ba5942764775190ff8eea1ac9f1d5e791258948da1da6eebb6ab850325a28e28

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260730-qt7ynayeqa
SHA256 ba5942764775190ff8eea1ac9f1d5e791258948da1da6eebb6ab850325a28e28
MD5 99fe47db420539e5459162941085ec0d
SHA1 e2ed5967ebbc05c11f781e5802cfcf3c4e4be09e
SHA512 451c1f0520f2b0aaec45f02e8052106516b57315313740b0554745dedfbf7722006f1cbb19de46ff8e7f856a9cd2628365b242e8c20c3935b5ccdc4160b8da6a
SSDEEP 49152:EoQynEIJx6iEdOXdgh73Faz9wLXDDZoaLOGpyE5QeaXTMc8aTyuPjSTU8Dmg27RN:8FAeaAFD527BWG
TLSH
T141267B1BE6B940E5C0BAD1798A57951BFAB27819873297DB4791430A1F33BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1900	elevation_service.exe
5384	elevation_service.exe
4964	maintenanceservice.exe
4332	OSE.EXE
6028	PerceptionSimulationService.exe
1076	perfhost.exe
3064	ReFsDedupSvc.exe
1856	SensorDataService.exe
972	ssh-agent.exe
1028	AgentService.exe
2960	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\da2c6c02d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091af306f2820dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb392d2d2820dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007797086f2820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d22b2d2e2820dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a16e862d2820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088d4e16e2820dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
5384	elevation_service.exe
5384	elevation_service.exe
5384	elevation_service.exe
5384	elevation_service.exe
5384	elevation_service.exe
5384	elevation_service.exe
5384	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4588	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1900	elevation_service.exe
Token: SeBackupPrivilege	3064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3064	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1028	AgentService.exe
Token: 33	2960	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2960	SearchIndexer.exe
Token: SeDebugPrivilege	1900	elevation_service.exe
Token: SeDebugPrivilege	5384	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1332	4588	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 2960 wrote to memory of 5100	2960	SearchIndexer.exe	103
PID 2960 wrote to memory of 5980	2960	SearchIndexer.exe	104
PID 2960 wrote to memory of 1516	2960	SearchIndexer.exe	105
PID 2960 wrote to memory of 5912	2960	SearchIndexer.exe	106
PID 2960 wrote to memory of 5376	2960	SearchIndexer.exe	108
PID 2960 wrote to memory of 5856	2960	SearchIndexer.exe	109
PID 2960 wrote to memory of 3660	2960	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_99fe47db420539e5459162941085ec0d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4588
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4588" "1420" "1340" "1424" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:1332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1856

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:972

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 115b9f451ee330cb382ac4bd6f11ba040a7747a971f008b5dbf7dcdb812d5b91
MD5 de93ec7bc3107d9ae353bf65a12810d5
SHA1 e7f5a3629563e40e30f61846db0228ee94a97e51
SHA512 14ccb72685380d3e86465912806bfd6cba2cd59d5430bb63683da44c22d6c8f14033c5f18f1651665d73fae50c4619df213b73a7f1db787d71b3fd22690f1137
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjDmg27RnWGj:/3q6sjBED527BWG
TLSH
T1DFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 12a11b91874da70af37eafa7d07b64b99dc786050c6c201235b539044715489f
MD5 6a5a5a9da246058899748970c46b9958
SHA1 37bf93944885e144dc48ccf929682bd33795d469
SHA512 5d8c68b48d378a3cc675304f832ebf634034396845d5f1f0468a72587efa3d7c5aa93d30eb29eb5e2a0cd6b8ec61ceaf8ef0f091cedca0d87a6da93180023d67
SSDEEP 24576:PXYfDtczAksqjnhMgeiCl7G0nehbGZpbD:6tcxDmg27RnWGj
TLSH
T19E850129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 ee962ab51588975c9b1222e91cfab5d7f969daca2207090451589c921fc96cb4
MD5 1bcddbf4f293a88acd35e6fdcaf24b5f
SHA1 76669e4c2c69a548460386baf91e0f01f2eabc61
SHA512 b25da6b5ac88c38791ec522ff80c2878cec21e52844c48296d9d3e67ba9396b6addddd48d150c185581b6b71b67d2b19febaab930d4afeca76d2388c709dee00
SSDEEP 24576:J0Le5ji0hmxLrM3sqjnhMgeiCl7G0nehbGZpbD:JPji0AJCDmg27RnWGj
TLSH
T143959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9303a6e0430a12a7c8e736b73a7b50e1ca3b452e8e17a930282ad99734c3915e
MD5 4f1f4d802117e68b195eb9d7e379a5dc
SHA1 0eeed70633bc4e41c12385e034b24dbc48d2b930
SHA512 c4d69f830d885b361eb3333bde6a447c775b49dfd8d1cbdb909fde8baabb64ec62e4032b1c80b27d5b5505693eed7964a035bf77b958c3a15014af840b67704f
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWn6q8wyu9sqjnhMgeiCl7G0nehbGZpbD:H/ezSC6vUzPveHjyODmg27RnWGj
TLSH
T1A8755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 552e23608eb71befcf8abde51fb421d24c56b73539f2529e9d98245dbc94334b
MD5 ce04408e3e6844eca044dbfcfb2f35d3
SHA1 a98de6607ad77d71fdf57a4c0f0d0fb734fbbb82
SHA512 8067de5048453474c238ddde4bdd8f31614b90a53bccc8fd80dc2e176d286b10fbc2d0b4ec22aacacb1a4f7ca0a5b3a2a49eeda621dc576fbda417640a19b6a6
SSDEEP 24576:WVbqPb88hv/l+YIsqjnhMgeiCl7G0nehbGZpbD:WVO88hXl+ZDmg27RnWGj
TLSH
T13D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 cae652c6c57c6dc4175b1119be41e9c2eb298bcfde839ce1e887ab0fe9c7a51c
MD5 149099082d9761d9fbc1de6e185724ff
SHA1 ef607a0ea05e1582a3767d07fbf0e74cab4cf0c5
SHA512 e8fedff68c25d5773780386c28dbe375861c77c034b0618cdd5d4972c04773c9d3e06ec3130e8fadca17cc7ae50e72591ae1988f710ca8ca0452f71a38adb84a
SSDEEP 12288:99LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:99LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D6523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 111cc67d9c763159f9448f2c10413e1cf24ff69e1b7ab6f82dcf574b815ea3a1
MD5 ed893b2d6a68c98d85e7db5d3626fc90
SHA1 5d7a5cfa865d3c41a5626615c011c4606f36fb7f
SHA512 91325d13526a3f96272a05608ddecc75068d9db44ca2d22dd3f9fa8fd082367173747750bf6bd131ed690e7a086dd881326f6b736b5077d9f97fb588650f7d78
SSDEEP 12288:1eBNUbTVO86UgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:1JIUgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19085CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7c6895835f433f466ac739483b9e59779bb8ab36677edfabdc1df46caf4558d5
MD5 292204ccb629fede920ad908860b163d
SHA1 cf2dad2ba4d6007da241146555e2afbfa86f429e
SHA512 1c7dd734a252595005a9b6d1af231db4d3da7a4da84dc3c06ff1ffb7283f664a18d0ad7622cfdb346c42bba52e5f6752379c2bd0175314832bd9d183c94622bb
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THf:jQvGAdlCEL8c/DRNw5CRD527BWG
TLSH
T114266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 287463d329a0bfe08dda918f5dc1727f1cd06f002cf323127c545d492e824fc3
MD5 1a70c2f78e37379bb8ed236a7243e5b4
SHA1 9210a2e5682859bbef6957082c97178844aab8a3
SHA512 53d08091cb3c10e25eb2f82edbaabef78f597303754758cf9fc270afc38e95a67a2d0d3b1abcadb20929173a6dcce8a62b4efa0850c19e15b89c14959f95495e
SSDEEP 12288:yAwSfxL/2Dc3DDLLmt0LDQewsAjeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:3SewsAjesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E985E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 87f7703a6028a6ac8fd05973bbf74e8903b210feca4c32d6b8843121554ba4b8
MD5 aac5191f626d3ca3998e9ba51d2e19dc
SHA1 ab906a727ee7e248e7687319c95f522fc4737d9b
SHA512 ca3d8661abab5b94752cf6c50a2619607db751fc42773cdac8c4159abe41a38fca3efeef004145beda8174c6c0631c2e6befbfd56080c86ed4e275f2b22dfffc
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHKVQBWG:sUEtQevvqc2W1cpV2tI32dB
TLSH
T18A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 58dae36ab998ad895ba40c194389bc66b6ed3121da15e74c119dc1527d757b6a
MD5 45cf3cc5389ac3c7f2eebc7c86adee41
SHA1 f85ebd5f6034cd033ae4ce5b5907bd9b93cc3515
SHA512 ac1a86e02509302b9016a41fc9bd2c6be45fa03bb71ace054194aaee06ac3bc6ff69dfb907568a78eafcc0e60b55da845a6b41681d3c2a9d280d60b0bd7fb934
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zSDmg27RnWGj:7oquVjnmdD527BWG
TLSH
T1B2D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c7670682e2d8ec610e7c7b8729a1d480068ed20a352402b39ba0b6e536d2c7d8
MD5 ffcf45fcbd1c01e731de61c90c18d8cf
SHA1 b2b3e9d24d00541a15e2efa3099499e78a9d7c66
SHA512 5675615562b19f63160979a05f11429737fd362fb029c3607aba7f53777f26b50aa49d7e043eaa38fbacb165e8acc52a2d3c712ebc91af76a2d4d0b057cb37d0
SSDEEP 24576:oAhGL3IFoiwtA5l7S535sqjnhMgeiCl7G0nehbGZpbD:oAMUFoiq5NDmg27RnWGj
TLSH
T16D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c40613dfc954bac08c47aa0e9d864161a9da9032c777056544af414e1281f250
MD5 daa51934af5ad72b3a9586ee586f6770
SHA1 be3596729e36aac167006d2f177badf179993f5d
SHA512 7f4cc37a89f0425f0c63b266f2135fc9793b4f00ef1f1d3b5c4f5a18a97751744df500a733ce500588c970a89a5de3a91845805d1a9ae4d8037340baa2cebb94
SSDEEP 12288:Ymw5HEjsChNfBFgl0WDm+CdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:VwumOWasqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B85F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 201d1041649aafbfe734a27038543e4788d76545ec99cdf64cd650aed6b75ce5
MD5 4eeed1d172e898e1537e8c76a29df723
SHA1 8f82be531ece9f9cc174e6130b4831785cfe47e2
SHA512 4e3a619347ca37324256ad0a4890473f3d44f5a6f2c620ae485e34c64cd46d05122378c1e287ac66b537ad155b928375b75ca5aa0b4b2d4ecb621150ac89bbd4
SSDEEP 12288:b0Z1IyOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gZuvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1167512AE239820FAE163417CC5E5D609E7337C62673043CF166259AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 680e035f469c33516676db5fe813e2f243161a927452ae80e7b0d4ad4406d291
MD5 e28aef9c144d80f3c877f0243354a608
SHA1 c5887906f1cdcf55d7a9ff1c97ff492c6877f7c0
SHA512 dae565955c92a460c5c445b4b5012965192906387c23958772a153b323413092085af63865a20ce080ae77cf13d8cb4a830d6af88b5c50a1be18a7c35b0648c2
SSDEEP 98304:6QRQyi36YOcPbLvw2gAf+PN3oD527BWG:xQyiKa/X+PN4VQBWG
TLSH
T14C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dfdcec16371f806c0a174f56045e6f549eadac178ce3055a4e6e6302bc5c82c3
MD5 0e20db4a495b92eb179ed0f00dee8ac4
SHA1 c4879823f532c8401849a51ac3e05f014eb251b5
SHA512 61b938bcd25234c19eb2dc8d2eeefe4bc470fa18dc9b62b5df6a0348a0548e61ba995f4f705366c5769cad5e52b6872e54c934ac03609b2f91aa7137c8cd1f3b
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN3oD527BWG:0QyiKa/X+PN4VQBWG
TLSH
T16C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 217a568bf20592256bc9839b06ab31b06e0c5993423933146ddab562e3d72cef
MD5 d40e2bf0d1fe01a20fe510be0de7952b
SHA1 1851c81028a082eb9d6d16d0a27651ff71e27170
SHA512 a135b61466be04ced6c1fe8643ca17d1576e249c50c1ae82dea587cac393ad155e93caa0a3835dc6d313c8d4e1020ffbb815e4d7d9c15489fb2099b90f9b7370
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0/sqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/CDmg27RnWGj
TLSH
T118B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3c5329761b77276a3a25cc17c1d340fb07a54d50f014de8461d6a245c6f369e0
MD5 9ee134d0d92eacbd635526fedc818de5
SHA1 8a2013b2a0ec8dfee99ee504f62580151ecdca7f
SHA512 f339f902f4ef69b191aa3d12b547495f5b20a92f5e85164b02ff33cc71a134b0dac0185e7704a6c77ca82b41f6a1df847d68b3d61f08204b18771160c024faa1
SSDEEP 98304:jy5112gYy5azzVvt69nLKnhZ/D527BWG:+LIHEWhVVQBWG
TLSH
T121167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cc65049c72c446d0c3d7cf0dceaa699a5418926d467906dd8c014609fa3a863f
MD5 10ca2cbbc98cecd3f87f9646ae0014c5
SHA1 25962779a48e8dc4af43089b1a08ff29e6d74927
SHA512 76fd6185f60605686f988acea50556de2ee322f18111b7c75fa28fac29a902c1cfe1c7d4b7643afcc00e283e73d1908eedf14838e2d331cc374c9cc2132d615c
SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBDmg27RnWGj:Pu6Jmdxd2dBD527BWG
TLSH
T169D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 791187269398f61ead5311be6970eb0496c9c17c7b74943838d8f999113e2c17
MD5 f35e93d6822dc61b9ab7845498ab4a25
SHA1 b5773357c5a0804e0491d458b24067778fb89313
SHA512 664f989950f50188fd3f8ac2a21d2dcd07f6603af736248fb8ea6b4e0e74a2d0c934f9213df0a7c9b1e725659b196f668735626fe6ec47ff3fd377d3322108a7
SSDEEP 49152:B1hpsNoJpF1A63U44CwH7R4x8Dmg27RnWGj:BmifPWRdD527BWG
TLSH
T167B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a01f429c6eb0a6ae92e706d6290b04eecccf7866ec337ff55dd27c1c1114196e
MD5 97c74a43e2c106edb548d3743cf5f712
SHA1 ca8fd7272bcb6d24ceba06dd8fa3361b998c330a
SHA512 b3754be57006fb718391d47001cdab58f22473236d20c4fb480fa51e3ab48ff5ed47d4e19849065072a3986c98de569f4f34867501c464c1319f7f15ebd20e8f
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqTDmg27RnWGj:K5dKii61TD527BWG
TLSH
T133C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 89da74331b172efbc89275ec6baeb2cb6905d1b4edcc9e971381aff8d563e3a4
MD5 2217c6d648a5bd4e6334094f0db95d90
SHA1 229ad8c057cabb51f9aae7db284b47ec2735b6a3
SHA512 a5c962f052d11020c1911c87e851caae0bca2b703449abdf7d7010d07c6ff1f13ae7574e2a82b0bca44ed6965bade485c6333807215d865c3800741769bc1f77
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5wADmg27RnWGj:OX2imphJD527BWG
TLSH
T11995BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 087bd2e6d3fbafa99993ee61b66bce5c7fdd1017ac879f003734d6e55e173299
MD5 e881d44db558c5f2d2e3e4f3e11b2fbe
SHA1 bc2c347a03b0e191aad86df0a7c73361b67de373
SHA512 76304c73151249f0cc512b0847849e521a4b3419ed92740b9735f12c81570f5b10718a709c701503b443b1764fc4fdb175f6112522da35e131ae29a1e31e6147
SSDEEP 12288:HjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB6523BE965C41CBE52249B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 20e48a74742a6cb6b1a7ba6288ea7ed9ceab0071bf716d871348f119ebadfc40
MD5 2a91a48d85d05657da39117962c27f2f
SHA1 a4e39df336cef013ccc00aea4b24847de8c68232
SHA512 fc84fb59bf7136668f64f87e8e6e94ca491d4c084f1946e84ad7c27b03fbab230f804cd09e5e6851fb33fb9cbb2414aaa6a2f3d6b78e6d70d54afc7422a6e500
SSDEEP 12288:eiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1596523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ac82eacd25e2a1f40dab4888badbc175f4ac8904a217f84f65e78ddf1d760430
MD5 c628315e8f85c68f5de39be37104291d
SHA1 c8eaabdf5bc334f1bdfd11f78029605e92408a11
SHA512 59c4819a93d305f47756431b401b1666aaa1bba21d4adfdf8a827673df00ca33bb9a604541cf75ec5e6114123947b324cb6b332690766280907200852c165d58
SSDEEP 12288:EYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A26523BE965C41CBE52648B5C3E6F14DAC073E5BE9200493BA977CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 cacf359eac5d56900656797fa91aeff85721939b23cadfd5c4628aba07723dfd
MD5 a1add29414de301136f1a76e057c67f0
SHA1 de945a5acd378db45ae34cd65cb428edab7ae053
SHA512 518e373f10fa013ef14cc13ba77a89df7bf1f57b3a458dd29f0c64d63b06e4ccf1b71f76d588b921db067b4d0397a806b10e7407d7c5e2755783a7be3d94e46e
SSDEEP 12288:PVZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12465236B675C00C6D83285B4C2F5E11DE8237D96EB30059B6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 037ca55c759d53e3bae0c6751e39f6af934afbfb404b748ad78b2bc58d2f27e7
MD5 811b85c81b7ebdc09b87526c8a227fbd
SHA1 159b519df4aac521bb602223fe60987c988de6f7
SHA512 896b6114e9bc3f0bf806bf91f320e439c94adef3b669ce96ba3d47e80676839729563665eea0abb49ddca3deec58e0ba618dd7fbc3cc457839587267bb0ffe2c
SSDEEP 12288:GhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1036523BE965C41CBE52608B5C3E6F14DAC073E5BE92004937A9B7CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6e90afcba2e857068b7ec2a0c9b4db624b0aa6868da052e2e612e09cd01eade8
MD5 9bd9fece8f21521186627868fb94b217
SHA1 d97bb2c298f22dbf994642d86129f4a573f2a7ec
SHA512 84c348bc6ca8707a2160ccae5acccf9bb03f89c0af48397c20eff0218a4509b9247dfb50234f8471f45c14b1bf939eca54dac7f4e02928a120a6bbe06dd5f240
SSDEEP 12288:e2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED6523BE965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f168cae9b75401773be65d33218bed0f0d7fca506c448ed614b9f1ba9b89777b
MD5 bde1aa39f56fe3d6f4322a3ac398e8f5
SHA1 5939438fcdf4ff36d28e550e5c474d676ac5d442
SHA512 9a4ea7e9acb33b84560cdeaa82726557e9d2889e6e7970c7f3a3c4f434323e1619bfc22322d3551e1bc0011430072090ec665fb056496d0576323b1cfad14432
SSDEEP 12288:/qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A6523BE965C41CBE52648B5C3E5F11DAC073E6BE92004937A57BCBAF7B14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1b8d1ba764835037d8431158a44e3f6c09afe063de52b71ff6220894f429b9b9
MD5 27a2eb2cf048b56754181d9123e80705
SHA1 ed0e7dbc5ce251c8492613b5442c6ebd4f2c6924
SHA512 b8c5140a70dd7d5755168f5c4892f41a5b2eab8e865b7908e9e754956af066b28374734d8f793cf05c5a55cee263741134e4198267e986621affceaf47543d73
SSDEEP 24576:HZMrzFVSOCsqjnhMgeiCl7G0nehbGZpbD:HZMrzfqDmg27RnWGj
TLSH
T1488501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6b8beb98a8b77e210e1511526bed9622b648b6ec6fe42f089b21353416907cbe
MD5 c55bf9401e97ea69b98966bb6b240f6b
SHA1 44ba4e9e8ae991f3a61de025133a447ab2c4e6ac
SHA512 ee93695ded2553976c9dc32cd801a2075fb97566b62ebc31376313f96d11e5b870688b87665a335324daec24ea444e72ca339eeb42697a0ddd251dda5d4fb32e
SSDEEP 12288:8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B6523BE965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6eeec4d57e6688b46caf4e70a280621603a9810f51524bf7fe9fcdaeed1fb466
MD5 dd2d2b8e5c20351f1c2cf13b39111fd4
SHA1 bd2366f4c6d09b5b6b89cb9d57b60d172a3a00cb
SHA512 24ee81b077f9ee488ec8115b59b5b85fad6a4b48decad8f948779ab9093d5fb9f7dfa2707803f78ee4f6df7b6b7a2d51e6c7bb76ee35eee78197afc666327edd
SSDEEP 12288:m7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC6523BFA65C41CAE52604B5C3E5F11DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 abeff8272387160d564c979c8f5b46cbcadd0aa12f091193dd97b5b0687909d7
MD5 31f513ed5e50ed1ffa6b9b5bb1710d1c
SHA1 10a8c71a62f6ec75336cb67acd8b40ba7bbae91e
SHA512 2adeea10c06bc0074c695d38fb93bf4459c5aa8cd976b775faeddb206c46f26fa906962ef173872ae5714b348f027d2c582297fb7b64eb41eec9208423925487
SSDEEP 12288:gyPz5L8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RzyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B75125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c0b20847ea35336939da34a3b51796234606550c817e246daa9d0d81176dfd40
MD5 a6463a3c4bbad594405d0b4e0d738701
SHA1 97c76aeb8e305e9848685a563c02c63dbdc4eba5
SHA512 6217328b72bee9d84234fb24aba750fa8c6e13349bb15122c5323ccef0dea1f54222f3544dec2cee3e7b886d186cee6d3fccef8cdd588673e859300b79e61feb
SSDEEP 12288:lfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B06523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6c7a5ab8edb44888464664e13ce0d240be33646a148a1d24ddbb10dc6f09df03
MD5 2435c70375c05ef264d72a7707ac32c8
SHA1 09a3f0e4385b74362cb2edc2dcb190a0eea4893c
SHA512 a4782f9bba4ae77a2aad005185a1d83cd699b07a2997ab9bfe41f529c6dd78e6d363c956f7d0859c55bf01d7513fcda95e8076fdf3f6ebc982bf087a3dbf1af8
SSDEEP 12288:ZfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1036523BE965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 560dad470468630ef5dd0647bf0536167776cba3f604b797053c5c0753af6b7d
MD5 23dbe4e6ace0d803c032217b0d9f51a5
SHA1 e5f631320d8f11f9dd55135a3a27a7b9f37d2cc9
SHA512 ae3abb99f8e3fead821d90fa8e4fb6b497976ae43cbe9b416c8edc001d92b25111dc265b9059962b6c8c189f6e864e17614e1594558b03bd807c4b3159fbbe55
SSDEEP 12288:uyPz5L8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C75125B73A530F9D1378138C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d5ed61e2e66b993eb84310a62e3a5667d2204f9069357c1f8423c7f2026b4f1d
MD5 4d6c4fdced8bd4f95d4f444b16d67f14
SHA1 f7703569bcae7e4209d86c14865f04be4d44f914
SHA512 22812113a8c8272a8771a63116d6fbbfdd387f8bade45610a01ce81709e869fd36f0d9c01c9ce19b8a2e41f9c50ea21fb3ae71205f6898bc8fe7f7d413eb0295
SSDEEP 24576:LTxaLl3z0zDosqjnhMgeiCl7G0nehbGZpbD:LTsLljhDmg27RnWGj
TLSH
T1E58501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 65a668ad038ffbc6eebd6d4da3bc5678f59e5b2f6cb27e07b41a107f959fdb8a
MD5 dd1833ebd51b079187022841de2edc9a
SHA1 fa705f307e4df027905f5d6b4dfd576cd5732a6a
SHA512 ae73b86f646eb956e79f81f9dfb6c4513de43b6d363ba0765d8306ccb501bb987157437639f3ea2e424c2d8ea6f591b500c632f5e6d211f39259db3ea40e50e8
SSDEEP 24576:i3pd9CHKy7GZcsqjnhMgeiCl7G0nehbGZpbD:Epd9CHKyaqDmg27RnWGj
TLSH
T14395CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 5d2e99f348e03570e9dc8006c7aa8cb3d35dbbb2dee7b87d198d7b9e260907a6
MD5 c512dab5c2e350a75a462a9f2c998c76
SHA1 243fb95426be5310b3954416ddd1cf9ef556bbb4
SHA512 f04ff703a5e72c4a657ab97496912f321589fc34b05e9c75a2cda2542eab743b249950595785dae7913456598cfd666486b5638c4f6effa19c98df00f81c6bd5
SSDEEP 12288:R4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E6523BE965C41CBE52608B5C3E5F14DAC073E6BE92004937A9B7CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2d02e1136a596b91bec92e2ce95bbdcdba0674c894bf97db42f2f3c62fa4f9aa
MD5 df0668c96c14f081aee0b61e6b32ca2f
SHA1 4e21e347d6d23360d4a7c5ce5152189e630480c5
SHA512 30d483099f457c27db2b48d242672cbd179896932c1dc3e6c065528dc59805f4158ab839479bbb801fa33033ef0f636e9a2477db512161c479ba604027a6155b
SSDEEP 12288:VuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1276523BE965C41DBE52644F5C3E9E10DAC073E5BE92004937B977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2adaabd21c8c8483a970ab1e462070811091490631af6a6542819c80ee78fee4
MD5 e0e8765b5abf7cac7f3a38ab941ea296
SHA1 867a2b9c2c11c72ff3ae3ee3a480fa9bb848031b
SHA512 d1e9289cb8c88c0f57bae488c70be390fbbdc6c1c94a5c1eaaffae61223f0133939df0146ea2cdd7a87f1377363cf0ef5ac4a9cc2b2f9c420d0e7ab4427ae50d
SSDEEP 12288:xFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1186523BEA65C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 84315393ef37630ac91e81d2aa80f3edc8fbd3d8823982fb1cde409f00925c8c
MD5 05291ac070e9a62fecc98cf5be12831d
SHA1 95faef2c11ab34b4344b24d27a40ffc012449ed5
SHA512 36977842192c15e217f94bc6fae6ff438f65e28bee061b11865313ee636a03c7d340b2e03e1ef69767c19c665f68d5da8fca5b065a33ba28516b1edfa2234fea
SSDEEP 12288:rfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1796523BE955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f47895d9583cb37e7ac1bbc75b1e62b72a5058ac59268b341f74d9ad02fb66b4
MD5 b42e1813e7b061b84360b41ad099c3e0
SHA1 8dca6e2b0300112df2501829a4e436edbd94cfed
SHA512 97dcabdd6cd5c2f1104bf10a81b6867823b1ff66986d1b209c5907e81c1befbb5ba422bab0eeb3498cbe675c8897780a44c44ab1681333706d7feec3c0caf6ee
SSDEEP 12288:14Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:14sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B6523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b27f1ba965d684bac2fb845708f838d55940141b05f97d22ae8fbb80a889342f
MD5 e3106ce4285947d2f1cf51d5e8fcfb70
SHA1 df0bc3d5deb20d8ea2aa1441b68a2dbcbfde7c4d
SHA512 0cb61c7c985b04f8f4ec9d36a80d4e6aeccd1a488665ade420043f3d654d84da3b877b327d563d11fb2c781dc6354fdb9eb939c2dfad5ac1ae33bed97a2f75bd
SSDEEP 12288:RHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB6523BE965C41CAE52648B5C3E5F11DAC073E5BE92004837A577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 bfb30db5ad0bf755c7589cd2ba87ae397ad5b516225ef9db19260a34ba334de9
MD5 a5f7d2009713c2952d7bb6c1cc21e1c8
SHA1 43072ea5a72fd5c81a27a10775c61eb37057534e
SHA512 90495ae1f7be0636a7f0ba56adffb20ed8821803bac6097d4edf91c6ab90049be627e69f49740e9318a7661590d4a2036b77490828896a603cb70af376e90dbe
SSDEEP 12288:ThXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ThsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F6523BE965C41CBE52608B5C3E6F15DAC073E5BE92004937A977CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f4fd7ac5bb0cacbc585c859afe9f086375457b8d2fb7e6e677cede0deece9564
MD5 8da8a0caf1e8de2fd7f1b777f9e4116a
SHA1 5da5f715768e4ea93cab41b50463b269b9ced37f
SHA512 5792c60db7562a384ff44cd6124d72d1b02038e0d9114b17d25a467bae2cae3b0fd5b4d64a7003c6f52fa5a16c1c54e289e0086bcc4645f519fb5fd497c10c6d
SSDEEP 24576:Ffwv2k9RX6wkyAIrsqjnhMgeiCl7G0nehbGZpbD:1MnYIfDmg27RnWGj
TLSH
T1BF95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 25cb9c83b2f3cec27cea31c438ffe884bede022cbd2b89ed7a8db13f46eb0f3f
MD5 4015ab177ca2100b1f5848d2ebeca81d
SHA1 87d067bbf488bc2e26f164e1af034c14679f3f0c
SHA512 c9dac3514d47690e7b31612f7d2a7607e1636badc4fe886af47fadede3a4060cc7faa4900d4fa11edb77b903403b82b8f7c5607f8b86f360fe3f337a85f749e2
SSDEEP 49152:4YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gDmg27RnWGj:vySzPID527BWG
TLSH
T115066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 812f2f39270f51964e83cfb7b696ac3cfa6c2d10c7b7b9c7a44c8481f82db95a
MD5 15c9f7af6bd85fdfd513b2e97bf0494c
SHA1 e4c5a513be148063d371bea7e17419589b9292f5
SHA512 b48cebd900ca664d1b226860bb24aa8f729aadb9ece3545fbedcf28730061dbbd5470adceaba127cb7d17a18c657b5cd41669afb505adb68fa3a5cc87a923a48
SSDEEP 24576:e47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYysqjnhMgeiCl7G0nehbGZpbD:e47JUQjTirIhCnDHUPfF/QDmg27RnWGj
TLSH
T17565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7fcb9aceec6c0770b71698c452123ae1933bf1a49f94ff960d0befd7fa740a44
MD5 00df51fb346e3537f9ace71c14227eed
SHA1 ba4dd50e406aa513a0755fbbfcbbda2974a631f7
SHA512 889985e2d3d9aba3b041eea67e021db6b6460081d9491dcbc719a29dd448a3bf01e7aa8a45970fb382d79e7dc44248d0bcfce5c44350c4937998d7925b162974
SSDEEP 12288:3VsfvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:svsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A75015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3956391491d94b6d86684a141e3ee20eac4f9ec95aea05fcdd9852a93331803b
MD5 410e060db7acfd5c792629869789d9e0
SHA1 eab432b4bbf6f6aefbec32efa84cd787dfe595e0
SHA512 c255ceaba2d7a5f881f798a388150f996a4b4452620a98e972b605051b11e35a4e020627ae42aa48b0315d853dd58675bb6ba854b8c247cdb3b8c0dc78a58af9
SSDEEP 12288:3TSqakcSU3fH1wL0/jX3tYHNApx8Oj8csttnZTsQh1uNr/WvQj2TYTxf:3TS5kLUPC/NE8cstLTsQWNr/W62TE
TLSH
T1AD453941766BC75FC6A940321E32D6CCAB707D01EE456F0773C8973FC576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 f70442ed071d33efd7415c4ae015c351ccdbe24ddb87aef9268de9202d9620af
MD5 7c700d3ea22207ac12736bf6e722212f
SHA1 d9567cf5ffbffa6ceff0b7de50491f1a4a33dd8f
SHA512 6c603c3f66b2ecd994e052c7aeeb75c3c8744bfcf907bcf48cb67cafd5e102f69c4417d43751a20d606bf76fac55d90f44866be62040c9a48e4c91ce49dd17c0
SSDEEP 12288:9GE+qZgCEE+L8x8O4Tx8OYOwt8csDtn33g4ggJ05EEkea1638WkMXq6:9GE+FCEE+q8csWkeYVWkM66
TLSH
T162750A816137A38FD0F76032032A5B4DA7B4EC06B7456F66B3C8453AD86A761B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8cb2151dc8c2b8331c201ae6dd92eb3baf11df78605507664d567f2a6d4a551c
MD5 1de498dc83731dcfbba2340bc3f813ad
SHA1 65f1ec7aaab7a463659ac602cf189bdfbf351647
SHA512 d5a14fa957d8d6226b2fc1c30404ae20e8686b31a47c6b7fd305399b8cd40eef9de7757a3ef8aadadb0d19efe21d77a253f0fabc2493b044f5ed76febf7f91b5
SSDEEP 12288:NO7XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D65237A934C518AF93609B482EAE12D681B7E669F1044C3B90778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e222547c0f98f03a2947e9552f5519e550b93bcd1641d1be2bd148342b74236a
MD5 eabdf57388a857e5cd5ecb5e04657428
SHA1 217e5b832de25e54ea26e9f14ae13fbca513913d
SHA512 0eaf2f63c319a880d4ef588a59b4e3cb98e5e658aa0eed9aa269ea08c9a7934078a8cda76542300423bc646c9a9b503fc79093b3f159ff7b82c5feb5a23ed1fa
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY9sqjnhMgeiCl7G0nehbGZpbD:Sgb4mBIBhGF2Dmg27RnWGj
TLSH
T14A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 6a347ab32307fb5a7b3ad5d38c32ab7340f272d0383f205b3a9246b666b4fab2
MD5 2fa5e80d4c6d980424cfd4858fa91942
SHA1 16200943739cb06be7191e276bd067ff9cddb34e
SHA512 4f1c00a8df647f4cbc56b8e57dd1bf091908d484bb78f7bec45877af2773580b558bea31a216e174afbe6cc78d49aebd07633afe16b94c5062f1690d6c0fa491
SSDEEP 24576:iG88u8FpJqH1Nzria7/mCsqjnhMgeiCl7G0nehbGZpbD:57ZFPqV0a7/ZDmg27RnWGj
TLSH
T1E095016577E401F1D47BD138CA868667F5B2B8250360EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 abfe86d7cfc7dba1ed4e91076064e07f9d254967dcaf6ae66cf11474bb02ce57
MD5 9d452eb994c72a5ac6c2e39d27787cc5
SHA1 5c5e4217263e2868a311516d6afe1833188c7b3e
SHA512 1b5598311aee7600d99c86d9d9129cd0491f5f3d90186213e7ae1bfb1cc657ef3696c32977c4622bcdfe348f7f1af8bcb53c3eefd9466a6fe883f639492cbfef
SSDEEP 12288:lHvUrBFrEjwaQmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:lPUr+NQmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F85F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dcb3e3d7996373b3021a4cb30b897cfef10acab309129d5a9be4791ba0bfedc7
MD5 78655a6d2643e38dbee9eced78af41ec
SHA1 8d6df47c6aa991ff5e952eeedea0556b5e48d156
SHA512 c1ec9d560ec74b94a03d30685023dd39de3852161bcdd4ec827a8299ddb21392a560e86492fb5340d3af7f30e3965568f0d19420733cf45f83c8cc638c1a800b
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6Dmg27RnWGj:NG05lO43bXD527BWG
TLSH
T184D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a90186c26b365355a486c17104e3c2231ee334ebfb29b2bd7586fa7c466031c
MD5 d403aa7f099a8b0a0929c219714e5ebb
SHA1 662008dff367aa59f6ad8383037a836218c63b4a
SHA512 fba9052d30f849f6c78a6ff8a8e7d7536d458583adccfd4723fb35640a7529b918cc4994b0c0e78bdc3b4b561b5f1289950c1bb20e46b33faf028ffb7e5bc89a
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnEsqjnhMgeiCl7G0nehbGZpbD:Sa5POZ3BJt2pasx2+mCDmg27RnWGj
TLSH
T1FA65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 37a109f4b3adf62d1c6dc2c7141d58057575f2d5d16dcac91126bb1e7adcffc2
MD5 424a7854929f545411250d38a363db8c
SHA1 58bdd1e8f021cbe3f38255900facd55a664e4d58
SHA512 562478b0cb369e1af0a7028f76660edfd269523c16619e2118a68c1187b86da99fdba5e34a11ca6dd0c3e63bff3bfaf85564891968044a4f798547e32a568ab4
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fk6sqjnhMgeiCl7G0nehbGZpbD:VNc/zEOVHF5Dmg27RnWGj
TLSH
T124857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e099d824608742fd07cb4ab49303c7b756a393732f044a5fcd61eb0ffc8b8490
MD5 866930d946b3d844607288993f0300aa
SHA1 99c86e8fa76f6934217438318498e093102777d9
SHA512 45a3fb5f11d25b8d767eb61fd44695648d96cca5fff25bc9c41838e21ad8797b6a795b55befba87c2452c75e6b6c3d69f6f14c5fa8c13c47e30538b7144e9ee4
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmBsqjnhMgeiCl7G0nehbGZpbD:vTMwBtOmVDmg27RnWGj
TLSH
T1CD55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 83a0dc20d8b46b0c4f4c92544c6bfb714dc446dd4425b87977bd2213d51f5e08
MD5 df2af6d1e4f5d6b8627dd106e843c7e1
SHA1 ef488b9c448de258fbbb5cc3fc0788e93be40927
SHA512 ba8b32ab0bf541a248f66c5febd8a566f3aa8ba968faa0171c9b8b636f07646082668f2b39eb49f7fe109df6fef87e90c56dedb80814071c2524784aa40591d7
SSDEEP 24576:MD3FHshBIYQgADsqjnhMgeiCl7G0nehbGZpbDd:MDVHeBIAAHDmg27RnWGjV
TLSH
T17895E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/972-116-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/972-114-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/972-312-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/972-122-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1028-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1028-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1028-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1028-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1028-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1076-85-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1076-309-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1856-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1856-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1856-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1856-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1856-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1856-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1900-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1900-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1900-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1900-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2960-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2960-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2960-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2960-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3064-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3064-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3064-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3064-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3064-328-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3064-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4332-69-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4332-63-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4332-62-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4332-281-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4588-0-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/4588-7-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4588-31-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/4588-9-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4588-1-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4588-28-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4964-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4964-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4964-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4964-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4964-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5384-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5384-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5384-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5384-166-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6028-304-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/6028-81-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6028-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download