53a7a34b5a0bfbc975cd443d6e12e396941b69515e16121f6fa780f6e404d129

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260802-epb5msthnd
SHA256 53a7a34b5a0bfbc975cd443d6e12e396941b69515e16121f6fa780f6e404d129
MD5 82dabb531c36e35301793ecda7c41bc5
SHA1 af89d736556e452a9d28ad391509de8de56881e5
SHA512 a9a011984526c305d7fcb66aef09c492c3ee4601d1685e57c69caa6a5ce953b4f8955f854df82bc752ddf2e3398a0b74394ad0b24d21c3855caece938afb2139
SSDEEP 49152:C8JFD1M+KdV5Taq0RBqEstikXkNFK28X1ejMcYzKlbcEC+MRki2N3T0ceE45Dmgo:o7KbC/D527BWG
TLSH
T19A267B1BE7B940E5C0B6D1798A979517FAB2781A873297CB4391471A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1860	elevation_service.exe
204	elevation_service.exe
1456	maintenanceservice.exe
3692	OSE.EXE
4664	PerceptionSimulationService.exe
4412	perfhost.exe
4252	ReFsDedupSvc.exe
6096	SensorDataService.exe
596	ssh-agent.exe
5992	AgentService.exe
2868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\37e1cf79c618523d.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-02_040640_792-964.log	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000513cda573422dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d926e59c3422dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab68119d3422dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2e920573422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c21f1583422dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000037667b583422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d3111583422dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f2b73583422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
204	elevation_service.exe
204	elevation_service.exe
204	elevation_service.exe
204	elevation_service.exe
204	elevation_service.exe
204	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	792	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1860	elevation_service.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4252	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5992	AgentService.exe
Token: 33	2868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeDebugPrivilege	1860	elevation_service.exe
Token: SeDebugPrivilege	204	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 4296	792	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2868 wrote to memory of 5612	2868	SearchIndexer.exe	103
PID 2868 wrote to memory of 2364	2868	SearchIndexer.exe	104
PID 2868 wrote to memory of 1836	2868	SearchIndexer.exe	105
PID 2868 wrote to memory of 4508	2868	SearchIndexer.exe	106
PID 2868 wrote to memory of 2920	2868	SearchIndexer.exe	108
PID 2868 wrote to memory of 2072	2868	SearchIndexer.exe	109
PID 2868 wrote to memory of 3868	2868	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_82dabb531c36e35301793ecda7c41bc5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:792
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "792" "1448" "1324" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1456

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6096

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:596

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2832 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2832 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e21efb8e3338cb114f1a9a8f16380ad6e33d9bd34046fcd844a39cb88bd43804
MD5 171d6288884f2d179553045920026a12
SHA1 45579f6d6625ae137b3b576db6237ab618e49eb9
SHA512 8d4d12f7591af312b0b3cfb453993f1c4af52c8b492a70a5e130f807bf5ed26148baa6d7852df278522fb0cc034370a59f231ce40b29f63f06c2455ba1440dda
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnVDmg27RnWGj:a3q6sjBiD527BWG
TLSH
T1B7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d44d5ed8cb430d8df9770b1d5afc8a24816330901dd56cf096a72e4f6d754b4c
MD5 55675b08cee8c78b74ee399e292705de
SHA1 99c13524a52c5f6083a791d7565f9d42a914bd66
SHA512 ce205819d31f310a0b2037f4ca5831a1e6b10e253d3ec12490c50eafd7f75931c47978bd4575b4728b96ae2977f907dc33be98ad980408f7148b06ea28f645dd
SSDEEP 24576:zXYfDtczAasqjnhMgeiCl7G0nehbGZpbD:Wtc3Dmg27RnWGj
TLSH
T1B8850129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0af4cc92c01caf119b61f76304f0497cfc47a0d18582b056537e8ea517314fbe
MD5 9076d78db32ba2c2e3ad058733df8954
SHA1 6063dddf605a385661f752eb31df7ac5689f0dbe
SHA512 1a688d977b68e347abca9642a4f78e874d5ec32b0471a44e094bc2149700ab6282e255a1d1dd37a17fac5e58d09ea55d5ebd40f7c792bd09bc79f86d59f20cce
SSDEEP 24576:+0Le5ji0hmx7rM5sqjnhMgeiCl7G0nehbGZpbD:+Pji0A5EDmg27RnWGj
TLSH
T135959E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4e85c17af0e766fd6845ec9435baf32dded936f37b2b3f33e7b29b4943c983c0
MD5 241396634f58b72be21edea9196c8710
SHA1 0da6a431d05ee7c288cf5bc4428326a493582c80
SHA512 a4e8d730ab4d76fd391558615ad96ec760419d5f7be5c721adcfc98cfa0fae4422e5409fae0bd171303eb5a4a5cf971afc3ae99af1d96ce916de5875b2e3cb14
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyujsqjnhMgeiCl7G0nehbGZpbD:t/ezSC6vUzPveHjywDmg27RnWGj
TLSH
T1AC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 37080008ab37f6881f4bc585c8b816628050c430bbf6a151df76f0ea52a4c91c
MD5 0a93d17e8cc10169c3fe9678eb0393fe
SHA1 c0c87b3b66c2af89dd307d161b56614471b60ed5
SHA512 23aaf7b6e95fae508dbae87a46e996e39c6bd40d91f25db0764f728caec4ca5d5875074693b763ada5359843f9fbc7bf2f77e98a5c2424b0a84dba4578b764a0
SSDEEP 24576:uVbqPb88hv/l+Y+sqjnhMgeiCl7G0nehbGZpbD:uVO88hXl+fDmg27RnWGj
TLSH
T1AA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d54185c90e468fb7f7af12391e20d3e91a2423045e83766e861993f3cdbe58ab
MD5 555fe70a099375d5688c04fbefecab38
SHA1 4fc39f5b3cf84956e52fcf7f7d005940eb2d3610
SHA512 ba7b0f0c6a1bf226e93f1dcb397a16f12658ccbbe44406c7d2f964e233a5d7f57657d42f2eb74e4faa58c155b697b87d17915c005522f960fcfb60b585cfbe64
SSDEEP 12288:M9tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M9tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C46523BF964C50CAEB7608B5C3E9F51EAC137E56982008436AA37DFDE6B5458CB39013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 21316ec7708b9688955dc0afe416a8ead721077854f29ad3a4b1b22bb3a619c1
MD5 58ab3195babb79e1ff0c28bc51c15918
SHA1 25c9f70f4dc7ec7893d7bba4f684124f020e3dc4
SHA512 12198dde66098f974b2d0ca2070206a9ff95a6dce3d4f6908c3f1bbcfff9b4502733b21616007cbf1fcd7fde838bb39e484c3824b330b94d64d2bedad21055ed
SSDEEP 12288:xeBNUbTVO86U2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:xJIU2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C385CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 246ed4b6f4026eb70a1844c56faeb4d5fbcbe8fa482f69239813659cafcc424b
MD5 f91a132b4d8ca43ac518167d250dde08
SHA1 7f4aad606dcff124277f947bba6700919e4bb077
SHA512 0a3118a8f0f1ea0858acc42d854d4ac9bcc7cb991cb4960ec7b7401e0c1c3b6c37c000022d0662f20f4db00205b99e63c7e6b7e49442dd946dda0637b9f9d508
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:sQvGAdlCEL8c/DRNw5CXD527BWG
TLSH
T147266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0099dce9d141290efe3ce23c33f4b3587e2152359410d6aa4c9072640eea8676
MD5 12ff8828cf8ffd7ee91d93502384e4a1
SHA1 64cc7f2b7addac3fd762dfd09216c64acff955b0
SHA512 6b1dd5b91db0d938923d15ff0b34781c114639625a3d5adbadb651b5c54928f7196bb2fcc6da1fd8f7cbf5108549ae918d6724ced9757c5e180477ce3dc07d36
SSDEEP 12288:wAwSfxL/2Dc3DDLLmt0LDQewsAjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:FSewsAjIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12985E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89E9E99702D12736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9acd7e246a506022dd3f98fa72271b494fc89bbfe583014ca6875f48199ed4e1
MD5 eb562384c8a6ecef0f8584d73a398591
SHA1 cbee0bca256fe33bdaf3a378d51939c425eb1c55
SHA512 01d9918f05fb6a02ddfd796232f3ea302d9ffe4772a79781e6524bdf5379ae1912b0a1c0086033b1fbfbb42a9f3a89556e5aee80531e9e5b21842b7aed6e86c0
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:eUEtQevvqc2W1cpV2tI32zB
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 11db57a3d7dcaa1f3e28d0aefee9659f01e500759babb71308608dbec40f8377
MD5 184affaeef178ed3c2a952ec1162fa7b
SHA1 51887493df86be94e541f4f03ca348bf06001484
SHA512 43ff208a4d19e618b123b67a773798ce5f557787f592bef8952a505b0e90a533fcf929a1812e7b0def02a2d91269c52900a5d4dd891e45216d66da38c74023e2
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:eoquVjnmDD527BWG
TLSH
T111D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ff23b9e0f3b4bc88f9e99729a95b36e6485d0570b876d1841b8dc3598b8ec87a
MD5 f2f88d9340a0254ca75f0bce6bb16eb7
SHA1 6fbf48bdb85347db09d129301571c600609c6f05
SHA512 18458129726d385d6be271f4e5ca8ef4c92fdd5cafe2d16093a701af444d0d5674de93e1758eff7fc0c3d996ed247e3763e4690070509c105a8b268baea5cc59
SSDEEP 24576:6AhGL3IFoiwtA5l7S53/sqjnhMgeiCl7G0nehbGZpbD:6AMUFoiq5zDmg27RnWGj
TLSH
T10F359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f37b9a9b02cdee3c0f027e3b96051a70e1f331640faf4b86f915d63793c131e3
MD5 8e9d5a0e334afba9400b88aa941e3226
SHA1 8a50600ef1deb2915b352c75db6cb9cc60edb95d
SHA512 0b125db4c3927d5ad3da23736181b994110669bef22c25da833f22ecfa0d2629c463f4ead3d793760adeb91b9d0527880c54878e571b5cb95c47c2b5b8d5945d
SSDEEP 12288:Qmw5HEjsChNPBFgl0WDm+CDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:NwuWOW0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E85F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9d057fb95687a56490819b99967d8d0521beb35369d622aa44ac5ea27b42b012
MD5 da3b5103491c516d5d6e02fe16e46e9f
SHA1 b6261f202b0cb232dae250eb1f774e8587f514b9
SHA512 c6cbcc080d38d9f8f4b7544fc29d6ddaeff439c976da73c65e165ad095788e65ff37b876c8d27365943ed90fd19c6e1cda624ff23383821e4402e51ce9ebc2e0
SSDEEP 12288:S0Z1Iy4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lZuxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1437512AA239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eeafaad407a60d5bcc72c2ff7c8e793af6a06d0c268a6b9e9977ee6b1289284b
MD5 77c1d9cb124279849c456564208fa772
SHA1 4500f25fe5780e0cf69daab195b65d1635e49b8a
SHA512 3c84268cd58cde7e88db432388c91ddb8e565a915a2855219b5fcee08e958e31a82c5029e99902c35b4d9ef7bd8e428b6b8c0805aa58929460aef52d5bb2711f
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3WD527BWG:wQyiKa/X+PNmVQBWG
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9a5fe2dbf8d88c5b2b5ce074e1a8db218b9e82587610322327636b43feef951a
MD5 74b2b365963a6bc74a2d7c9ba04eb5fd
SHA1 b23c25118a2f0c740ff2785da93c5fcf51117b6b
SHA512 0bc58129555f4266c89bb6c7e714cc3891c9d8d29234b57aa06bf2a025b6f8d2d376b46df665d978d197c855cda81993fc62889d7dba5fae4155261c93dbeca0
SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3WD527BWG:bQyiKa/X+PNmVQBWG
TLSH
T175667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e805a887bd3e739e3c4f31ad1613790d849dbb120f8251ae5d641fc68664de59
MD5 d1374c0eb2f411bf00f8ea3b3791d021
SHA1 44a89cba805d8023a42e68cea706c5cc32f59f48
SHA512 c90ae7066612f4f18cababd6867b412b5cc869b2e36beb528fd7c2e3dd1490dffefe9ac62742c1471cf9588e9f0be7b41c6520e1c526c8125d57251f35c11a66
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0BsqjnhMgeiCl7Ge:b68Qg55nhceWu7PNU3/EDmg27RnWGj
TLSH
T17BB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 015ef1495042dab0b1b93ae70122c1bbdb58fc8d2e01ab96c0522c31fc60e3ac
MD5 e84ab9e4f6c241936e69c4db53327b4a
SHA1 83ac32a4ac4939cb4f35dad50d9b7619386e6c7d
SHA512 b668b590022e9b482cc4fac57cf1996f79c79267fee22d22ad97a4a2c7042ea1f25542705ad9b07a878f3c3c5209f0c2303a99b4a053a6baf399fbc497a47baf
SSDEEP 98304:ty5112gYy5azzVvt69nLKnhZRD527BWG:QLIHEWh7VQBWG
TLSH
T177167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f3243a462c9e1f8ab0cbde2bacfd90cdad9a69584a6ed0c900600e08da3ca360
MD5 313eafed9bf24faf958d6ca3ad9248af
SHA1 307d27904db903beab5bdeebc845434185136c83
SHA512 f743170c9b881ba42d5db728fc0b2c6cc31bfed78e27810a550aeb59eec4c3b30ce5048b35441424806aa8f214c728a38fee8ec7c0ce1aa20bdc88abae8cee13
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1Dmg27RnWGj:du6Jmdxd2d1D527BWG
TLSH
T12DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fa24bdf6126bc41f5e61941cd9a7762759046e43859fea26717a8995a1c698ac
MD5 7dd7c77001af132cd3a3cd2473c50c22
SHA1 52ad5887daa1515d390b491320ae28b7fbb464c6
SHA512 ce8e81aa6c7335f598d7a69784810ccde1ebd9b2a12fba82bc0fcbcc1c4d3737fbbaff4993599b288a4c8ad4f80affa4c2883a4168a1a77d1ac40fd9e2ca80b7
SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xaDmg27RnWGj:ymifPWRDD527BWG
TLSH
T15EB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d56cd6fd891e78836f6c87446b80ce6a0aa65652e3733e5c4864f92fb1790474
MD5 7b24b71910cee531467638d043f673a0
SHA1 d338e48baaf6ca155e0568ef923ea25d2a4f0b43
SHA512 43ddac840b260d2ba663830223ffd85720d82bf0a5c6f132e6bac07cdeb9f8ac7b185648b3d53eeef73e320487857e963b47948c958e65713e954ced16439662
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqFDmg27RnWGj:B5dKii61FD527BWG
TLSH
T114C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3816449135953603f775f8666e8829416c41c57316ce5be85beef44e1b880793
MD5 d032f4d6409b8bab93dd8e3d597d98bc
SHA1 c6341bba6831c261be2f7e44685548882c9339ef
SHA512 91b7e6573041432567bc446491372d428117080a0f19f317f0bc9768b4abf0bb6f70c9a0300f3703815a9bbbe98420ed8192b501f55f6636f102d9cbcdc0f52f
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wuDmg27RnWGj:DX2imphPD527BWG
TLSH
T11095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0ec8d8902089923adbf1d49ea6a36a79b74a0c12d6fd25b175bf548f8754fabe
MD5 f9714b9fefce004f9cd91af2f4bfe25c
SHA1 7e7f93aaf9c0b82f698e0829e9173b33b83b5933
SHA512 7916a73e3baee7f3f2a1d1d61d5b6c68a6d016ab63ddddef9a302c344c686849dbcd033ca134bb7f1cde5d373457b7c73d2d1cd4685c2ad03d5dc3d5d07619ea
SSDEEP 12288:ulXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ulsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1846523BE965C41CBE52249B5C3E5F10EAC073E57E92004837A977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 05c431b052b9c5484fbe7604369563da482c3086384122d324faf9630d49da7a
MD5 b35c33a97649965967bfefa0a59b8e72
SHA1 aa3c9a062b754c72a17d076ba5c51f6d26cc4ba2
SHA512 1b3f0c9195ede0a7f3d93cb8af7109ffc59cb22a95bed4e3444f64eb262950417349c369d3e298d7149b4ebbf31797226f0dd04665e94b469ba718b1b526e526
SSDEEP 12288:u8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D96523BE965C41CBE52644B5C3E5F14EAC073E67E92004837A977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c8a3d48f6b1975230f6ba5abe101e96de8f2bee794a18718909bda2646cbc5fa
MD5 88de06744bae35a6b96f63b6c38e3399
SHA1 52cf0fdfa5d6c7c405669dedbcbb8a07b156f9cc
SHA512 bdbb8eceb4656b32a55baf9fa727116643779814422506426623215e3de3a4fe94a27427e706ccecd6c905865c96bf6af5e66e6c802b1cbfee6dffdeac59e6be
SSDEEP 12288:xOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE6523BE965C41CAE52648B5C3E5F14EEC073E57E9200483BA977CBDFBB18584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1ad6bedec7726abfd70ec30b14e879cda6916619306d56003fffdc9ff2f56f20
MD5 f870b8366d4ae897474f8751affce32e
SHA1 f22359e1ca95c41eabfe446878fb8cf4e6d3f36f
SHA512 fd5fb280be12e888522b372e02a35fb5f5e24e2f408c7ad1e4a368712bfcdf1670f195b009c8a1530d3f5345edc54faae0e1f9939cc05132f3d90c432edc6f35
SSDEEP 12288:PVfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B765237F675C00C6D87285B4C2E5E11DE8237D96EB3005DB6B532CADAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9b112af0b1ff0e36485b628332557dc967874b92164a2a9b8ff8fbf7bff0d324
MD5 aedffd51a538d975757c833f37fe9b9c
SHA1 749eb837fad198b9a35ec53f8d75e1e4f4d367dc
SHA512 2f6f42b1afb29f2b90a4285c9f678fc71572185efcc28f2a8c1cbd0ae241fcd2504ba3b4468f8280dfa83efe33e807cd674e8e4ed849338ca868aa5e059c125f
SSDEEP 12288:+HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD6523BE965C41CAE52644B5C3E5F14DAC073E6BE9200483BA977CBDFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 af463e6e55fd3b9440d7ae35dc973c8dabdce1fbcce4f3ace3dd6bf4982d5f8b
MD5 a4dc4005fe1d4a0fe37d12e1906d3f09
SHA1 b2538e68f5e89b99183fd50ee9ce705333f65674
SHA512 29da58a58e9f002d34782cc94a6ca71fefb698fa3f43d99192002da2dbad47a1d6eaa92dd8191bb257aff59d9cc64cf2d8408c826606df6eb20582187b9d1f79
SSDEEP 12288:ggXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ggsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1076523BE965C41CBE52644B5C3E5F14DAC073E6BE92004837A977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e590b790e083ee2bce658db8f90328b81f0cf32c7bba6dc3fc94bbccd76cf199
MD5 8929a3f3fbadd56ecc304ead45b18475
SHA1 f1016d2012fec790980e82bb3c9c54b9d8d3f0d2
SHA512 242c8ce8c1eae74e3cf76e39616cf2e18ce3498434244fa22ca810b35b04be9ce42102e886034df4d36d6d4b6365af2087eb5992868f15f9bd3b73eab8d40c1d
SSDEEP 12288:YEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E6523BE965C41CAE62644B5C3E5F11DAC073E6BE9200483BA677CBDF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 9a8efa7a33d52c39dedfb1c57873b10100815bc0aa76612481eeccb63f99b848
MD5 6e4b90f181c5232144d55b016fe15f45
SHA1 21a59c576842eca2a5e5a77af2631db981232c41
SHA512 5aa133a06df7555bcd58f990e2bbd3e5ac1e622cbbacf9aa9a4549d41865712946f404c1292518255fdcdd7332a67c2eb8ebaf25865d27b6bb9a05b5b5b4a205
SSDEEP 24576:tZMrzFVSOcsqjnhMgeiCl7G0nehbGZpbD:tZMrzfMDmg27RnWGj
TLSH
T1B08501A9B39018F8EC63813EC965D90AD5B37C5A4B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 aabf13bf94d0bcfafc946580d85b3064fcfd3247a956b2e286232868f69144ee
MD5 e6801a0094a969c8cae62d3276005608
SHA1 45b5abc29e4e368d9a60a3dd2781a59b6b0d3d41
SHA512 77bb3dd632b30b226405857f89f7ea39c584e93c523f46205d662a5df2ea5f7c5512a6b2d0a4eec4757f790aa6b69c985bccafe6708685cd70368fdc15a5037e
SSDEEP 12288:GhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1366523BE965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 37ecd522cf978e464d4aac6b4e27cbca8159f4314cea6d29b6065349ba2d9186
MD5 8d2ebbb34dcdc675e1af58250a042b44
SHA1 237653cbec0896156a6b90763210cdbc098b7b98
SHA512 ef040be4bda54aa3581252cdbeede97258c31cfee0a49c66efa47594046e7426017f460de844648b3736dc0c905a8a6251244c1b36a29f360ef57f20ce6cf2c3
SSDEEP 12288:mdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F46523BE965C41CAE62644B5C3E5F14DAC073E6BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6bd8ff8d29c5496d27261eade2741f565b9ab384c3e72afd5b6426bb383c4e2a
MD5 0608c7c4ad782c0fee7fd87ff473401b
SHA1 eeac20497f388bba153582db95ff2dfd77462be7
SHA512 f5fe04630011a55b79cde9cf6d6c22ec9ae8b33a834c2a6dd78d1ddb3b9bf510ba0198c82685737203be77d1a457ca718cfae0e6a09a65890bcdd085fddf08a6
SSDEEP 12288:ZyPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Yzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F075025B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 1072a6fb1e142daf05038d48bb9f933984a27b1d421327677dc491d2e640a387
MD5 b23d249918b3d2e3c86132ae03887884
SHA1 42e8ef1a91de49575d7d1525e60af0ebc22a0579
SHA512 2996ed51f64d354f1df7c8b0c3ee330acf5fcc7c6bca81fc40192bca8dc4ba54c21d7eb3140b857bb4d6d44148861d4607d97431586666ffb4139c4f666f7a61
SSDEEP 12288:8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1726523BE965C41CAE52604B5C3E5F14DAC173E6BE9200483BA977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 821be289e03d8d7ab15ff8249e0981d8d8d24f0ee250513c9374decc28ed7a3d
MD5 1a458ad148df0d406a4ebd0cfca77752
SHA1 954bcc1c56ae9a5039939220a5817a425ba5f87e
SHA512 e9d11166723f93c28640c547250cb11702ec786ac142eb62651cbd5b93faaf8d839ff217e01a6fb17c4eeffe9366c6c82634d3ef4f183e5e71abaad8cd96cbb3
SSDEEP 12288:OhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1746523BF965C41CAE52604B5C3E5F14DAC173E6BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5fdb8c77f655d79f641554816b884ed6461962eda6271acef31a2cd4a6fcee6d
MD5 3842037ee1e146bbaab84fb969c5356e
SHA1 a737fc478e73f6b46adf82765b03561e624c106f
SHA512 102f8f058e83bc6fd8bd52ddbba40bdbd6d1fbd985663a613b93f846885b295b17b9eff873cd0fa379f58abd8017b7c84c20ed6f08290b4e789419f647d06b48
SSDEEP 12288:5yPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB75025B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a73d4c492f58fbec82aaeb816331873c5b3fcad0027cd91095923e4655c81c31
MD5 4c32b2c1647387deb5f61a402ad81b6a
SHA1 0bbe8c6dd4b05f17da8dff34d26ea15e7bbfc273
SHA512 559a7cf3a55369a08d4469ef6bd3b012315b2e796c230e3651406fad27c30e10525d99dd9857e782a4a0b7350858601c7fbad905f63d27c3149fca74cb82cd14
SSDEEP 24576:+TxaLl3z0zDesqjnhMgeiCl7G0nehbGZpbD:+TsLljnDmg27RnWGj
TLSH
T19F8501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 c17bd2afbe28d615e414e2959e10d564e0d419f66f3a6ec942103e5cd014d0ec
MD5 acc4f5240b60c180c4ffbb87cdba18d3
SHA1 d5458f5baa75a97bd01baee1ad615924c5e84fb8
SHA512 cd586893a0665a4203042ef254c0cf730f7a61b042116a8578db9d6a4179952ee2607ea125d609bd7967088e5f4dd26f003f91476e2649b95e209197e852673c
SSDEEP 24576:c3Zd9CHKy7GZysqjnhMgeiCl7G0nehbGZpbD:GZd9CHKyaMDmg27RnWGj
TLSH
T1BC95CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a4fbe014572bd470860033d7baceb4a03ec1b00137996ad5b89a2e44099f9f06
MD5 32108ef0152ccb2ef3bd459cb5a651ba
SHA1 95bc8c51bff35bcfb4c573cb149e9ac5e527353d
SHA512 ac3284c178894453847dd99a0f0941ce8c1b34493fc181eefe445aa731e15e9e6e61a473868176de09f7dd6da84a2af605314dca27b31d189e26593f62bb384c
SSDEEP 12288:TuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TusqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E6523BE965C41CAE52648B5C3E5F14DEC073E67E9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 cb5c3d5e28ab0a713dd3f567a46e1bf01fa157fa8840970625218e7b99f27c61
MD5 5d7b105f014afcba705ae1c8c63239c1
SHA1 7b437750c2ea5558358b6afc91658c99836d7ef7
SHA512 918a35fea0121410bc13ce468c67a00ad3ce17413bfc955e8d46e151cd71d0199309c8cd68975c246c0ef42e368f8ff7c911183248cd4714562ff45638207266
SSDEEP 12288:DYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1966523BE965C41CAE52644B5C3E9E10DAC073E67E9200483BB977CB9EBF18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 9fb0d43ec710be994f83e82cc74be8a46b19bebfd29e1a5fc522397003c6822a
MD5 ddff4aee3a2b68abe248f3c9f22da381
SHA1 2be12dadddfc6348091e162de93e901acef31d65
SHA512 60af15b1820fd9342c71266f1921a41ff6205c640208c6593aa7ae23406625ca3cbb93adc3347c8e05330bf4151d9352d2f92e31d8dcebf5061f6804e3cf4d11
SSDEEP 12288:OLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1666523BE965C41CAE52644B5C3E5F14DAC073E5BE9200483BA977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 9524714ff7c7535667272058f6487911c72f3b297f53e9bc2f1e78fa693691b3
MD5 48448319aab9e1b5a1947d04b2f26114
SHA1 85af8ee351b648d9f662f6bc6aa76b92fa888646
SHA512 2c9bad6bf2b883e698b17ab5dc4892de5550f0f609d39b2a7776558ecf096d732faeb8da23a28e77683e439d633f104b791e86160b8f1abc13e8c5584880581c
SSDEEP 12288:WhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E6523BE965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 454fce4f990fafd566736e1b030bc77e68a732af9787b26bab5b08a2c3182253
MD5 151fa8efc74ed250414d6af01ad12388
SHA1 f7f84582adaeb1cb3f88679a18781e0fae1da34c
SHA512 f0662db1466737980c567ece0df53f8d1ca986e6846f1c4b0d2b508f7d042bdb0ca03ac8e1aaa39fb16b7b1229c0e0d9ab1a50b1fb17800b832e8141f37c5fea
SSDEEP 12288:VuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1556523BE965C41CBE52608B5C3E5F14DAC073E67E9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 46f854e202b9a008c7e6de09d04551613b059fc26d6b8695d30b67d33b366222
MD5 9f623f3c456d84beff58434322268309
SHA1 c53113760ef6cc0b566aff2c418bff83d8bfc351
SHA512 08e1a1656e554968587ee37f6d2d5ccb716f51b726f89ed3e5b0261d1892ac36a48206b7e01f6d315d6c0ef3bb90c54785766ec6b8a72c81bdb45b772e7c6095
SSDEEP 12288:2JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C26523BE965C41CAE52648F5C3E5E11EAC073E6BE9200483BA577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-02_040640_792-964.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-02_040640_792-964.log
Size 1KB
SHA256 41dd3d00385d9d3f27251441c5e154f9d3d87d38d4db4bef2bff858fe96f42e5
MD5 596f8a894194de8986acf4e0d3030c0a
SHA1 8bee0dfc63fbb065c782acc0377128e698862503
SHA512 79cd824325187f65acd5f857274b93f12440c2ca88780e4be2f253ba3a9fd63731135696e0ee91902c46d016a29fc816adba6cda12e30b6673ddea1fa81fba15
TLSH
T1D021515A2BE80E06FEFADAC299FA10535F393A917835C65D55E4434E0871F80EEB4723
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 b975fc9e488d12e5d573ee6b57d09d30cf09ec5ebcfe22bc5a31b7c9fa479987
MD5 18948d35126f5efb1f6a78527ebee5eb
SHA1 c589dd7f4d12faf0c431196506bbfa49faa05118
SHA512 d94f691772bc60683f0f2556a2a1059ef9ea63657844177f3a5f8f5c3954456d2b759611086b95895cb170df3f23219fd6a6ccb99d6b5af6d69159b79f51b5cc
SSDEEP 24576:Tfwv2k9RX6wkyAINsqjnhMgeiCl7G0nehbGZpbD:LMnYIxDmg27RnWGj
TLSH
T14C95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 67e4b3f0b271acf69766d80e38697ebc757b61f2d53f382ddb386d479a0a608d
MD5 1a19e83ac854f5a9749c9a47ae74a198
SHA1 225075c71df4480a9f8c3cea8bdd27af36d88ca0
SHA512 b857a2e561495bdd3ae7ad2ac22a33e88f5a912d1164deca41ae89373a09e449552f12b1d492e8ead91e91667a7ed3a5b84036a4d9fa104905043854dec153a2
SSDEEP 49152:PYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ODmg27RnWGj:aySzP2D527BWG
TLSH
T19A066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cf875f83f82d5a5715d606dfda0cdbe4ac12546323b01de3d334fc68e37b6e32
MD5 bd2c9c870a4f1ffbbd290d96d4702d29
SHA1 e99592bafc8ea93418ddda0993b1b0f07ebaeeae
SHA512 9ede4ad62528b97a2fd6cca2a37ad39fd429ccd0038400a36b61419426d27fdc8632ad2efbcd75c4ceaf39005105180b8fe6406105da1b381a65994ef1e93cd8
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYMsqjnhMgeiCl7G0nehbGZpbD:w47JUQjTirIhCnDHUPfF/+Dmg27RnWGj
TLSH
T1E065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 27cf1e0653421ffddb701d7d68fce32589f57e31313817dc01cb2881f393ef6e
MD5 6b03808f354de1fccbf9b9d385b5a6dd
SHA1 83f1240568cbb750d4cf05498d66e1c87bdbc81e
SHA512 4b239a09aaf2e6ac24693f3a893ea0882766febdeabaa457d8ce0faed77ccf391eaf92c6edd2e251146ec65bab5a40a43d8ce1fd1f75a07d441ce5c8e5624523
SSDEEP 12288:0VsfxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E575015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 64fda893d96cf7ba374744e404283b9c64cf2811d7a0cc8b7e47e588c48bca58
MD5 4a9e4b43d0e56a5d22ecb462eeb0cfc6
SHA1 d32ab0a84265ccf976261194e0e6b97e5462e824
SHA512 07efa2c4d0b378f82df6976b492af3bc258f4c929fdda0822b1bec75acc13318199ced7578a8e2b5ac3618330e3faa1cf054b077c02e4f2173b19fef2d68e3ad
SSDEEP 12288:RFzUQz0U3fb7cEFVIyD9XLHrbZfW9EuO9:RFzUQQUPBIylLHvZfWSuO
TLSH
T14F251740766BC75FC6A940321E32D5CCAB707D01EE05AB0772C85B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5c184e085f1729d23c97ee1aea0ba66b0cfa064abd96c36bbdc804e8c92d4a64
MD5 62b2d1e7d6d9453e4ce7c5c33551b6fb
SHA1 7cb25d61c99f0fbf0a05cb717db39eddfc9bae6e
SHA512 5f4ed00f319dc98b6f1a7a64889cbb105a2947de10fab74a0191e2fedf69b697ab84e86c328380226178f1873a6ee09b2a3c991ee17d352c96478e12c5770bb6
SSDEEP 6144:NsRyYLxrXLrZmf1nrAeb9ndLOiNNNARPtMxe+A5MJlEyFkSKWRPtMxTsd2LmiZ51:NsR9fZmfl/hrNWVMJi9TNkdQJ
TLSH
T16455B6816537A3CFD1FB6031072A5B4C67A4EC07B7086F2673C8553AD86AA65B0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 77f0ea6c78fdf8ff78ebf4de1a23066e87ca39cc410513158186e28591d52042
MD5 91e1d7d5933e13f314858588cb4d8ed0
SHA1 132f2a99b25b8b3b55cac577318048244ed70def
SHA512 8c0763ba402a0a8e7224d1c8e223bcff7220539774000a91a380eb9061b13d4b2b093cab2e81bd73ed8a6307711a5b5b7edf7a37e24c28ed74fdd495eb223fd6
SSDEEP 12288:xO7ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C65237B935C518AF93609B482EAE12D680B7E669F1044C3BA4778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b2f9718bb2bf142e915e0c93c02f4c605e5db4ee49dead9636364c882f0dde5a
MD5 ce2d4834fcf87d09c5937ee929efcb58
SHA1 5a0045fc232cb8d9927ba6569fa3734dd21983c2
SHA512 382071c5f29344cb2fdf5475e6ce2303acb139d3afd6154cc0df4c2253689510f2b6e194ee9fae89a57c5f95f6ed0599f13999ba69bbacbe389e9de565585c6a
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYjsqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGF4Dmg27RnWGj
TLSH
T1B3659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 77f2a57e9c3edda90c95ec106af129e5f7c731a7d9be577cec8be31580724193
MD5 3ad5656b237eb5b26753cbed1dc2a73a
SHA1 63fadf25d1f96bfb885ac61ea9f8ee0783c11734
SHA512 62ff517a1a365a63261933647c78d48f89ad7b72a7050184fa47629f774bdb67a68f6d221bf3acd70b044bc5cdd8fddbb1e8ef91de83adaedae211cc1cff2fcb
SSDEEP 24576:JG88u8FpJqH19zria7/mcsqjnhMgeiCl7G0nehbGZpbD:c7ZFPqVka7/fDmg27RnWGj
TLSH
T1DE95016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c814a553f65cdce186f9a0e85cb92a02d2b1d769f47df3b8d5be4b853abb85dc
MD5 7a395b3311ee2f982ac42e67fa428062
SHA1 95344d6454c8f84bdd1016c61c9dc6eda8df0f57
SHA512 23d35a2e5943c9974bd5b3f211b6052e64316a58a1625ce406010a98bd230f174552a714cfd721200e9ca804f401258f68dcc99c3d17bb6273b69330701f60a7
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:KG05lO43bJD527BWG
TLSH
T183D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 abee653fc847b841cb839108ea6bfd3e7b27774e8caa2b82305931afa0c2766e
MD5 dcbe22e4affa921ea179a4964bd5acb1
SHA1 e1886673feeb8b26e74249f57c80a391875f1f2d
SHA512 8fa0c18ee970bc72ed42e8d971bf5db9fc9ac958aeb9929a192a492c4ace5828d152a2ca7c8ac260e120e5978f70e732415825515fdbb9407e176e288ba83bd4
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn6sqjnhMgeiCl7G0nehbGZpbD:0a5POZ3BJt2pasx2+mEDmg27RnWGj
TLSH
T12D65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f019a352ac1a5547063da7d9d44abc87328af3037263605e40971fa3687d0d74
MD5 dcd58cd4c29832dff1beaf2cc07aba9d
SHA1 dbda73a3b8ebeea269b1d279530a66785c5d3a20
SHA512 3595fc503b50afb9d97c3fffc158ec409b671b78b4dad2d80b72063fab996e260c90907b66946de84524c2aa2e20d301419afe1de2a6a2357d6f3e7211feb9e8
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkUsqjnhMgeiCl7G0nehbGZpbDj:WNc/zEOVHF/Dmg27RnWGj
TLSH
T157857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 594e216484c55c21e7f411573b737c8497e37933775279119d1612fcc32e1c8d
MD5 a97604d26effa419d406830bcfd170c5
SHA1 28f667621a42bd913f37ab5f0edf2db867811b63
SHA512 4cf55c420ebdf5163aa4db5d2904ecaf236c59b14a91362bcf50deecc0969661b1b1e3e41abd2989c8faf75b0448655cafc6205b136d24682c7f4066e505c186
SSDEEP 24576:7TkNvNnaFeYhJNtmZBm1sqjnhMgeiCl7G0nehbGZpbD:7TMwBtOmpDmg27RnWGj
TLSH
T11055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ca35d336391ff292c1d62a0abe264f22c4054f0b7d5e167ee2075ff9f3d68739
MD5 cf871f03f2a59782c1e61006a11db815
SHA1 fdacb430c63cbd01529f9e5f00c2bdf6ee259a0c
SHA512 495e891c2f0b4493c5325852533774b8fea4e6eae191c2272ada6ca8ea1634299640c7b536d42f8a35ec9241a495834c365bc9172cbe1976025e57d9bcede38f
SSDEEP 12288:CHvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:CPUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C785F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 48b70665aa661655f29aa581a61cbff62af4e307331450b7831b1b9a991c0e10
MD5 5a459e25964d5af448eb7af00b10d437
SHA1 b845a689ae0a40e7842fc33bd958ed32a7d63703
SHA512 3aadb98017c4ff7804e04a55fcd43fdf0c77364c81c7fb0daab8c3a669ce820f844077528c51c302014e0132035c7164f0f016057aaaf27452ce158c249648f3
SSDEEP 24576:3D3FHshBIYQgAFsqjnhMgeiCl7G0nehbGZpbD:3DVHeBIAA5Dmg27RnWGj
TLSH
T1C095E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/204-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/204-175-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/204-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/596-115-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/596-313-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/596-113-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/596-121-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/792-27-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/792-6-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/792-31-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/792-8-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/792-7-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/792-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/1456-61-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1456-59-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1456-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1456-55-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1456-49-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1860-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1860-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1860-26-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1860-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1860-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2868-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2868-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2868-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2868-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3692-64-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3692-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3692-70-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3692-294-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4252-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4252-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4252-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4252-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4252-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4252-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4412-310-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4412-86-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4508-326-0x0000017A98A90000-0x0000017A98D1B000-memory.dmp

Download

memory/4664-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4664-76-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4664-82-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4664-309-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5992-133-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5992-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5992-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5992-127-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5992-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6096-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6096-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6096-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6096-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6096-315-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6096-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download