77d206ea7b5c20ce5458694b8526e3eaf6015cd19dd88cca05ee8e009e90b89d

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260802-r3da3sbe67
SHA256 77d206ea7b5c20ce5458694b8526e3eaf6015cd19dd88cca05ee8e009e90b89d
MD5 2b903df7d6a80dce4c034597a1cda33a
SHA1 168f859ac7b9eb0900e0e1f694bf4b0c7f799248
SHA512 730a593b5fdae7762ca702d82748d3254f583e6ca8c9e802031c5817720203a8cc59c9badd9656ba1ccd0d2cbfd1f28d79b0acfb813b9106073d48375d3b922a
SSDEEP 49152:SjcHonJkXCXjMHaIbnCeGusRN/BEmjfzScB1QMTNVvn30TofuBDmg27RnWGj:+XLfPrJaD527BWG
TLSH
T18D167C07E7B941E5C0BBD13D8A569657FAB2784A877197CB43A0871A0F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2008	elevation_service.exe
1560	elevation_service.exe
5080	maintenanceservice.exe
4996	OSE.EXE
5084	PerceptionSimulationService.exe
5964	perfhost.exe
2328	ReFsDedupSvc.exe
5072	SensorDataService.exe
4364	ssh-agent.exe
5868	AgentService.exe
1900	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\339316f0e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-02.1442.3500.1.aodl	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091f106418d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e19b9418d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7748c428d22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d5c70418d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfef4b428d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f85b93428d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
2008	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3500	2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2008	elevation_service.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5868	AgentService.exe
Token: 33	1900	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1900	SearchIndexer.exe
Token: SeDebugPrivilege	2008	elevation_service.exe
Token: SeDebugPrivilege	1560	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 5712	1900	SearchIndexer.exe	100
PID 1900 wrote to memory of 5128	1900	SearchIndexer.exe	101
PID 1900 wrote to memory of 4632	1900	SearchIndexer.exe	102
PID 1900 wrote to memory of 4648	1900	SearchIndexer.exe	103
PID 1900 wrote to memory of 4600	1900	SearchIndexer.exe	105
PID 1900 wrote to memory of 2408	1900	SearchIndexer.exe	106
PID 1900 wrote to memory of 4184	1900	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2b903df7d6a80dce4c034597a1cda33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2772 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2772 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 85d5eb43773e27671520e3e576d1b73f7f2b1f46f9ff74f2052f252992e47513
MD5 fb490122ea30bca6d00416408326ac89
SHA1 5585c35233c355c4ec02104d604b625fd49ea976
SHA512 f17efac60b40e4afb3028a931d78210f9989b6c4a8c61ba7a4ad76e0d0b19111765295ac3d1564807fb0a02c4dfe283a240e1bd05a505f0d24e942f8d15ca85a
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNDmg27RnWGj:L3q6sjB+D527BWG
TLSH
T1ACD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a4a1edf933a8a9e8fc634e0b60499f8eb6032e99699b4fd5d332f64d375f4b88
MD5 263df16e18330a2fb648024b4a8437f8
SHA1 8ca4dc53102269b3178398ab8c47b7cc6c67c2e1
SHA512 bed8592b9900f38fcdcdf85d150882c5f46c807104ea3e6f6b2a2fc0780aeeac2d88ea3a0470d405bf7925ae07422d99e83e1f97d6462eecb0ad7d5da53b0a94
SSDEEP 24576:TXYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:2tcHDmg27RnWGj
TLSH
T18465F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e03dcf467bcd2ee60b3384cc8f438b4e2935f658d60383e6842e2334070312c4
MD5 77e02420c2edbe08c62a1cad7ee24ad2
SHA1 e9f40a5f345db69ce0d2067a8c7ebc67036f22f2
SHA512 d329a63fb06aaa6654bed0ad3777a3fe4e9c324d225b7832c7a96a56046edac1e4600b13513dc563a7df2f584589e16754709b36dc3dd3d1581aa3c445f19fe1
SSDEEP 24576:F0Le5ji0hmxxrM2sqjnhMgeiCl7G0nehbGZpbD:FPji0AjbDmg27RnWGj
TLSH
T1CF859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1e97f2380b3a972633c43214d62f4356dcf6ce8650c4ee3881bda2fc7e88f448
MD5 7e82d07b43c10b04037a34c175ee0c59
SHA1 5f8f185fafe49680102a61689c3ebe3c40b1fc5d
SHA512 a4bbaa9202118a8d0febe10c0c900a6b3edc3e32a9ea92863b106dfd9a8dc1cad92d3b048e934d251959961e9ba7aeb78ec1eb04b5f1b78f74737ad4e9ba9dd2
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:z/ezSC6vUzPveHjyvDmg27RnWGj
TLSH
T1A8755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 afe087cb1ae96519be72ee974d642f73da795128061df368d6422bd870c30460
MD5 3fc5b7b2384e2a2c35e456bf8a27aabd
SHA1 858976cc79379cf8fff656c50255cb6b1cfe3d71
SHA512 f43c02177f1fd2318fcb6e39aef7da0d293d21e1455173cc1a882825e1ebc760208b8f65e4a16b670255ea75915b597b7a8e8c6ab8de096cdb0958fd288c74fe
SSDEEP 24576:VVbqPb88hv/l+YJsqjnhMgeiCl7G0nehbGZpbD:VVO88hXl+ADmg27RnWGj
TLSH
T19D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0864a4d8be56b40d2dfce67e1f0b00fa9c04089d25b5f42dd94242d0ec064c97
MD5 a43e5adf64d6b380409079c3953192ac
SHA1 1244eaa891b0fe9ad43088446bef2a629511000b
SHA512 d097a6e3a2af3af258ba9bd64c05c77c9ec98982ccd3066fe9979ff8c3da75e16e1eb8682a692a2c3b11d065e995f220868f342590f3e93fc411a7d8b05715af
SSDEEP 12288:bLiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bLisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BF964C50CAEB7608B5C3E9F11EAC177E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 826ae86417f56feeba44cd728d96fc5257f0108bafec8225b5a08d469c67cefa
MD5 ab5f0bbcbcb1de7ea6c8bf39eee8a0e1
SHA1 da2a8ac127ff3bfd50e4784f2c8addb4d37023c4
SHA512 69bb43c174b612c708613eaf2d9a2c2188ca2d1d1c082da6af86521e35b981c2cb42f70ed15b22bc8b27156f4b9eb5c637a17f0b48296c32c37ec4c9e1dfb5fb
SSDEEP 12288:OeBNUbTVO86URXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:OJIURsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE65CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 52a55c65b1865c0e2bc7c80905c1e6636d167830c6ce37a71f3486381fe40109
MD5 00e3a2db9da42617c1d6be5898b22a50
SHA1 23fdeb5d73bfcda204ee967e6896d8e43a6a277b
SHA512 e457b7d49f1a319b44c176a297a004a72943f27fc05a83b865e5e1ac84387b23105a34e1aff125e83300c22230e6f7b671f25556300ccbd6ffd32420e8e2039b
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:vQvGAdlCEL8c/DRNw5CoD527BWG
TLSH
T18D266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0513dd2256f74a18348c385c350106e6f1159adbf713aa7cdb53b7234dbb2d21
MD5 637ddd5325d73f29305bab1461df5338
SHA1 78aeed7550f2b3aaa88b97ff0f59a37715d3a626
SHA512 16ea08029808fee3c25ff2885005634dd15dfe1d279c2a5aa37f0cb301cd759331f9f3a24135e8f42c44b1b8d4f533d2e2cbbb400b899c85d356d6c2526d2077
SSDEEP 12288:FAwSfxL/2Dc3RDLLmt0LDQewsAj3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:m0ewsAj3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1a4a158ef6f0bf858509bf0ce80b2ba18e10e85190851fbc214c7f4b3c2f2d5a
MD5 ba7279d8180ec6b6cc01091c2475c6a6
SHA1 ea478d51bc5608f52a1bc4debe1e4f64e4e861dc
SHA512 ddceb954202cb9284da45cec790744033cacc06320d79b051ffb1fa60f77a0fbd0ca59bc7f5e6fc12df3e8beb033abf76f584169d6aebe67f094d3c9caa5012c
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTVQBWG:NUEtQevvqc2W1cpV2tI32KB
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9b5f3bcb1768aee6c7c78b761691a92216af7acd390ac19380dc439b41ddbc60
MD5 21442705a80fdc43c35639b16ae27273
SHA1 35444117503d59a976f363c7b3d1a86687ed6bf9
SHA512 c937505d50b3e1ad97dec5f6b60a69f7d65a935060854598169ced2f5e2b7b7ebde5e3d058fb4380ea32c4e551d40f22da0898369774805dc1e90acaf0869666
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zrDmg27RnWGj:7oquVjnm8D527BWG
TLSH
T130D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 03bd2bc81b470950ca8600e82dba99c48b4f7b28ca04a9b6d1ca704dcf93e963
MD5 d736ca87e491b316f1433a633b37a625
SHA1 05aa1b697b3f0c3a408fd2ccbb09661d4f2920c4
SHA512 524b31eb1cb836c116a15333e38341d2127780f445b95a0c9a69fa011eaa0cbc3314874bf9dfcd0c815ad969daddaccba8556318674c39cb1924d83b9b315274
SSDEEP 24576:sAhGL3IFoiwtA5l7S53gsqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5sDmg27RnWGj
TLSH
T103359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7df140422a04c815e6d2702cbe8a7f1f8df55a08616835df693f1b64658bbbfa
MD5 09fd62459d909259e10b9d3a6bacafa1
SHA1 5ae1f7d093ed974dcd5f39758f7ddbb8e49095a1
SHA512 86d3efe4c891da0f88613968a5fa99e48406d547f8ba58f741c06a6adbfa58a4e91001436bca9a51052fc2d927ce6a441b97ca0b0103c77cbb2aaa547bc2aa59
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+CsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Twu4OWbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14365F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0e891718aea04e9cbc2ceaf8232f493502a8b2fd23d1377e290a01dfd9bc3978
MD5 275af6d116b05c44af86684532b122f2
SHA1 7f31ab59b26b66525a88bbdd8fac0ff363481aa2
SHA512 d48ee7fe2bfdeebef92fc4b65b8b1373e828db6bba72bd67ff0efadd7f6f525138425a11b824110a479c2b277de73794daec156c743703a4d197a4fc1fcec1ba
SSDEEP 12288:WeZ1IynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZuesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1175512AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9e23c7feb82a64e94ace768ee1f9a6697f7fe7b50fc8fc2103a31d56f35f9f06
MD5 be69362d5b50fc4cfbc16c2d28f0e648
SHA1 d904c2509c66b89fa8779287ae7d6e66ceaa5b64
SHA512 206e239b3833a3d51a183b329ca47edb047c2917a91e17dc9269e8dbf0d6d49b79d1bd572ba5069eaba9d04ccdccd84fe9f4c7ab4c657c304aea26a4ea3dadba
SSDEEP 98304:ZQRQyi36YOcPbLvw2gAf+PN35D527BWG:QQyiKa/X+PNJVQBWG
TLSH
T1DC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ee9f1b03384f69732ba4c0434668b3d90a9c43e5c71196b317f67024d0c1e27e
MD5 a8b40aab30f2ef6b7417e2cb81d2ad7f
SHA1 9630b0f92e1c60eba87016353e99503007d06bcb
SHA512 c995a89b89b64529746d291ca0998ea2fc4a81c5a81ce643b0905ce7c94faf54b32ed1e24f273665d503fabdd3b33416e4486c483367e0b95e19d5705e561f3e
SSDEEP 98304:bQRQyi36YOcPbLvw2gAf+PN35D527BWG:qQyiKa/X+PNJVQBWG
TLSH
T1D6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 861886110b001e5eac56de2fbc4893d3d9d81ea5691d6865e171e116dcb1285f
MD5 9ee0d37ab91ee08880be29182cab8ceb
SHA1 8d2d0cdd760a1b45439f7309e346e09e703d99b1
SHA512 7992643369a0b49419b6d5b3010ff94d84dc5d665f9356084f6c575b346ff9e6c1b4e454a61569e93bf37bea9875cf7522eff1b0561ada448deaa99c8993b595
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0usqjnhMgeiCl7Gq:n68Qg55nhceWu7PNU3/bDmg27RnWGj5
TLSH
T132B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 febf3693aa4a48332190584688a190c010420861b88978cd726a7950cafcf978
MD5 e048204809e116311abaf27486653e88
SHA1 9bbf40142c670b5ae2bfcbd3a5698ce3a89d0921
SHA512 0677399f51faa51eae5f103890c6241bc0086fb1f77ad48c4f96a161362f20908c3ef2afd216bddd8f95841681b80761d78df724cf0f073e91a93cd5d08ba91b
SSDEEP 98304:yy5112gYy5azzVvt69nLKnhZmD527BWG:7LIHEWhEVQBWG
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8bc9648a30005ceac9def4b5cf7e4a8098524baf73f58e71237685931307bd61
MD5 6f88489bc03babb42dcc8a4f90e3c4c8
SHA1 4bd026273c5f6ff0e033acbe666f87fbe2948304
SHA512 12bce74aa662f43c1fff6427fd94534b8cf96250e9651061b8f56d3f7286cd2040fcba01e6c108a1f50963b48027823a3c72ef8a1da7420a22272e50ef4cbc41
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:/u6Jmdxd2diD527BWG
TLSH
T14CD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e50ceaac2e2f5e0e71915ebf6880cd53008e5a67e1d6e73cc7d3f7ba0a85170c
MD5 033e8671681050bbe8d2ebfd6ad7c788
SHA1 46e73aa5478bb973c7ab5191782dd3a94534babc
SHA512 298468da42ce13a3ff1666803a1aade1210abc91f7dd511d3ba49d42667a74bb967402cd5d95dd34424a5b180feadb9e4f8b134c4c169010fd5bd572ca4d12ac
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xFDmg27RnWGj:HmifPWR8D527BWG
TLSH
T19CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 37a1497b6cabfae2766bf76a3054bb785b97a7a61f726c4ef50cb506f533b197
MD5 beef04b62d7147e4f3a8004e36afd000
SHA1 5e56e70ba1e168a2ef66284b8347f467005d4dd4
SHA512 54775e977ee8d3c9ac9d32cd0e1dae287ff0dc9d5ed86ec0c533d4f779b82d9ea4e4d7de8dd7713d40027a2439deb672f465492078ff94bb6aaa2a486b858010
SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHqyDmg27RnWGj:05dKii61yD527BWG
TLSH
T191C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5a7bd31b214f43faa15e08a6ad29da7f0676c239ba4c54a52c8006cd56dfcb98
MD5 3400c62c23aa0ef2fd1d5053cab874ca
SHA1 5f0751178f099e929a4d7ea6d1bbdd8a7f8020a9
SHA512 2bbf3133f632aba8ec062c1f5a2fab515bcb3196255510ddd23aaf53826abc91bc4bb1d3bde99757d0e99df4b032053502311f3c6fcfc713f0779aa1ccb2899d
SSDEEP 49152:GhtSn8EApI0fig3giDn0AP5whDmg27RnWGj:HX2imphwD527BWG
TLSH
T18895BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cc13a100a6ce5cc9d9c7eddd27d96e8727de281e586cef2e74b7547309d01a26
MD5 a2019a32d36209711ae3a5420ab60d56
SHA1 f8af587f0394c656f5b32fb4ab41d8905bd77c90
SHA512 e9ee8b58924b5ac97b409789412768315f7c1a238de88fe899f2ea27e92c8b8d3b1980f0e50cfb3d6553c8ef485f9c72a23ebec78c7d733560d997476bad8f4c
SSDEEP 12288:gKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BE964C41CAE52648B5C3E5F14EAC073E5BE92004937A9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1c729a29e50ad57a8e5bb948c6b20637619194bb280a7bc12d7e3a3941f28257
MD5 312024b3d0db4042f1f0a37844de943d
SHA1 b8f854e917b9076041dfc69407f6d2d1faa95189
SHA512 982d62c5c5ff56ebe858cfa2a3f49f0eb8d6ff102d5935afb9bda1a6b916b269341b46a3060ee6b970046fa8a846dcf4e58c089d570450defae41009e8b42b60
SSDEEP 12288:DzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BE964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 13d03ca039a7f2de38bae38616f323c6d2dc3137601564bf5d7aa05802c61efd
MD5 7e6e2898aa5f8009ce4a0157caadb43a
SHA1 b6f13fa68ee86c9dc8f2574615f6481b83115d98
SHA512 b9d5ed931b2a206c535122b90c46c88938f842e2cff0ae2fb1322b44b29c4a5aad324f28ea5a1a21e816f43882d34d65d1e281c4f5fb1afc59dedc099695188e
SSDEEP 12288:PZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 589728ce1cfc329fe514919cd2384b891dcab063a6f67f6a8aa4b0a0ceeb54cb
MD5 8516c4e5cf527c79c48959e411efac79
SHA1 e791d38dfd1dd532d9da921be494185155392920
SHA512 ec7d764191a98ae083bb0aa661cc5b7d3da228e391d69496931beb7ad6a0289c4e6961d67b638e76cb45a792905384dc6cf18cf743b134adc553edc7683a81d3
SSDEEP 12288:gVAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA45236B575C00C6D83685B4C2F5E11DE8237D56EB30059B6B532CEE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 61af7bb707f3e0e0a2bd8e407ee6bde15d2b82b72d5433c5b2b7f9fc35bb215b
MD5 ab39e01de5b13ee9f54e9df11266a716
SHA1 755dab52028a5592884496a7b1f5045696c50cbe
SHA512 dfc93d588e0af12538fbd922f05493b2aadc36e7edf15886bdc8a288b283ef48886c542e5e1b75e0005633c72382747fcd6407999a1b4d953e6733b0c100feb7
SSDEEP 12288:q4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BE964C41CAE52648B5C3E5F14EAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4884adb1b0a739e72b1bccd917b42718bc4630e6432634b4034dae7d7169537d
MD5 226c0333c0101532ffe4e72d73a0917b
SHA1 bd96de84be5ced06bbe8ffd55247781a3b9bd6e5
SHA512 afc863bfccc095fd571a5ae8d23eb7a820905021dc1b68b12f7db1f215dca1fab27cb7df009f34cbd56b82fd4ea2c9d4ea8a0d917500f5ed8ee0cf0cfc1b6935
SSDEEP 12288:IfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BE964C41CAE52644B5C3E5F14EAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2ecf9ac827d82d09681a0e60a607253d69fb6938b1ba53af3fcfe057ce9acbec
MD5 907ef4675730ec30cd45540171b9955b
SHA1 b041bdccf3cdb8d68e193aa21bdacf53fde762a1
SHA512 8836c30c85534e962efc203d1679a1773110bbca6a1b5df70627ae03157373255f93578417a1d226be4a630091326ecfabd127267ef78bc7c6e43bf1dac17aad
SSDEEP 12288:QrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE964C41CAE52644B5C3E9F10DAC073E5BE9200483BA5B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fecb01be88edb9fc4ef7b9c5235ee15cc4d5f0d5ce48b83c2210dda4a44df201
MD5 0e9a6341c0875b316dbdc28453fffc69
SHA1 77617d13c93d6411b8273f00bbc836f34f23f4d3
SHA512 52901ec2a0661decf20fe43242af56577e45452a6e34ee0a838f6cfafd4ea6049e1fbbcd95ee369896dc0dedec2662021b336a5c0d6a6b957c68a29201b542a2
SSDEEP 24576:pZMRzFVSOTsqjnhMgeiCl7G0nehbGZpbD:pZMRzfzDmg27RnWGj
TLSH
T1DB6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a4dd760409360525c89ce3257438e0e45206634fdfca64dbf56c83f8cf184182
MD5 b24f4907402fab5fe3dacc16a4e66829
SHA1 67bd522c6283cf6f010a95c49e3607bb42054ab7
SHA512 01e9010dc359eaeba29217ec6a67a2ab791bc65410c8a48eb4792c82541171a071f12cd7b03865b74da9bbc6a296f3ae646d9fdb893f161e1e5b83e5c538ead5
SSDEEP 12288:vOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BE964C41CAE52604B5C3E9F14DAC173E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 80d0aa675c16e0c2e638aeeb84cb04b798162bd61b68a7233f96c9037de4709b
MD5 ab2576c804a215b583ab047fae07c2f3
SHA1 ad59952533382a8c4246f47810bbe8d44afb95ef
SHA512 55d89d04205f5881404e3eae71cebcb822ad419cdd5f35704bbb3323c76a21825ccd493a2def5ecba47019271cb88650c4c66fb9663176165c32deb10ac0c942
SSDEEP 12288:MSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA5B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8fcfa0710a3958c528f8497563a037001f9812716fadb91c1cf7c45ee27f673b
MD5 89bbc0a958e0fee6c25acc10bd3f8131
SHA1 90c3d285dea06067593e82bc2d24cee0aea6834f
SHA512 cc465568b45d8ae2747b1457ef992c8bf6e385b8fee64bbf9207e21bf6fb7254d140b76fc8b9d7f3c691c5a0d1805e98f0bf90fab98cab2f4f2787784973de6a
SSDEEP 12288:PyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:izynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F455125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1dbf9e135e701d0ff9ff0251e02fa57529d31f362ef10cc1f1d01c6c5cd2d521
MD5 e69c6081b8db40169cda4e2cbe72e51c
SHA1 73500ac7dd9bcaac09ae9c615aff5378c205163a
SHA512 da04b3266b493bb22a655c6b0545617ee706069c723f74eb253c1aadce4f5d0ab63c80162f7679f05be3441d77610b31a8ac68f46a241f0efa42c612e88d7bde
SSDEEP 12288:NOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e169fd268de67a5a8ba6a82ae5c25c9dda8c263c033fce46cd963d868dbcfd1c
MD5 40582febfadbdf0ff2f7d2f5693e4ef3
SHA1 739b9336b9e0470c64294879838ebb1f6a82242a
SHA512 d082427a89a5aa901e926eaa7516a5aa863614506e9cbc7720e2f8c83bf71d9242f8e229aaa90bffad50bfa0e5eb4ba9211bc29fc17cceb2a527f3967679531b
SSDEEP 12288:1OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 dc5c5dc83a03eac640797b9dbbdc5c120f833515b0e7853fc632748c2a523cec
MD5 0a9f52ff2de3b0d338564469ccbc1cb1
SHA1 94557d758f9928d40d0e9a40e1862d8680b169f9
SHA512 f1452565615a479f338afc8fd01d6796c79acc477c20dd3e7ad121432125a15834d6f12a490a8c933168bb12e0a6bd18a15b2d74b1b3547bae9cd4e064491ed6
SSDEEP 12288:gyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RzynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b4ca10dfbf02e8b5ab1bcfaf96f003d0839a3593c4eb6937edebd4f3713f84b4
MD5 bf4c57e51315f474ef02ada096fd1d79
SHA1 a902c81f43ce036ba69fbfbb3cdbc1ac0c711195
SHA512 0e95b6d116a722ec5e1cff423b7fdfb2eee552a0d4c176f2e532e94f69a2d5d27e6eaf19cc3c7b056f750fe64917997fcebdb8e76fff842c333bfa3040e46d58
SSDEEP 24576:3TDaLl3z0zDpsqjnhMgeiCl7G0nehbGZpbD:3TuLlj4Dmg27RnWGj
TLSH
T10D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 fbc8b1fe9ec09841250ec9b4ebd4b1e2e8cf3f6e4d72587da7d2d40c9b9b01ab
MD5 c3fa614a61677854df69832605dbf281
SHA1 56b2281756f2c7b5e469913652f4014c281c1c15
SHA512 435190bde2dc6b46db6bbfdcc51ea02ddd116175f284c5f15e9a7a975d543a5172183435adaedf6af30a026caf045651fcc4c1474df0619f048c4ef5324c7c90
SSDEEP 24576:Q3vd9CHKy7GZlsqjnhMgeiCl7G0nehbGZpbD:avd9CHKyazDmg27RnWGj
TLSH
T16675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 af631f6363af3b177fbc5b26b9237440c50641e5d126a2213c1a67a39a6413ea
MD5 1ce09510486085335b41f692fb8297e7
SHA1 4bf0cd1043cde407b102c4edcff6a16a6b3f467c
SHA512 1c4d1b83af120e7f27f1ff6da05be05b4450796fe757d6bd1971953a23a7365addd791f038ab9addf3cdda22bdee3a8e4354a929f4ee7e7d3ed202fb3df49860
SSDEEP 12288:r5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE964C41CAE52608B5C3E9F14DAC073E5BE9200493BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e01baafc60f7af8273bba3b6d1718a2ef1cfede84335e45bc73aa2b76bafa3ec
MD5 289088f506042d6447ffa072364458b3
SHA1 7513d2cf31e53190d599126ae44a5bb6d76f0598
SHA512 44da292f5d60f40643559a68475b00b1b7cdbe585ea77c31c4ee21626b6fdc3ab331c1212c5a9ce06e3873e256aba7cb8cc819d0230544e09117d3c07b421918
SSDEEP 12288:dHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE965C41CAE52644F5C3E9F10DAC073E5BE9200493BA977CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 585c203ea6926a651c7094be50f5ae345e0b229ddf1f9b5803d53c11b397a2ee
MD5 3c5bd03d20c2043a939d9a5cebd5bcfd
SHA1 63c6aa15befb8781c99254ddf173823431d7efa6
SHA512 ac6001f91f176d8aa5372331d46bcf3c4b0d95bd0474231ba69c0c0cffb7e2c4c273b2d0526629225750575b3c596c11f5816c4ee63f3724296789cce906b12c
SSDEEP 12288:jEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BE964C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7c7c0ddb8521c89bfecacadd2fd8928314cb381fe98f221dcce6bdbad4abcd2e
MD5 23ff77958a386d2e3415a475c2a3e4eb
SHA1 741d167a7f92cfa813d7c0edbd3f78e82d0803ef
SHA512 b23f37e122f203d8839e50c435a690847ccdc9bd71eb988cbbf5e79fd66ae9878b066a22de9b02675abb2b4002a19d60af3b6496c228e46a467f7a72b79758b6
SSDEEP 12288:wOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BE964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6325b743504c34afa149183fb31fe3f1657b6e2d376ffb19e1ee4019309d661f
MD5 19733c57b2ae9f32d7a1e3c07ae7e7cb
SHA1 a07871bbaf2ce6a2a5d65186e860d3463ea1a078
SHA512 48371c0ffd3c6f4d95743975c1e300a466635a36432aacfc1858a88c61b77798e33db66e996c395cf79350eda4f94366e1d1e0e6f2c8ae4bb9bc170a9875cee0
SSDEEP 12288:+5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BE964C41CAE52608B5C3E5F14EAC073E5BE9200493BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c5f01f12f3965d18e91b035da2125df0963817d751543dd69e921b2e1a493126
MD5 870be0b1eaa35d9425bdedd188321803
SHA1 4e66d70834470b515308f3bac6de208c02271b1b
SHA512 207581174fc7ebf88a3688be5e8a9d47ea9e558f7fb70394a43e41a80fd9f8ee4180400a23f11c1774012814080018a690a68d38aa164414ac3a85371bebc14d
SSDEEP 12288:mGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE964C41CAE52644F5C3E5F11EAC073E5BE9200493BA977CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 105cf5188454ce785a603e47144bbda443230995a0a40560071fda81374bcfb2
MD5 e8bc58f151f9939e210a7fcc736e8daf
SHA1 91afe633348e3e6bd29a8af14284b85c1f3f1476
SHA512 d93c93750f219929274bd4ebb1515042f62b3f2c26f45756474a4046fb67d4bdc814a39f48a96ab4ecb8cc0ab64ff17e853a94a3a74fbec105d21722d111deb7
SSDEEP 12288:+4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BE964C41CAE52648B5C3E5F14EAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ec7c2531a43ae42781c7520377582ec31b585453ec5718176ca02341aea4ad22
MD5 80e33e136d9b6fda96ef99308c9a616f
SHA1 c790a3dfeaf16856dcc3e97a34f49026aa126562
SHA512 75bced64d05068f136569300f8fae9d9078494be19ac7cbe8b6c282185077c806ea79f24164f54dc68552bd2a5fb6248deded16ae32b16478fd43f2795b80f8e
SSDEEP 24576:GfwvUk9RX6wkyAICsqjnhMgeiCl7G0nehbGZpbD:uMnYIGDmg27RnWGj
TLSH
T1DE85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 947a580a54f95d37edb5b5d9d6b4b370b73caf6c72a41186477bd656f29cd099
MD5 f2d41ad63f1a870c14c6cac4194e3a32
SHA1 c128b061a21c0abc874e7cf57997382d01686305
SHA512 9591262bbf56ea42339e511070bc149e53492d2e2d501fd619595679008186b5977181055258c10236753586b802bfb7818b0f8f00851dfba583bac974e4e982
SSDEEP 49152:7YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BDmg27RnWGj:eySzPZD527BWG
TLSH
T19D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d640ba1c7d8566f9c44373b165f5918097eaefda8213835e597541e860c7f431
MD5 7101addfb169a2a39b0040495f090683
SHA1 14d2e23b120552668add2bc58ed7a79ab3303458
SHA512 04c2de07c30035ac14d750d74031f2836d766c3ff84034119e159cb5a3877f6eb70dfc640f5473faf3cad51a9ef70c7f89ed94b7e04efc1ae344db6d6f57b2aa
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDsqjnhMgeiCl7G0nehbGZpbD:J47JUQjTirIhCnDHUPfF/xDmg27RnWGj
TLSH
T1C565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c0bc69ccb3bb24c72b0eea9e765040a1f49051c076e670463811b3ef2809a671
MD5 437a5650ac67b73335d1d1506c4593a3
SHA1 525e0eb2c56d7167cbc663df00d2cab66d32b701
SHA512 0af33880657f67cffa9fa414a62501b9b9898c69a6de9cf1c4271663a63ba2577a7ed2034fe1ec742c19f8ef19eccee54b3f213de50e97752989b7efd3c1f197
SSDEEP 12288:KbsfeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hesqjnhMgeiCl7G0nehbGZpbD
TLSH
T14355015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 733167e1501b88b3c0a5dfecc3a28ae8f79081b91089d34189e3ff2119a5a398
MD5 f4f15f9f2782af9d3d3a4816e6ae12a4
SHA1 3acae09e6e0af1f477b08ca22593bda99a1df1f1
SHA512 9e2f2dfebde9fd0ef11dffde69f01ad092bd69252d3aa3de8d63dd548872213d825bfaff888ee6defb2923c2d619a3aed4d9dc633d3e931911c674651150253f
SSDEEP 12288:t07WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BB934C518AF93605B482E9E12DA80B7E669F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 44382fc84e5bfbddbe9f2d5ddcc2eca840826700aa5dd9e2d868a73ab099b71f
MD5 3e2193b2bcc8e64a89805f3cce5c57af
SHA1 631ced6e402e540a8558c62013b2ea2cafad4dbc
SHA512 e60ea9f038232bd9b12c32298688c624b576f88967cd30508822e137ad3e1b0d3839b0b0c8322204b8ca5fdf62c89c74edeb1b395aa669b8de9827fa4a429db4
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:Kgb4mBIBhGFHDmg27RnWGj
TLSH
T131659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b0d7ba757172b3f87ef23ee30bf7c0856b70f3adcd05403c3a6f00813ed030fb
MD5 288c8d84ca2d44f6dfb3470f5c2965fd
SHA1 b8e0719f470f339a97e9a5e52260b01fdad7ee0d
SHA512 7524d9c15f43576459fa9f42dd74d2195e3497b1bca03445f2f1816117cbe9f261428b30c52b989d9f83eb41ee166ef01cff35d3bc0c76ef90fa8ba602dd4ac9
SSDEEP 24576:yG88u8FpJqH1bzria7/mTsqjnhMgeiCl7G0nehbGZpbD:p7ZFPqVea7/ADmg27RnWGj
TLSH
T16885016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1fea97a9243b6b0530ef456cfa8976cd117718a75556ed4c990da4980d3879d5
MD5 d9b0a2374ea867484f6d9aef1d8302f5
SHA1 5fdedd09e317710800e3becc1815ba0867c0998a
SHA512 fe57df49e7b9d00e27c7281763142cca8b3bdb75400cb5035d92106a5e0c34211ffbc526bcfe3958c04c3f835181bf91101ffde2d49068ff16f3ea9ede13067d
SSDEEP 12288:mHvUrBFrEjwaQPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:mPUr+NQPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17565F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a07bb42e308c128f67cc923feb0a8f4218ce62b9032db73de4ed90ee62b2d1a9
MD5 f3e108aab5de0435e9d62cfeb324c6f6
SHA1 04a1759a565f8421a6da27b5f6ea0e84c42cf808
SHA512 412a7276b1bd595a0f1b112dfa9b6ed4987742cd889c496851c2248ed7a02cf640aca78a772badd3ade561224697c3592bd880045d6e72da2a8b842d793f3f76
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDDmg27RnWGj:kG05lO43bOD527BWG
TLSH
T1E4D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f2c3b76972500eedba0bba21633e4f01783ab349d30f72014ec470273cffa1e2
MD5 80b11085195b3ab1e2db3034661fb9c2
SHA1 dae39f112a0c9127d4d108a81c8037423d70938e
SHA512 edb654473a8ae4d96c3417c95724cb7f819d50f903184baeff84ccb26cc5ca0856cf4af9e3dbb13d21e2459e86f44e70a5a4c7f9b3d7f138d7e7ecca87bec5ef
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidndsqjnhMgeiCl7G0nehbGZpbD:ea5POZ3BJt2pasx2+mbDmg27RnWGj
TLSH
T14265BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 572349299c1aca29a2e29ca80e15e6388ec824d1624e90ee45fa8cfdce618e0e
MD5 97dd40759f513cbf9fefe5083a2c3e1d
SHA1 bec78d5e9b4dc4c00c20058291583a97d16f0f02
SHA512 f670b4c8a89e1fcbd5a517109f8e5532c451895340ff87101ee0325af9cac856b6b3c1c397894f26a7339b468d5eca86a9fd8fc616efc6da3a5f9c963c261daf
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fk7sqjnhMgeiCl7G0nehbGZpbD:iNc/zEOVHFgDmg27RnWGj
TLSH
T17B857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e99f83ac5712d70b61ce98afa3e2d368a9a78a0ab1f06f84197e06e6c9e7749c
MD5 709551d2a42b42166d32b5509bd5d14e
SHA1 8bf8ee8d1ed422f2676ae22511c72c2fcad65691
SHA512 06abb220912fc0551b1d047fc97d1c87c69960874467a8e1b6a88821c29697cb7ab2f737ea1fc45a30d878e215da07e709f6941a963c643cd749d6399614d877
SSDEEP 24576:GTkNvNnaFeYhJNtmZBmSsqjnhMgeiCl7G0nehbGZpbD:GTMwBtOmWDmg27RnWGj
TLSH
T11955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 822c2c2f5d8abbc7d3107ac5ee6e482509d996bdbadb5972b677713e26de4bb9
MD5 ecb844460ae4b2092cc8a8fdc3eb0413
SHA1 9a4a0ebe4ce4a5dc992f220c4d3d011aab3ad87a
SHA512 7f82917f94b1139785f5317431229bf6dec9655fdaf258950f38aa38bac8bb63e767b695dd3b3f96bd5de572891548d78c2057225f23a6d8ae5847774bd04303
SSDEEP 24576:7D3FHshBIYQgAqsqjnhMgeiCl7G0nehbGZpbD:7DVHeBIAA+Dmg27RnWGj
TLSH
T1BC75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1560-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1560-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1560-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1560-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1900-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1900-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2008-15-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2008-22-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2008-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2008-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2008-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2328-86-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2328-80-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2328-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-331-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3500-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3500-9-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3500-45-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3500-0-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/3500-51-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/4364-104-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4364-112-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4364-106-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4364-319-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4996-282-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4996-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4996-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4996-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5072-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5072-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5072-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5072-92-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5072-316-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5072-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5080-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5080-155-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5080-138-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5080-132-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5080-153-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5084-298-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5084-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5084-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5084-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5868-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5868-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5868-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5868-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5868-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5964-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5964-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download