f025e8655fe0cf862f528c73dc6c15332951b62e6e1d8e0de7e06e21081f0475

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260804-vza84aaq2w
SHA256 f025e8655fe0cf862f528c73dc6c15332951b62e6e1d8e0de7e06e21081f0475
MD5 fb412802a191a6b0fc2cc257457c10ee
SHA1 20ff15ce837cfacada9998eeeb84d04460f425f5
SHA512 6f6c847c08a42dba37c879db058d692abe6561ac50e2a63a65376f1dbe3ac7a9fff749057968ffb4eecde8c5068d0b7a7a30f406ff0c4a38199c052a39f0a81f
SSDEEP 49152:bjcHonJkXCXjMHaIbnreGusRN/BEmjfzScB1QMTNVvn30TofuGLNiXicJFFRGNzb:wXLfPrJV7wRGpj3
TLSH
T112167B07E7B941F5C0BAD13D8A569657FAB2784A877197CB43A0871A0F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5552	elevation_service.exe
1604	elevation_service.exe
1320	maintenanceservice.exe
5732	OSE.EXE
2544	PerceptionSimulationService.exe
1200	perfhost.exe
5008	ReFsDedupSvc.exe
236	SensorDataService.exe
728	ssh-agent.exe
924	AgentService.exe
6016	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d8a05189238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000626c0f823624dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a7a21823624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cb80e413624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000deabe5433624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007454ad443624dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
1604	elevation_service.exe
1604	elevation_service.exe
1604	elevation_service.exe
1604	elevation_service.exe
1604	elevation_service.exe
1604	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2728	2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5552	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	924	AgentService.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: 33	6016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6016	SearchIndexer.exe
Token: SeDebugPrivilege	5552	elevation_service.exe
Token: SeDebugPrivilege	1604	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 4212	6016	SearchIndexer.exe	100
PID 6016 wrote to memory of 2720	6016	SearchIndexer.exe	101
PID 6016 wrote to memory of 4068	6016	SearchIndexer.exe	102
PID 6016 wrote to memory of 4092	6016	SearchIndexer.exe	103
PID 6016 wrote to memory of 1600	6016	SearchIndexer.exe	107
PID 6016 wrote to memory of 1552	6016	SearchIndexer.exe	108
PID 6016 wrote to memory of 5544	6016	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fb412802a191a6b0fc2cc257457c10ee_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1200

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:728

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2688 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2688 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 13648b898d3a339e10b3aba9351f7e4c5a46df704c91329b1ee445c456a862f8
MD5 7644f0d0ebbdc957030e773fc0f2245b
SHA1 59cd4dc6ee14bfae1867808e76ddcdb35bf36e13
SHA512 90a6a1d346afa406463bdaa5bbd462903396f980775eac77481ab45f17a71e8241f7f5e6435f18dc3a8250225a9752bf615cf5404bdc426daacbe1ed8bad405f
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnhLNiXicJFFRGNzj3:33q6mjBe7wRGpj3
TLSH
T167D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6107e4375eed01ffe2e4cec92834bfdbae71ad7ceef12226629f2c34df58fba9
MD5 080c0f74cac8d5d3e1f3cd7363195081
SHA1 51522b9f47a46d85be7784d51800f0a54d5785d7
SHA512 0b00f1fe5783fa714bf515346232a5514670af84e1c690663c302e04c5e0237c2408643970a5e03ca4dd49a680cfabac0b66c589719b2d8ab8b9366194c7fe09
SSDEEP 24576:3XYfDtczAS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:itcHLNiXicJFFRGNzj3
TLSH
T10D75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 75997e60524283a745f5d28d26b7d455d7c0ab95bacda7c6d2b29b396b79fdf1
MD5 dd3f63f8f084bb772746de0c4bb6010e
SHA1 bd853ddc9c98c6188f14a244bd2b59ed917b763a
SHA512 5000de998124cc13c2cfcb471fb3facdf128939ce8dd9da9a80c83f46c29750669ce14199b01d49d053525445acfb8c105d88c3e76ee4c5d451a4f5f9fbdb744
SSDEEP 24576:10Le5ji0hmxhrM5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1Pji0Az8LNiXicJFFRGNzj3
TLSH
T18885AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b92ad40a529e55fecaf001af76c4fc7584e80605403136737dc27702f3adffee
MD5 7f628ffc05a6975ad88d7da38158a687
SHA1 6d1abf5695366008e45e139f8344293b41bea3df
SHA512 5d99bcdb46f893821fe059728b104a69bd114df95ad36a999300e78f59af13b4556da3b7bd49ae3a9614f7eb2d8b00e70754785c5c7a1bf4d0ac7fe2b3ececa2
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWj6q8wyu3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N/ezSC6vUzPv+HjygLNiXicJFFRGNzj3
TLSH
T155756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5872e26161b0b8df362278dc08bf1d135bf163f331120be15f8c98699203615d
MD5 cd141347ce7b327a50c61fe53bbf6f1c
SHA1 bf39de235a78049350ca7f8a1d4c98fc8872b4ea
SHA512 d9665ede842d54af0ee7b5ccc829aa09201efafd8600f68b8c7d9e4fc661cdfd7bd51043b15a323ac8906c7d12ae163ede90f2b9b02dbc90a5c11e1aa7d0339c
SSDEEP 24576:gVbqPb88hv/l+BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gVO88hXl+cLNiXicJFFRGNzj3
TLSH
T130559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9a0f4a516ad4820e7aa8fd3d9f08fadfd0095a4b07c63ff5847342358fb7ba8b
MD5 ebfebbfd205d3461be8b531f7c109758
SHA1 5a9e6382395f6ef5a2440ad095979605a9520f5c
SHA512 7e655f549e854ff1ac783939e3eee84c405a2efead4df7e677c9adecf9b99a58866b158400ff47db3897b56a7339740ec7636422c5a3e6aef8e4e9b6997c8c68
SSDEEP 24576:aGF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T1095523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0cb24e1f8bee1725e8bf137c87ad96f9a9a0c0a3f8be35a7200a6b7bacc0845c
MD5 7275376a85a1540b1fa55b7cfbd18a61
SHA1 987461278f972eb3c8ff36271dcebecee1f873ee
SHA512 ae708705b41f9c789c5fef4d7487d8cead4f98ac6943c54a62e3ddddd82be97e3c9d91ce5aafd652612845aec2fcc1232d0408730e4de501a39c96237fcfaa1d
SSDEEP 24576:IJIUG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJIUGLNiXicJFFRGNzj3
TLSH
T14975CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 94bd1cbe24b7874a97e73d2a9157986f3efd83b3f5e2cbf8b3312e59582c33d4
MD5 377b52e955e27f2b839a254fd70d54ac
SHA1 251b49ba92a449eb57f2bf3e609a936c2659c8a7
SHA512 a235131638820f52bea522103d2be5ba4a05d5c2b6f7d08200d0402611d5ac7d02f9ea2995fd826b86a25d4b0be447eef1f38befc756c35b0952b476467bae09
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:3QvGAdlCEL8c/WRNw5Cn7wRGpj3
TLSH
T134266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 13803b0721cc4199062ce77b698fca38a05a26e5188c25c121c94768fed8b390
MD5 ce552bc3dcaf97944d8d2cfd77d6cfba
SHA1 985113d8c088d4b3f91b7337872ea7c237c034e2
SHA512 6eb7dcffc729fd5a6ac5929de74b0ec3d075f279a4114464e4c19e19512cfee443cb0a8fcc9c1cfb15323360b549da95c6e8e37746fb841b93673f6d00e76dad
SSDEEP 24576:bfewsAjs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bljsLNiXicJFFRGNzj3
TLSH
T1A975E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 91e68446682d95328520b6cff74ab6ef6a2d801f6ecc1e39a9a2b9f2ae6a4572
MD5 330873fae325edc5607464a7e138ecfb
SHA1 aba1eebf3c2a3850d37f65cfaaedb831cfdde9d4
SHA512 7dfc0aaf7e0a7a41b99f183629818a5126436c4e1b001ab40c7cd7d89e9670cce59bf06ef3e36b2742fae9c25a921b66c40a37e36eea6541ea4249c8e9788b9c
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgF9:tUEtQevvqc2W1cpV20I32E9
TLSH
T157474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5e528bc0e8e428b0664fc7371d2da29953caf93361671e09f03d3dd9aa6cc042
MD5 1cbcd47ea581a7c66b2fd98072b26e5c
SHA1 652dfe9844da9e0783e58ff73e536c90a6b0fe0b
SHA512 573d27f6e2b120f4b8d843288e001816cf5fd75427a6ed5bf46490a25f89208b5c669dcc655b7db5e3f4b089960dd0a29903ae73ae920f4d03099d2398b8dc0f
SSDEEP 49152:HCbRquA/m2yL5zLfFiV+XenmE3/zMLNiXicJFFRGNzj3:Qoq2Vjnmr7wRGpj3
TLSH
T1A5D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1f8f8df3dd48d2fb9c9bb6d177dce48dda80120f55011b40bdadc9ce1d6e9306
MD5 d2c1f8bd5c1be33e90918aff687a9e85
SHA1 45ab5ec73e24badd5d603099a35e394a87e33e88
SHA512 62d76224e8147a46218fa646f52100287dac6d231ede88b1c1205080d22990744ecd3975e0ae26f0911bbb87479d7eac5b197ec2226ac38e17670d016174f440
SSDEEP 24576:sAhGL6IFoiwtA5l7S53L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sAM5Foiq5bLNiXicJFFRGNzj3
TLSH
T112359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7f49b5ab3844b62ecf92b35df123bf852e2f3d0abc94470a10ecce5d00dec9ce
MD5 5bd971fcbd1ef4b77928db5e9123d890
SHA1 b941a2ae7d7b727675446b3348c7e5be10099d2e
SHA512 5470544a60599456ea485f279cd536d1074d8eb56e528477132f3fa86c02e37f56396fa7e8c9547d29a703b0a877ad05baa1b974fadcbaf0c98aaf7f982b536a
SSDEEP 24576:5wuROWA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5wSOPLNiXicJFFRGNzj3
TLSH
T10865F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5e64ab1296373095d14e71bc2b5803f426075fa2352789d019e15624bdc4f528
MD5 3e1578de71401ce776d8c2531f2fd023
SHA1 f7e6fc2626978914c0758876088f99ece58da1c1
SHA512 fa9fc52d8c8ccc648ad938525ccfd0bcde798adef87da57659d877b9c4da5688afc8115a302e243f0bcaaac0c698a1b472ef7f2e2959f87c80ece4c13f2c8ccc
SSDEEP 24576:6ZuR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZLNiXicJFFRGNzj3
TLSH
T12955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a57ee78ec9b4d2f6d2a08c1b15b0da77f1a5f6d5f2fe4e823363614782a02af4
MD5 86c7d0001d8284fd23459850260eccf2
SHA1 233ef2546046ffefa9e8bb9f392ed871f3151a90
SHA512 6da08f47128c501455fa75ac2da895bc6b90ea7068d64f224f7277085964ab7e6c4176d0ee0e2d3dc088c308c0d9e8e1e173caa256c903073e92b2c810747bd4
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:iQyiKanX+PNuF9
TLSH
T186667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 46ba3b9553db2ba5de42c8bbc25b48170ab40341f7ca45a027f114311e32b9f0
MD5 12ae82edb7b2b961a789a68524873556
SHA1 314e650cb2fc2af151760cba64157e385670b8bf
SHA512 025c76fb0bb3e4d78afc2daa188193d97a5038b7701d629247505e84c01dae1aa824c11f86d67d0d3fb24eef02a556d8cbe79cd9091cd564e1d17b18bb5a49e1
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:dQyiKanX+PNuF9
TLSH
T1A2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 684e20a11415bc31990365f6baf3a0c1e65b7596ebb28a8ca357f8bcdef8dac3
MD5 d2d472ee9ce5b5829227de2f8d5bfe39
SHA1 58a108041585a71705a23c21de60a3620c43f754
SHA512 efed8f453e133c0e5e626ceb26db3f493117d000b82b7e867c02d91189bb055e444eea16be11f5ac01de09a6fce948aa5b589fcccb7bb097a65cfaf01fb1d289
SSDEEP 49152:j68Qg55nhkeWu7PNU3/8LNiXicJFFRGNzj3:dthTRc/87wRGpj3
TLSH
T11CB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 88ace2bf9ecdbc2dfb0a7988fdb71b7fb62f2f44fe76bb617dcd534f08255eb9
MD5 72e5c69b9cce842b035da24c982482d1
SHA1 8ce9e836ad3e2ae99d2ab19648924dc122ae077c
SHA512 b49983f3a4c6e2706564c1f6d9e5422d013af604a6002d1b227a97d51cb33245267a90e62da2952c82bf4fcca5079f47f6c9af95239962171c47cab9e6ce2670
SSDEEP 98304:Ry5112gYy5azzVvU69nLKnhZF7wRGpj3:sLIHRWhnF9
TLSH
T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0a9de3e3f08840f0bc82a685e98fb0afabc8051a848a803201570ec0413b40b5
MD5 49d27729b18648fa0c0e8e501129c97e
SHA1 4e63dad7946746de9ea858e580c0f9d77a6f8dd8
SHA512 6ef256cfe6979ddf5a606bcdbbe7a51247e07da43ba291095e2b39b2aae1c7c01beb50c07b757d74394349e496f9cb532c75a18a0612c6b823f693e1a4acad2b
SSDEEP 49152:UB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glDLNiXicJFFRGNzj3:Ou6JmIxd2dD7wRGpj3
TLSH
T160D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6106cc4ba915f3c12ab1222cef48faa7453e889020b9ae9351e478feacb410eb
MD5 8a081bc242abeed8851b158727ad4b60
SHA1 1312c1febeed894b014ab4d6ba8b31f75e830cca
SHA512 0e335b8c65f4ce384473800b75775850ae5253f0d397ff7d4b0e2b12366b537e5c909a694918c1688d2525bdcc0fca86ef3adf5793bbeb124800957c87e817e4
SSDEEP 49152:n1hpsNoJpF1A67U44CwH7R4xmLNiXicJFFRGNzj3:nmifPqRr7wRGpj3
TLSH
T17BB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a73e0ebf426eb4c907429de459226427152119341779e2cd8294c2021709fff3
MD5 0ef6175744ec065cb22fae54e71ffd3a
SHA1 7529b69619bbd4b7163e613e7ebb6825ad9a2054
SHA512 819a46a585b8cc268c100e444975160a31197cbbf2c85d34fdfdc9c94898b0ec8b7232978e6237c0f3ac231df32b772d21cb15b78b1d9c02fc60c5cb799f1ef9
SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHqRLNiXicJFFRGNzj3:15dKqi61R7wRGpj3
TLSH
T1B4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5c0c51b84291bf8fe0dc8e34abc7319dac7612d7014576d2ff70d052e5a90094
MD5 51f9d257079db1884735712e3f6a146a
SHA1 90c4d1e2f2fdbcce0b324a7f08ff7feafc4ff6ed
SHA512 3fea901fb599e8baeec4a6c735538fa8c40f24354616109481ff690938917674d8c09464c916812a5f5a464f55777baeb8beb7ec7adfa9211ae89ecbc2e758d9
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5wSLNiXicJFFRGNzj3:JX2iWphv7wRGpj3
TLSH
T19A95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fa6e9808fd230a244d32c8e599d48c3dd1145fc8edae03c5c448b970293d7938
MD5 1034cc87e7adee02c7721b7c8041c136
SHA1 e8323381dd929751a15b22b8d189d278726f5acd
SHA512 a4ba0c12229aef1fc801e8f95d214d33f839b0657ffff59f82d65f8867ba6052ea47d5415909526b4ac0691ceb2b8a78ad8991d131c01b9100cd6e6e1f9c20bc
SSDEEP 12288:MRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Md/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF5523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 833adf6f7695c96c80dcbc386b32fcb9b0aab043b0fc99dbda27b614f4deae59
MD5 7fec0fd2b4104abe9d5df69dbfbf7d0c
SHA1 7525e010f07b84b3bddf58c11f357c85dc09cfe6
SHA512 7179d77833468f2f0b61f65966d57936fda478f1f5c18c4257a612b045b015f3cbb02f59b1ecfff54982239460ef49443f710ed65a093829485e83f726ed9880
SSDEEP 12288:XeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d5585dac356ae1cd432d8fe921052e846d812b78e2ec9fb4b50efed8b26a93d6
MD5 0724d1e363704a8bb4aacd2a1e4ac8f0
SHA1 29350d286fec3686c1792ea506979d4e15dc0e79
SHA512 69e5cbf79d9b361d4e005504c55bb17d0b2aca555c13f55f58b250d2d82de0e90cf4222f6cb5bbe70681913e6221eed21b12b14e1ced9d41069c8b58dc6f03ea
SSDEEP 12288:G0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ge/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c0ff7cf69d47c9a66ab7273aac6461958e9c4d0641cc28a10a5223190cca0b81
MD5 09733e0347e448af418d7d1fa4b5b148
SHA1 e0cd466cf9bab765e2eabcc438bc1152c44ff823
SHA512 e238963a87ad62b75f34f8b0089a9dedbb16420c1901ee43107e75ff8a79f6c705bde802b731301a76eac35d2a928f24889c7a40679b6f9521abf4fa27190640
SSDEEP 12288:HVfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF552393168900F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 79676fd6a0b37a95554ac14888c0e703ebd6a5b1de5869462535c8e574e4fce7
MD5 bb82a7eced678d33c32f48994238803e
SHA1 8633ae88762485b405cc111133e01fbc6d89131f
SHA512 88a1910353bc454d61ec4b21e51d864ea3d15176a30de33b8e21b1904371a035ab96059d85fda677d78b05c5e72cd837f256aa354845377553721868bc12dd31
SSDEEP 12288:NHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 18cc90839881d93dfc66c35fef23763aad082805a4a32e1dd57b82a301db850b
MD5 a0beb892272cb4ce63b610db17d2f678
SHA1 4759fe682b29aa893bfa8ec60e895b913313df7b
SHA512 d4df7a9d0fa061b27d2351d9ae15cff4c9882ef93cde51ad426a8e734a0b4dccb55fc382aa68516f479d22f3b8b73ada36a0091376b53c9a304dacaafc0d32e1
SSDEEP 12288:TiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3286baae5311f7e73a2c03861117650e71f70e29b1e6fbac53e712fff28f5b56
MD5 56169024b4399a7f67550fd1c81a1238
SHA1 6c893ec37d00d046abea7d7b2a11a72a3e4f0a88
SHA512 4a7ab3edb00c58b43114bd7c8be0f766e4c4d5967142500b27ce3d71b243d670a64e763b9c038ef931d1db919a80a563f2f1cb151951a4bd9d18d71dd7937ae5
SSDEEP 12288:BmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3548955B1FABC003986354428F5882E2DEB5659E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d07f9732895c4d57e6dfd6406c9579b2e698348c20847bae533dc9cadff2a2d9
MD5 ce60203395e425abbf8a162271487459
SHA1 ca7b6aeecfc07dbbd8474f976d35a5bdf1776ea0
SHA512 796117e99dd10c0a6362e014c6c59f84837d46d0cbb2a08cdf4ee1f2945a2b58a8226cb5b49855a3767e0f955d5abfe645c8808e03adbcf1b56083c8ac04908c
SSDEEP 24576:FZM3zFVSOI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FZM3zfULNiXicJFFRGNzj3
TLSH
T157750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 72722112e4cb0be04a545e5612df9936b826f8ba52c81f72487051918e7f6aa3
MD5 867264dda248a5498cea2d5dfa2b658e
SHA1 a8d314a04dc556bd233b43f6ca6787019983bcb2
SHA512 76f8412fa1e8e9c14512a453f0a238802940fa7fc3973913a14d85916d0e0dd53f7fe9664bcf87ef92925669923a31f30be4ecc154075fd1d81d5e010f4a11b9
SSDEEP 12288:QdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1FAFC003986754428F5882E2DEB5619E3E2083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b83ca4b3dd895c2d621d5f38ebbcbee6a57ff0b6d52ed70d68b44b23b85176f7
MD5 65624b2a0e72616da78e44b0ea3bbd97
SHA1 f0e923555e8d36ec76fc614848182446ed38f677
SHA512 55c41057e6b740dab929a31d1bad13f0bc112cbb42f78debf28575338444ffc20b271dcea4d3c3d59db2e8aa44f7465bcf6e5be70b1fdf1d8a1e6ca63a1b0c72
SSDEEP 12288:spiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e0bbdb6bf1477522c70586148dd61f613f7e60ff6bf2a5e6cf005f48e7d42bd6
MD5 401eb0a1b1e255da648d731b0014fe9d
SHA1 9e1cce6539370160c83760320ca8cca4fcaa91c4
SHA512 46997f6cdf04b903c896b8abc0dd8fe48cee114b5eb7a17d45117b578d946298e01d2beabee6eb65b45928c86919f8cc628d6f0c49851353aab245a5db84e984
SSDEEP 24576:Bzyc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BvLNiXicJFFRGNzj3
TLSH
T1DA650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f609c288921b3833429861b4ff2b7b7b9bdd7435470b7993134507709895ef7f
MD5 678ea1b60f831307b746225cbf78233a
SHA1 51d8eca68f2388d486dd4c7e1b2fa59fb5f7ac5e
SHA512 708f82940397cd5ef28d2a2904dd5c937257109a716036fab41017e5f0a012f1ea695569ed1d0498f345f391e10aaab5a12046eacea8e5631d07065c6f488681
SSDEEP 12288:hdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b278d26ec0bd6db35873cacddc0e3dd396d34a91af3a1b9580a4600b842327a3
MD5 04cdef5ab9763c8ad147debee6813af1
SHA1 2c1d183e12af31c0c689ec72ae0fc215ddc5c52f
SHA512 0f2efd4126c15b2280f539751a2ef904ae7a24b0a93ccb5d6d080ed12876bb043d7279b70758a0610c0aa9b11858541c809a114133ddd2e3332e18c17df5f51a
SSDEEP 12288:9diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d3aa5ab4f96f752025d58c220b36a45993079d6295372b4886674942440a9f83
MD5 3f7d64eb319b10483f02649683651013
SHA1 5d3755b873b17c59315da27c28f8ee2dfaab603a
SHA512 5f48bac66e167af1e0b5976caa8912ea7d31d61548f0e98ddf89da08ba48b686f8e1c66be4f49d8f61388cdc55bfed423137c6225c598f0ebd5c3952c265f2da
SSDEEP 24576:Xzyc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XvLNiXicJFFRGNzj3
TLSH
T11C650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0afdd6e9e7af043c27887d40646e5a3283bc092b99b397658085509c625bc019
MD5 424d22e156a47676b796ea4a3cd94e36
SHA1 14ceb19e017e8ab62eccbf16cbf3c66d9e27bda4
SHA512 d5c3c7a999cfe5e51f4d937cc943fc211ed4e4903c08b3820def48c66b23fb23e93ef70bcc347921fc0b0cdf51cc0537f5f3de8c92a04098d455338f3c65f6e1
SSDEEP 24576:mT8aLl3z0zDu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mT7Llj3LNiXicJFFRGNzj3
TLSH
T15C7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 db30a2e8d9721a06101ab83f0d2c1fa92d8e324e3720764bdd0f7c60690130b5
MD5 f979c5954e6391be3f27f2dd0661ec82
SHA1 1fe20f859398fd114656178a7b418a5b0ae5f548
SHA512 651db3d792345b019b85d0664b2178008610ba60b75975fc6a120bff332032d38b4b662b9da518f1c81bbba85b60ab2312391526758688afd8ab821195500fcb
SSDEEP 24576:p3rd9CHKy7GZK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5rd9CHKyaULNiXicJFFRGNzj3
TLSH
T10E85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e82df3d11971ae7f4b6475bfd0db9ff53fdd5ef7b13dc3c0961e37bbe33b1f50
MD5 cf9da51e7ac2f8013fd533ef4cddcc23
SHA1 657f132384c6619e1488162768550fb92d177724
SHA512 af8f8ab17f92863c5c96f1a679b7388a25270b24e6c686ed2f45fd93eac2195e49425ba80972029e3134bbb806e71bd8dcce69d191dcc6c59d7e403b36470428
SSDEEP 12288:CUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 231798e1a88b29062cdfa79c2e185bf49e7c8d95ceb01f426680821039acce2c
MD5 c6a7080c3e38b46e804e8d084110b84a
SHA1 e070b32436fbb065ccc9f80ab68bbd634cb2de8f
SHA512 03fc8984ddeaa1deedf989311faec7322bdc3aa9b3396474488284e4b8f8c5361e43997c250c629d530bfe37358db55cefbc4332b03855bf1b59437d1e871eb8
SSDEEP 12288:5aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:58/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d3c75e7c24d65569437c3bc80a1ab2c600f412320103e6747f502b939d0ea903
MD5 c7cb424ad70513132b2402544f9c5d7e
SHA1 17708cfea3b74142161dbb91adc0a61b04a89a82
SHA512 222572ab2eb312a7dc062178af644ce28d77e678ee1008ddd3b6ac993fb87309bb23bb9cd5e6f642e5a0a14400f9f0aebf7016b1577649dbceec12f6f04ae44e
SSDEEP 12288:TLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 29ee23d23ed343e473ec3b05334a678558bf001247d7f68fc2281fe62e8c792c
MD5 5fecbc71190175ab6da7547159b48114
SHA1 6d11424da24a691d6f34a67968653d84c0244cc4
SHA512 3b8996fd31d74723bcc49aed688312683ddd226d3e198b9a96f3f3306517e51a6fa4f582f87fa14f41fdb214aa46f771094855ceb73d7f0fbcf378a920c3766f
SSDEEP 12288:RdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 56bd208c1ef64c8e4cdb296e0ce337c200b941926c0f71c4a422890fe4272d17
MD5 a13dc79fc4f912b4e9c9796cc3776342
SHA1 ab870574a493cab6293f7cd8df374411b2661d4f
SHA512 da8f7e5794ab0dc09c21f8f1ca8aa58fa3ce364e8b28bff99a7ac5608800607d560ad4c82e994d0a4727db2663469f9d58066bff809d37bd80fc2e605bd0fecd
SSDEEP 12288:VUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cc86b09119564c2d106b2eed75f5f40784d77973e1e80de9e032381bc5c44f95
MD5 d08ac5113da42df6547350291c66f864
SHA1 7e6e9b107f9ce5c59459bf2ef438522863426e7d
SHA512 5d5a0749a23b797d9b50b90a72651b3272ebae966ec61840f839739cc79052a5ba5dad4efaa3da611f4310bef8ad23f105a1a3cff0f5acf63cb4a45d9422b0dc
SSDEEP 12288:NFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3abaf61337a4bdd3d81daedf1080d9f390054e132f1080b20e3aee9c47bf4ddd
MD5 fc73083998a536ea216219f4cff00e9c
SHA1 31f1882d9d9c2851ac5d32217887dba8aba508ad
SHA512 24065d68a7fa88af841016f72f6e944930be94d177ea0d416884334c0e00fefe0c7984f855cbd0215e8ff14c40aaf0f9b2111fbcb246cc49d94ddee3de774736
SSDEEP 12288:QHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e973c3fc034e1ba569999b3d02c9990b3a539b6208704d993197cf5a4e0ea9f1
MD5 7ea63b2921c381315c5cdb0ac54ab937
SHA1 8b87c597c6ad8620176f06abe0ac736f5210da92
SHA512 f9f99c8c40f671f68a57f9c7c37d82d6b08d08d62750442f02ca194cea8a14bec71cec4042bf41bce2ae04463a1c734922c2ac267046ceb5c72e972eb1a8de82
SSDEEP 24576:Tfwvzk9RX6wkyAIl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GMnYIlLNiXicJFFRGNzj3
TLSH
T1CC85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1b2b81d61e8d1b8e84841de87e628ab54e1a48e54ddf94b89cfcd06609eb0783
MD5 738ab7de1699685e2c23a07e51939245
SHA1 e5c3012effdffdb0ed14a428fd992a8e13de290a
SHA512 d508436aea3ac4c0a801d1bdd82c4ce317cb151101e648486fbf10b21270db5dbdab4afcbba0a9eee3f519501636ecfda74278eb5a9aa78fac2029572ea735ba
SSDEEP 49152:KYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yLNiXicJFFRGN:1ySzPK7wRGpj3
TLSH
T14A066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c98f06a3afc5451d71214d48aeb3746291e25b2a34a78e3c5768c7c96bfd2dc5
MD5 777130a6806e49c0170701b17c3a3b5a
SHA1 e6ca9eb9b3812987c41e16a4015b19eeb60c701a
SHA512 d1b78c61fa5ba8d3c6d8543e9b4fc8a734eb1dc273c0f91215ffdf804958ffada352c5863139af4f1c8fc72809f20763a0e13799e000cfb7cf35ecd38ad2221b
SSDEEP 24576:l47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l47JUQjqirIhCnDHUPfF/iLNiXicJFFS
TLSH
T1FE65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e921910180dc055f02613b9443f4cca4485f14ca192eaa043d8a074df8feb7f9
MD5 b28e17809dd8a6ae17299fc2d71cf80d
SHA1 5392fb0ff6a56122b342ddaca54adc4d6df7b71e
SHA512 a9ce20cf05649df524cc8fe34e54495dbc8600b457eba404afabd34223b6c8020f88ff62f025215992826344a3138e815e2d9201348af5ff5cc12b44c027cda9
SSDEEP 12288:+psfNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10365F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 354d161f8406ca3fb47932fe43583289abf3192350373e54409fa304f6b0f57c
MD5 3f4ce4dcf09654688eb5b4dd52b81543
SHA1 406c7cc7780d222c9f978263f4825e4ad302721e
SHA512 3c26408466a4787b50c8a8fe7777a7e93a5c76cb3d57a71fcc60f77076521d09cc0fd2b34dc337931075f76e1291fb00fe8151f3ba292c0a996228fd6680512d
SSDEEP 6144:/7sBC2na2IDq8rERrfKDexHF4Ny53hGmqksHhTRPpdIh1p64G4K3TyBrY0flsiuW:/EjZriy5xGjHh7464D8QY0tsiurqTmzc
TLSH
T1F2452851762AC75FC6A940326E37D1CCAB707D05EE056B0372C88B3FD576668BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 601590544565438e1126c00d8e3b5b93bf5466730ae69961dba8fe89b1fc203e
MD5 e66f7414a6151b7dcc08cb62666028ce
SHA1 1846d317d9b701ec255e1dbcb78bae3b2cd9c311
SHA512 3691e3dcf60c540d1706c727fb9db898696d2423e81eaee7f30f328eea16450366c05a869c978fd24f4d0c4481f598a281a5adeedbcd20a3afe02d1cc769a156
SSDEEP 12288:p6thqaTIUjGDZgSVnwdlknZnU3RlUNDfokQApgqSARgT1QoTEKuB:kjG4QPK4
TLSH
T11D65D881A537E38FD1F76032072AAB4DA764ED03B7056F1673C8053AD86A765A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 689b60ef73a6b21ae946b568138482aae52f14a8558af97c88d342e0c2c912db
MD5 eaced257a61c115396815c2e1fd23007
SHA1 fc88eff3a74bec6e1c1c3b9c9f454fecc0ae05c2
SHA512 029005b3b8462daf238e4d9ddb581e3c4aa09d31779ee549d8720dd96b8ea94c08d11ab5b3f20c16c46c7cd3d5edac9847a9ada542099802821a308ab7fc95f6
SSDEEP 12288:hF71iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A5523A3428D59B1FAFD1039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c27389138ce4b48b9eea7dd2374d27d76934536cf35e8d51f2d132e7bd197f5
MD5 b4d2f23218c3b52bf751e170b331e8f5
SHA1 518120b379f42f86f927b211210a24b9aa84e615
SHA512 8e140159116e76556e6cf7f99aa3b94700deddbf30fd68c8efa8c9e82417b9deb271bc02b2b6fc148234ceae0e08bd45e7443c3c9a232d8d5f3c51326358f83b
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lgb4mBIBhGF4LNiXicJFFRGNzj3
TLSH
T18965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5da002dd05c23b5c48732c4a27f767569d2913f3337c0f14a4223245d4a2e3e9
MD5 3e18d6f8cbcc67d7a38e0faf741359c3
SHA1 631d1daacdd8dcf17d6d9457982aae7d10d37520
SHA512 caf9ab2f6de1e561f79dff6206d2a44bbcbcbb7eae0afdfee84014c61f5a807dcc126146b23dda6fcbcfc1b9137eb3c56e032427a4a6622a2a5f6a8e2311caf1
SSDEEP 24576:QG88u8FpJqH1vzria7/mI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D7ZFPqVya7//LNiXicJFFRGNzj3
TLSH
T1E685F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f086146ae8b0bce3abe2edcebf13e52232371e7e79aa1a83e57dbedc4dd68017
MD5 ff370064dfbc5e3af587249090c3dc21
SHA1 22d14bc339f1c40f6c55dac37dfabe42c96a71e6
SHA512 a21ce5da53f11d1bc2fd8e4e777b44008789a80b718e82a5ff956d95f3fac3efc939681c1c45d834b2425313be1859c69242f9b5c4491b9a8f861a6926a252cc
SSDEEP 24576:BPUr+NQU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BJQULNiXicJFFRGNzj3
TLSH
T16265F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 802ee907a5d7f61e298338f1a2f98ecc4f7df8a1ce8fd0077889682e4f74ba4f
MD5 fa484ff646584963598f5eacff3f673f
SHA1 78acade2b1cae0da5a5bf8ce4edd77e95429d128
SHA512 4705be6520a72874d0abf3aa508e0c5213496190bcf440cefec4118f83ca26b4418a0cb7122f1449054b0030d1347f2925e11b366f0e42d55dcdf4499596d394
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkLNiXicJFFRGNzj3:OG05lO43bN7wRGpj3
TLSH
T1B0D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 743e88d8947f06a573bd2476a1a16b46045f1a57883bf21d15e7d58e290d9bf8
MD5 7f179a041cf5453186379f9a780edb24
SHA1 b4b4149d3987523984dbe2366d2cc325af88af3f
SHA512 7485ea7e9488c7409fb61bd4e978b731724e9e815980d61b37a71a9c96c375a2667b9e69fba7677300c30543d5f231c3d1e73e417d6c0c43647fe6de6a60d3d4
SSDEEP 24576:0fa5POZ3dpyWVM50JicR2hG0lasx2+47eidny/TwSfVcYG3K/cJHlnFR+IGNe8jg:sa5POZ3lJt2pasx2+m8LNiXicJFFRGNf
TLSH
T10B65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 25f3ed509314d8c3e8ef4be03d486d90a8233fb25455a998d824188abc2ae6b4
MD5 79cf7172bd961130650085954e966338
SHA1 520abd3dd76c6a09ed92df025c5fe43d1a042b79
SHA512 f28116cb5bc6eea4eeac85ed6e4780bf70f431e6cef6b15bd05feeacd312a3a89df36670aee31e244596a471da9673ef2b40acc4824f9837d01e63c352602873
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fkg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yNc/zEOVHFfLNiXicJFFRGNzj3
TLSH
T1A3858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a4fc5cd0e288f9f1c833a0681a96b5a7fc3c8bb4705738702191632b9984c9e2
MD5 826479838fe79982df461b20e42271b2
SHA1 a653152456377b793045ebad725ac1c81cefab9a
SHA512 ed5e927a9e9f018df1a21cac242eaa8db5ff6bc37a191ee015142039f068be3bd95f3166caeace7833a5afe9b125d080ff309324b0cffbd14810b5aa118598fc
SSDEEP 24576:rzkNvNnaFeYhJNtmZBmn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rzMwBtOmnLNiXicJFFRGNzj3
TLSH
T11D55AF6EA6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c0da573567e96b4b4dce890ae645c3265678110965355e95ee6767b11b37dd91
MD5 f32028de27541ef92c5ce885807dc800
SHA1 a3107e9baec3d9a272f1e5c8251d71d2c95f7b83
SHA512 0b8d3beffe627f09cb1abd73e8ede6b11c78483043e4fba1f330babdb00d6c4ecd8e5898dee701b63cb18af4b136bd9c23bf52eb1c15c07db8994f031210d1f3
SSDEEP 24576:0D3FHshBIYQgA9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0DVHeBIAA9LNiXicJFFRGNzj3
TLSH
T14275E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-119-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/236-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-324-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/236-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-113-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/728-124-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/728-327-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/728-132-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/728-126-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/924-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/924-143-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/924-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/924-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/924-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1200-89-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1200-321-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1200-95-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1200-90-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1320-58-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1320-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1320-52-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1320-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1320-62-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1604-46-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1604-47-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1604-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1604-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1604-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2544-79-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2544-320-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2544-85-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2544-77-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2728-6-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/2728-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2728-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2728-23-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/2728-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2728-22-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4068-408-0x000001C35D2F0000-0x000001C35D39A000-memory.dmp

Download

memory/4068-339-0x000001C35D2F0000-0x000001C35D39A000-memory.dmp

Download

memory/5008-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5008-100-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5008-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5008-341-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5008-106-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5008-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5552-26-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/5552-34-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/5552-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5732-305-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5732-67-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5732-73-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5732-66-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6016-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6016-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6016-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6016-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download