b778e39e6ebab2f221b1fe531affca58432ceb48a5a0a6a5
MD5 1156ef23d31250e715406af2533ae942
SHA1 0dc16df9e983dfe41240e45711c7115daccdba9a
SHA512 f140fd5c6911bbea7df8a491fef3b7e323fe50d52655ac7e17b6df92ee75f8a277939e4dd72f67c6dc329f686977dbaf6254c8eaccba331e362043f93c0939cb
SSDEEP 12288:mhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:mhatr0zAiX90z/F0jsFB3SQkn
TLSH
T10545230B341F80F2C88317355288984B1A795FB4B6D3AB85F2957F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b4ddb74bde6d905df3c39bfc08d92743e022cc6f78cdc7672f90385c65ca80e7
MD5 a06b3cc6eb0e86ceae3ebfc8d127a507
SHA1 060a8e0e2b06d095e7ae044b5ceae2005c89e875
SHA512 475384f97f5770a0fa0473c67279f0e1ca3c20fcf78710f8fb2d97a8f8f79dd2609374bd43bd3b6c2fa01f2621706a824939f0d0f3374245c0db38f572e5b9b8
SSDEEP 12288:0yPz5L8OUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8BG:tzyOatr0zAiX90z/F0jsFB3SQkyG
TLSH
T1AC551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c03a8e975b1ab800462828f1304a817ee99fcc549bbbc4c87905a51eb81ef9f6
MD5 2d421da4526383dcf152636527a0be4e
SHA1 c337e42060d5c97fef3948e23cf08c57a51d77db
SHA512 b258792b54f9b507e8d3815096f7cb66037d739df2bf882d49df44425acafc8ec08d9c326dfa13b92f6e4efe54053c0bc4e06c9dde10abb4ff9475587d10f87b
SSDEEP 12288:VlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:Vlatr0zAiX90z/F0jsFB3SQkI
TLSH
T1A145230B341F80F2C8831B355288988B5AB95EB476D36B85F2D53F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f51911a53f1e0908543f680a9a34ab86b0484bcd1f0f56d556886d829eb665b7
MD5 29078af2b63e11e89f6a667782123e2f
SHA1 7acaf950119bec3a4710629f439b53716b878adb
SHA512 e1d938748b72f4b896c10cf6626783ded45a8b135800e93e450d50454ea9b5a11025ff196188d0d3dff84d403a78ba587215b1ba7ebe2515ee7870e246c56001
SSDEEP 12288:SlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:Slatr0zAiX90z/F0jsFB3SQkn
TLSH
T16945230B341F80F2C8831B355688588B1AB95EB476D36B85F2D63F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f6df64c444ce40ebc3258633576632d02bc0c04d1a42894e8ff27385a37a20fa
MD5 ea8347a07b1aaec8422f4daf3613b4cc
SHA1 08ebfff0bd6ad4f29b54197be6a7d9cf08b14470
SHA512 ab4e2041aaf5dd68f5efff5f2960a792c97411898e8f0b63f9cc4362bee05b4abfc8916a943e0f90baa84d6299729a7ff5d65391c822e683e2119684ff7934b3
SSDEEP 12288:tyPz5L8OUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:EzyOatr0zAiX90z/F0jsFB3SQkx
TLSH
T1A0551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 72559ee847d100890f40acc4b22fd12134b642735a56337211152eaa9c47f7bb
MD5 9e4de95d79656879ba4327436e399cbd
SHA1 5f638cfdebb78563ae37c745fca8ca8bdc346484
SHA512 a8883bf3c6df4d9aca8c79668410e3534133848eafdcb5adf7cdc23dd7193ae1eac3dd9295442db8a715af618eb5e8f345dd59d797dfee862ecfa550d0a19b27
SSDEEP 24576:rTHaLl3z0zDUatr0zAiX90z/F0jsFB3SQkm:rT6Llj/aB0zj0yjoB2
TLSH
T167650199735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4b3586cc1a065ac1d937693e072fd8b98516ccc2c9b93ab6dfb080f942278903
MD5 d56032905394acaeaa78ccdc60949625
SHA1 c9db884f5459a53fefebaf9c48ab46431d102a1f
SHA512 ce75c8728c5bb36ebe2d5d06e9d6e697fc1adf293f7c8cfb72a9685d49be6c960619a150e52d0df912a00906fe85f4de0eb66ad715a80e0535bc9e02b3f220e5
SSDEEP 24576:M37d9CHKy7GZ4atr0zAiX90z/F0jsFB3SQkF:27d9CHKyaGaB0zj0yjoB2
TLSH
T14C75CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5c1369c1c38c952eaa747b6d56d6468c1ffb0a42befa1774a4e0ee693f6bf844
MD5 3f9de555e3f1ba661b6c8a0cbe146092
SHA1 b9fb384d4c74d1792a0597e8d75a0927fef9fa47
SHA512 09342ca658690a108642a92b21462afd6f6d2b993ea5a6c11c34f7b41c97febc40064169a50a6c7d02fec8b683214859d2e7831426afa0349cd7d09e2a3954ab
SSDEEP 12288:EkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:Ekatr0zAiX90z/F0jsFB3SQkT
TLSH
T14B45230B381F80F3C8831B355248988B1AB95EB476D36B95F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 dc43367207f884776c898c929e912edc7dbf0914f23258c052b4ea4ed16ae6f9
MD5 c10412ad9286513ed3b043557e595343
SHA1 ef73cdd90f3642b43e92117321c2d175b080ddec
SHA512 8c4e2c9371f6a840d7228807f39d00c30cc23232be24933ed9f18f3791d0ec83c0303973307e2a0d4501d8d53346a1aba741e42b4ff83bb95f95b14d6cab0a2a
SSDEEP 12288:5uUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:5uatr0zAiX90z/F0jsFB3SQki
TLSH
T12345230B381F80F3C88317755298884B1AB95EB4B6E3AB95F2D13E0F9E3C1C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 711b324170d85953bc118a2dbef279ee9da7769a26216366af2922dca42dcb5c
MD5 024ddb0df82cd88f1dca37b509fbbd70
SHA1 bc98f8bb8deb1112342d94e9f55efd233267b542
SHA512 959ce026bd67986a37d14a4f42870faf22839540d2a71b97c91bd1efebcaad05011ae8db7edd0da6fa7450ce2c44a34b2c429149f18bba74eacdef5e6e281433
SSDEEP 12288:fnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:fnatr0zAiX90z/F0jsFB3SQkO
TLSH
T16D45230B341F80F2C8831B355288584B5AB95EB472D3AB86F2D63F0FDE3C1C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 77524aced5b245aca2b832dc1ce0f183b08753c5c9ad9845f213637c5215c7c2
MD5 6b6b7fefe18b5c951e6a209b0120b02b
SHA1 6b5e8d32f24f8d069029e2ed327cee344e56013e
SHA512 4bdad736ae5c8c517a869359dbb5af93a9ef783812ac7bb411da0f31841e28ef4b36bbdb9354c8870e3fc0a18e3f2e099b1bdf1f25d3fd6597f691153aca985e
SSDEEP 12288:dlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:dlatr0zAiX90z/F0jsFB3SQkn
TLSH
T1CE45230B341F80F2C8831B355248984B1AB95EB476D3AB85F2D53F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ee734fe27ceff00f3afbeafe427d73fd6b65cb38b39feef45ab42b84579c1062
MD5 81bb6bcfc2bb78d53f92df08d6cbe6ef
SHA1 8b5e7d2c1ce09d7369fe25f5ad888e2b00fa46b8
SHA512 77e64a5f8fffb4e53c8fb900e4f7d51aaf60641467240ca94261d84a4d0607db377583af62efe88d4c46f71c494e27b51361d8a17539e209a384d988f284060c
SSDEEP 12288:QkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:Qkatr0zAiX90z/F0jsFB3SQkD
TLSH
T1EE45230B341F80F3C8831B355248988B1AB95EB476E36B95F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 407c27aee3c380cc7be2ee62874cce45e7f19d1346925f030d7771fa6d14ffd9
MD5 aec2aac39475748b9c0536e29b3eb6de
SHA1 6edf2472c7d9249297aae2996b2987d6d404af8e
SHA512 b10499c09da16f3b8425f874beb693c554eea18ced32bc9400fd4c7e3fa62a6ce2fb25994c32d9411b861598e5d8d47deb81bf1f0de1e5bf2ed7d62d7070a0df
SSDEEP 12288:INUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:INatr0zAiX90z/F0jsFB3SQkA
TLSH
T18B45230B381F80F2C8831B755688984B1ABD5EB472E36B95F2923F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-23_075104_3500-4640.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-23_075104_3500-4640.log
Size 1KB
SHA256 52453cdd20b963fa49b0f8e1416ae97e0164f77497855d6e9e653febab335a28
MD5 20d2bd1c11641559d36d66ba4565e933
SHA1 5204d9787f714e069f45900142c62bcc3f99af34
SHA512 7a2fc1dcbd93d525cab3601ec2ef74069a3ec4a0f01e25cf39a9ae5f2cd0865d45e3b52b4e0e45d4876d7ddb1c5ecb393c588c10f24d0182a1ba28bc75b78233
TLSH
T13D21A22A7BD94A45FFFBDA8299FB11539E3939562C30C94D10E5424D0831F40EEB4317
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 de72d39da44c26666a820d2d4161fb0f859c5bdf4533fca781aa794436e4d8cb
MD5 8c76016d51f3df8fd0787955081c2f39
SHA1 b949a7f9ed5d88e2177117a7a15b5b34dc6db5a2
SHA512 e63642b94136e4ad5e87a7425d55b2928820ddfdbcd43603fd7dbdb6bbaa509cc6b56d4fc31f35b6d8752cb87e5553a8dcf249235953e9a865e9121d34aa440c
SSDEEP 24576:Kfwvok9RX6wkyAIRatr0zAiX90z/F0jsFB3SQk7:WMnYIRaB0zj0yjoB2
TLSH
T11185D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6de8ceb4278cd016c96b42cfb58327359c259d54186991e0116a6b69edc077dc
MD5 4bb4890a21dde8cd2880b4b15ae8995b
SHA1 3409e2df34ce1f100f4dee98a428ce2cbd0ea120
SHA512 ef15a02238f78fd8076b1ef7817ce04d6bc4152bf48d6f5c59bd2c2e37e4cc5657f32a94f017b01d8dc1cd839a80b159e44916df618228d94d0e158e7628beda
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gaB0zj0yjoB2:iySzP3B2Yyjl
TLSH
T1A4066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f26f58af342dbe25bbd86c57582d21c554480b657f7de382881f1caa82cd4098
MD5 b7dcd8bd4ca2939cbe46fd8e2b77d12b
SHA1 062dc535813bd57a03128e7edf2083df7a79c305
SHA512 b23dc5541ac17326eb6219dbe2db5b853f769e27faac98327616ce7023cc95c6e29e56c9896c1c12b2d6da987c1191581a7f68dd89772f3ce230be179bb02a28
SSDEEP 24576:J47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYiatr0zAiX90z/F0jsFB3SQk5:J47JUQj1irIhCnDHUPfF/QaB0zj0yjos
TLSH
T11A65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8eac1cf116c8e32fb77644b3ee2dab3fc1e4cedf7886f07a8906cf2ae421e8c6
MD5 1904748388bf3b349f2eccfd16f3edef
SHA1 7fde90a6deda9ff499cc94fbf724f8b11b867e87
SHA512 67f53aa78f2e4b1d1104c655603f603b5870e26b575be517ebcd1e29c07e766617cabcfb5b8ce8b2a686102500581b8b3e17dc7e3109fed737ea86ca4d235f45
SSDEEP 12288:SNsf1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:r1atr0zAiX90z/F0jsFB3SQk3
TLSH
T1DA55F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 b82e9afc933555c487af713e7c0e0b2f1a271a7047464aa8191e99811d6b5ff5
MD5 58818a3e76a6e7a32ab57667a57cdb23
SHA1 a98092005470f32d5731ec29eb69d89ad38fbbfb
SHA512 5f311ca2a376cb3ab79c68a9eb860e913e28e6954a8144181f11007fa4008e84d96561029560b2f6868c1b049f43f6d25baf518ec569f406b40d95ea1d5d5300
SSDEEP 12288:VNqZU3ftGPVpCWWNbzyEa9E8yXHOiBwHNj:VN+UPkPsNBgPQHn4j
TLSH
T1D1253910766AD75FC6A940325E77C2CCA7707D01FE059B0372C89B2FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 93ac788daf9c7753a4a55a1d5f210f2e453e3e1f11d20345bc3e82d9e064a968
MD5 54b9954818f41c22a54b7a89835f7856
SHA1 da5ffdd70c741228700e9769c20c3ed0201d26b1
SHA512 79e6f3d84759b9b9a3b65a77206dce64d872a012e36a9568f86974defc608a3a557a84b31dcfee07a1ae835e1b75db278e46eb75005c420e8ac3e60ca5bca6f6
SSDEEP 6144:yBGKcoeO8TOz8HO4Q/IVqepN9GiK+mEKX8c5Mg3PC5/OEXFuIewo9Lcnx/medi+9:Rck28AhWB7
TLSH
T15D55C7815437A3CFE1FB6171072A9B4CAB64EC4273095F2673C9153AD82BB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 72ea45b26dda76d28c26703c3a928269a89f2c0e081a7b308d8790fe7532036b
MD5 4477e8461cc29bb6cf40bf6a9e2f920a
SHA1 72a00252a33fde98ef9b36cbd5f257bc37f12947
SHA512 e78cdf7549a39360ca95d78ce41ecfac9400724799a3ec8b9d342926fe1007bd8c87fb99f4c46482cbc4fc2668069c2de6e649ce22257f51f49d1e654a68e12a
SSDEEP 12288:xM7dUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:qdatr0zAiX90z/F0jsFB3SQkL
TLSH
T1A1452307351E80F2DCA32B3412988816267EBA746BD29AC7F1413F4F9D386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c907989678a733c23f86592cdf5463b2f0cb45cc17ea4ab7980eeb2b8545f7a0
MD5 78eeb72ec94ed734441245a9d47092a2
SHA1 f50b5fbd7775314ab0cb3b93bfcb3b172b7cfb81
SHA512 920357777e68b154f130485267da58b40995cb91ea4dd652c62c88e4fb36f2da5a59a61ff8af3b9eb152c6d8de633573801a232952ada0e9146b09dcb117bcb9
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY/atr0zAiX90z/F0jsFB3SQkL:egb4mBIBhGFiaB0zj0yjoB2
TLSH
T1FE65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 de944ca6edc6bf5ddb54600aaf13abbd49d7887ca8a2b6bce59d2da6b7d1e88b
MD5 293e689d4f8e3df73a5cac87f4e7b2f2
SHA1 5654ba4958dfa46841b3cbeb3547bef2cf534072
SHA512 aeb50ff8aa7d95c62269137b68787ccf2028fd51165cdd548dd2295b066c01ebc721870a71462268169aa0e6ee0d3e308b1d40824e7493e78edf3df3f7198882
SSDEEP 24576:nG88u8FpJqH1bzria7/myatr0zAiX90z/F0jsFB3SQkG:G7ZFPqVea7/HaB0zj0yjoB2
TLSH
T1AD85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9153b1ed5ff5e44eaf33bfb3ed2b75d013f7fe8c4be31d64577a0b9c0e6857c1
MD5 aad84dd122d9cafe4769f4d67fd69164
SHA1 2813f38265fc8ab60ed1fbd9f692a009a645278c
SHA512 f6a172d05ffbb44fbdfb557edb9b6e0c10aae8763a2df606d13a2bd60e42b9c75c1af364dbc1cacd8556af60fcb238dfba6fcf15a494278365eff05efad92697
SSDEEP 12288:nHvUrBFrEjwaQGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:nPUr+NQGatr0zAiX90z/F0jsFB3SQk4
TLSH
T17965F11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 85f1bebcab0b8656848f3d97848714345f7e39bc409c2dd4e02bae21f3e7f101
MD5 4f991678d0b4b31b1c4f3c146c1e9f89
SHA1 a7c631375bfa7b5dc7295b6217acf3bae75f4414
SHA512 e4b84dd9d0549b8b2e8d43558c7f07ae6c69acfbff1d79a207da43c7435e29623d6fa10ec9b444946e64e18fd79a97ac40b274449fa45666ae55eb9d674fe54c
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWaB0zj0yjoB2:xG05lO43bAB2Yyjl
TLSH
T1C1D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a25e1268d253ced9e910ce732fa0c01f58fb2206da81c4dd46a8adc4fe1c2124
MD5 3bde3dc7d18f368398a608c17050f3cf
SHA1 aa06e906705e2490d35848c8d4c092d6aaf96641
SHA512 c4615a71211eaf571e18a66b3c5d2281542ee5ee7468d301ee7971dda9a255fa352881b5117db77436e3665226e0699d76fa6d5d22002ea0440ead805a7fcbdb
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidngatr0zAiX90z/F0jsFB3SQk/:1a5POZ3+Jt2pasx2+muaB0zj0yjoB2
TLSH
T11965BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 44fd48d15f0bf6c46e751b7b71e7d6db2dabc2412412f42983f4d47c3ba74800
MD5 6d0588dc17a2f70379364d75beaff0cf
SHA1 6db4d4b9ca81f1f1559f2d5504e977b5efedec06
SHA512 909e559a5814c11fbe4ce55b94424398621d94611178ce40e494a7fa2a51418eb61ae28023c29caa115e7920fc55a6c4e96bfeaabcd5ac61f2adbd2d83398d66
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fkqatr0zAiX90z/F0jsFB3SQkr:vNc/zEOVHFnaB0zj0yjoB2
TLSH
T15A858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8ace244adfbafc581c2152c74375466684d36fd28c0fea881c1cbefb9b18b69d
MD5 1975dc83f0e118684d68823820777b37
SHA1 50cf15f96c7b60e6225f5e52b008a92c9a420895
SHA512 46d7b44a0e4dbb9a4df25af1ef820d5de2b7e3835f21d50d235cce1f27058e7f8d97dbe4053d1d0fa4a19e9addf5ff27ca7e0d3f3fce49627720a349a87c1fc0
SSDEEP 24576:38kNvNnaFeYhJNtmZBmnatr0zAiX90z/F0jsFB3SQkh:38MwBtOmnaB0zj0yjoB2
TLSH
T18455BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ed9afb2d4829fabc8ef3584d57448dd9e4faf3f4b00a43b4c2e1187824c20267
MD5 6c8d0bb177c519ea3942dcfa46f3921e
SHA1 8fff862998aea4a7250ba5bf8a47c4dc87222912
SHA512 63b0380ebbd372f3304c6cadba7e96dc95d480ee1e4de9036e196ab01cb3db65b92b604fb13290808a875006412b0ba4763a3b405b75999660150614d6eaf0ee
SSDEEP 24576:lD3FHshBIYQgApatr0zAiX90z/F0jsFB3SQk0:lDVHeBIAApaB0zj0yjoB2
TLSH
T1D175E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/560-61-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/560-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/560-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/560-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1588-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1588-84-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1588-304-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1588-78-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2252-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2252-117-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2252-111-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2252-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2252-322-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2252-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2408-337-0x0000023AE0390000-0x0000023AE0A10000-memory.dmp

Download

memory/2408-406-0x0000023AE0390000-0x0000023AE0A10000-memory.dmp

Download

memory/3180-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3180-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3180-94-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3180-89-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3500-43-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/3500-0-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/3500-44-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3500-8-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3500-7-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3500-1-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3980-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3980-144-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3980-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3980-142-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3980-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4168-15-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4168-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-23-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4168-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-21-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4808-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4808-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4808-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4808-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5040-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5040-72-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5040-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5040-288-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5164-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5164-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5164-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5164-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5848-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-105-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5848-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5848-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-338-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5888-133-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5888-130-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5888-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5888-325-0x0000000140000000-0x000000014027D000-memory.dmp

Download