14c29797464731b1055480c503e6ec47a862f79600115ca492a33dde7fb9ef1d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260730-np6tpahm31
SHA256 14c29797464731b1055480c503e6ec47a862f79600115ca492a33dde7fb9ef1d
MD5 2fe8d59d43df9c4e2a3f6bba5f0ca98a
SHA1 7542a77a9b4bab420b168c67c6e64e9a1f32b76b
SHA512 68b04d1e3607b1bb8fbcd7a4850705e930974ce30020b00aabef5764e3854eefb17d39d15beabeda541a3bd46105b1539b5dedc1e2049004c16d18c4836c72db
SSDEEP 49152:RAse/gQd+hryfJTzkFinLOmRpH3RRK2Tc19dUWz80TX8HPlnnay:s62UeNnd
TLSH
T166267C0BE2B941F5C0BAE1798A579517FAB27819873297DB4790474A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1120	elevation_service.exe
4872	elevation_service.exe
4116	maintenanceservice.exe
744	OSE.EXE
5124	PerceptionSimulationService.exe
4000	perfhost.exe
560	ReFsDedupSvc.exe
4984	SensorDataService.exe
2944	ssh-agent.exe
2492	AgentService.exe
2144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\76e829ca209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d467c38f1720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000939bdecf1720dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd13e08e1720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e11cba8f1720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5764	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1120	elevation_service.exe
Token: SeBackupPrivilege	560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	560	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2492	AgentService.exe
Token: 33	2144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2144	SearchIndexer.exe
Token: SeDebugPrivilege	1120	elevation_service.exe
Token: SeDebugPrivilege	4872	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 4632	5764	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2144 wrote to memory of 952	2144	SearchIndexer.exe	101
PID 2144 wrote to memory of 3616	2144	SearchIndexer.exe	102
PID 2144 wrote to memory of 3376	2144	SearchIndexer.exe	104
PID 2144 wrote to memory of 3240	2144	SearchIndexer.exe	105
PID 2144 wrote to memory of 3684	2144	SearchIndexer.exe	109
PID 2144 wrote to memory of 4800	2144	SearchIndexer.exe	110
PID 2144 wrote to memory of 2332	2144	SearchIndexer.exe	111

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2fe8d59d43df9c4e2a3f6bba5f0ca98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5764
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5764" "1492" "1336" "1472" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4116

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:744

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4000

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2680 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2680 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42bdf2d17608f5b6b8e6732eba2a152802ec0d3245f52103332f8e7cc8af3817
MD5 f13086376d5add003fa99662771f74d8
SHA1 8f80fe6ad2381294c35b3cdd0de0b714acf64686
SHA512 49f5b490040731f2896914d25bc082369ee3436a7fa5065b3926227c949acb090291501e06f82cfa61b85e7ac495966db387c9f72c6e343cc17f4e752cbf40f7
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJ8HPlnnay:k3q6HjBdNnd
TLSH
T1D0D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d56fd7e638496493678b1573ede37e13313a46b25667e1cb0ce384c7f1f0d442
MD5 cc1fda26d3ee3fbcb9c45d0cb0d83cf8
SHA1 80785c19e399da2eb445c9e93200fe0537d53aa9
SHA512 dc3f1c6262c13c071e76941022b9bf43ac6f424efcc1c5e4717b5d3dd3d37a3f1f17e7b571fdebf12d0c9fe194c503ae0610ba8a66776392a4016c21bc331dcb
SSDEEP 12288:A1XLsswWkxy2lRq2czAxNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:WXYfDtczALAFZRGjHP5jnnay
TLSH
T18985F12867E508F8DD67823DC8A28511E733B85147A0EBDB03E4992A5F733D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 cbb390239f39a0b41b233989bf20653e04118d810a29c4558438605b2b9259d7
MD5 1608e77072db4376bb552e4bb63a1c23
SHA1 aa9b4376a91cc56b265d519ead8a00a1eb419361
SHA512 5162e15fc47a3a596a35bc96abdbe64e0fbdd5ed82c165f2dad11ab0f0a73ee1024fdce3d6a28019b52c4ccf55a25c72b8f1675fb3c6764548af8c6584b6db15
SSDEEP 12288:cXZNYVLeyUji0h90ZD0wxpGZIVuHrHsTNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7J:M0Le5ji0hmxYrMJAFZRGjHP5jnnay
TLSH
T1F2959E16F6748335D073C0B9C5D2A69AEA72308257308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 901718e447be41ffb074570636af6b40bb2dc64cc2a2f5089e9da298adfcee70
MD5 1a4be6c80b47889b1dcda0f7e0d28ca2
SHA1 0c3647bb9549690836d216e36d80461b28ead969
SHA512 efb943640e2728ac0fbbf582fdff404d1fa3f73498c3a70b1f326500a8403e1c31d03584674f3abb4e61916ca3640dc893969504bb1fb0454d1e153082cbfc7a
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyu3AFZRGjHP5jnnay:3/ezSC6vUzPvxHjyZ8HPlnnay
TLSH
T142756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c036758e29a4e7d31817b1a7bf38bf43afdbd4b3c3e6ba85357b416223767b6
MD5 be213f6561321fd4fb7ab9f523bbd5ed
SHA1 98f7906a605d3ca8925ca2065396959e500dd177
SHA512 14310d38237f6ed4cb60ded263ebef95325b9803190e7cf80bc28faec225bda2a155f6bde6c0ff6f49816966f0deffc4010453baf4fb98a9a664b5b2718c92b8
SSDEEP 12288:bVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98wNAFE7X7qJtPvbpOngmZCiLcHWb:bVbqPb88hv/l+6QAFZRGjHP5jnnay
TLSH
T1D7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 282db7b5fb561616d3011e0f8364b7e9db08bda1b99e690d5e97f42debccb05a
MD5 a6250c5b61eafc5b4909f82fa2aa594e
SHA1 b8b62a0686add0b890124e5442d448961e34d635
SHA512 8e4affaeaaedeafbe2c688181d17e58142d9a51f632bb29609adbc5d6010708b8f25c3b6fc92ea1b6402117edc4dfa36304863783f7de06e762bd581b525bd5d
SSDEEP 12288:SHvNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:SHVAFZRGjHP5jnnay
TLSH
T1F265230219AA84E4CBE6C237709952B4831F8E1456B94FB7E2903E6FFAF46B1D5D1303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2c6fe0cd7f5f12abf5b21a2f3a25b8e124f613e2d9d28afe1e6ea4397bc11f2c
MD5 4ab3b466c7e1a5330afccdb780dc974b
SHA1 8725e75d8841058881350dd80b31e708182cb8b6
SHA512 94d9dd4be50af123bc5927ff13f5d46ccd96954932a9627f8e6715d92e3406b7855a2826cfe2d138e56685870a9ee91fd2da3637a0be92c4e468082b05a27d5a
SSDEEP 12288:TeBNUbTVO86U4NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:TJIU4AFZRGjHP5jnnay
TLSH
T15E85CF3BAE28FCE1C27A8DB956918340D77678304B6293CBE174830EDE235E15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e04f145fa18cb697922fca741ed598a0085e5fb5d201d33c91fc85d879c323a1
MD5 791c3eaf6bf685af522471ce2d9fbb46
SHA1 962cdf8812e11be73063e7c09ad2291f3bef3f0b
SHA512 2bb7ad9b437f7b584eff818694e243bb5b8d2cd4484143073e977c13bbd5bc429486248fb5c1946b260997c75bca3bae38a376dcbaa88a04787c26f22897112b
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:0QvGAdlCEL8c/yRNw5CtNnd
TLSH
T139266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 618f982cf8d2b553bc4db9cb2cff367890c890bea36366d4330fff67211fd1a3
MD5 9b180cabc0a004274bdb3bc35b3ccf29
SHA1 ec12ed3f4a96ef5a19e2329d0f1f7f9f5b7992a8
SHA512 9bb88476ccf54c255f70d3929567b34e8c0df82e8865facc981e5b2316bbc17ff44ab421acc7d02f6e4a026706db87f311c44464f09a7bc5d1e10c1df32a3d6a
SSDEEP 12288:UAwSfxL/2Dc3SDLLmt0LDQewsAjyNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrd:p7ewsAj2AFZRGjHP5jnnay
TLSH
T17985E031FE75D036C7BB0DB21B26C716543DA9204BA11AC3E3E84E9E99702D26376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d23ea1a7e6dc0393254c0d525021dd493ca6279f0f65721ddefb151323986d7
MD5 0b46994b5c7ec4320d5781106eec5233
SHA1 b6d5918f85609086031ce68965efa72a08a366e6
SHA512 886da061f7ea786aa7ebce1ca0ac9c69286b1462de58395ee9e487c3f15fe3ad380c7c45a54ff812e3fb577e0cdefd6dd86970a28d2a5c64d530f6e691ad5276
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIFd:KUEtQevvqc2W1cpV2EI326d
TLSH
T19B474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 edab1482dab44acd1e9728c6c4946afcf5abdec42a30b43427fa343d7a40625e
MD5 5c73ba902442dd73bcee3b7b64ff1e2f
SHA1 fcb4e25641a703711d18d49a93d46e77d9a02c25
SHA512 4b26a9580629b97e4c773579f53de318ed5f8de59af47c70dc0fca530cac0478aa0887776c4f9632e35fd3b252a042c3e19380bad60751349c33667ca4433915
SSDEEP 49152:ACbRquA/m2yL5zifFiV+XenmE3/zV8HPlnnay:JoqHVjnmZNnd
TLSH
T19CD58D0976B8C1E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6450588c6a5afab1d9c74e2518e260436f4eb2a7207b729e7385d730ea434300
MD5 3eb2bbeb8c3a537cf6d68c7effb7a405
SHA1 3d40de6584e2a12c771a91125e34724c7d4ef038
SHA512 2697270cc93d8c66f67ae0184ce87b5b192f8fac75394f154424dcf3f9c8d84e7bc7350291058ffa9a046e97256956be26675c26adf91230f11ec28d36b04274
SSDEEP 24576:rAhGLJIFoiwtA5l7S53bAFZRGjHP5jnnay:rAMyFoiq5y8HPlnnay
TLSH
T1BB359D81EBF945D4F5B3AA78A9B68170EA76BCA55E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c3c804500cd45e9feee34ae0e74cbbce72631ee58b2529898ddebe2eba1f1e3c
MD5 03c2a34d05b9bb908278a9f480804c6f
SHA1 9cb9a33c078dd46ec511c004ae3d6a658b2c0031
SHA512 248df483d8d4f31f70cea6a34c8e692a61c0c8023b6c06fb0dc3b9a543411cf016b22a60dc9923b0db4b7686e262350c36fb26eb806a5dd87579d63ca377473b
SSDEEP 12288:7mw5HEjsChNzBFgl0WDm+C9NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:awuSOW6AFZRGjHP5jnnay
TLSH
T17B85F14636E50CF8EAA782398587C135E7B3BC112A35CB1F5360CA5B6F77361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 d6419d7747fb64b4c332701d89ae0a7a9fed2645638e7e72027a4a868c2d3f09
MD5 e9281e6876f3a783e0535520df079baa
SHA1 7a9b4ec72d3fd2a50369bfe8319457bdc48d5f1e
SHA512 12988ebbd7003fc0994563caa5eeb30bf5813670c29982bef5c696b6846309e571fbec2dee7def647983f4be1b85b92d839a315adf07fa7892c9a43dcefa11c2
SSDEEP 12288:YjZ1IyCNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:kZuxAFZRGjHP5jnnay
TLSH
T14A75125626E560F8D2A3823ED8E54254D3777822237643CF52600A6F6FB3BE19E35323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 634ebef23bb3a5e72e68155e30b4a29ed95d50c870ddac7945f3ffcc1fde9fcd
MD5 5ce4cf543b2a08b58ac440e2ac672ae6
SHA1 263617ef1e1d4e63ce57ce66109c8e277f2df000
SHA512 0e681f854197012ee7db25949355e3c382374b33a54271614e8a031b5581ebcba5f43418da63f766b3f29f3849080dde1f2da16a1134e173f4072db676f0f167
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:cQRQyi36YOcPQLvw2gAf+PN3iNnd
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e12f08b04b968c4b9c1a016049a58f77da283877f3fee1c7bf6beda4cf83a256
MD5 f442bc13d084eedb712e386824e08e79
SHA1 78cc7035677571017436f32218295b890c18d001
SHA512 9515fdea0f5dd668147b835afd9bc8df1db50deded194fd0512c4a586a44bdb8efb9b2ed327c8193c730f7cab5016c67d0ebe8f9b787967f33269b1966b3697b
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:6QRQyi36YOcPQLvw2gAf+PN3iNnd
TLSH
T161667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d31d04fcf3d21c00f575a51470012a9b649f940d4e2a085dde678f4cea5fe16b
MD5 143159eebe4b0149ab41d3f7d3f7341d
SHA1 1790ba33a16008aeaaac271690a2a92916c8f039
SHA512 1e6e99caee9177a817e63b43c59e2008d1eba1f8b8487ef36513d515ced6515fa097981eda1fc2d0a1b9ec7cf5a93f6df5dc63824237789a0f8e374c942cdd40
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0hAFZRGjHP5jnnay:x68Qg55nhheWu7PNU3/F8HPlnnay
TLSH
T197B54A33B2F600A9C44DD1769F4A873196D27C758FE0E7DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1e26776e666852881903c70d60ed98a975b2676e6e9b5c33fc1c40d85cdac51f
MD5 9894075d23e090c82ca45973d93818f1
SHA1 6525ac38680b53c79dad4dfa0a5f14e02bd0a7d6
SHA512 e66badda72e80366e7ebfd00af1390906b5850c2e6c6e631e4ee29ac99321777f9e173defa28abbcc60520b903b29883f5e359bf8a22242e2edffa6c43c17cc7
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:4y5112gYy5azzVvL69nLKnhZvNnd
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bb315dd4ca02175e20e10d3714d28cffd6f6f90fd098f3c186f177a759be77ae
MD5 42708a28f8ac1d03871418713cf26f63
SHA1 acec2410b60276e61872f13641fd5786f91e7ed5
SHA512 a422c7433ef06711b4264e11587cfaf79e926f84a3f2093b163e31f56b74d769c0a1b1cd9de0b52d038198efa436552af5f11f3e99a64665ca7289982f44ffe3
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gli8HPlnnay:yu6JmVxd2d5Nnd
TLSH
T1C5D59E13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a4927df817ffc8dd360b6d0a1b6b01bcc15f6cdf9a8d4e0b17e2b080de96aca5
MD5 4068d70935edb8e4dbb734f681f17f6b
SHA1 c9a5a791b50695d6e6150d9f848277ef23f9139c
SHA512 dafaadb58f284cad0321a724a46838c3764bb6f20ca2d8171cb300602058010a5ff0e8a14ba1f5b0be10ed945269a4630683308f199067f7c1e4f43faf7bd2b8
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xv8HPlnnay:7mifPbRZNnd
TLSH
T16AB5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2430f8f69d58e7c4ec7c1332ee108fa8b9efebc1aa52ed1eae54e0f6aa38f780
MD5 9e87843b0e4690e7ecb664f1386c6505
SHA1 26bba58bdc674f410de127f075f8be60939169cf
SHA512 088a76710d30b851c10b6a0c99c7d0d786cb6a2427395ab37fd4fa8cdda47e0cf9196c869ee86d4ea21cad816aeeb9826d6f4dae7b1e0b2497a7c4570f341be1
SSDEEP 49152:NSuZQIY0Be2KRRVtOnks6NMHq48HPlnnay:D5dKTi61DNnd
TLSH
T1BDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5e10e8392cb44dd11a0cffdd2fbf7d9a95aba0605c82015379441fdac17c5687
MD5 10d621f2eafea98d748e8112eb62ab2a
SHA1 330ea58e3700f30ec34d985ab2e7156ed2edc04a
SHA512 0f6777464a65c558f5f73912fec5ff42ceb7face5aa8850077ba523358369d3e9bf862d2338af80ba9f13d2d3829159715646e66cccc6f18b57cc179793fd591
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wb8HPlnnay:TX2iyphlNnd
TLSH
T1B895BF13F2D900E8D05ED179C7468632EA62BC150B39AAEF0A9077561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 578496de4ef3593416f4688b8d1cf5640383ddcd49930b7dc421d2d1ea697daf
MD5 539ca897f28e1f1109fbdb1b9f6372d4
SHA1 349f2bd849ef7d33ed9c50efa2d7d036f69e1fb9
SHA512 644d75709889815a511b6e77958027b928c2a58d2c29283505677a99349274f5725aa5d5cd83adda51c442f83c2f7995a0a67983bc29b22dbb245d96d53c50ac
SSDEEP 12288:s3NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:sdAFZRGjHP5jnnay
TLSH
T13365230218EB84E8C7A6C277A08553A4821F8E15A7B90AB7F3941D2BFBF57B1D5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 58f2eb74c6dac0eaf1ead7f5199e70d7537de120ce73fe3ffc8e016b5c8e6c59
MD5 051c0a4964a92db1783608ff189ef277
SHA1 11bd42211d3da8b06876b24c19258325a76279e4
SHA512 888bbca07c71d37cba3c9dd643cfcca560e3b61b2df7f9d6f355ec7ed44c06bc779cb7cd958b340d4f4e9fac272829eaae584643f67999fd50b7024dde8c6e14
SSDEEP 12288:GeNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:GSAFZRGjHP5jnnay
TLSH
T10665231218AB84D8C7A6C277A08553A4C21F8E15A7B90AB7F3901D2BFBF57B1D5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 40e4846aa44f893aa0d18c02f7a4b9ee9435fa82075b224fb542d6bb0f0d895f
MD5 089e6daf60841cdf7ffe995728d1ce45
SHA1 b46799af12a55e92ba13e85ff33263cf2aa6fb27
SHA512 a70eb2fce35616624778c96ea6fd4a59b05b8f014070b03b5ef0b5cd2e7b3f478e3351242338e0a616d27539513d5a55dbd67fdcc98dcda104b0252a3e9ed44c
SSDEEP 12288:egNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:eAAFZRGjHP5jnnay
TLSH
T16065231218AB84D8C7A6C277A08553A4C21F8E15A7B90AB7F3901D2BFBF57B1E5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 a939c94acbbf51276d9c1d7c230b1fa6fd7c6b86bc9b924e7f6fb73a239780d7
MD5 6cb75e36d430cb0f710cac9ed00c380f
SHA1 72cf898665eac9dd067f99101e0a3aede3988119
SHA512 011ee73708d2fa555a75acc300f84b768e93ddc96c5ea010799fa1b5b7a55c2396fcee12c57cba75f77f0cf9c7d82fb7dc267a1faf5020f34c410e6ab898a134
SSDEEP 12288:VVhNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:LAFZRGjHP5jnnay
TLSH
T14165230219AB44D4CAA6C33AD4959260D37FBD54A7754BEFE3500D2FAEF17A0E9A0303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ca6fe8e345abc03b5b3997a53c94fb38acc7dd22c69134e476c04162f400248d
MD5 f49e26c745ce737b61795d2a07357784
SHA1 81e4b5cb2a30f6e2727513f89c24191076d2542d
SHA512 6f6d599f21d5d97e74f297619dea4dc6db0b35b9bfef80e6e528ae485d37580bb5d4c4757d5f56ee7d3a1e7608c51455d45baccbc63dc8269bd5706d0f446579
SSDEEP 12288:d5NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:dzAFZRGjHP5jnnay
TLSH
T1B865230218AB84D8C7A6C277A08553A4C21F8E15A7B90AB7F3941D2BFBF57B1D6D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 28a6164e85c111730914157f323e1f7613471c65d4d011724d20d873cd3758aa
MD5 b6131ad27f833cc9b401b899c676ed6c
SHA1 5bc93d04188dc1623016a772d85813003b6f93eb
SHA512 8221ba7dd0a66952df41059c16cb7081bf3595bc7dbb2bbb50be6c38470511f75ffa1a1f44cc537e829a246446ed1c22a305c822d5b42820744f17657ec70f3d
SSDEEP 12288:taNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:teAFZRGjHP5jnnay
TLSH
T1F065231218AB84E8C7A6C277A08553A4821F8E15A7B90BB7F3901D2BFBF57B1D5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5396f9f0f9021f83c7029d7730643148c3401b8c6388a00837f26dc56297b51f
MD5 97f530fdd3e9e2c64cce1da5d14c0db1
SHA1 acf36d5cc54ada7d7ac54e8a51e9c55554e1b2a1
SHA512 7e41cba2ba0c86f6f7cb9f739413bbe0916f310707ac52a56c54156761317bfd5bf5e5bb09cbc130e63f710f7d7e25010d91d44619450e4495d50e810d912c30
SSDEEP 12288:rWNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:rqAFZRGjHP5jnnay
TLSH
T15065231218AB88D8C7A6C277A04553A4821F8E15A7B90BB7F3501D2BFBF56B1E5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 feead8e2c0642ff9d3c59ee233caeb0521c35b1ea4389991f8cec1fc2675c883
MD5 fdab5fb41a27e3d8b34f9e178fa34737
SHA1 abec9080d1652a86a16fa0005255c438acaf549c
SHA512 47940abc1a097102506d7e1424d5318bfa6abe6994769c46654eb06b4de8266a9629778dc012665e0ae715382aca4b5acf52e5fe25f7d858e4c14979b4053518
SSDEEP 12288:aiZwb0zzFEoS2cPvy+NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:9ZMEzFVSOyAFZRGjHP5jnnay
TLSH
T11585019573A008F8DDA7823EC8558915D2B37C1907B0CA5F13A43A2B6F733A15D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ec93f177604aeb94544dd521c6af8cbe3b771204761b723a54c5f489ab5e93ca
MD5 7ac1d0268d538209a24c6227220e0307
SHA1 e5dc29b3db1db9cb109c5ea2dc1a2adac72d9843
SHA512 7ed10e4e9f03e51bd1af1fdbc2a9ea93163bbdebd9ca504485b005d498f43f7af121811a8b3bb548bed2092cf114a54636e6c232b11089b5b1bd832a0c2b0300
SSDEEP 12288:WLNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:WBAFZRGjHP5jnnay
TLSH
T1CB65230218AB84D8C7A6C277A08553A4821F8E19A7B90BB7F3941D2BFBF57B1D5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e652f3f0af7059b10b5b0863ab63e7c06ad5e9fa4811b6cdac325f17cbb42a45
MD5 8c5856acff5504f78a5eafdc0fcdb19b
SHA1 73710e2b7378e1261fe2ec307dd44bb1a366b2ff
SHA512 8a12a5613e4f07e00d35734127e339381b6631c73c71a2598d6e8628da19d8a9d5c04f44e108ef282517507160573b45b863b47058a73bd23254cbf0b8ce149e
SSDEEP 12288:r/NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:rlAFZRGjHP5jnnay
TLSH
T11965231218AB84E8C7A6C277A08553A4821F8E15A7B90BB7F3541D2BFBF57B1D5C0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7c0099a5ea41b47383df63d0f5736052b5de1bc0d5995f290a52ac2ef0435082
MD5 5076863afd351e22090b977d239ba36f
SHA1 a26978863ed83f8299dc1a5f1c8d28a3caab0484
SHA512 1f8404bfcabedc7d57dde766a823674a76916f2311122714a44e942018725595cec4ea51760a0e4c71e168c62d7d2b90d6de004559ad58640dc07349779d3542
SSDEEP 12288:+yPz5L8CNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:jzyGAFZRGjHP5jnnay
TLSH
T1FF75020336A620F8D1768239C8921651E376B83557748FAF53A00B7B6F737E09E7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 99888a4bef3744bbed94b1bf0324a52766acca75e3584e004357c960278e627a
MD5 8fd24ec924f79ff1fa5d270e4967c7d5
SHA1 19524a7cb9081b52b2c61f226d6d87976b5f5def
SHA512 dc6ad983aba0b319d448b96900f2b4bc20cb72c6bc0c002646949287a2cf02157271e1b66a03d3fd4afac1511a06bbcc3038d1659dec557c3e91486f69dbd88d
SSDEEP 12288:ELNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:EBAFZRGjHP5jnnay
TLSH
T1F065231218AB84D8C7A6C277A08553A4C21F8E19A7B90BB7F2941D2BFBF57B1D5D0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4d2bff8c76c49dac7221ad87539d0973bf3c047be74b325835e8049ee34db3af
MD5 a9d7dda6c4e8ad44cf05ac80f4b163c6
SHA1 dc19958bb1ada3b35c47cfd08550184a5774426f
SHA512 c7f00a4a7afc7d6791fbcbb59910e37febacd743ed7828f9e2789f29206e5f39340abfbdbdf64d0e37a732ad8e9846290faaeecfaa7f511ec1fba897894cd33b
SSDEEP 12288:MLNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:MBAFZRGjHP5jnnay
TLSH
T13765231218AB84D8C7A6C277A08553A4C21F8E15A7B90BB7F2941D2BFBF57B1D5D0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 6d01d4fb262299e485ad104653af055abb198a25918165ae555d8db274161d8f
MD5 4213234fda2b915fc29b4375aa23dc40
SHA1 76a9e906559c5410f9f25b01307c5ac0bd16aa43
SHA512 e1913a94e572a89756dc2ba1528f7f988ee0eae708fceac311349e016825494b51efd039740f4fe7adf6a04574db679bbcfb313a660da170b9dc5fa16d75a416
SSDEEP 12288:uyPz5L8CNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:zzyGAFZRGjHP5jnnay
TLSH
T1F575020336A620F8D1768239C8921651E376B83557748FAF53A00B7B6F737E09E7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0094645f49eecfbad98add2f4347f604cc0ee66d7c109a60858fe94b1eaf7f25
MD5 79204251b9bc6248e3bf45b3ed40ed5d
SHA1 5311858aa85b7f3ab27e11c5bbb5ff1e5cf23f94
SHA512 ed30ab71fd3a22966e3e5451a8f8d2793ec55698589042c384d7b5f3b998141d1ecbd04ecce25d77afd06b1d3581519daa97f762ca273496370a058828081528
SSDEEP 12288:kCd9sWYoaLHF3z0z04PDvhQNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:dTdaLl3z0zDwAFZRGjHP5jnnay
TLSH
T17D85019573A008F8DDA7823EC8558A15D2B3BC1A07B0CA5F13E43A2B5F733A15D2DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 070b2c5cb66b990bf6b4776a2bfb6468e070508fb1cc08271bf1af6fcef362d6
MD5 0f3a7325cacd1986ebc67a93d1b64004
SHA1 3ef2e1673bfdc4d3e59bf502e9e8b6af74be1718
SHA512 b1698a54233591f0b810473c3bb590e8e17d9bff85d6d49399c83e143a23673345826f0b7a8aa2c0051491190febb1c04c2de5432977c235b68c77ee4587c03d
SSDEEP 12288:zi4e7wRdTfgwCHKy7GLbbdIv1NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rs:z35d9CHKy7GZcAFZRGjHP5jnnay
TLSH
T15295CF90B3E414E8F1B7DA3588765511DAB67C5A1B71CE8F03A4261A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 8531270b1a9f3de68e0e3291f114709f61bdea72ef3102e18c155fb12498d710
MD5 d288ccbbcc7387833cac5f8fb4a36f98
SHA1 0e923a42aedec4f9ad9a1a2e3c0663ab835fb9f7
SHA512 335e28a962e31b226e3c7ce7d779fda8b4d18efa64ae1d3d52f45819c8a32cd3848a569bd3fe4953dfc3e08fcaa7ee8b762ebbdd4ece7d5bde71423fd325a2da
SSDEEP 12288:YANAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:YgAFZRGjHP5jnnay
TLSH
T19265231218AB84D8C7A6C277A04553A4C21F8E15A7B90AB7F3901D2BFBF57B1E5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 bd24154e845588c8395e25344eb2322891eb1a7e91cfbbaac38e937a7b1a41d9
MD5 85fd296286d9888ce791e410c9be3fce
SHA1 e632a03fb056807665806d3857132ace1a548303
SHA512 f85a2ee629200b88bb4fe8cb0b60b36ae9efb3ba6b5f98330be5468714485f9d3a56d72828276179e171c5c9fa437621404bfe1bf0291b73a5d9d5397e438f75
SSDEEP 12288:XiNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:XmAFZRGjHP5jnnay
TLSH
T1C065231218AB84E8C7A6C277A08553A4835F8E15A7B90BB7F3901D2BFBF56B1D5D0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 92b6aadbfb0ee5c4f7f81d72f0b8b7812141a43a0588b6b8a88468f4fe2fc480
MD5 51f63bd86663baeb05da9137fba8e853
SHA1 39c90def2fe50a8a9921258118698a193f171928
SHA512 1fa6c46c6e3bfc86c4d997412e6b1f51afaaa99651a7dd1d1784039f88905ba19557e654b0b7c4a4d9f4a4840d819f838c499acad5397652ed9e2d85a4371c36
SSDEEP 12288:V1NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:VvAFZRGjHP5jnnay
TLSH
T1FA65231218AB84D8C7A6C277A08553A4C21F8E15A7B90BB7F3901D2BFBF56B1E5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 22e4c698f7a17a26133f9e3e39127b05ffb12a431c8602e99d3b9dd32102e716
MD5 40c2f96c847ad57ca188baf8b45e864a
SHA1 6e6b00a496c4d0a304c195f0bf4a5d48beb5b5c3
SHA512 e13b08ec27cb41a1a3d3d78cde597041ef7357d5436f755545bc526491c9287dee7caa4d78f6585f582f592392fddbb880789ff1fc3c73306cc8467e3793347d
SSDEEP 12288:iLNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:iBAFZRGjHP5jnnay
TLSH
T14B65231218AB84D8C7A6C277A08553A4831F8E15A7B90BB7F3941D2BFBF56B1D5D0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 5f1508c4485651ec43675d3fdbfc13443b926de1d3d32a87128f0fb05a4b7b8f
MD5 9d984c1ad6f88c428e85a10147fc20eb
SHA1 b1c71b33a50fb9e7bceb4aa24ac6994f3d9900ee
SHA512 c377ef9278fdf2d3336d42e68aa7fe0170ee4e21f30eb163bd1e217b11327a1339ceabcc8f8a71756e39408534bb177b17a634bfad9c031616fc14cf0cbe8c9b
SSDEEP 12288:EANAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:EgAFZRGjHP5jnnay
TLSH
T1E565231218AB84D8C7A6C277A08553A4C21F8E15A7B90AB7F3901D2BFBF57B1E5D0347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 160d31590a0d406cbc3f03ee1e308afe4ae56ee4f58ec6cdb2a69d341886a26f
MD5 4f8cc743512e0d70dd748bea43737801
SHA1 bf8f1fd74b6135046cadbcc71e2b59743a2dfec2
SHA512 ade6f51ee8c8be9bff54d57ea3ab1da71dfb00850694da5c71475fa49199484445a8b7196df237a27aed6321ab11e9ffe24a0a9388c9c87af0ee72788bdd6a09
SSDEEP 12288:9DNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:95AFZRGjHP5jnnay
TLSH
T1A665231218AB84E8C7A6C277A08553A4825F8E55A7BA0BB7F3501D2BFBF57B1D5C0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-30_113528_5764-2468.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-30_113528_5764-2468.log
Size 1KB
SHA256 516cf92dcb697b355572d6bea664e3aaec0839f4ae5eeb41c82b5086a92de0cf
MD5 19c99e4e022bf8c1d710026bfcd4a8bc
SHA1 20667dfe5c4c618ac0f43ed9227d5ea608d3c632
SHA512 ef9fcb2598ef22ed831e5d10a0b8ac52d7292068ae67ff8a5cbc8a9eb76d001a99dbc1638f04aae1ee196052795fd8c6e6ecd43867e59281e506888b5b98ffaf
TLSH
T1A421B42A3BD50A05FFF7DAC198FA1553AD3679D32834C91D00A4424E0932F41EDB472B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 960634fc5a978673cab4697d36ea3eb49085efe74ea4834b94e5b67f6b5ae85e
MD5 4f0cd8d9f6d5da485ba9c278271cf747
SHA1 f99be752a19e6dfe4f290b744b57357b6f9def04
SHA512 d4708c95118ff846f4f76a49251f1a3f6d8f932fb43a5b824999d8892bc74507b99f33be0f15a5314bce8de05d4eadb129e37fa70d56cf4aa408ee0ea16e7edf
SSDEEP 12288:ifwvD5uN64Lk3tRX69qkyAI5tNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rs:ifwv+k9RX6wkyAI1AFZRGjHP5jnnay
TLSH
T1D495D029EBDC44E5E1B7923C98B7460AF2B278691B31C6CF1299536E0E33ED09D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9a3480bf4425d8bfdbc05ad852374e7ddcf406e7365090433b110d5370ae8fa6
MD5 f5698499fd89aff65b259501037ed6b2
SHA1 c686ecdb6f4c27d346c41d9ecfacb204d3794b27
SHA512 636470ac5d70aff11a8ae04411fc9580e064a4b7c1634cac2f54dbe8f677399a9ffb5335b31e1200f4a7f5c0be2557cf22346393ddf521ed75c65363cb61dcc6
SSDEEP 49152:jYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK078HPlnnay:nySzPCNnd
TLSH
T1B2066C56A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4feef9bd340ac1c9dff464428c85fa4558bed38eb55ef33afb1261f428d730f3
MD5 a1267639d9b6211175377cf8d8b92930
SHA1 19faea4a3f51d00ea77370d9312dfb9413c20d24
SHA512 b7523da77af9fc712ceb798db49e91d76b9794750c4acaa81b0b902db1e890679024e60714cf6d44309cd9d16f1410c38255c6891ffd01ebf6d8929a690ac9c1
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYCAFZRGjHP5jnnay:W47JUQj1irIhCnDHUPfF/r8HPlnnay
TLSH
T1D965AE1EA3EC01E5E1BAC27885154A5AEA71782D1B31CACF2270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3a3419db36bb68e8fef38c22e41af75ffdba15dc2fb85adac32334dc8b433e20
MD5 ec1c5a3678b7b5f760cdea2857863889
SHA1 d60b5ae35b7647976e45fbf61a2e6d6354a5e8d2
SHA512 e5a6e309d1e89d2ce8c28f00b00d7bc3eeed0f1d30f53b961b9e57f36be3284bcd6ec56025f431ffbe44047b83a6125e7e9851ffb261101c12f70b1ad040cb70
SSDEEP 12288:Kzsf7NAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:1xAFZRGjHP5jnnay
TLSH
T11575F01AD29941E8C1AE923AC7454650F3377C2593F193CBA2D0F93E1FB66A09DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d80dca260aea3aa50360493ee6bf5d0ad6f5916927c8e90f6f48acc20056d8ed
MD5 0ed3c9fbc4d56eb5fdda7d110f62a608
SHA1 d025356fa13c23b18bc1ad66c2541569824d2d21
SHA512 d3360ce193db8deed225d73e43c9b024244b272b5d4ca739ab6096ad181f5ec2d365eb73fc8ef7ca9335e709fd195e1f046e50e4e51edc167f1a2d0d10b5cb47
SSDEEP 12288:MqCmk+0U3fmm+vK3cTannOAU/svTEBxAzff:MqCm50UPnEbwx7InAzff
TLSH
T121350750766AC75FC6A944321E36D5CCAB703C01EE046F0373C88B3F9576669BAF2286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e8087eb4939ab53962befa058b30df562978a24f2660eed4314b2f955446f1a5
MD5 ea643e03f550b8c724b41759b5a371e4
SHA1 7f3adda48b6685f2f368b0b39e5a98ba85c75750
SHA512 93cd2b713579f760fec4617a675e007f53487bfecba38c8a7fe744e744b2f55b0269c00ec14debba70884fff83c16bdb378d3fdc715a0da66d4ec6cec6b58240
SSDEEP 24576:LfAanrrgp+pxTV6fG8SkmYn0mMoP6wNGC8L51I5dHq5XKq5h0q5Lq5w6q5Djq5SO:8GLvM
TLSH
T11F75FA816137E38FC1F75031072AAB4DB764EC46B7096F26B3C8453AD86BB15A1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 415a45275f8ed4b100fce0317b4fbbc46d2a20dd559f49593c5a9e9fd8626e03
MD5 d6d3e0a7ce4ab933d0807b1755f72135
SHA1 502d991f657829e24a492f719c826ee70a32a897
SHA512 e73bf9df69fa9a5c4534b56735e2e26a0bfd3ed8259f0a8379764ce93e1791edd76f5c01884ea91b6e24da33616411eea6f6f4b38735c325e53e188cc3de12c6
SSDEEP 12288:DN7zNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:ppAFZRGjHP5jnnay
TLSH
T1D865231219EA88D4DAB6C27660499274931F8E245B644AE7F2401E6FFAF5BE0DDF0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e0a091b05aa58f96fb8c5a7e7782b9e7d0fbc187078411a5ee830e79deca76b1
MD5 31895bf4098fee1117a080c76f7472ac
SHA1 6c751ea739ae564e5ed712fa5c261de3991f08a7
SHA512 8c998b7711e5716314b044dad4817d27e78d0cba91dfecb4e8d552bc859581b289de9e8c82f10bbf20ec65092abc72606aae0a915ee638609d5fec05c8bfc2ee
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bY3AFZRGjHP5jnnay:Wgb4mBIBhGFx8HPlnnay
TLSH
T121659E1E22EC01F5E1FAD2B89DAA4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a887e4f8a5933e3db63698bd2bc0a213b10e52f294a6fcff8ed9148ad7a5ba31
MD5 63667039721e35f46b0a3244ad85a987
SHA1 29ecdcb1a2e61c4b2bf79ad8739d429871b299ae
SHA512 23e8aabec4fc35c94c75d4e747af1c6c82a85f0d2207a247e106496fb735b2817a915c1dde6c4f2997837b6b33acdb37623423cb605c713ff0feb584913eea68
SSDEEP 24576:6G88u8FpJqH1hzria7/myAFZRGjHP5jnnay:B7ZFPqVoa7/m8HPlnnay
TLSH
T1A995F16566E101F0D47BD13889864663F6B2B8250374EFDF07A88B561F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 464eea10b0bdb9de431cce9910ac0ccfecee5d9cbc1d6161d636ef287946d934
MD5 7e18778e47eb764d9d549961452a4f85
SHA1 4698a9468e0d8c6b69de20ba845eb7fe5f762c92
SHA512 cc2d2382708732d58e4542f8b999015de05ab7c616204ebe07df9e2ebbdeebb542aa6f43ebb1b5266b6560a7fd18dd47f8a512008d72f56d300de7a27c6e424e
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjN8HPlnnay:7G05lO43bnNnd
TLSH
T1E7D5C06A62EC11F8D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1379435e5aff200c6d039fa41fe675e1f8b701378996c6a4e097c5cd22368834
MD5 c7e97c7af5302d95fc946b0b4b461ea2
SHA1 42f853e8125bdfe4d199baf1f3f2e509aa4f2915
SHA512 90cadea7de53df3b13139ee32c37bc51503f82cab485f8b4941d444f033baeed24d56edc1cc072baab174da43c1a59b485ce498463bc7601deca3674f9180cd6
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0AFZRGjHP5jnnay:Na5POZ3+Jt2pasx2+mF8HPlnnay
TLSH
T1D765BF5EA6FC00D5D5B9D17DC583461AE5B2342153329BCB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 45e0f47005ef002285f3deb0df0d59e40cf11fd07997f796f375d8711d838a61
MD5 9fe65536033676ee414198a42042b5ec
SHA1 a1951040fe8639130acab303dab52f9e6a603ae4
SHA512 2847897dd0225d45acb274810044f570c8c186ea1ed113ce4dc66d27be587f436cba1be1542bcee1b4a93b5190088dc3cd27f99b395c5494a2931d56741c19c5
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkaAFZRGjHP5jnnay:MNc/zEOVHFG8HPlnnay
TLSH
T16A858B1623E901E4E5BBE1BE89779646FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 72d593e473642aa00454aad2412f97caf4a768e52ac7b58029d0709ef967556a
MD5 7962720696c5252441ccc02509aa3c1f
SHA1 f8ec785894a8e6e6771afe6186626652032ce147
SHA512 868686090b14e202ebc63520047590b7b1aaa040b428a05e346c90c2d8db5b2946890817fb7023335a5c50b6a7af405f48e40789152998fdf539d308a60ae132
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmvAFZRGjHP5jnnay:u8MwBtOmG8HPlnnay
TLSH
T1FA55AF2E7AF845E4D1FAC6B5CD238112E6727861073293CB9290C13F4E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9687ea680fa915d7eba102805a4e26e37e9681dc0a1bf3625785d0010b5d896e
MD5 a9e26f63e7e3d10d837a49f24083cad2
SHA1 a7c050fbf0a6fe70816602ea565ba1ebcbff8b4b
SHA512 9ac72661172df3dea80d536ac725ca41474bab3a585eb4c7e6a3a3311911be85edd0fd277ac99293ec3970539270ffa425cec453c2e5128827712174d7cfe24e
SSDEEP 12288:OHvUrBFrEjwaQqNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4rhy:OPUr+NQuAFZRGjHP5jnnay
TLSH
T11E85E12F26E918E4E676E17D85828719E372B862131292DF02E0417F5F73EE8BD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 2e7a215d4f65e1517af89acfc52a25a6704853cdc50aadd6826d3f47f9ccc032
MD5 87111ea5e26134d47ea8ad7e97c0b494
SHA1 65f03efe5480c4d2b6dc6701fb66959d7469ca9f
SHA512 13e7f28fe1f8b09e3d4d8c5ab75c65155778290e0fc611ee2702daa836f0f77fad36a5a4217b58c81818fb85fa64a2136b9ec0db86b589ed35b2a2c223ed3a7c
SSDEEP 12288:JQcMxWDXN1Dp/fshBItT1IQgAXNAFE7X7qJtPvbpOngmZCiLcHWP/Dtj7TMsrj4o:1D3FHshBIYQgA9AFZRGjHP5jnnay
TLSH
T14695E13EEA9D04E4D57BC2BCD5538606E37238A9033256DB12D481BA5F6BEE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/560-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/560-104-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/560-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/560-337-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/560-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/744-293-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/744-64-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/744-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/744-71-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1120-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1120-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1120-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1120-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2144-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2144-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2144-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2144-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2492-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2492-141-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2492-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2492-143-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2492-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2944-124-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2944-123-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2944-130-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2944-321-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4000-88-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4000-318-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4000-87-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4000-93-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4116-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4116-46-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/4116-62-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4116-60-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/4116-40-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/4872-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4872-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4872-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4872-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4872-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4984-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-116-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4984-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4984-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4984-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5124-77-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5124-75-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5124-83-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5124-316-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5764-51-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5764-55-0x0000000140000000-0x0000000140470000-memory.dmp

Download

memory/5764-0-0x0000000140000000-0x0000000140470000-memory.dmp

Download

memory/5764-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5764-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5764-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download