cbca08ff042ee7412eb73f4517847f46ea78fa96cc95b750438d30bf62e6d7af

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260731-e1p6mstfpa
SHA256 cbca08ff042ee7412eb73f4517847f46ea78fa96cc95b750438d30bf62e6d7af
MD5 41516209b0ff5c1b024b340b8c552962
SHA1 17db0c05ee3ec333902538b67be7d77bff06250f
SHA512 62812fdf4901627cca2aa4699ad3ddec8d79c66178a2f59b8e1fa4ae08fed96425623e39b6c49d7e422d7d8ea21ab636157535edb41437e706f0cc8c0f4a1a97
SSDEEP 49152:8Ase/gQd+hryfJTzkFiyLOmRpH3RRK2Tc19dUWz80TWq9SASScpfB5X:Q62U99SVN55
TLSH
T1FA267C0BE6B941F5C0BAE1798A579517FAB27819873297DB4790474A0F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4660	elevation_service.exe
1428	elevation_service.exe
4328	maintenanceservice.exe
6204	OSE.EXE
1692	PerceptionSimulationService.exe
4184	perfhost.exe
4904	ReFsDedupSvc.exe
1252	SensorDataService.exe
3356	ssh-agent.exe
6708	AgentService.exe
5728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b75f3926957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078072ccfa420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a223328ea420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fdbc18da420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004780498ea420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007d4e28ca420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe
1428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4524	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4660	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6708	AgentService.exe
Token: SeBackupPrivilege	4904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4904	ReFsDedupSvc.exe
Token: 33	5728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5728	SearchIndexer.exe
Token: SeBackupPrivilege	4904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4904	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4660	elevation_service.exe
Token: SeDebugPrivilege	1428	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5380	4524	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 5728 wrote to memory of 2864	5728	SearchIndexer.exe	103
PID 5728 wrote to memory of 7120	5728	SearchIndexer.exe	104
PID 5728 wrote to memory of 2732	5728	SearchIndexer.exe	105
PID 5728 wrote to memory of 5944	5728	SearchIndexer.exe	106
PID 5728 wrote to memory of 2776	5728	SearchIndexer.exe	108
PID 5728 wrote to memory of 3424	5728	SearchIndexer.exe	109
PID 5728 wrote to memory of 4668	5728	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_41516209b0ff5c1b024b340b8c552962_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4524
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4524" "1448" "1320" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:5380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6204

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4184

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2a648cf1d0821af112c4866c747bfba286bbd57333223a23c05fe2c8221e28bb
MD5 3da5327e6ff5ed5037437fa63b49534f
SHA1 622afd21d07c36bf3be1e04fd529df0a8e3d8492
SHA512 c533022617ee6e23a3af5d221bcd65db9b8ba97b2501fcae5ece667f8a553565baffaa17635c4265be4a76845c6c267bea204e3e6e11c3c47f3476c5f0d38420
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnhq9SASScpfB5X:o3q6sjBr9SVN55
TLSH
T112D58D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 71c7d0c59837c76c1d06ab168747f217dbcb157d747bb481c19aaefee386a4bd
MD5 06d8f85dd7699afa811c280e3e6e24ef
SHA1 ec3df5acf4a254d505c50cb5ffd2704c0815b7a5
SHA512 d001f2735993d7b91e4a8edf6bc0cb5d7a7f823159096e1a87c6545b9e7ffb31a7f0ae211469277ac3e8d55d89f0ee16f9429b768e59cbdb44a33d7f54a46929
SSDEEP 24576:MXYfDtczAWrqUQSAlkSB+pfAOQ+7jXjra:rtcnq9SASScpfB5X
TLSH
T1E365F12867D408F9EC578239CDA28411EA73B89547A0F7DB03E48A650F337D95D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ecd987fea17670b9501de0571ef9bb960f98392874bf2604969bcda7a16db47b
MD5 c3db4d3f944e5c6d64ea1d7a8e215654
SHA1 ad9ccdeaccaafd7d25c298351ca52cd96f6f772f
SHA512 0063e1c8363eb5339941a49dde6a97cc47f5cff4488ce6159fece4f8982771e19c2fce63cf49c974e23ed4cb8059cf56899c99ba60007a0f0a85dafaed767a4e
SSDEEP 24576:+0Le5ji0hmx/rMkrqUQSAlkSB+pfAOQ+7jXjra:+Pji0A9Nq9SASScpfB5X
TLSH
T17A85AE65F6748331D073C0B9C5D2A69AED7130861B308ACB4286D77C6F67BE6893A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 61876625320c772221c551ffa6b0b0df5431a5b6ab4b90397ffa3a6492bed33f
MD5 ef8abf34d403bda5e081753c455e96c4
SHA1 0ba2fa2a53104a2e461077456f3d9759c949e85b
SHA512 cab82dca1915578efcd3a3c37342a5af30a001b9ad9a5fb21c66a38849ea3aad965916bf82fa3bc562bee957f809f58df21f386db919f2c2da472e0b0f6ea63a
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWn6q8wyuOrqUQSAlkSB+pfAOQ+7jXjra:F/ezSC6vUzPveHjyxq9SASScpfB5X
TLSH
T11E756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4173a56efd479cbbd2d6cbfbe5c59d7f448cb6ea78669dc3b0951a7be60295df
MD5 e37c764a806bca9c7d77e965ca5650ec
SHA1 5c6132ee05d3bba0ed67b5a747deee6b5d7abb62
SHA512 f5d4b8d7eefdcdba8b88e6b96f36329071388088ccd570e0b38ec7ddd5e87263106f140287a0a66e4268ad054eb471db958f755a476d4483d09f2a4eb2b7a818
SSDEEP 24576:UVbqPb88hv/l+YLrqUQSAlkSB+pfAOQ+7jXjra:UVO88hXl+8q9SASScpfB5X
TLSH
T1DC559E66F5748331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 85d9d9349e211e52851909e64d583b9991ee2059bdd66a2ae52a4de59f919501
MD5 d9c89769dff67fe1de8e4907a782a874
SHA1 1ce4d15f65cb1d355f2eb1bf94ed00b9c6c0167a
SHA512 70896d74164a172f14a0ef0ae2c03984bbbb10d18a46ca211a9c2de320b704922ffbc758f98a393f2a1255fbf580675b531efc6629d3fb26a1533dee2639852e
SSDEEP 12288:shxeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:shQrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T16B4523E44A5435F1E68706319E4E44E0DA78EED909E27B99CF90EB808E30AD7DC5D633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8055a44a08cd993d2d00ec2b7b15646dd1f758708c6ee887fc5c4aecd648d1b6
MD5 bf2eb95d7963b2898c7c4fe5af8231d2
SHA1 af010f2d9b940aeb7d36e47fb9b3a854435233af
SHA512 5dd9208f06d5d8722f9acb700739b0b1fa4258d9446e4220c3dd86cecf0bf25462bb097e6164d91a051189b8afd665adba95abacb9defdebbe5d3fb63f225603
SSDEEP 12288:weBNUbTVO86UIeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:wJIUzrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14F65CF7BAE28FCE2C27A4D785A918640D77278704F62A3CBD265C30ECE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d9a6fd1af50faa979b9f59b5a43e7615bf293bfe323cd65ea48b153c4b5b2f2c
MD5 1edab7b5d57bdc4275535295537d02d7
SHA1 358bd041fcb452a8a66b92e91649ecf7d77d7223
SHA512 b62f77325a2e528cdf12b999c60605f18c28e3264d706b4d9924d562670fbfac1cb4efbdc2aee4e53eb4e1f4a8fdb610f3d55656718259ee7b78e0e4a9f1ab16
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH9:uQvGAdlCEL8c/DRNw5Cv9SVN55
TLSH
T100266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b490c5dd88ca932b398cf35c0b4eed853a8385d08ca0909f0c43a4c3be7a5ddc
MD5 7f288c17ea8bb6e19d51acb13cd15d98
SHA1 111c90b06e55f18b34750ced8feb1e2b30b1c688
SHA512 5a682da498712b8e0975ae28255415dbaa00bb90b78250a729c22d2bd7f97f0326d4336e3518609d8ed5af1c561b3d33d3b00db07bfb374fa5f726a3d139d613
SSDEEP 12288:4AwSfxL/2Dc3HDLLmt0LDQewsAjSeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7+:d+ewsAjNrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T15E75E071FE74E432C6BB0DB21B26C715547CB9604BA11AC3E3E88E9D49302D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aca557e81ae5b0f4af23b0b3039b576c75195564ad2f16a1c2262bc85d99a7fd
MD5 27437fe53990cc4a67ecdb488bcd8c5d
SHA1 3536ff0b7d90565dbd0124061394a4b85589e318
SHA512 145aa3fbaddb8cc650aefa5bf422707cd61c0dbf6cbd7aa9af94e22c732ebd437474ca7bee1eef99d48f2a1b044fcb3c57432553612972f58669e15712d9ee29
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHXVL5:BUEtQevvqc2W1cpV2tI32j
TLSH
T167474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2731b012b5d56e502104bbe8f4856d963bcab2e028326750e3cb876402128768
MD5 0e55d5cb49f360c73fb1dd5f20830cc6
SHA1 31f6ad0b4a5c42b707ac135ef8ec9dff0fc826bb
SHA512 8057c806bd49138f105011154c341f509ac53d17871d5dc11dd2074eadae2a5e03a6396d7663aa2407d93ab722affbf0b670784eb15965aca95c69382d7ebb93
SSDEEP 49152:6CbRquA/m2yL5zifFiV+XenmE3/zdq9SASScpfB5X:PoqHVjnmD9SVN55
TLSH
T1E2D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16d347d9f931e1f23effd8187f39f9fd9640974bbcc16c5093ca82ac03f425b8
MD5 e0fc0ad452955ce6155e2934bb7a678f
SHA1 66089abd9b91fc3f6e1bd1ece6b7255dd9ef6177
SHA512 b60399401aab3947c39c4d66e2b1cf02b8ca1b796ee5926eb5d894f5464669772600ed0379457db001dd936afa950959b6dcde6314b8d6f205712abf376c9a30
SSDEEP 24576:gAhGL3IFoiwtA5l7S53SrqUQSAlkSB+pfAOQ+7jXjra:gAMUFoiq5oq9SASScpfB5X
TLSH
T1F6359D80E7F955D4F5B3AA789DB68170EA76BCAA5E31D20F2250D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 584b20d0ce675d773f2fc33c4df624f676a0f672482c6bed3cb644c1be1350cd
MD5 29877f4b2df5d89a9d5a077a816f3612
SHA1 e019bb2c435a651584100a20b7962941f05fea70
SHA512 2d5e53110019b5bc5ee1a03a0c9d1f08278f83160ef576905152c2952d16c3136c7e7806c52f88d802d04a7055c94f41bc6a61f79929b472fdcac81d0d64f964
SSDEEP 12288:umw5HEjsChNTBFgl0WDm+CHeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO+:nwuaOWxrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14465F18576A41CF9E9A74239CA57C031E7F2BC022A61DB1F4760C65B5F33362AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a0ceee2473deab2a096757256cd84f38d145e48698c449547b0266820f4f17d9
MD5 2788baa6def74014e973ff0b5c84f500
SHA1 83885277951b0bed95e2061e5b19108cf2aa8cd4
SHA512 f2ff54ed0d4007e726000a67d10510a32e15390a89229183f8786a6fcae590cd76c7296816b33f8e650b9d691b4f90b0b8284fcef8f587f2661d08232c8fb533
SSDEEP 12288:bAZ1IyieDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:UZuMrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1E85512A927A430F5E1930239CDA94580D7B1B8A627B253CF4B6487954F32AD79C3DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b02c108f3a15b450ed3d206770a68818241f288a0884951caadda912492c4ea0
MD5 0fd4143fd5e35a40165be53c53fe6a1b
SHA1 1ceac12abd30ac4456f51fe3ef3b23ec3dd381a5
SHA512 48bd86a16d23aec3471ec3c337e2f64729e3eecf37734cac82c613942c07a7c408396e7249a8e960f5666a6f4d1bcfd5f215716ad2ab404d8481a666012010a6
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:4QRQyi36YOcPbLvw2gAf+PN3O9SVN55
TLSH
T135667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 36bab1d0240b05831c728b5a73bea8a237ce40273c1f531bbfd485663284c89c
MD5 be4ce2abbe65268904c5da2d438d882e
SHA1 6f1750e7a2ec43c135e421e234543af9d1758466
SHA512 0cc704c51c4e45797e2d696bb0e6491c082037063522081e40e21bc514c5d068d38f9a37bf2c5bd371a8ce0b579fae1abb65c7f06eb4cb34aae0565029dcc727
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:zQRQyi36YOcPbLvw2gAf+PN3O9SVN55
TLSH
T121667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e3ba9f01ce7c775dd254dfaedef90d24a6a326aace058da22eab2cc97c18e864
MD5 adf31bfaaa598ba90b87c7a14d1380d7
SHA1 dde228c57dc775cc9f09be38f29fa1bdae0d9521
SHA512 fbfd2bc98678846cf496e90339ead734fc5e92c0871e661981f1fb81f32a97911ff95440e012df382cd1a08c431628059d098b1ccede62927e0203fa382bfd11
SSDEEP 49152:h68Qg55nhceWu7PNU3/Nq9SASScpfB5X:fthLRc/09SVN55
TLSH
T17EB54933B2F600A9C44DE1769F4A872196E17C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 709002885d377454918dff80f55b4e2acdb78785475a08387d1201151f39c798
MD5 63c679cfb74ee4f5d3eb6b0fc74d5853
SHA1 beb4c4c07447aee5347c3de5cafe9a17d02edc53
SHA512 1c9f7c5b1edb153455a7de720581a6634c9696bce4172255f3083367fbb4890db9a1613ce4523ec31f353c5cff9bcb1855557a287f3ce4482fe88187651202a1
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99j:4y5112gYy5azzVvt69nLKnhZp9SVN55
TLSH
T1FB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d51b699c0461501b2ac22b34f0b04d16eee11301b2ced05068b0e114593beec6
MD5 4d0e89e25a8361f774e424fdeb90ce32
SHA1 307cd383a92c923d34de16d1a6f6efd69598ff47
SHA512 636866531366f1e4a65b6e058e1381445746678faf6bbef013a6397b5de547e411508bf30713e45fae00fd48ca85aa6deef487788d6b6124eae3d7eb1bb56c9e
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8q9SASScpfB5X:mu6Jmdxd2dH9SVN55
TLSH
T1CCD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 adeffe72138688342a40dd1ca9c7f0d01377b03cc498f9ea0231e22726a3d854
MD5 f48e51da32efc9c54e08c8fe975bc9fa
SHA1 2aac82f9fac3e5e66d19f65801d2eb3b08eee6c1
SHA512 5e94585543d8bd484c329a9d94f2172b4366a02b17b65b6e13be38a7c561bbd1114399e228dd49e2a799ac83512dc085a7277484d68fdb429183b54feb8078aa
SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4xnq9SASScpfB5X:NmifPWRD9SVN55
TLSH
T1C4B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b1a87b0c181f6135f3b6cc1fea8b2614a48ccb0791ace5412e60c7087965c6e8
MD5 ffd72b8eaeb0e6ee283d69e1c0302b75
SHA1 2279941e4f81027d111c083be4632ce2368d8f57
SHA512 2bc2009fdfb9a6b8d560ef8bffdd880a436a1fb32f8c7d5eb656265db1c4346d212654289104f404b6fffdfda3d40424610abd4bf3e94dc2a6cf62153d455121
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHqOq9SASScpfB5X:i5dKii61V9SVN55
TLSH
T127C5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4cf729d169b47c2cc8d3509d0c010b06768e582d85e194bfbb43402e5deca766
MD5 0ae3df894e31c9d966d2f8dde523bb2e
SHA1 c5fe605d4cad504c682f3621b1cc846201d96fc4
SHA512 dda3c9c4b467a85104f0f2631ad915a60604e72f360b1216a9f69c9f9ff5542b1e7fdeb0a849691f4cb231cb7fec7b9555b1d96d0f1bcc420aa6bef9d9f45681
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wDq9SASScpfB5X:UX2imph39SVN55
TLSH
T14A95BE13F2D900E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e34bb0918ba9da209bb44706c1b3c3d4ff99dd6cf420c49d908aa81829726526
MD5 9746a9e817ad58026ca26969bbe1266a
SHA1 e22fb6b8390abb2bb71d14f4c0b81a4908781b51
SHA512 ff79405f3c36fbe6ae3c94e92c1ca70fafffe70ea1d80f1ec777d79a6dd18053de3ad90b3396abd9f16e565b3f91205a4382cd50ffbeb0fc0921c14e1dbd4290
SSDEEP 12288:r5eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:r4rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1094523E4495525E1D4430671CE0E44D0D9BCAEDB2AE337AADF89D6408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 45ddb07f8760a0c14505a8228ffedde6f2da14474a6a08747ed84e0821346195
MD5 f79c93b57ade9a048213c01f79a0450b
SHA1 8071687b13b371fd3fe646eb44ac6757f82b6e34
SHA512 5624e875164df097292f06b873f07481bcb8df7545e2cc6c0f939d6c94eee9b7121e751391b320f0ae7f745e4bd3c8ceef786c19c2d2a56bf7e67fd7ad70944a
SSDEEP 12288:7GeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:7prqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1DF4523E4495525E1D5470231DE0A44E0D97CAEDB2AE337EE9F84DA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2eaa0543cfad4d39253db3642faff7bce57269bf856271b031c1a4228bb47019
MD5 5e105fa6b0c90f89f0b6b4df449b5d66
SHA1 83cee847a4880e9cdfe94b968f708e331d9f325f
SHA512 2e32289af19f41366d3d7bafc5f1b54b1572da66081885ff0e440577a9f834b76480f0d5108c3bd34a33de2dc080cbe15fc1275f247d524557adeceb2c35fdde
SSDEEP 12288:ZQeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:ZbrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1DD4523E4495525E1D4460671DE0A00E0D97CAEDB2AE337EEDF85DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a2f25bb1eb70448e13b15215fb1c3f9113b6294f916c19712e499add60c2f20f
MD5 8a436e177dcb128c53189f56d95dde7d
SHA1 7d47c8f78f5844f0361a3c03ee3a75168ddffcfb
SHA512 99c8aa8c4538cc5a0524dab59a02e66566568667c73780236423265bf3e5844c52249c699d2aef2984ca5cc8a64c06d458b3f20399d1e180599e7f423c075879
SSDEEP 12288:jVzeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:krqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1334523E51B6925E1D4834235CE1A44D0D6B8BDDA5BB267EF8B404A854F30BD6AC2CF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 23ea84b8dffb67d1fbaf7109c93cd113753c37ea809cda6e4c678aeae84bce1d
MD5 a7930d975e6cc17d16f5db3cf06ddd22
SHA1 a53ea62f726ee222eab6ac7db3c147463d5fc773
SHA512 a0095f3ce275ce63ed66c2ff5735615cad04b02a9fa2bad90db4f1c181026c3c843538c923af515318591e12c6217e517154743a4efc26d5b33e72ed5cd87878
SSDEEP 12288:BLeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:BKrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T17A4523E4495525E1D4460631DE0A04E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 04bf4d55283cb53b47dcf08d1a5ad4094c338d46fe9822ddfa4b58dcbb0cc122
MD5 8253c21d9e55ea86e6269344cec7008f
SHA1 9c4932ef2d7f92dbbf9bf89ceb9da4eb4003084a
SHA512 f2b23f26ffd815b0ac2896f5eb7cddabd05ee6c55f20ab2a7282193731cb01f0b00c293674f3c397298dafa6e188946ace216048a160e898a1d22bce76b70aaa
SSDEEP 12288:GaeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:GVrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1004523E4495925E1D5470231DE0A40E0D97CAEDB2AE337AE9F85DA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 403740cc9503f2997ab0bd10410df9dc5b4a1e8b90273640020f66f8cc22f9bb
MD5 78fcd0c6b04b82a36b4cca3385419c04
SHA1 9d3091719e0854c4ec49673d49b57c8918498dee
SHA512 8f1754048bb3eb0ff8f019d8e5287cafe192b2c810cef0636ec4d60118d71cee2987c3d6e98b464644d58c555fbe65eb4cc054767bf10251d84e9546ca9a0d92
SSDEEP 12288:X+eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:XBrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1A64523E4495529E1D5470271DE0944E0C97CAEDB2AE337AEDF85CA808F30A9B9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 dd281fbfc350e2789494618914d05fa3a918ad2faa036da34a46b032c635b4dc
MD5 098211e92bd783a20de86642b3ec8630
SHA1 bdca6de9abe45c242d921f544530395bd6a2a391
SHA512 e850eb26bd934510006e7444765e936a6f2d7f77d5d4a215f453c3509a89263478e85bdaac499e83bc9118e0d3e9ff5b7279390f9180514e9ca2c454f3db76fe
SSDEEP 24576:PZM3zFVSOJrqUQSAlkSB+pfAOQ+7jXjra:PZM3zf1q9SASScpfB5X
TLSH
T17D6501A4B39018F4EC67823ECD158855D6B2BC5A0BB0C65F07E436664F337A25C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 230a6643125e6717e0a0790e140be272dba1d21bc1ead19ba2b8175f1ace128a
MD5 da248b1ead41a8af51c57a8f866279ce
SHA1 d740ee0c7654af054b5e5bde89af896ecbc806ad
SHA512 b31733d5492409f0a701be95f57f3d69e154b83ee2257243492bd995248504278778a0f2450979975bb8ecac8b402267fcae70a8998c89ebb81d8870cec23dcf
SSDEEP 12288:0leDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:08rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1964523E4495525E1D5460631DE0A44E0C97CAEDB2AE337EADF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0285a961abff3e3dae8864c668e59075412bfe3ff51a10ac1612c747ad873fb4
MD5 5133155daf27e091fd04d4f94db25c7f
SHA1 aea13436035dcde1d84558527c5f62b73f590c99
SHA512 591b01ad38b5b42d39ecdce432d8fc56ddcd72fe74b868ff3d986392009f75c5ba33f4a54de8b397e37b8b44209274a5822b6bbb0da1348593c94d5a0f653ccf
SSDEEP 12288:jBeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:jArqUQSAlkSB+pfAOQ+7jXjra
TLSH
T18C4523E4595525E1D5470271DE0A44E0C97CAEDB2AE337EADF89CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c490bb418c0fdf43f3da36c6da1bb57cb716814a09216fc9e28a97ac89bca9fe
MD5 740f87579573ed89a00e3335352a2913
SHA1 164cb142032f48342ed61a497e4493abdc1bc803
SHA512 9bcc5ee907335bd9ff2d6d29b43c20153134447000b97617b425461272729d8377d2d7fe79d5432660ca7c14641afd99c37fa4954610bfc6e8a36168761c75ed
SSDEEP 12288:nyPz5L8ieDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:Kzy9rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T12C55019763A130F9D0678234CD560980F7B5B8760B619BAF57A447B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a3aa8cc2ccdeebe85468ac904e0cc10eb0bfbe070009e7c4d49ce5693244b35a
MD5 fb3c8a2033f1a90b9d4843342a75e310
SHA1 38a6abb4a3814179fecbdd3c3c2021754ae24383
SHA512 fb00687cc197194ff52cc6fb109b1ae43e7aad2c0d3fdd02886f0450412bef9a0f010c4aa1001a5dd10abfc68bfd5f8f14b35935fa559ab39027eb179741d67a
SSDEEP 12288:6leDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:68rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11C4523E4495525E1D5460631DE0E44E0C97CAEDB2AE337DADF89CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 29201b8c6c13111753bf8f187ee27939a0acf93f6700d242de7e5d8a478a970a
MD5 1aa5fdc0e1f5be25b51995c03d9af20f
SHA1 871205f8cbe82ea83cd20aca3d6bd4f82e3c699d
SHA512 ce5627c9f4769fde5c20b293726afeafa29ba3f25c16113d7391ef1a80d4945cb233f0674ccdd713dd0d9b21e612bf5e4c46daa696eaba7143cd2b5dd9acaedd
SSDEEP 12288:tleDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:t8rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1084523E4495525E1D5460231DE0E44E0C97CAEDB2AE337EADF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 38adde89e57876a42c07c0dda559685d5c06fae992169d846b7a3dcc4f02fd5b
MD5 bb672ddbae5ea8004f3fb73c38d0f3cf
SHA1 9e2be3687013527db8bd4a73ea274bbc27328b50
SHA512 75df1aedd7b006b41bdaee244a60164458b6767e579cda2fea7ef71edc74688df52d10124852c66528996fb1c59333160a169040107cd3eb1f1c1f1102a58219
SSDEEP 12288:6yPz5L8ieDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:nzy9rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1A555019763A130F9D0678234CD560980F7B5B8760B619BAF57A447B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8355e95dd444050a6e875b056e7d3e26e6187935f4fa5b09043080ff4fceb080
MD5 c2fbb6003cc1cc489679c99d6eabf662
SHA1 e6233952d9e1ea00d5428dad0a268248236f6938
SHA512 7a845b2b891060e471525b196ae32f97901f9b10d315056c4fe4af02d2e50438aaabdf5f167688d3c98f999fb4f8b97a4504f4fb6952e900d3623032a1cbb7b2
SSDEEP 24576:ITNaLl3z0zDrrqUQSAlkSB+pfAOQ+7jXjra:ITALljkq9SASScpfB5X
TLSH
T18E6501A4B35018F8EC67823ECD168955D6B2BC5A0BB0C65F07E436664F333A15C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f8d3301e4ae72fe8906aedd6b3111283f69ed1fc3c6940a8b2f9d44c64231d8e
MD5 9e35a6918d797e73222bcdfc1d4a1adc
SHA1 2bbc1c772b3f1a31c84e41a8289970e722ebfe93
SHA512 61083869344af16582383e9df31c682bfeb03cebf5e0d490c4b1d44d8421436400375075e84ee8d42da62644edae7b48877bff4ba65a9e901d83cf48844e7537
SSDEEP 24576:K3Fd9CHKy7GZnrqUQSAlkSB+pfAOQ+7jXjra:sFd9CHKya1q9SASScpfB5X
TLSH
T1A875CE90F3E414E8F0B78A358D664511DAB67C9A1B71DA8F03A4665A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 63f37b7f2cd7fb19d3d60cb619bc67980553838372ac4454ec72f411810b72d7
MD5 cd09aecf2c7d38ba3aa26fc885618a2c
SHA1 becee5d3953c12c4eb3668cd730fd793948d1f28
SHA512 ad851560fd0c20eff805dbff911cabb8e8a96364287eb1db0623aa5faffaad6461764e0af246c954c6fe8d32d72554617076759f30a84f94a99df82d4eba240a
SSDEEP 12288:aweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:a7rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1D44523E4495525E1D5460631DE0E00E0D97CAEDB2AE337AEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b4f818e152c7669638e6c8bba545fc4f5bb39d5e69c08b0248dc391675e0458d
MD5 f09f39c6b937806a5618ab32dae9afbe
SHA1 b4357b1c50ad64f89cc4dd69adf4ea423c977cc6
SHA512 8bfa5a9bd51d019824f16a099150c6b055bef68d11110939493223ba51061413511c99c7b7bcb49a75b016396654db5d70fbe0303f4254b004b9fd3b2f7318f2
SSDEEP 12288:4CeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:4drqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1F04523E4495525F1E4470271DE0E44D0DA7CAEDB2AE337AADF859A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 24bb178b8f1a3d3a05e6a6f52be82158409b47caed096bb98ca77eaada2321c2
MD5 46d231fe9b657f6474e56c5982155caf
SHA1 116737e8c35d7384e4fceb79e2f405757ad59d97
SHA512 6c57688813c46d428d3374feae0a48d05a096fbd023e002fbf828d448ea975d5463f7299ef71aa6c37ebb9f1b6990555fa63d407f2829fa5f07db13297aff9fb
SSDEEP 12288:P/eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:PmrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T12C4523E4495525E1D5460631DE0E04E0C9BCAEDB2AE337DADF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2c34a6e4f6db23b45d55a016e7ca2f886f958ec94b052d480f20a7a6168f977a
MD5 b4adb7226de8ed0ce61ec2dae73b9b37
SHA1 c2ac0364d615083bebb6241a6ebd591a5506fb6b
SHA512 baaa150d5af1a4b70aafd9a6db68273feafeb838adc36e9c070246f6c58de1c2cf6a8a29d8d97df45c73d964e7c0bdf45abd7f396f085e72f40ce64c9145cf80
SSDEEP 12288:TleDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:T8rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1174523E4595525E1D5460631DE0E04E0C9BCAEDB2AE337DADF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4b76c5250c2be1f2290ee2f56bc87f3a8d03910cf46f62c7b541fb2ec67bdae0
MD5 700db9c2aeedbedeccc14f4668669698
SHA1 5bcd5f9cfb5b0cdd20b48203bab3a213c372ca84
SHA512 dddde72393db01db600f62e1a2be84f250a043dae46ec760a4f7e3b58cbc8ae523b08324cb3703d7dcedef52f64cbe7b68e8fbc40fdb02e40710b4005d8f20f9
SSDEEP 12288:hweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:h7rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1244523E4495525E1D4460631DE0A04E0D9BCAEDB2AE337EEDF89D6408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 506e3d9a825b3d3309638fed9d132285442a0a40ea5e8b7e52e79b5a21259e36
MD5 4a75877c6b8b25fe8be91a99217d5216
SHA1 05cfd7d246e83360980153d96337a668a5aa387c
SHA512 67a2e9df732d6b7d222d7312277921a96083f33178351ae22dc94f8282336a28cbadb012c2f5cff7e6088624e60a31663fbb8ae8d0586b6086a43491e1111591
SSDEEP 12288:v9eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:v0rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B34523E4495525E1D5460671DE0A44E0C9BCAEDB2AE337EEDF85CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-31_042447_4524-1204.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-31_042447_4524-1204.log
Size 1KB
SHA256 402306222883b407079cb6253e79bf574473380a57481c3aaf3412f4ac86949e
MD5 00ec8f9388097d55f6176c1f30a9cf63
SHA1 f58a4387606cb010ef5f714e953f035ca88b3156
SHA512 347af96dc4860e3e7dd3454183dc972220f66fe21592ca702f005fd40ffd95651dff9c4880e0af9e470908281108dd08028bbbed9aae771934d1c2d3a6d7be01
TLSH
T14421722A7BE50E0AFFF79A81A8F615435E3639926830CA0D40A4434E0872F41EDB0727
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ad99fd472b22640c8e4e86a8419ac1797cf4acea1adeb54008ba9b40ac916d0d
MD5 965f29dd6019cbb1b71287c0ef320465
SHA1 2574901efaf7c0bc4db7e698172159a0ace2f9b1
SHA512 bacfb3ae17cc71a323bc9bcb85d09e4ee20ea80f241c7a241cb49ff62ec0e902342384c87709b00d3a234af4a487df60d7c97814b04870c12522f4e5ebd46f50
SSDEEP 24576:qfwvKk9RX6wkyAIwrqUQSAlkSB+pfAOQ+7jXjra:kMnYIyq9SASScpfB5X
TLSH
T17585DF29EBDC04E1E1B7923C8DA7464AF6B178691B31C6CF029A53AD0E33ED45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 083fc05a8b2fbf147279969be08c91738f30f22b6c8a4f461c4c6b0503ad6b97
MD5 d1542eede47a8674bc30b8b51a42dcb1
SHA1 8b3758c98592da5b338fc4d53402569dcb5c464b
SHA512 41f8903ffc596f54fef980980aecba96f97f2275e5a27396016af3e0a85a5f1d0165856973f690bafc93544cbae7f3c51034c00f62162620e7e76314d9e2c112
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jq9SASScpfB5X:+ySzPu9SVN55
TLSH
T121066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b37e2698522834300b5a7913419f5886d7bdb46e3428a0cd7b9432d3227a32fd
MD5 a048321d9a17d5b7daac7562215713f1
SHA1 756f2bba38456450bf2ff261f5481547ea4d4e1e
SHA512 1e8ceab7a99b235083fc15ebe72c7e61dcd5bfe887cad3c1cf94c750fbd9aa63dd799d2a3a386f087d3d68164cca9c301cbaf729791c1b1f7a7f8453147a29d8
SSDEEP 24576:K47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY5rqUQSAlkSB+pfAOQ+7jXjra:K47JUQjTirIhCnDHUPfF/Tq9SASScpfX
TLSH
T1C465AE1DA3EC01E5E1BA827889154A5AEA71742E1F31DACF1270837D5F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 697ed8dfe46bfa71f1e3dfd7dd54a0fe618d5a14866cb2b37569628919f4a947
MD5 5fa76a35fea714f9e4b665306ee2a546
SHA1 ecf089c34c9ced0ed469848a089ccd4b62224e7c
SHA512 9c87496d1c6ba5d159745ca9abf02d06ba4ccc24d3a2a15407b0d6d6019c9d06b6898c77755d7baf0044e049e663c659ad126e2390e0e57d3de70edea1bb8200
SSDEEP 12288:4ZsfVeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:lMrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T15655F059D29812E8C05E5235CB464A80F7377C6647E2A3CB57C0F67E0F356919CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 93fdf8c68aa02228bd41e9c1551d5075b57bc737b2ab920860fc1ce3aadde0ad
MD5 8cc72b250725f7283a5145249ca77add
SHA1 c9d6488e7baafc0cb7a2695378243fdee2795a13
SHA512 9e603b3df30d25c7f3d65c340eb604fc3d7c85934a7395f7431f3ce5e936a988ec721cc23a06250e732bd99a40df9564cb3ae9c2e3c89533634f634a73921c54
SSDEEP 12288:yKnBFhU3fulH77SyrYtvqy4j/bV2Nnj5lPX0xLLJXpDTJ6ycF:yKnXhUPQ3TUUyaz4NdkxLLJXpDTcF
TLSH
T124452851766AC74FC6A940325E32D1CCAB707C11EE056F0773C89B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 778d3c96410e5b62ef5c244c7db5ee64cdef9b873f3fa051a655e067802d4a36
MD5 87437bc9fdb0a1a3f236d0a276a8e256
SHA1 ca34451aa00f9db26063c72af7181d972611333f
SHA512 e26d58cf57ce545b5469432c719777e4a946d015895a18ebb22175a07c958558acb7460995e329ffaa1578563d733f555b14cefa4ce82dd0e9b1b85d208f29e7
SSDEEP 12288:qo+pChLH8RVwpauqN7AwvMRqBDczFaaMjl:qo+pChLNqzkwjl
TLSH
T1AC65F8815537E3CFD1FB6032072A5B4CB764EC06B7096F267388453AD86AA25A4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 82eb64bf653ff06d0960592c524f6873c0e17611fb18c19d34b4ab7939264db3
MD5 f7b0d6c99ee7723e084b838a8a32ab00
SHA1 e4bb7f2925e8d663aef682f8f3e84e9a7158c738
SHA512 157a8eaf608b105ce34724b8435c0323e09736ca9368c1c09ab8fb240b115236b7d0d1f3cd2b763f9d50cea71b52739e3750c01dfe1e64fa090338ffbc5a21d6
SSDEEP 12288:sp7teDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:oErqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1A54523E5475829E1E49606309E0E40A0DA7DFEAA0F9166DBDB4497808E30ED7DC7DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 34d563f4baa4e0f730637bfe8ca7aa1904afa280e9ec1df2796e93f07899dbc1
MD5 8418f7cd2badf45f3698e7f3a7db61ca
SHA1 c522bcbd13fff9d7d7a6b504ff9a0d83c02c5236
SHA512 8a12bd03bb3f414104c2ea03040c69ac27acba6beb7f195311bbd3e79d937277a80af0a26f2a8f3a693ae2b9697a1c0db845757d96fc3d11c6cc3b4bd9ad2e90
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYOrqUQSAlkSB+pfAOQ+7jXjra:Vgb4mBIBhGFZq9SASScpfB5X
TLSH
T1B665AF1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4c1db82fb3cdb990d43e86c0ac3d16c19b89465b0c7df62091185c1e2b5ef0dc
MD5 0fbf3aa18778476d06e6ebda82093777
SHA1 dacb892c5b48a2dfbb8c458769c52edb359653fc
SHA512 042273bdfbcb4a345c066f20f28f80890d5531be6756fe9c5d828f70cbd8af00a26f3b6c92ac1047e2125c026b9723b374b87dbb47e87272fb587c28e55f0034
SSDEEP 24576:bG88u8FpJqH1pzria7/mJrqUQSAlkSB+pfAOQ+7jXjra:67ZFPqVga7/8q9SASScpfB5X
TLSH
T16485F16566E101F1D47BD1388E4646A3F6B1B8250364FBDF0BA88B510F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 09f24089f530cd206d00d3a1bb3aaa88777294ab851f4589abf02a813b204ecd
MD5 800ce02e32adf4e218a930d63312e384
SHA1 06df9100ba9b84c8680e26149d6cadc9280a1b27
SHA512 898315c12373d5cbdd49633f54f69c64bff4cea4e3819d895fb46c5c3fc8b545a21fef7a86476ac9ad0f877f63bddd33f9fd78bf08aaf60e7276914e923eef9b
SSDEEP 12288:4HvUrBFrEjwaQqeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:4PUr+NQFrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T19B65F26F26AC18E5E676A17D89464659F771B8620712A2CF03D0817E4F33ED8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 83d1838219429b03970678760e0708f22feff172ffc114655380fa195fe38a79
MD5 a195fb32213bfbef3d9051a1f23f20b3
SHA1 67b327f9658b364d5cb7efe8ed2a09f99768c73c
SHA512 b23b6a1b4048d4f02fc2402f0b6c05d5fbe80d4c467771f31867ae438f92832e2c40c3ee0505c0988d793fbf33e76fbadbe6ce176fc514749b8e7ab1e9965ca1
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFq9SASScpfB5X:yG05lO43bR9SVN55
TLSH
T154D5CF6A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f8a22b23115ae59c55f0a9a26d4a5a7d3eb51cc643a97a6275959f8c76ee7506
MD5 ddc38824135688ae44529a3b04e1ae84
SHA1 721c01fc051257996e3192bb9a14d9c76ed0cf6c
SHA512 9f49cc602e0990dcf337776eec2cca24fc810efca7bf0cd585e9ccea5961373109f1005be5a6cb6733ebcb2ad96bd5eb30225f8a8b272fbc70280a922d031ded
SSDEEP 24576:Zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/rqUQSAlkSB+pfAOQ+7jXjra:Ja5POZ3BJt2pasx2+mNq9SASScpfB5X
TLSH
T1D065BF5EA6FC01D5D5B9D17DC583861AE5B1342613329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 793ac27d2a1fc389d1913caa73a8fe6edfb2982fe66acd86a7e24dbeebb10813
MD5 75869e0765e72e5a785886b13ba1d881
SHA1 d01961b00aab90a72fc093a1d385887a8bd57626
SHA512 86bc55bf218233aa27e3b0c344f4ba4d8ce0bdb69c647358b75d0c617cde30b8451dc2928b59aaf086b86616d596fe006100dff124ac155a8fc97dfca620adea
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkRrqUQSAlkSB+pfAOQ+7jXjra:2Nc/zEOVHFcq9SASScpfB5X
TLSH
T185858C6623E901E4F1BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 549e48c5064d86e3bf57511af7f99423bc686413f3bad24d7faca538512b8b34
MD5 639832c68988b0b9908b3990506edbd6
SHA1 3c7b353b41b5fe0c253fee6c76f1f6fe855cf63e
SHA512 86a6c29cff6091ba821982a605b7c37291b436b4c8322412f242b1e16d75892b2d5fc0a9c7e8727009eca8f4ff14b5029f1647ed33736969b2b45911749dd753
SSDEEP 24576:KTkNvNnaFeYhJNtmZBmCrqUQSAlkSB+pfAOQ+7jXjra:KTMwBtOmIq9SASScpfB5X
TLSH
T18E55AF6EBAB806E4D1FEC6B5CD238512EA727461073293CB5390C13E4E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d3fa274e7acc4d97ffa7f1914015b3a30c52768ada2d55df6c3b638836ef3ab2
MD5 d255ccac57a091bae955f3e959d97149
SHA1 559a4bcffe605556ef86eb986d5ef09deb011b72
SHA512 62fc496d19fcee6fb5262ce6645b3249c6b95486da6a5f89db3626a53ea6f8338aab8980307eb7070c2832baffd289e562456ac7de9cf44a00d741f3c13393c1
SSDEEP 24576:HD3FHshBIYQgAYrqUQSAlkSB+pfAOQ+7jXjra:HDVHeBIAAaq9SASScpfB5X
TLSH
T17775E07DEA9C04E4E47BC2BCDA538906E77138A9032266DB06D481B55F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1252-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1252-323-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1252-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1252-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1252-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1428-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1428-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1428-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1428-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1428-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1692-317-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/1692-75-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/1692-83-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1692-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3356-130-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3356-321-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/3356-123-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4184-93-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4184-318-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4184-88-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4184-87-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4328-49-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4328-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4328-61-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4328-55-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4328-48-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4524-8-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4524-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4524-0-0x0000000140000000-0x0000000140470000-memory.dmp

Download

memory/4524-44-0x0000000140000000-0x0000000140470000-memory.dmp

Download

memory/4524-41-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4524-7-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4660-15-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4660-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4660-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4660-23-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4904-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4904-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4904-337-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4904-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4904-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5728-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5728-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5728-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5728-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6204-71-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6204-64-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6204-63-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/6204-302-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/6708-144-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6708-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6708-142-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6708-136-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6708-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download