cda6254eb024258bb18c3f0ec644dcaf767ea259eb025790ab797a91973ff4f2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260802-egyzfacq71
SHA256 cda6254eb024258bb18c3f0ec644dcaf767ea259eb025790ab797a91973ff4f2
MD5 d25462b393a59a2f321aeac0a410d6ba
SHA1 732353f2f6e596ce5c3a1562ff3d963f8f8aadbb
SHA512 0ef2f0d96d162f150fc45b63541ea26d23d9b67777cdace46a09ccc27cf03880eb1cdd8caa11ceaaaa21f8543d1814e2c933d985ae119c456d70953f8a084412
SSDEEP 49152:rjcHonJkXCXjMHaIbnCeGusRN/BEmjfzScB1QMTNVvn30TofuBDmg27RnWGj:3XLfPrJuD527BWG
TLSH
T1CF167C07E7B941E5C0BBD13D8A569657FAB2784A877197CB43A0871A0F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2572	elevation_service.exe
2800	elevation_service.exe
5364	maintenanceservice.exe
1232	OSE.EXE
2360	PerceptionSimulationService.exe
5140	perfhost.exe
440	ReFsDedupSvc.exe
3540	SensorDataService.exe
2784	ssh-agent.exe
5532	AgentService.exe
1788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8bfb78a3238bf42.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c81dec93222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003275f6cb3222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7f937ca3222dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000870c010d3322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000590de6ca3222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000327e0dca3222dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085f1dc0c3322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fcdfc0c3322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2800	elevation_service.exe
2800	elevation_service.exe
2800	elevation_service.exe
2800	elevation_service.exe
2800	elevation_service.exe
2800	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6004	2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2572	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5532	AgentService.exe
Token: SeBackupPrivilege	440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	440	ReFsDedupSvc.exe
Token: 33	1788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1788	SearchIndexer.exe
Token: SeDebugPrivilege	2572	elevation_service.exe
Token: SeDebugPrivilege	2800	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 5040	1788	SearchIndexer.exe	100
PID 1788 wrote to memory of 812	1788	SearchIndexer.exe	101
PID 1788 wrote to memory of 1352	1788	SearchIndexer.exe	102
PID 1788 wrote to memory of 4216	1788	SearchIndexer.exe	103
PID 1788 wrote to memory of 4756	1788	SearchIndexer.exe	107
PID 1788 wrote to memory of 4964	1788	SearchIndexer.exe	108
PID 1788 wrote to memory of 4796	1788	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_d25462b393a59a2f321aeac0a410d6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5364

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1232

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eb7250fd8e19369a53775292f9a153b1d39cf65146007aeb12f1470757303dd8
MD5 9fae09c0abf0ee616d22d51686008757
SHA1 dbc29c34cd0eae40d6fac0fd93d64c19b8c40df8
SHA512 627739670f58b627c6352932dd536d44e65d5db7b4a50f20aa8042a6f0c556a5530f3d31ce440488c1abb158dee73ee080fb8946d5b71dba7157ada46cc0158a
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxngDmg27RnWGj:K3q6sjB/D527BWG
TLSH
T182D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 89b2925db08a7a2b0a6782b3dcdc83e086e1d13d70357585dda2d88e1ea1a632
MD5 49dccbc1f13affa0bfe1125a265f2fed
SHA1 95cf32e3f967cae74458fb4db97385c55e70bd8e
SHA512 2a9673ea6801122a91477249965a7cc62cae261744799180b1424ad1360eaa137c7323a71d6abf45094b569b7dff95982bc7a304655fc662bf6e6db781078cc0
SSDEEP 24576:ZXYfDtczAvsqjnhMgeiCl7G0nehbGZpbD:ctciDmg27RnWGj
TLSH
T11085F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 25504d8b6906defb7a0b24a7527415af5cc61c7a807c1af23902b3f4c3b91091
MD5 477ffb86c2cb46256cd2ee3ad69cb091
SHA1 27ebee24eb10346c4735fc7bcf7d9fdd2b4f8d18
SHA512 fe3d43a194214d67de0742c0a3f785f73a9e05b14adc36120ab9f8297b2e3f4bc361ea5c215c6655c13e52106f67e43139a3f55c91c84fddf9a26ad0bcbe3eb2
SSDEEP 24576:z0Le5ji0hmx7rMssqjnhMgeiCl7G0nehbGZpbD:zPji0A5xDmg27RnWGj
TLSH
T19C959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ffe235d85c2dc9352098e7b88417cac6c568fe8ddb7aea5411b44a3192f53d12
MD5 6b76874e9c7ce9c3379018c1b2a6580a
SHA1 32f5338527cde1d33308612fb1378298706cbdf7
SHA512 2f52d06094a2495e7da5c103ad5657fabf8136abc3d7e1027dbc44f3644eb92cd0cd496c3ea0c7d984ac9aa4486f26de10d019001af701af1a86557bc79cde2c
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyu+sqjnhMgeiCl7G0nehbGZpbD:s/ezSC6vUzPveHjyVDmg27RnWGj
TLSH
T128755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 18353a1594c0fc132471d878fe524b5e9ba15a5a094ab90aa8e068bdac0d0918
MD5 0acb46d36788c05e499a60c553e54267
SHA1 a4d7e3580053de8c9783293141e3f73d64e3e4ac
SHA512 e856145b561e75c394ad59f271ab0f0910a1de8d45d3edfb29a25bf94f4a559d8eafe0441e11e5c5e2fd1d69097be5b625cccc0ab5fb5c4443785325415d77f1
SSDEEP 24576:jVbqPb88hv/l+Y7sqjnhMgeiCl7G0nehbGZpbD:jVO88hXl+aDmg27RnWGj
TLSH
T130559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1ad6f4ab98d9482c15277f221b8bb8d345f5b37e8e6e740a30bf5b3aff91b657
MD5 8e3483079c86baebb3f89e3b10f02e2b
SHA1 26e88f132fdc7a3708d5d7afe8d28aa8e2e55717
SHA512 31bf63e8994f51ad248ee8f8bd4d64d0965bd09962a71f1592cce04ae5df1cc46247e305f358edf9dff693120abd4c0c876f4bd9408003d149a5f07b8a9bfab0
SSDEEP 12288:q9YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q9YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1206523BF964C50CAEB7608B5C3E9F51EAC137E56982008436AA37DFDE6B5454CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 01249c43937151ecab675ac0d1236a4659b3ea150d492b21217dea8398821a08
MD5 649d0e3a840a61bb861f6e18290cf31c
SHA1 d61a699f34e925107799b4f687d39cc0a40ea7fe
SHA512 5933038525809a644aef97f03affdb30fae8e4ce59ccbac2517b5be55ecd410b4974ec8b62df0c0fbeec58c354cb991c56823aa47e3fe80732616c698becc3f4
SSDEEP 12288:veBNUbTVO86UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:vJIUDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F985CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0833dabb84cec0eb530587107ed02bbeeb86eb233314f94b364908a8b91e9da7
MD5 2a1606b050c403fda42f9b87f057567f
SHA1 0b99127b9f303fea4698ce370dd15a9d130aaeaa
SHA512 742c6840453f9e2810eba4e852f27aaa59a4a12fdb6445513aa9cdca5d8e5068515b4b3ff978c9c100665b31f137a48b2cd4f70d5c2cb10ee774547d9b05559c
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:FQvGAdlCEL8c/DRNw5CCD527BWG
TLSH
T1DE266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ff47d77733b363850a542495c2393d04390d5eb0d56e0ec0635707205dfa383a
MD5 8a6caf2532a0d465917f3edba746f58f
SHA1 d586970399f6e06f45ccc13a1dbe7fe167a3a640
SHA512 285667b6afaac46015b0032a4faf558370d992d6e6adff164d55683472b93ee9b01448b52d4146b2460a9003eb4341b8bc12c7bccb36ce240f41edd132f87c36
SSDEEP 12288:SAwSfxL/2Dc3DDLLmt0LDQewsAj9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:XSewsAj9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13885E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89E9E99702D12736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7abc591fe07f9f2296a2d26c26471d22b9c375e393089b407d0cf67d11b5efb8
MD5 75ebcd55c92b9fb0d5d9a5c1409cb6bb
SHA1 45beb98dc7f389ccf41398c1ee3f10880afacdf3
SHA512 0def0051090283bdd384ebf84537d2c1394c4976ab8930e40e103f0924bd57c3109eb5bc9c74267731b9d5241d547fde54f8779026a8b0776a9ebb765343af39
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpVQBWG:wUEtQevvqc2W1cpV2tI320B
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 16984e22562f39b2772564f10c6fc0d37abd3db334de5a7d84bcd965eb10e445
MD5 166676c1f539b13dfe151d2a10cec471
SHA1 6f5c46907b4c8eb9251916f3f2a48f80a1b2186b
SHA512 e695f960ba666f164263a1c20c264846dcd8e3452a825686390d34b9845fab04d941eb4ee514a6286d3b920e6ea82e19a3b728292fc912eaba5ac0237bd8472c
SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/zBDmg27RnWGj:LoquVjnmGD527BWG
TLSH
T13FD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9179d620ac13af70b12d3531f030f844417d50343f0c4c1475e0595c94dbd0ac
MD5 e10009024696ecc0c9d32286ced15b2a
SHA1 7199052bae85749d1b35018995f98323ca5f4081
SHA512 b52593103beceb438cd615a62695d49b4d7db672c01f7b30ba7393c2fbdf6e104b3b8dc7f4de6ff50ebc2b372916f15ee3ac68cda314f88e7a4076c00c9ea7d4
SSDEEP 24576:6AhGL3IFoiwtA5l7S53isqjnhMgeiCl7G0nehbGZpbD:6AMUFoiq52Dmg27RnWGj
TLSH
T1A0359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c1e7d999c059307164f955b4633d1a05172c7edff24da91e4fdab03985102561
MD5 1a33db889562b3ee7625bef65e4e9f47
SHA1 c5dd4a576eab55a6cb1d7db5fc3873fbfb0cdea6
SHA512 9aaf35f105d347c4f3a49d1d06ab48d5701e5f74cef9ffbbabaa778f88c1b0183b01fad9c3709892f9dcb57ead3507cd5db2c5b73bc50c09c0a567ada13cec4a
SSDEEP 12288:+mw5HEjsChNPBFgl0WDm+CeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:XwuWOWhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E85F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8428c59fd212e39e5df7f9773015859406503f8d8a38d2f6b79bb8d8b2023b6d
MD5 5191222233f9a239b8eaf007196ac9e8
SHA1 20c9c6f8dcef7b4519f3da810d20f760bf7a5953
SHA512 9116f8eb65b4959fc9110e9fd31ddb7b8cb6f636a2b642055991d638a09313169591d6a06eae342f45d2dbcbce24ae7cc152a76a0b665050a9ba48e2200cd0ba
SSDEEP 12288:O0Z1IytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZZu0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D7512AA239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d05c12d137d2281d3202779ff835f8fe72fb4079627a665073218214ad49dacd
MD5 4222e5bf64309ba4a75279d0eaec5b83
SHA1 f71edef3a215440547bdc9a1a04289e92961bd09
SHA512 1824166959ddf85a07a2cc886dfd23772a6471e53b3fdbd967fae444424e4501b15c6746cd007a3ef9173b549704034f21dc944c3d80597b92e68c80387c6cc3
SSDEEP 98304:NQRQyi36YOcPbLvw2gAf+PN3rD527BWG:kQyiKa/X+PN7VQBWG
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 de2377e10aa6e728a64b5a38e889bfeee1c22a19e032efe0d6cd3d753d2d3dea
MD5 2d630f333be39fb39965eb728c8f73fc
SHA1 87e02e0564fa130f02da99f4a25918ab8a933890
SHA512 01f892da79cb9d682cfa9c30b7b89e5852d479ef66cf8ea7523ea51bfc0697064396ae41511f18f3cc856d0342929bafea95f5f6843dd591da8960125c0db659
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN3rD527BWG:6QyiKa/X+PN7VQBWG
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 134b2b17029d7d8d4d7d53b60e3efda22bbb92f981732d3bb28717ca542805a1
MD5 b0658eb675e8301633859873be03b412
SHA1 3c1b6ba976f96ed43b4845056f698f3fea6ec2c8
SHA512 3c4984c08756602bb9be0be9e39902cf31b0b83976c4a4ec9e8999af561d82b1f4869adb3a0aef447039cb19cb897d96985914fa13061a9e757a5298738b8abe
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0EsqjnhMgeiCl7Ge:i68Qg55nhceWu7PNU3/xDmg27RnWGj
TLSH
T117B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b2405d478307a931eb7fecf8d3bcba1beb59fc25ffcff69463244382e23af24
MD5 49319b721d0134b4b9f652da2860e3b2
SHA1 6393b815e8dc24ae94ff913f66bd49c08e2017a1
SHA512 8e3765ba2437d88f98158311f05e72918b6aa09d70f373ff892f832830d3b6640f74299228484d58148c9f3f256078f4be49f0928d63c3082c18f049e84c2da3
SSDEEP 98304:ay5112gYy5azzVvt69nLKnhZED527BWG:DLIHEWhuVQBWG
TLSH
T17F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce09895eba0fb4ae4aa7b26e8bdf291396ba21cdcfee25f6c1d692ee73b3b5ac
MD5 94a3d8056fcf08898b212ed190890c97
SHA1 1c8cafbf3689ba24758fb5b8b0156406f80e381c
SHA512 ca61294f5ff9fc14133e09228fe714a4267a84977536c160fa893a00ea05fcf57dcfc5c5656471622b3a4cd62fc0be54f80c958b66be6769763d3f18e8a9227b
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+Dmg27RnWGj:ou6Jmdxd2d+D527BWG
TLSH
T1FFD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 29a4cda270254704d65576ca62d6a53ce5852d42632794503cbeeb286e7e1dda
MD5 b830f3d35c395514259dcd22d525fd3c
SHA1 ce8a9098245b2494ba61ff7fdfeb8c641f37cd55
SHA512 9713320b3ed98c7a2353b0439383861c60aa663023cdbd63d84e5bec9c9b61e3f662e1cb41ecca68111f1bd9c410a423406762724ec96d11b95d8791e63e8c7b
SSDEEP 49152:w1hpsNoJpF1A63U44CwH7R4xnDmg27RnWGj:wmifPWRGD527BWG
TLSH
T10AB5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee40202b98d13934570d07725543df1f0d6861a88dc0c5ca7a0225cff155ecd8
MD5 e90764c3bfa7a4735ac0cd0d9d142b31
SHA1 fdefd9073ee573fc53f3f7d98dc7b84dbe49b060
SHA512 e4c76fcb35cd17020f5665db0f1c24e2e587fdadac2261c77ba0a4886748a2c5f25fb26370ecaee93b2c848f7745f155fc704ab06329743915c6d8c28a6061a6
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHqQDmg27RnWGj:Q5dKii61QD527BWG
TLSH
T1C8C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b892afba4ca581317635491be0f64834f6e4cd0124256a12e850f18afff16ba
MD5 873953e92eda4930a2b4f7c503dc1f2e
SHA1 76d55d44fbe7787b2c623f1e7ad145613d2ef887
SHA512 7eabd554ced87e900712f5d171a5d4620f3b955c7e05c81e186ba44eed28ceec14229c418116f34893dae1bfc795acc6a1e3c15a6304284f384a51ca6959628b
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wTDmg27RnWGj:GX2imphKD527BWG
TLSH
T11D95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9fd68b9fd501c40dfb46684b5651b1536041243b3017497e6852bf974b259e42
MD5 f2fee90b7193e63c8b966aae5fe99c40
SHA1 cb76faecafd39b865d2ff0f848de1ef32b3e02d1
SHA512 b2dcabb600393a64c878243d1cca41d752f0710c679d306759cbcce47202aad3c5f6bb4fb03bb8db1bdc9022e6c021c3a1948f11d04c080edbdfffeea02ed3a3
SSDEEP 12288:AgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF6523BE965C41CBE52245B5C3E9F14DA8073E5BE92004837A977CBDFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c1cb41d7266ae8ce6b8dd368d251bfe5b1e511751a71be4ee3f78d2eff50a357
MD5 2af32c394835db77b9d7175eeb2ce357
SHA1 e219e5f8efb047d58dd06f5a7b1d938d28e9349f
SHA512 14149ddabb3136b892406c39a91574d36b7362aa8d71cce1444a8af46cd2c3010941875ecccd266d7ce8081c6e0de8a481b617788cd23c2063809cf4652253b4
SSDEEP 12288:u5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F6523BE965C41CBE52644B5C3E9F14DA8173E5BE92004837AA77CBEF7B14984B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3604668638bed7f150115a705f903d0d7fcb286a99301c616a8f026f8710b820
MD5 8e2ca4f8e647c4465d3680d6109aefa1
SHA1 b862a7898605929072e6114307070e410e95194c
SHA512 517bce58a3f99ca418beaefbc8c0347fdcb031ed009157ec4429209b79ea5c45e40906a3da3cfa5ed819478991de41a5c6b3ec1577ec9f270162733e9a341bc2
SSDEEP 12288:ILXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ILsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D46523BE965C41CBE52648B5C3E5F14DA8173E5BE9200483BA977CBDFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ad85ab18e47ddcfb76431830e530e8e95790ffc7c7dd9b98853a994418522ebb
MD5 01dc29d5227d0477553bde789556b0a9
SHA1 0de6e5a1d20bc9d29d0bad58acab4567eba39cb5
SHA512 92df5b34885e77c31317ec241a567adcd9095faba09bfadca4db42be2c19a0757b00fbf12c405bfd61b718d0e6b22f880c95be93ec63dbc4fb0f278aa5fa6580
SSDEEP 12288:IVCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2942492cfd3fe8425b980d0567ae1ef179ce83c630e615c89ef3004e506f4a32
MD5 ea81aeda42a4726d1b55f2d8fe8d498c
SHA1 4c51794e42d6f798dd104092aea9e9b0430f7ab8
SHA512 fb8c2ffd3e4388182ca507069dff3de6120e3f929542b7941b6df4c76aa5572c23364860114d19d78c0518ecc37bac6cf0ef19ca6fae2d097e8c43d0790d3329
SSDEEP 12288:m6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C36523BE965C41CBE52648B5C3E9F14DA8173E5BE92004837A9B7CBDFBF14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9293edb7f8118a1f47eee3d7ca6b6302e596865f2ddcc1648caff6b99c07321d
MD5 ac1bcc1a15c6ec68e7ad4ed9ae338cb5
SHA1 b0d95a0a6037b8fe2beaf1e13416c9c1d56bf899
SHA512 5ed8db61136ec7d96b33fbe4df3c6427b667292da0b9b111be8bc6d69515efa6be74fff09990e5f84965beda71ca109a3bd4ae2a019a707ebb26d86e84ac550e
SSDEEP 12288:ulXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ulsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1706523BE965C41CBE92644B5C3E5F14DA8073E6BE92004837A977CBAF7F14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7c98dd770a61e2cb3e7a2c182ce0358de041397ef2324763485dd39decfc5457
MD5 397ccdbe4bcef3201b6afa00a735183d
SHA1 a288adee6aa807756e1c0379f70d0de4713217f2
SHA512 3c27a9014bb522c29f8be6988dad06b2a123fc4c1ae50a2633b09ee572716c51a9a2ee9be95175fcf6f99df8c49ba46c4aa762fa42ddb70b0d5e00552e28b364
SSDEEP 12288:MxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C66523BE964C41CBE62644B5C3E9F15DA8173E6BE92004837A577CB9F7F14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 486b434289c2e604db252e7200b27b21eff87a722b156c302231601d6e5fb481
MD5 970feb5b98a7bdb9b526748cf52fa6b6
SHA1 a60be89e267fb550910f06ce05168a3ce8060314
SHA512 93e9b684eb28137808d4605aa7eca6f76c56ad7ad1f9d3d835435e36c2d4118f5dc55e4a21d5b9f3fd34a0cb4dbeeb13e1983507d7f2bbf7423197d70081f0b5
SSDEEP 24576:+ZMrzFVSOZsqjnhMgeiCl7G0nehbGZpbD:+ZMrzfJDmg27RnWGj
TLSH
T1E48501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6270c061f45ce1859a3f416c64687b16cb291a2dfe08c55ebaec868833718f71
MD5 74b5e7b7c33aa545f4ab439f03506e89
SHA1 c5d5acb26c683d5295b6177439f936feafbd5537
SHA512 6cabf367fcc5e9dc3e74221bbe75f464d5594d0ed4eb2805167ea4b22458ac03bd1298d820d31ee723dd68923d417b8468ea729378ea86b9f98c7b43fd18b439
SSDEEP 12288:TkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TksqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F6523BE965C41CAE92604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 47eeb22bbb2cc4cd21e886c24b0540b3f9a797da1631d569d69a5e939cb5894c
MD5 0fb31d3aff1de627c61965b8c658dc52
SHA1 607211a6dec7ac42a6b22849c57c571ffef6186b
SHA512 ccb02d85b4334d35c03e7399034d20d16cb5a420883cea5c075924f32b6804345bba12bc8faa5e2d29fa4ffb3fb47b72cd74c7ac7f3abdd80dc57e0e1e224174
SSDEEP 12288:AIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C26523BFA65C41CAE92644B5C3E5F14DA8173E6BE92004837A5B7CBDF7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 e5971477c3946f7da63fa073593a6ad303479e1db9be826c84698e8c10fa856d
MD5 ef78312be8534a11553331fa3da2bb7b
SHA1 660d72da480458bde77457d984561839aaa9fcf7
SHA512 045b4a27307c40265a8d784c3aaa5d8cc446d5c8fc8cbc4f53440296f99cdc2ef716607af94b0036aa8ce5bb3a2e2949cb8332751e955d9197345d13474e9b5c
SSDEEP 12288:gyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19775025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 086a52231e6a252af64fba97d1ede372d532e7806818d069df4a6170e7475913
MD5 dca211a8db9cda98cead030fc29f75f4
SHA1 c7e377b33fe0bfdcc02f9b0346d5e58b252c57a8
SHA512 6024bf47c4ee9b15f4859dd08566a69e30f97fff24ad09f5fd1b81cde91ab2d1ef7a3c78f713614ce0040a004fc7d1285eec46bfab5ef2aca57dca65ac601e18
SSDEEP 12288:3kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F6523BF965C41CAE92604B5C3E5F14DA8173E5BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9eff78ccd2e2d8423868cfa6fea77626e11136a59b4314d1da83e9bc7069edf0
MD5 f1b5fd0409c1a8675aeeaed0868461c0
SHA1 29709e22448827178c9f734e510ab10be70e95b5
SHA512 8720ae46c8e7a4a94665bc5dbac772017deeed03cbd3adc9bc8145620f0d4514e0c0050df2d8ef844f143dc9fecd15708be2fec69af06289f3ee65898fa1c90b
SSDEEP 12288:nkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F16523BE965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e6649348e61a305373fdd317367f98472001cc8bc3efbed4cdcbf931efee55b8
MD5 1a42b7fb168e43dfb2043e2621abac45
SHA1 e9163a328434cff06889842dbc7536e414d57ab7
SHA512 ca57166182d37c5996a8af6d6722d0aaa06eb7ba9a5de48824fb2393658b535cd5262359c14a1821d2ad610be45d18c92d290209a308d929b4d1da493c7c4adf
SSDEEP 12288:dyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13275025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 032f4f82194f2d633476accf23555b602cc95f1fd6b65ae1a42590ee770e8376
MD5 a26d0cd34f956b88ffb5a8b76b885e61
SHA1 3808f0ff539a8bf978619f5804376ac6878edb3d
SHA512 48836196eeeb6ed4d298dc4b0225a1dd1a3c5230e2d0e5251c201d2a3c660818d8611a8ff273df9fe2b078f5eb5e4d483be801f100c3e1e6b644c59cb7d0bd87
SSDEEP 24576:XTxaLl3z0zDbsqjnhMgeiCl7G0nehbGZpbD:XTsLljSDmg27RnWGj
TLSH
T1F18501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e9379fb0b4809c66854b4b87a6438ce8663b3bcad3385a461ff5486b79aa498c
MD5 894072532d99b85fe307383c91009791
SHA1 ac6468f18185403c14ae8b362145a737126deadc
SHA512 56cdb7aafde70568dcc52da8cf004197fe0b237ea8bf170404d80c2846fa5565067fd74b79dd25805ca0fe2d429ef9a0b2b01c94d4354990d3b62f06baeae271
SSDEEP 24576:/3Zd9CHKy7GZ3sqjnhMgeiCl7G0nehbGZpbD:PZd9CHKyaJDmg27RnWGj
TLSH
T1D995CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 35614248f4fab2180a6f7024231a711609752adab3a9e55ef5684d719a69323a
MD5 60c7704c948181b9310b1a6c06cbc253
SHA1 9bb9d66b0f000099b3ae5f74f28b770ca2ea4ef6
SHA512 aeac9907aa7b7c4eab4ae01a3fe5c22ba4c4ca300302bd3edbcac7969abc4e8e2b85c4b9c639a1c7b6022e3560bc03728da46d9b70649ccaade31bb7cdeac53e
SSDEEP 12288:YrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1356523BE965C41CBE92648B5C3E9F14DA8173E5BE92004837A977CBDFBF14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 71087e220d4dc7be43ab161dc5c14c158113a566b5f5c9da30e9aa1aab30fb78
MD5 160906712a159c136d1cd517240cb026
SHA1 3dbfd42c31827852af89f432999a147d49996f17
SHA512 8b44a7dcaeadb8c8588337bf70cf473727532a8c47a105e4cfb9a072505cf7386f5ecc030b5881c39a65f0710cb2cec91c9bc1d5e53e0bec1df9d96f1b59c655
SSDEEP 12288:gNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEi:gNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1376523BE965C41DBE92644F5C3E9E10DA8073E5BE92004837A977CBEE7F14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 05cb38efe9217bdbe9ad27e09566c47ae020830f3eb6567b4b93a0fb3ed0450d
MD5 9f2ee5aa2ab9a7c91e335a68fcfc1160
SHA1 b2a295f0e008d63fc31ef25cac10da783a38bb6c
SHA512 b66f07f280d1e7f635c38f0dcb552326b32a207c9f7a7c1bf8abcd48286e8aa88dd9128f5cd62c0ef7f1843ff65e1f98ea5b26c326dec784063103aaf631d070
SSDEEP 12288:V2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E6523BE965C41CAE92244B5C3E5F14DAC073E5BE9200483BA977CBDFBB18584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 59108c50abe3871bfbb753699ac530563b41511444c52734b0df83824396c7b5
MD5 106fc075cbd71c75c319200b6ca195a7
SHA1 424861d23abe2e4b66878ad7549a1d60d2f0b774
SHA512 0713edfe5264ccb8d63053633519caea2b80402b1ef910bedc3259ffc469fafe43443da9afc3cbf859dea6f67470a83532a994ff5e41635dcb487e085d87aa65
SSDEEP 12288:TkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1086523BE965C41CAE92644B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 7c14f442ee9019a104e2db5a5e30ba1cc86a962fb7c4fa6930389c96142b8e13
MD5 cbbbc74b531d6d0e088666ea2289dab3
SHA1 0a7d3da8c069d88867c44a3f714b5d4ea24a8518
SHA512 8919d774de9465816a1558bf3478c13ab28555eae95b6b57ed284d87ecdc5cc9bf79e753844506244548f373477388adc1c9d96c765fad26a4d18b214a61abe2
SSDEEP 12288:1rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F36523BE965C41CBE92648B5C3E5F14DA8173E5BE92004837A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 f18bd676156317a8c0a615180eb1a62f9f342b37a63084d8b92cfd7e1a8789bc
MD5 b0122c16e2110eaaf493165ae58536a4
SHA1 370abf342d297ee67917118c9ac6c0b61083eceb
SHA512 d692c01b6a041c9c1774495b32cbe4b4108626f65de77963fb64e8a1c9095f3093af2fda4caceba4657e6c51a459fbed3d41669a5b73bdbf121404bae37f8ebb
SSDEEP 12288:Y8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1106523BE965C41CAE92244F5C3E5F11DAC173E5BE92004837A977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 60c9f9e63c569c793955d7c2bff176057e67630b1bf7e02cd16a82b574adc9f8
MD5 7c1fdbd34b3138a7e081d18b4bfcec3c
SHA1 19decdc97aa70f5e5efad7cf8ca721fe995b23fa
SHA512 ce61c1e8373400ee91762c9301245e3d13edb870e9fa732175399ece15463c318065ad4a9e16deffd7da3943da0a14469be8d88b95663cb29047d265acaa2598
SSDEEP 12288:N6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF6523BE965C41CBE52648B5C3E5F14DAC173E5BE92004837A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 7f6c513a7aa85074282829e056de8fa80151b8a8bd8c927791271bc65a57f5cd
MD5 f1828b7fa281d5fc5c1788cd5b3b1414
SHA1 e84011abae8099853d85482f71d844146790a5ae
SHA512 1d8b8d0a9448105b2c00f01a9843470f4c6110edb2c69b5eff95c39b07a1b4183314c29c14c16e04a06bc3861e447bd433b58b07181e944c39eeeb4caa86167c
SSDEEP 24576:rfwv2k9RX6wkyAI4sqjnhMgeiCl7G0nehbGZpbD:DMnYIkDmg27RnWGj
TLSH
T1B795D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 532410cec9ac61696ff36990339de2346068e951577fcd96422cc49b0e5f4244
MD5 5354ca625425a7c17955ce9a35293fc8
SHA1 93a6107acb307c59cbf2d158e092c77f027faa7e
SHA512 a695fef33b92da2330f56e3a45badbaeaced143e7c0621840d41e231e74092b7d15b8f49fd2f1e73aca0ad42414c44e5ac677a06063ab831ea3288f4d2af6421
SSDEEP 49152:8YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zDmg27RnWGj:7ySzPLD527BWG
TLSH
T1B4066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 259c019d58d9c642c3ece5cfd062331eb608de1152fd8bb5e5c5745090dae7f8
MD5 123ace49db46cecfc3b9486f386bf79d
SHA1 3b9f68b2a6cefc13993cf119548afc579369eedd
SHA512 55d6c55d5d593a60038066dfe72141de79ef1434515d9762b4105c3bd972e8f889610b247ec96468a9abea0ad20221ec1e4979da9a38b9fed84be02aa28c7fa8
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJsqjnhMgeiCl7G0nehbGZpbD:347JUQjTirIhCnDHUPfF/jDmg27RnWGj
TLSH
T1EC65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f55914aa37eda0ce222012d0c5bc7161926c8997c6cf8f65b49d15a87f515e44
MD5 b64a55506888fb932d718769d5f9b803
SHA1 eee87e5fce6e9dc9d67f7402b1a013132be7e8ee
SHA512 75eccc312d335362006d85a936ef4c6c06172591fe12e201838f94b420954132f1beac475558bc5ca78bb151680fe1a860fc4bb36c162e1acfd15c31af6a0e17
SSDEEP 12288:yVsf0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF75011AD29802D9C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 0493c93f776523ebc35bb1ba662a7c03c09b63d6fafb2e5baffaf50da78c2ac1
MD5 c034bb8a96717a67517998410d5a607f
SHA1 d9e47dbb57b53bf6d37df3c6116a303f93186667
SHA512 cb867ca0965e3995f742b693d59afa85fd4aeaec8ea6eb634cae51061fa20505eec019a37badee6ddeb9306fb40f842e03f8aadb6b24a1facbcb4c7e64d28dce
SSDEEP 12288:ijn/Cmy5kDO8uPLIlkuCYfAA8vFZBxWzxSmcaRMb9yNw:iDCmhbLMjvDB4NzcaRMRew
TLSH
T147451850766AD75FC6A940325E32D2CCAB707D05EE05AF0373C88B3FC576568BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 dc5b1933b8e9863a946b1e7146d906970b8cc829c569d3307502639707893723
MD5 d25dd6b1ce7513c7c1538da87ad3da62
SHA1 a1775d05be0ef3e93d9f08935da2a84011c32e60
SHA512 108ea5a004b753141715da7a4a4a16799a2f4480a571c28f9c48884ac52cecaee39559f9e9122bf5a2589236d41793862bdce9153bbb9c52d8b75663c88b704e
SSDEEP 6144:YgeYjC8mN/8RINjSF69lsi3Z5k+wKDexHE7kZzN/GK/GbtigSZPZEBK+aEkI+9YN:YgeYqB7siTk+37LIpbb2WnySk
TLSH
T1CC65F981A537E38FD1F760720739AB4CA764EC16B7055F26B3C8053AD82A725B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e965e705b91094d951df0002a0c4f36476c0b887b1a638d83c302fbc8021b560
MD5 b1640e81684200343574ed0341d95423
SHA1 dce0cbf2f8b37789fc89509b4f023f856d5555d6
SHA512 58f880576dd2d395c224578cb9fa9ec3ac7f8bae075c62c09874b2e5aab2f56f8153a284d691c4921484d2f27908e5ab61144dffe68730ce64bee898b28fb689
SSDEEP 12288:nO7MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E665237B934C518AF93609B482EAE12D680B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1eceb9f728ff378cee25cde5d13cd36a6d7773c2034de8d9bb7d91fedf82ef6
MD5 b7620b706636be9feb10b3df0b0bfee7
SHA1 c5ff9435803cb0b13347fc81eb06adecb24ebcd6
SHA512 b59c74ceb0c82409980078d7bfdd505466484cb01aaad87b290961d75078544165449d4afa2cf1460af749e709d608a479a9b1c102dbc59ffd8d22daca2baee8
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bY+sqjnhMgeiCl7G0nehbGZpbD:fgb4mBIBhGFNDmg27RnWGj
TLSH
T1FF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 96db1198951eb8ee854a1605d5824391ed2bbd5fdf7c078e29404bdd50714d0e
MD5 3a3ded278b1ee4657d628a5787d2eaf7
SHA1 132113df9f3912329a80c2d4b16c783e72f80b47
SHA512 51fa9d5f78f2be4443ed40be9969b9eb6cb5d2b0295957270297ad9887cffd73640452ac164579a01ff4d90701d37c3af16004a50c5914d5e74e5ebb07685380
SSDEEP 24576:UG88u8FpJqH19zria7/mZsqjnhMgeiCl7G0nehbGZpbD:n7ZFPqVka7/aDmg27RnWGj
TLSH
T1F895016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1eca341b439f83a9f24a09548abfbb0b4d7b531de5f4ded202b7d90a488916e2
MD5 59d9d261d2dd3fad306d1be6bdc4e165
SHA1 b24c20517dbaa0e11e5fde272fb0a04a75b95c1b
SHA512 ee907652a59495335bb0ca27939797e54ff83b565be53123291d2850cb97fd9dbe81aaec13e3a3a57a8c980f1a629962a4ace3eb2525e80be2e5459395233815
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZDmg27RnWGj:SG05lO43bMD527BWG
TLSH
T1C2D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 017625a315da61892a0fc16176de4b30a95c3bc59a191b98b9dba6f96a076d14
MD5 66c75157eddf14f1fd3639421b2cb731
SHA1 935d77cf469aa5791fe393afd7c2e2644c685801
SHA512 bd9d8f4f938e4595e701f273945f4a191eb8bba3f1af71a6bef10309205e2fc75d0989a9ecfb1cdf0ac7dbe4c7d55b18b458a6d3930453e24fa4d8a351e09dc1
SSDEEP 24576:Hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnPsqjnhMgeiCl7G0nehbGZpbD:/a5POZ3BJt2pasx2+mxDmg27RnWGj
TLSH
T13465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2ce4c0c99573ee112989ee441ab3fa855ab09653b9de5fe51eae42bed9722830
MD5 87caebba3df3c9dd2fb79166e44605bd
SHA1 46c1ca0513c81fb5c6536279c65fb2ec650e7fa0
SHA512 a11f0fafe25e31d7465ec695d572b866e62e49e0bdb4c640b706dba8183117935aeb974d52a720f9c8489dd3fa464df3ac642513fcca01c328129f8fbb6e1138
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkBsqjnhMgeiCl7G0nehbGZpbD:bNc/zEOVHF6Dmg27RnWGj
TLSH
T107857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5955696567a09869a25cd9bf07b1ee8832f904dc24f36ba1768f82c00bca6518
MD5 ad477920bf6dad68cc06c24176b91212
SHA1 eeb8c1511afd4043ffa93bbf4d138b19a70f6ccb
SHA512 f47739a040f154c9cff5d35a700c7bc3f36989c41fb4e896bae328a8e4e0622ffe2dff1fb3b777f7cffb33e50200260f525795043a288429fd2f8655cc7b7342
SSDEEP 24576:tTkNvNnaFeYhJNtmZBm+sqjnhMgeiCl7G0nehbGZpbD:tTMwBtOmSDmg27RnWGj
TLSH
T1AF55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 fa0173badeeddeffd8e0293621db38685162ecce18735ad4d9f116982afaf0f1
MD5 7ba4359ed8fa521904ef98650260fa36
SHA1 f06851c9cedf37b460bbad541444f94081571f53
SHA512 998919796d156b18fc77d137dd4748e222b8b3db0719842eb571d96ab923a844990ce57f3d2fcf1568d7a048dcafe5ad52725c8705b7af3b1081d52d30a626a8
SSDEEP 12288:9HvUrBFrEjwaQVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:9PUr+NQVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18385F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ca21f29edbc5d409795e8829deae6ff0ff02a4ae3e7413a3e27ec2b5e452f607
MD5 dc866c55a19a63c43c379a2f1c45c884
SHA1 398499e2f550da0b3ba0e01032c0f8d8404c8ce7
SHA512 e6da47352fb77725b6a7c5788c2a4e4ac6467d34b736d95924c4bbcf000fdf573b82477b3b07ed5df1f6d5548060693d3093bcf8ab7fc57276b234dd46721030
SSDEEP 24576:HD3FHshBIYQgAAsqjnhMgeiCl7G0nehbGZpbD:HDVHeBIAA8Dmg27RnWGj
TLSH
T17295E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/440-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/440-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/440-333-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/440-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/440-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1232-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1232-65-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1232-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1232-283-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1788-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1788-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1788-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1788-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2360-85-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2360-79-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2360-299-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2360-76-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2572-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2572-14-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2572-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2572-29-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2572-28-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2784-120-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2784-317-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2784-117-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2784-125-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2800-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2800-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2800-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2800-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2800-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3540-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3540-112-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3540-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-318-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5140-89-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5140-314-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5364-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5364-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5364-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5364-57-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5364-77-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5532-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5532-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5532-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5532-139-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5532-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6004-36-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/6004-35-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/6004-0-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/6004-7-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/6004-8-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/6004-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download