69e501f8e101577b261e844e35211c301b0f56334f33313e6a9ac21d73c63d5f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260802-dk447assbv
SHA256 69e501f8e101577b261e844e35211c301b0f56334f33313e6a9ac21d73c63d5f
MD5 65ef4b8c69bc3688d0a502ef811e8fae
SHA1 e67047d8e6bb0312b92695399aa2022fe833344d
SHA512 2a548e0da35dbf181446fa4e95793306d94954f0d134fbafcab138d695a21479144df1f9c5c500f2fa9dad5c1ac46e4a258968b15d52e166f73912dcbcf6e4a5
SSDEEP 49152:B2lWq/pQd+MhtHMbjO/IOFBFileoU7ZtxSHLQcN5tUttkaT9YQ/lFTjN4:BqjHLBwLm
TLSH
T1AC267B4BE6B940F5C0B6D1798A579617FAB27819873297CB4790831A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2052	elevation_service.exe
7020	elevation_service.exe
1600	maintenanceservice.exe
4204	OSE.EXE
4748	PerceptionSimulationService.exe
2644	perfhost.exe
1216	ReFsDedupSvc.exe
4212	SensorDataService.exe
3140	ssh-agent.exe
6684	AgentService.exe
6220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec88d66b957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6f2debe2b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9ba01bf2b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccdf3bbf2b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000009a89abf2b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be5c19bf2b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059472ec02b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072023a012c22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da75e3be2b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
2052	elevation_service.exe
7020	elevation_service.exe
7020	elevation_service.exe
7020	elevation_service.exe
7020	elevation_service.exe
7020	elevation_service.exe
7020	elevation_service.exe
7020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5780	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2052	elevation_service.exe
Token: SeBackupPrivilege	1216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1216	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6684	AgentService.exe
Token: 33	6220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6220	SearchIndexer.exe
Token: SeDebugPrivilege	2052	elevation_service.exe
Token: SeDebugPrivilege	7020	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 6100	5780	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 6220 wrote to memory of 2604	6220	SearchIndexer.exe	102
PID 6220 wrote to memory of 7108	6220	SearchIndexer.exe	103
PID 6220 wrote to memory of 3948	6220	SearchIndexer.exe	104
PID 6220 wrote to memory of 2640	6220	SearchIndexer.exe	105
PID 6220 wrote to memory of 3808	6220	SearchIndexer.exe	109
PID 6220 wrote to memory of 3880	6220	SearchIndexer.exe	110
PID 6220 wrote to memory of 1948	6220	SearchIndexer.exe	111

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_65ef4b8c69bc3688d0a502ef811e8fae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5780
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5780" "1460" "1320" "1472" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:6100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1600

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c3c842fe8d9d8cb1df009b5ae488f672c37f30466d2ae6c8392814b092dff9a4
MD5 7689e2bfb47efe3037e17896deeb3034
SHA1 9475536bbde74bf5351d54666a2dc5902b8eb18b
SHA512 e297c565ed847fc4b75753fdbc48579ccd58af658dd923d7c754c1d5fcc61dfb2417590fc3b68d8c0dc431d66f2f3dee05e6be6bb452f8c6065666e13a7e603f
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFQ/lFTjN4:f3q6HjBpLm
TLSH
T1F0D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4423f94abbbb53b6a89408032c3aed4dacafc27ce4d9c05f5ce9be3657de5572
MD5 95a71040762ee127716158faa8337062
SHA1 a598e3086f6db53d21d637a311263220d66a3b43
SHA512 46fff50d62c23422e8a8442e1b5d24b3b35156ae679ca7745f99af3111a1b97998bed013aec5b0d98300ebdbb27ea09f8721babc5f1fa95c69a40f02534e4899
SSDEEP 12288:m1XLsswWkxy2lRq2czA6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:EXYfDtczA6nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T17965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 490e4c7c42f823f7ec78cd06611b06ab6b5c3e5a4ecd3b16d1b6c7afc641af5d
MD5 d17338412028292626966ac5e411c11c
SHA1 82937c91715f660bc0aa437dbed5738a0f644a84
SHA512 355c75e6aea008e4e4bb2f64f732c2c8846fca80db65972d5fad328acfab52a879d7dc7f1665db663b6e1496249dc99784c54dc2f83f590d8750d27c950f8921
SSDEEP 24576:10Le5ji0hmxLrM1nQ/tbw/2Mkjy6Fr7g0ob:1Pji0Al8Q/lFTjN4
TLSH
T193859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7b45689a42b0b2cc733541f1c010ff3001ea833d32d7bf066b3605adf9d8bd60
MD5 9eb7510904239e7068fb6d6998f418b7
SHA1 4b94f2f5bd13b73b0152963d9e73330d76873bf2
SHA512 d763128d512c3af8b67145e806df9777beb51477cc7d8865d4f0f6a9d05816c939617991e1b9a4bcf57cb101ee1a7424038e11db07e7fae74d4df8ced862afb8
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuTnQ/tbw/2Mkjy6Fr7g0oR:R/ezSC6vUzPvxHjyIQ/lFTjN4
TLSH
T1DD755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 730d0939c3fa782b4ba2a079b601465655a5589e7aa6ab3fc44b4d0478c8ea1c
MD5 f7662d40aaf1e68377b433fef8d1a35d
SHA1 00a6b776056dbddf3d778b596bfb1226be6601f9
SHA512 61228da767cd5495c270d82c368470e51e818e600bbb55a5cda634d0eac22689f8d2179d2cbc95dfd5c8d74932e31953f8f84e7aed3916e733665bcfe74ae9b6
SSDEEP 24576:OVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0oe:OVO88hXl+RQ/lFTjN4
TLSH
T149559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e008440dec2baa4f2337cbfb4f627b13f9dbe232f22df99c335c3344c7b41e83
MD5 e85b87454fb92732bc0a7f947e5e1301
SHA1 5457c1679c8d0866361ca77b5af816e78413daad
SHA512 a81f1d38739b01c20a73c2a159bd5715e3199f02de8caeacb37629aadd74acc3101aba09991831277c3c55d169631f3f84800181dc646a88ffbf871e24bc4d42
SSDEEP 12288:Wz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:WzJnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1405523796A24F897FF2B06B15C8284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b477f33a69351ae52adb4148a4fa64f98e0d9f436d5e4202d952bbf9188156eb
MD5 7ceabd1d5753b05049d7aea02675cce7
SHA1 cf42966b6ebc08238d7c71d13d0fb75c5c240412
SHA512 543239d6e85f337449124f6bdefac39ccb2fe60843101270b59266f2392d308d1edeab6f68dfe3afe2cec5a92a5eb7d95b9ccbcec047b77b2a03ad39ce3e8aea
SSDEEP 12288:FeBNUbTVO86U2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:FJIUWnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T12075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3684406a023fd77e14d04b3e9fb45602993d42903d483d517a55555cb8a33aaf
MD5 fe2f56e188cc1a95bf1b67aa5bf46872
SHA1 c3b7be00a2be84585ad00e18e9a16f54615e0f87
SHA512 bf78d149e36e25aee0a05f7b66c6039b262454ff6bc0592c836af4c971fbf062c6e68559d44b14942cf7b1d44afa28cdec8fa9e1c88874c6d0d6d578169a9d3e
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:VQvGAdlCEL8c/yRNw5CILm
TLSH
T1E4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4b8a9573a1d2a7eb2621d2a56e6c426656e6ceb98cbf4329292735a0d1b74b65
MD5 07d7d366a23f7cdd348e84a6c1a235ff
SHA1 4ceda70a4a015730fcf7f85453859de0ef42340c
SHA512 502a4e25c6f363437ffa05e8d685fa7d5f12d84c48badaf2ac39ab1bb66752730c6612ee85622d2d28d32075a00f2adc4a6ba526aae1ace0cd5718e91a680ff9
SSDEEP 12288:/AwSfxL/2Dc39DLLmt0LDQewsAjMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgW:IQewsAjMnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1EE75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8fe19962d75c4d7e54fd1a157f9627d016478d2c0371d995948bc7e330e2f842
MD5 8d94aa82b7d0ffbee45e94c1dc913ba1
SHA1 fd5af3b5a00b4870a21a71aa0953ea3232c9fcd3
SHA512 0698162f5701de4d0ee6528cd6fe11c62eac51bb1ce248ad6c0a303261b0db17f975877c51fdd03ab9f840405dc0ed57b7edb0f71d5ca97bd9088d643d91c429
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXL:dUEtQevvqc2W1cpV2EI32
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 30ed32466e6a5d3ea908b27e75d23118124341ee8a05b7db40a56096ad474078
MD5 7b1155cb02d0564fbbf7e78fb7466a89
SHA1 c0dfbee1b61a89605eae2636e8837b5e28757af9
SHA512 9780487b4a02d813cba8ec861db10cb426677f134f9e375a371f609e53126452393a50a60b718870bcdc9ec17799568b719406dc52bf6fc78ac7d0f24443d7cf
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zsQ/lFTjN4:AoqtVjnm0Lm
TLSH
T14DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c5f23e10f64dddb1e092437aa7991666b0012d0b7ae4f052d22f36d073b7bb5e
MD5 5ec281f4a159355173407e37b9ae33d6
SHA1 4e8b7c835ba2f745f3ec7964b8ed8245a7034dad
SHA512 9b64be1e611e4e2dff7ea294ca3fdb03d06049a10b23f490612217b0dbee988f41c2e1dd07bda484d0d10287826df06ce38bc39490139a836c6ef7c0fa575867
SSDEEP 24576:OAhGLJIFoiwtA5l7S53fnQ/tbw/2Mkjy6Fr7g0ob:OAMyFoiq5PQ/lFTjN4
TLSH
T16A35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0108f28c2b6e220dec1136b2f73232bdcd24219faf05c313c798c5285a83baea
MD5 f4356fb07a0d836fcf42457365b4ecc2
SHA1 d873c27aac934c5478edc578dd4d52aa019e566e
SHA512 2a48f92e1682c685eea86bcbd79698776dbde8e80573793b6d2c5c468124890ccef4581e23d4352a12e9c4884ccdcfeb82bd6bd1d886c2ef214b9bcb3d9feeb4
SSDEEP 12288:mmw5HEjsChN2BFgl0WDm+CDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMB:/wuHOWonQ/tbw/2Mkjy6Fr7g0o0
TLSH
T11965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bf8fc77d71ac6c99a88cb342f3309516ada0ad36069eddb3a6fe214cd0a974f1
MD5 0fb1cf8386f2e130649b11bf65f357ec
SHA1 7c933468316d3043e93971b0c0a2c430ae0552e4
SHA512 58c86fa23b5ad119b9a673c449f5e366fb0ee86590f566e68f7d498418e24599861affd04b4d1d7d9d021d5a00d2851e7dd54229eeb2375f02d741d6ca028276
SSDEEP 12288:LXZ1IycGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:DZudnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T12E55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1a58a51d61bc8400e16c1ca387af65230150d67c94b9e1e3a2b9353dbbd4dc7f
MD5 4a4e29bd3cb7e28f987657c1fc5917fb
SHA1 88280aba83e5807013fe65a095d890dccc5e5fc6
SHA512 e430d35f80412cfffe0018f19217f1d91783e2c780bb60d189bbd4abd2bf538a9c3675d05a01ce267c6066320a73b1c646d8c1e1e1d9dbc150ce063d8ea803a2
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:1QRQyi36YOcPQLvw2gAf+PN3tLm
TLSH
T102666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ab3ac6471ee39cd23035747f8171e884e337d13af3cc6382f23a7a420500ee1c
MD5 6495b6417523d2cb464b4673cfbd5522
SHA1 d7498e29fce2db83867cde135dc7e83765ea6eae
SHA512 698f2ab7396a00e0fc051ee43b4dbe748a938c0bb1f2de4907b59abc07fe008943b4d7e39445c6c79362549f2009adfc05ee1ffb178121812c227f2d2053ea61
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:uQRQyi36YOcPQLvw2gAf+PN3tLm
TLSH
T18A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4d9a0406901b3f863ef446b63afaad725ef63b6d0bf73486bf3fe09722453d1
MD5 7d36feae11dc3695d089d4b03f4e0c87
SHA1 6d5d502e5b5641348ee9bb7d0fd37ce10885f2b8
SHA512 4278a6dbd0ecb6c09fee816e34f3993371870ae3b5bc6ff9627e48604d535428d55ed60e0c8ad28f20548bc582f57facee20962c193414efa0fc6ed87067dedb
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0NnQ/tbw/2Mkjy62:y68Qg55nhheWu7PNU3/8Q/lFTjN4
TLSH
T156B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 67ffec8b5e12ed0d1c6466fbbc54adc8861b66559dee61181f1e0e92c5c00cbe
MD5 ce3b4058f35fa14d0e6bb16300b7a9f1
SHA1 7067cd3a8138a97a1709dde1cb5303dfe51b7893
SHA512 51dfe5129fc704243b8fcc0f8ff883298ca86ce8e2b335a2e0b305136584588f31f797d2faa5b522ecfc74e888a9c3561de5bc24710070b507cd75b6b433ac9f
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:Ky5112gYy5azzVvL69nLKnhZ+Lm
TLSH
T1FE167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d9c888c81bad7323a95550bd14a9f9e77d9d6b8a48aed45dfb40c30eb3d9bba8
MD5 5d4a1611fe3bfb82fb05fa8202832132
SHA1 df9f75d78264a769035fa306bac32ef189ba676d
SHA512 6edf92fee183b950e6a6c324a3d7c700e02b6bbb8da03a98665269f114bf2e0a1f64c65116dc5786733117284921f306b71955470a61034d6f0181376e65fa7c
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glaQ/lFTjN4:pu6JmVxd2dVLm
TLSH
T13CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 77c771586524c17f368e1ec11b5e67224de4156af0872bab8f0b5c0402cc5730
MD5 b11fbd27a23389a37ff1dec132d11a56
SHA1 1768cfe042e32c8dc21bfbd8a9baf6d6183391c3
SHA512 07175657ef6d9f13f8fff513c362399fcedb3ec308277c2196fc674b91199ed0ce0f253ffd6b56885b89107106f7c6718e977a880caaddbe9f344b8ef683e249
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4x2Q/lFTjN4:JmifPbR0Lm
TLSH
T1D6B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 44f728a52926919ee1a8d374eac2a062a21b1bc79feb5f3b24e576b495cae3d5
MD5 9315a8461ec27a3d9a02610b7228e546
SHA1 a1223d714248775ac74e2f9ce736ae10d618ec2b
SHA512 1dddbc53f85c7d369857e539a680c2ee613419985a2f2b237cd4b0ee05c73fa2f13f0a109a5224ad6c3b2355655d6791650dcebfba9ab5a694a3b6ce8e7ea8df
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqdQ/lFTjN4:v5dKTi61SLm
TLSH
T1C1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ba30ecffa8dad8e94620afc802e9bb0aaae612e82391facb2a31e350218bc344
MD5 52e9f4aaf8c7ae57161d8354101c7a4d
SHA1 3363ebedefed9af4566dc9ad300a679ce8578d82
SHA512 4b6204da4c159c3dd79e7b2d8f09c412a46bfd549f9c6727fcbd379c0c1fe7aa386ee74f11e2277b9ebe8347cccbc3edbda1c5946a3f88dceb8ece1049cd2723
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w6Q/lFTjN4:LX2iyphwLm
TLSH
T1C695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 17e53cbee15cb500a25ef33c9f1a1ca9937e07ff49131c62e866ab70f25ce642
MD5 3459bde2af7b021d5e5f9395788bd687
SHA1 7e85f537a8994aab1ed114ac7704016e3c3e40a2
SHA512 ccd99a19d4fe778b65eb1881eb41c251f4f59a3dd6226faef7d0d2ed8f1506df7ce58dd271a2897ddf8ff169a47cdc83be06116ef383a416c0868dc95ad8972d
SSDEEP 12288:GBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:GRnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1025523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 91cc41376470d0f053a95be4a8fc74e2f13839d16067c3d926902d51e7598e23
MD5 b251ff1ce26036558bb968fd8b585828
SHA1 df82d9672a4d58d5152b08a9303f33c05308d9dd
SHA512 16ba303b0c7441e2d19f47e3d25d033b4d61cb4f2f6903c76f8ab68c321cfe9f54077b14de21f4d257d846a8d73514e883a2fcbf36ac590eb4b1900e34a4c3bc
SSDEEP 12288:tAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:tgnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1675523697965F98BFB1706F1488281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 30261e44a2366bb828024780fc24dbb7396643f687984dcd80243be908822271
MD5 fe568c8d59887e03e46e6caa3090cafc
SHA1 8b46a5ac90d492d65e00478c4c09b43f47ef4fc1
SHA512 c399fcf18a0e2f1fccfdafb45e2d3187de0694d428ffae64278d57ef9fdeadc3799630ed9bfa7dd3448b0e7ff224db942455cf2abd4338472208ed6e4b71eead
SSDEEP 12288:UeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:UenQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1C85523697965F98BFB1706F1488281829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2bad9a688dfe8648ebc9443a10254edb215eb1a233be08e1ffe416ebff63dc81
MD5 97933e78b15a286e0cdb9471a72862c4
SHA1 e53f412f0376516e281fc20a069b2ffde770a1d1
SHA512 7ac457fa64373e41f201dc51e3114f9f3d71023150ab652542810909e92e8ba0c1b6febaf9aa4df23a6d9a2e43e2d28e0ed43f4789a4ad24f7d235d3cb8ec12d
SSDEEP 12288:xVfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:TnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1465523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 17f4ba386b368269e727a2557f7606246955960788bc24c5951430350cff9cfb
MD5 02cb5eea5db050ddcffce40a6189de56
SHA1 c4078b3d23fda6c235d59a5cedcf8203ac1a12e6
SHA512 ea6920d87ef7366de01f5d26c6e4cdea878a969c8875081c00520b45f6cfbdd18d683268f0a293d0d5fc6315ac8cc093b840882ba4d644e469b6926c970b2098
SSDEEP 12288:N3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:NXnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1795523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a19923f39b29b3a68782c28d053cd89f0140d84cb1eb290de5eb0f6982b666f3
MD5 7148959dec43129912c000041169f669
SHA1 7eac3c2f7fc3a09ee6715510c29c1d240ff0f0ce
SHA512 6e4f62b6cea05c0610f5842b3c8e1379720ecfff8fbb5084078cd5e6d390738bf1f6c7ab38870c9c67d82f5dfd86f36ff0f36be39852a5bdc846d0fe9aca3d49
SSDEEP 12288:JUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:J0nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1A35523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 da01578efbf7ab3f212b0553c03c31eefd9c77f7ef358294d8cdd0d49f67eda6
MD5 f1a6cde9adcf597fd2a1074c141dddcf
SHA1 5a8b9e37a37f742fa9193af4dcbfdbcc4aac175d
SHA512 7ecad4c18065d6ff409fd87c69d97fa189f527d84801026057bce6f7c1fa21fe24f8d506a16cc7b8304abeb299f2b4fc53206aa7067ead72302115ea1fa7b4bc
SSDEEP 12288:OYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:OYnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1A05523797925F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 167111b73339b466aee668008a71cf4c1200d4586c9058635599a5a7b238f08d
MD5 912f840afd9dba9e7f45edb4ee43e8e5
SHA1 72d8bc0b0578d7e2c47eb0cb09eb82cc68356a40
SHA512 e6cd3d8685ff5c5591836621073a11816002ee9168d5a4f83016749151e6d456c2194b2b82a9012588fa90671a72abfdad067ca24425659c44046a2561cbb3ad
SSDEEP 12288:riZwbDzzFEoS2cPvygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:WZM3zFVSOAnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1437501A5B39058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 174618ed602a439c11414fd498bbd24d71765104c1cfb5359fd9843ac5ac43a8
MD5 fa35c69d1cb59b5ce9a4b0bf62215aed
SHA1 f40a7273b9325f525e75fcc04c10d7074c72f2c9
SHA512 c40044b4714dae10cd8b89b11be5306abb09044a88c896f23a0a5ff5b227eac94a1cffc6f69ec8a6fa3967b01515de28d480cbd7893e57edbc0b90ca32a0ceb0
SSDEEP 12288:zNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:ztnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1FC5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c639f5061e38c8c6362e5645f01c8952f3a980c3bfb64f3ff7d9f9fc7ea3dff2
MD5 0a3652542a86a95887ea6d8f58d23334
SHA1 5f3b85c9ea14c248c23e69755f7062f0f35dde08
SHA512 227d9aaf8768c0f80b0b7e4b494f865073efc249839e4434b668696291aeac27e5cf48a116346ead13fb2896af66b8a7d38bceaa6141866d5468bfff42c3fa6c
SSDEEP 12288:7JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:7ZnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T14B5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4956488986e8789eb66332f5ef12e212e4ad346007cd682ffa1969dbd01df2c8
MD5 f4dd7967c3b8de197c3dc20d1f6c1022
SHA1 af6ab5ee7e7bc93513894d837d72544d96d6ab86
SHA512 fd46cd9639d78c774902c87a87eb55e5fd2d64bf97953736a32058253f438310a6f46e240ea980b5d1f1ce70a6b575ddb1a89bcc45f4df0036da212eb7743825
SSDEEP 12288:yyPz5L8cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:vzycnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1C065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fc3bb5907829823ab0632944d5e969e05d43255c161628a79a04bcf2bae074a8
MD5 22dc1357a72ba430a258866287417ef6
SHA1 e4749911212397da546bf6676e6a9f984a366c5b
SHA512 36d1a5b12667983894e1de2528afef4b1e850b76dc933b4d83626cbd55e189ad098d6616016aeed79036b3d469b3b9187c3be0418b184c948a70dadbe5ccaa6e
SSDEEP 12288:oNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:otnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T13A5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 861b4d6809217c471f4f13cdcb92cd6f7875d27d5642e1d4c087268e94f7ca3c
MD5 0cf61ce3810f5735674ac6581bb5c3e7
SHA1 f29921dbdf1935d2b945a81b28e4a8179c698692
SHA512 4fdc2f1ddc42788afa08504745f6b4eb9cd44b92e07d2aec9d66290ec826beef3e23953414421f5b449a49808ad8cf70064c7bcd62c0043e4e6d61619878bd83
SSDEEP 12288:2NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:2tnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1585523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ab1d5a6e4a7dee50724955ff49967f08464e5399e3ecef32a4101b5d77ed6bb4
MD5 816d51a6eed5bd145adbdb9c28e93794
SHA1 abdb3c56aee5da5b86f93dd98083058f683bb0ff
SHA512 9e54239c3d5fc9d91a3fd8942fb6598047d5455c5a08146ea9078dcc2b519f11b628bec8bf6e1d96893ff59eb26c07d5ab1279c0d4d01d76828f09a3628b1b3a
SSDEEP 12288:7yPz5L8cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:2zycnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T15D65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ffb3b44a26cdbafcd682e5abc2a61fefdb6c342740b3e64d713459a912c8f6a5
MD5 fc798e2132df9ee7c91e9b877e930e2d
SHA1 685d551b2e616ecc3a249f4c94984904dd18dc68
SHA512 ee9482ec9deb7e99f614d772b5105537551249c73cdd69cbccc486d6a11f9dd31cbda34ab2f16192fe05e7e469cc535c9e45a09c7f9d9aa21cdc4052e1a6aaa4
SSDEEP 24576:6T0aLl3z0zDOnQ/tbw/2Mkjy6Fr7g0o7:6TDLljTQ/lFTjN4
TLSH
T1117501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f712a19e8d71c059ab7403017f9597567004bbb1c4fb017c37874fe23e4f6dba
MD5 b26dedca80e87f983aa799a655a49e8f
SHA1 fd33163270ff85c8dbef2e27ccb475989042a270
SHA512 a3e729311b57a15a35c1b3af4d4048e0e20db94650ee46595a4975ea6e97948479219c5ca17261c43fd5e12936ce264aae76ad966393da3b96847e46b25b8a7b
SSDEEP 24576:j31d9CHKy7GZCnQ/tbw/2Mkjy6Fr7g0oe:D1d9CHKyaEQ/lFTjN4
TLSH
T10085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8a6d19d333884961a7fbfec4ace00a51e1e3248eaefab1a4a3e336b4222acbca
MD5 b303c76711053122b9ae9ea22976b555
SHA1 08d3cdd2fcd0fe1657fcf5c9a52f0286093500e7
SHA512 0cd868901c1458d0124bf098469a72ab90ffca6133642ae95f07780f8fbd5140f9738545b71e504a22cdb97321ada8e870e708c9acd8be3fe1ceb9d86ca3ed4b
SSDEEP 12288:Q+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:Q+nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1D85523697965F98BFB1706F18C8281829B3B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1a82d06db81be5342912a3efd082780e0082022c52a6532e46c006f4c0ee550e
MD5 2e0e479931221c0e0fbe22ed9a516024
SHA1 dccfa1b8c91e48e726fa894dfabcc872a3472c55
SHA512 9a54592ccdd99740a33688016d969855d5620cda2dfe752d611adacd9adc0f8f644fe9bf13bf95c6861cdd4582f04831d02583d6c5d52dc94aa4b8d31db65553
SSDEEP 12288:O8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:O8nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1F55523797964F99BFA1B06F14C8381829B3B0EC6BFD1938F7B481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0de7283ebb5694d245dc6f8df32a18b3e40dfa1b0e31265a556bd4bd59d5b8b0
MD5 031631d0d8d2a23b0391d909497caae8
SHA1 d03a28ea6bfdf8324a102edf3f6a1e8fb1ff0714
SHA512 7aa63b0657aabf1123bdc230a76ab0da24f9f4d9b1057987a3ca60d7327c7aa3e85f5c7139449af0fcc0154bdae945aba767997262e12a2a9e29d386658f21d7
SSDEEP 12288:EbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:ELnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1B05523697965F98BFB1706F1488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f28bcc5d3ec600e3e50bc04ac1dd7177a9b96fa2f940dd52936956681cf87be2
MD5 eebc9a324837c010706f40af6a6fcca5
SHA1 5508b52808976a536623842867c12482106a080b
SHA512 2e771e6dfa3bba4cabc8abd92f60e3547ab3f40043eb052bc79ae49e889628bf26dba959db895b9220fdb776d82bac77bdab98e031245aab0382ef2b6cd95418
SSDEEP 12288:4NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:4tnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1095523697925F98BFB1706F1488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8d6bc8561b0688eb3fcbc5089886901b298eb0c0978a54ca6e07e343626571a0
MD5 59d12b3130f8762e82602aee69298e43
SHA1 0912dcb9c07b74f0e19d5970607c424b4442749c
SHA512 45e2cd176828f390d59a60d1707b9f6164404e026e3583b372d14d3188ba4850eb2f066f52e341a37f6f5d4971cb45910083c04fdbd14e02b01ffe78861d0d95
SSDEEP 12288:I+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:I+nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1A35523697925F98BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 53fcd303fd50cd91acef14b2474f4188c7a62fb294393eafd55c864691ba51c2
MD5 57ab48743bef7fd245a6ca3cf96c48bc
SHA1 0d0165cab448348a2b8fedc587e066044f7d9a58
SHA512 f4a08752b4881801566c8f860c305140cb6711a9b61b1605354c5987b0a5c26f1708d8cea88ed5a0a200f7c6419d83ff06c053fff260bdc4cedac94281c24264
SSDEEP 12288:4FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:4lnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1A85523797964F98BFB1706F14C8281829B7F0EC6BFD1938F7B481229967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-02_030504_5780-6616.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-02_030504_5780-6616.log
Size 1KB
SHA256 1e84377507af19550a70b0698f448c32a6e17f5d72719cf488fcde3949ac61da
MD5 baa25d2c9df69c912e398f9894e589a7
SHA1 d5692625537cbac9cdba50e271c5d937ec9a7bca
SHA512 3788629d142a3505042c2d5dd646db15b3f6511b3234819138b7c66e8e6f713bfa14efa5350e7ec99b9a2baf39bdda11edcb8d1abaf230917d110993fa3f9b88
TLSH
T1602151597BD80A06FAFADEC298FA15539F3A79966835CA0D04A4434E0875F40EEB0727
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 a1ea64cb1df31680de796bb3e970e18ddd441e29bb2bc83dc89893acf3be0672
MD5 4f7ab5fff69b1ee189d00dc51f603d71
SHA1 7a8ce7d58119dc27723949a9d98a97e5e44e1179
SHA512 e97102439ace08d56ad70659161723a1f65e3794e8a36aa6ca1df3239ea42035c3cbea309d9d7ce09bafedeade7de5af48028b0d77e68f99921659e20bcdc2de
SSDEEP 24576:Sfwv/k9RX6wkyAIpnQ/tbw/2Mkjy6Fr7g0o/:JMnYIpQ/lFTjN4
TLSH
T19785DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 35d59452d9687c1a7341191a66c97cc1c346df9b416afe49d3eac5920c5a3d7a
MD5 c132135c89a76efb1152fcf4f94111e1
SHA1 aa026c4167f7ace2fc4fb9052ac1d5cdf2f589e4
SHA512 8f73a00a0051d9109ab2f3b78ac158f6e3fd9096a1e79839507f7a07b7cf968eb53ad31ecb20170fde5802efbecf109e009fa357bce9c40fff85c9ee2e546b39
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aQ/lFTjN4:QySzPNLm
TLSH
T16E066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f09b02397c30ed08c67a8e3e3dc6568acee46867bad0ce91a76b472f19636a0c
MD5 0a08fd270ed80b25b128476f61c623a5
SHA1 9cbb53c02cdc5a57d12951855e9b972998a493d7
SHA512 b65b8ec5e4463a744af434b35bf5835af7a366a8d671619cbbdabdeab7fbb078269019ad3e6a6cfdc2d6abb7a830af9cba99df343473043aee414bd912a721e9
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQnQ/tbw/2Mkjy6Fr7g0oC:a47JUQj1irIhCnDHUPfF/qQ/lFTjN4
TLSH
T15665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bb78288c708deaeb7dd1e291f7451b59a40f9b2ec1ef54dd4646fc48e4d0b78b
MD5 0fa569b076d00cfd9654a3a36e70978f
SHA1 5ecfba7ed08e26669a7c97addd5f7501ce32693a
SHA512 f5cb7668626a3e6ace2b3866e715ec531ad91fbaa6fd3dfcac012dbac5dd5983e313886e18f2f330c7745109029e06744abb8255e1da8ef611f0b0516a50afec
SSDEEP 12288:Xssf9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:bdnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1FC65F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b74c4e99175615e7b3e6c4dfffb8ea90dc21e66dab9c62fde56601e5ff73488b
MD5 426cddbaf37bb73557b3f508dc196eb0
SHA1 425fffc5bccd2c1f96621d893f495aa29f5dc1b2
SHA512 d77da8add29272ab95d7019fa17e31b47f325bcb7074b2fd7de8dfa86364d91fc0be4b2a9ecf9ece353bf1576962ae58657409d7233c9d4bc1c2dc6eb6d8b608
SSDEEP 12288:R9BfdU3fRy4KFVqgtv+2vZ0GnYS+WilOqJ61mIwQgFyns7eeO:R9ldUPhgtv+2vZFnlilOzmIPSys7XO
TLSH
T1EA353840762AD74FC6A940321E33D5CCA7707D41EE45AB0372C89B3FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 2325302de13c8fce52e034b8963fcf0a7db728278515c0e8249b5eb933a77f3a
MD5 d3ed9bdf2bdb7e35e35db6c38273db69
SHA1 dde13ca2e0f605051d727c117bf1a69f9f45bf25
SHA512 9513be1c686a1d07333b50d350ff03da9ddf740e8949ed164df24ad77923a15ba6950de39129011fd002293c5947eecf7980f46d7080d4fb272dc874e89dd969
SSDEEP 12288:v/ubuogtv+2vZP7/eMsZlsOMubFQaBtwKMjfENavt:Ugtv+2vZdEct
TLSH
T1FD55F7819537A3CFD0F72032076A9B4CA7A4EC06B7095F2773C8453AD86A725B5B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b4d5b71d5e2c40dbb45929c6397dda47e50b0f80b1f293093c8840c1071a8b1a
MD5 b8a5fddf9e284c30b7ae669091658595
SHA1 5f946f2f1fb4d9c0b049ea96a801239ec78d9f56
SHA512 0a8bf7c349ec441ec3442d8d7bb4519a371b8eb026505bfb55060b25e7b320b6278c231898b186a007b5a09991a90fe9e06db99240b74b6b32c51b63641eec3e
SSDEEP 12288:3671GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:eVnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T17C5523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6238d3c8acc91bd3d355b5a6d0c24b91d1cb11550037b7115ede4d75efb72a19
MD5 c8e559cf2a55d005bb71cd61049858c3
SHA1 6e9ad63e2f7b81da729ec5aceaf44131ea1b3bdd
SHA512 0b6df56603eaeac9c42fe1d4e16431eba967fbf6062338e44fedd0af8d222fc6f924ac552506ac2e7a5aadd1103de72a77da4c87736faf3a85f96b05c3f4fa22
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYTnQ/tbw/2Mkjy6Fr7g0oL:Mgb4mBIBhGFQQ/lFTjN4
TLSH
T15365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9444f3b9f37fa88f2fe6c9be1c5d3091acb70fef4ef709e629595b329e0604af
MD5 77f8477e9093e91b17485342d9b74ece
SHA1 a03e7f52b7006c50036e09b7f8fc84b1b0f88705
SHA512 0e6839f4a2d7f9dab4aa983f1ffe402fd0b32dc55aa3585ae122d9f6db83b792bc02d81c01f4aced461e0bd6a3f1c3ed952302fed686aa1ecbdc0c0ff08311fc
SSDEEP 24576:wG88u8FpJqH1Qzria7/mAnQ/tbw/2Mkjy6Fr7g0oC:j7ZFPqVva7/rQ/lFTjN4
TLSH
T1D985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 acbe442e783d4867f165c9d4cab391cb053cae2d71be91587d6206be3ea8f7a3
MD5 6fe741837c269e400c3f698d709d84e9
SHA1 8a9d55d2b0cc56b6d7b5231e52d1b40f20599d95
SHA512 25056befcda032793f46f83e498d1a4316110e0df105b83e95195a9d2f0c6e409443139fd5bc73ff2154d6e3ca1c9f2f5b17756c4b09e90b638b3daba9982099
SSDEEP 12288:UHvUrBFrEjwaQkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:UPUr+NQEnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1BB65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 07b5825a56e8a83ecae180a3acb929e5e9eac632162f823bd28c8c25b49ab7de
MD5 e9eaf6c353496e6d52e79700e1f6e814
SHA1 e892d39a1bbe50244e18ed842cfc48cc8b4361bd
SHA512 a135eac1632cb0e67e314191f5bc533f041fb3abceffcf311ae082440e0f7928e116764814b2c8d241dae3cbe9576b6cc6f68736afebe154b4150a60314e78b6
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0Q/lFTjN4:iG05lO43bGLm
TLSH
T17DD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bc74bba1af3ad4e7551d914443ccdd703b07858abb9cf0ccf1eb7623bc0833c1
MD5 787799ac3ccf62400fc4943274a89675
SHA1 e4bfacf22069705477665abc8a826b4a9b436005
SHA512 916c64daaffe0df165f9178a3fe19e202207dea1b64cf18ae17a7a577bc47e59f7c1c5c3f408de92a5754f9a225a48ccd8ed300f81a60c48578499de6e73e9c9
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnanQ/tbw/2Mkjy6Fr7g0ok:sa5POZ3+Jt2pasx2+m8Q/lFTjN4
TLSH
T16365AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aabc85f2156bfc9346139be6bb071810de6e7e37e2eda3067355c62df153c6f9
MD5 f3f5b9042a996978c105007a3ff639af
SHA1 36f21d69a65512ef634ae3891a89fea2aca35445
SHA512 b0119d3e92b7da4c395d88c40347504efad0bae618b4cce96821945124e0ce95f7641f0870045a66fc746b67d9dd1dd6f2777b4049a1816f9d5a5af1675a700c
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkInQ/tbw/2Mkjy6Fr7g0oj:gNc/zEOVHFLQ/lFTjN4
TLSH
T102858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e6b3b7dba5c6b8fc76514c63f8d7ae5d51cfa62d8bda3478bda06f82d6276894
MD5 4c4a9c8a3d8b5ac1e05adb230da758ef
SHA1 d6a0987ddd2f3d2bcc18749609ead8ea66dc5513
SHA512 1688e6fb564aa441e6844f5f306dadc8c3e2a3af0305a3353d48b296770b198cbb6637b7822ff417e715d7825c555ee626ec0d3e2d67ddbfd7891baf7c1bfacf
SSDEEP 24576:38kNvNnaFeYhJNtmZBmWnQ/tbw/2Mkjy6Fr7g0oY:38MwBtOmWQ/lFTjN4
TLSH
T13F55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8ef686e2d4fd50e76f251d8ea750dee0242e3958f181cc9934e5911c68ba0097
MD5 d10577d735c9cc67f9b214da084fcf0e
SHA1 b7c88130d9a08313e86b48d07f572eb97a6b44cf
SHA512 32dd3fc23851776afd424840ce6c3e23a84fa82362c1316e989b108885998e2c8e607927a6221262480dcce6da15d86b6293768b0b7bf350e80b58a2c5956a33
SSDEEP 24576:jD3FHshBIYQgAxnQ/tbw/2Mkjy6Fr7g0od:jDVHeBIAAxQ/lFTjN4
TLSH
T1B275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1216-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1216-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1216-339-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1216-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1216-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1600-59-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1600-56-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1600-50-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1600-49-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1600-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2052-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2052-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2052-16-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2052-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2052-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2644-87-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2644-93-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/2644-88-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/2644-318-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3140-123-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3140-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3140-321-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3140-130-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4204-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4204-288-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4204-64-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4204-71-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4212-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4212-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4212-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4212-116-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4212-110-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4212-322-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4748-303-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4748-75-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4748-77-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4748-83-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5780-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5780-40-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5780-43-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/5780-8-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/5780-9-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/6220-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6220-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6220-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6220-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6220-325-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/6684-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6684-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6684-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6684-141-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6684-143-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/7020-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/7020-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/7020-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/7020-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download