016270f79e09a770443638ea2648049dc7551e90f94e9def85c97554b0134e58

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260804-xz6fcaff58
SHA256 016270f79e09a770443638ea2648049dc7551e90f94e9def85c97554b0134e58
MD5 8ea9c7db6d45d0320e8b4928632e148b
SHA1 5d6698ef18a378e7b963e1a6101606f153da509a
SHA512 8eeea2a7155cf181d5b30a8137666671a9bcd04ed03972fc4acd70abe54205208761cdee3a29fcd632634deb69c16d03478e50a498c120a31558aa53f9e7af89
SSDEEP 49152:h8JFD1M+KdV5Taq0RBqEstikXk+FK28X1ejMcYzKlbcEC+MRki2N3T0ceE4RLNiI:A7KbCv7wRGpj3
TLSH
T1EF267B1BE7B941E5C0B6D1798A979517FAB2781A873297CB4390471A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3784	elevation_service.exe
5060	elevation_service.exe
2984	maintenanceservice.exe
5276	OSE.EXE
5880	PerceptionSimulationService.exe
1920	perfhost.exe
256	ReFsDedupSvc.exe
5828	SensorDataService.exe
5428	ssh-agent.exe
2900	AgentService.exe
4424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f1f54ab7238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e64bfa1d4624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002901b95f4624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef24841d4624dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090418a1d4624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eab84d224624dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3784	elevation_service.exe
3784	elevation_service.exe
3784	elevation_service.exe
3784	elevation_service.exe
3784	elevation_service.exe
3784	elevation_service.exe
3784	elevation_service.exe
5060	elevation_service.exe
5060	elevation_service.exe
5060	elevation_service.exe
5060	elevation_service.exe
5060	elevation_service.exe
5060	elevation_service.exe
5060	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4132	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3784	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2900	AgentService.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: 33	4424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4424	SearchIndexer.exe
Token: SeDebugPrivilege	3784	elevation_service.exe
Token: SeDebugPrivilege	5060	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1784	4132	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4424 wrote to memory of 2136	4424	SearchIndexer.exe	102
PID 4424 wrote to memory of 3744	4424	SearchIndexer.exe	103
PID 4424 wrote to memory of 2680	4424	SearchIndexer.exe	104
PID 4424 wrote to memory of 4880	4424	SearchIndexer.exe	105
PID 4424 wrote to memory of 3388	4424	SearchIndexer.exe	107
PID 4424 wrote to memory of 5240	4424	SearchIndexer.exe	108
PID 4424 wrote to memory of 3328	4424	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8ea9c7db6d45d0320e8b4928632e148b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4132
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4132" "1464" "1340" "1452" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:1784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b1a83485a5b5e21003b1078807a0afd8bc97c483b2e818e849f39619b7b2c01c
MD5 96131505c7c7e178e52ae710eadc9cce
SHA1 55761b46ea6a265c55331feb535247f61aaf9933
SHA512 19234e6266dd45d9a1030c300cd6edb804870f8161869c825d17c7832037f02d499efb19c39ebf447dad28793a05ecd883483a664684797e188387bca784af20
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxngLNiXicJFFRGNzj3:Q3q6mjBv7wRGpj3
TLSH
T1B6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 79ddc88e8e12d1f4e1609f9b56ac1083ac9193e5ba3ce1b6f52e07f358c82483
MD5 1fd0c2b93160f66b3be712492825331a
SHA1 0fc4be848dc6f2e007a19bdf0884d08d4c8dea9a
SHA512 75bc40f2208ac2081a2649ef0b683829ad3b9701d55a673948b8f4c83b052f7275c2a441e7c59faf90d4ad7cea8d79c3948afaa74c529ee6644498203f140eed
SSDEEP 24576:gXYfDtczAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XtcKLNiXicJFFRGNzj3
TLSH
T19D75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 77c564c429bd10f18128c71b10ba1b1b9c01dc4297b4dc4134c61de5c6bf8356
MD5 cf19755261ac71c2cadb54d0a88f5cd2
SHA1 d5166d41ce3bde6ba4f45d02ea5fcc10bc535c2a
SHA512 748a797182f47e3f5a9b2aecc3188d5ddea1fdf5e0a79875547593457790e28f4ce74957e20bb77e9c5dae923bc551a7de5319950b2da2b668b38f6ad35173b6
SSDEEP 24576:N0Le5ji0hmxhrM/s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NPji0AzCsLNiXicJFFRGNzj3
TLSH
T11985AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 84e9fbca6e35498882d168ff14fd4f6a6c95f0f7a327f08f87029ed2e5e1a3c8
MD5 ef50130ef2f09a99d9d31eb118820dfe
SHA1 c59b70191c1208b8a9aaf15a27a19caf4f984cef
SHA512 cd07bb3290c8b4ed410ba321f59e6161b07c636d339c54a023c4d71c195b44ecdfa267a4e65bef11e2a6947eb965295cc3c42ee78bb98272a4e8e1b273280688
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWj6q8wyu5s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f/ezSC6vUzPv+HjyusLNiXicJFFRGNzb
TLSH
T10E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a674a95dac344a53ae8230349c6b4bbf6fbe839feaf5ff363b648655d74eb6f1
MD5 120537942026ca0511394c0060075748
SHA1 78b8364f9864c34f51a6861a82be1be9ee4eeebe
SHA512 05feb882f3f0f46cca6a1179a0398de4b421675fc2c4cecb6fc1633d8296b0ed6558e15de83d2cf4cbd9354a69367ec2e86986c05f751bce7cd2c2edcb413e9b
SSDEEP 24576:UVbqPb88hv/l+BYs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVO88hXl+isLNiXicJFFRGNzj3
TLSH
T126559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7f09f7658afd627ab50f0109d5ada51a0c7522cce5ef0bc5df7dbebc5975a5c5
MD5 b946ccc27b9be9f80fe6697b73a91a7c
SHA1 3ed9a6520532704985eda5d99bccc10ea383c964
SHA512 5e5885c666a6681be0d1980289a773d52d3fc671b161e02cd763a12247e8205c62d4562dac76887e0b7346a6a8c518415168efe55a00ab0198e55dc397515d16
SSDEEP 24576:aGDs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xsLNiXicJFFRGNzj3
TLSH
T1B95523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6ba28aab93e68309ec395d98caf5a94fa4cea66bc89f1a24fb0b7ac5fb09d185
MD5 a9c67aff2075a8a3010eeb1b41bb75f9
SHA1 a1ed02e5cc30e35542e444acd658307fb041500c
SHA512 a8f5afc91a82d81cda2a9024fc8a95bac324e98724659babd0111d21484f1f74682142bf41028013172a5a6528bdc3ecf63a817cf6a48930398f4cb8fb764ff8
SSDEEP 24576:5JIUQs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JIUQsLNiXicJFFRGNzj3
TLSH
T1D275CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3a4103242b4abd83cb63fbc8a91eec01c478fe8007283c1543cb2edd65cd8268
MD5 8558e34fbdfd5b587da01068c34cdd92
SHA1 467bfdda2a0543f5ea8e241f7a440a4b07ee3b7e
SHA512 2934f78798483599f2119c5a5f7fd359092aa729bc81578cca958a2bae97aa8fe4ab1e92f7c71479adebfc971e652dfab859755c6f3346a807acefc55b51d55f
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:oQvGAdlCEL8c/WRNw5CJs7wRGpj3
TLSH
T197266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ba77edeff9a06bfd372d9f4cb1c0df8f8776e64eefff5dad8f0521d03d161b3e
MD5 eebadfba19b0e91d2c3302ee459022f9
SHA1 e207d038a7a9cc64fe3c13e75c88487ac16196a8
SHA512 1d350287abdcf252aa14e8d98b3d5f8cbebda9aaf3df40421699f5d4dfc73cf6a748da89eee5319dad5298760ada190e446a3fe95f929d98e478c3a30458ff35
SSDEEP 24576:BfewsAjSs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9ljSsLNiXicJFFRGNzj3
TLSH
T10C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4a48da8f0c8fd3361d2272073eb6b3d8a6e8f9cc11d69ed5226c0cdcd4a0ecad
MD5 67b96b85e51d9d04659bf6cd1d86d3c6
SHA1 827f3966bb86838599453933ef05c8db5882f0c3
SHA512 104f41d2a46477a153d41d6c13b79f3020991c2a7f6562cd5781f1fbac71429863b5861dd463bc245861fe9f1d75c3645f502b1626340e1a93946f7ece94741e
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6oF9:NUEtQevvqc2W1cpV20I32L9
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8c5877600fcaa5d644383c4921762d421c94ac5c3769992e8085c6743e1b4444
MD5 e34c32c99c3b7b577bee0cfb247a10cb
SHA1 2016c0ad641b9223192e6c4b38a0187a965c17f9
SHA512 01da46c63fca820dd47870222ffba6f7c54d19df0365e90953fd3dde587e11153659251e950787a812c787610dc3804df66b24eec7fb5e28ebe4a914c37da833
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zysLNiXicJFFRGNzj3:/oq2VjnmVs7wRGpj3
TLSH
T187D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b5f7155c23b06dd15e7997acc44ac901b804ce61d91a21bcbb6f8c4de0ff4262
MD5 1e5b2497a1b755fab6603e2fbbc987eb
SHA1 89e5947e51a7e1143e160e340dd829fda6a6ede5
SHA512 4068f63398b8db9828d1ee7395b37be972a7bf1f90c213317744fa456a118d6376fcf699b5ee80be264068f26e196b4efec04a666ccb73a9d6f0bad6333cae5c
SSDEEP 24576:cAhGL6IFoiwtA5l7S531s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cAM5Foiq5lsLNiXicJFFRGNzj3
TLSH
T1E8359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 734c7546dbb97b80ddbf91e2c941c400f1a72be190a724d1286f15329b15cc03
MD5 e0faec53c41856e12c0eaf449d3137d5
SHA1 ccb2b5e1bba500587771e4f66cfc42ff07d5a917
SHA512 5daa06cadcebe836575abb9cc6b81a597d618ecf5151f4ff406e6d9a9ce64e81e636e2614a27273fb7ee1744d3678e0f8c7eb3bd8fb64909dfb2a3ea4a7923ac
SSDEEP 24576:RwuROWOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RwSOxsLNiXicJFFRGNzj3
TLSH
T1BA65F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2ce18d56b1139d2f54af3587745ac9921ce2683c2efbb0e2e32cc8c340fd7c17
MD5 7ca050bba782539133100773de536a46
SHA1 859a923910aa388c9eb0b35f2d32763da16a6f1e
SHA512 6f0173e33889dbbf3d2f6e2358ca22991330d876e5944f8b3e970a209d557867243b1bba8f9633cdfec4aef9ae9652708e95efb1f6fd1f3d23a39394869f925e
SSDEEP 24576:9ZuXs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0sLNiXicJFFRGNzj3
TLSH
T14455129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb864109eae26c60c26ee3b879a9f4e07208b4ff5e5f08c82f0c6b3ba51ab154
MD5 43c325b58aa9f547a351926a6448b97d
SHA1 b752780a3659b479a40d89d7d04053a7a5fa82f4
SHA512 d96f899085b2977eb91b5d2a14ccd71f0f5e74755e467d84aa25f19ef3baaee0907fc674111f5b68f5d3d9c76c7686a8bef9b9ed4640eb07a25e96759cf5621f
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3Ms7wRGpj3:BQyiKanX+PN8oF9
TLSH
T11D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c95c0fa4b78f28dd5505cb5eb702cefc8654a9d7b42debdb28c260fd5237b7b6
MD5 8f0ff5b2d510e7dd0917338ea2fa8e98
SHA1 3fefd4f1e77ecdd202f182d76b1cef02ad5e4ce0
SHA512 26d4808acd9b8d13a6f9fc4b2a77bfc7089b89cac47947705d96c2f90fe6e75ddf62b31f99acf9becbd44d0eebf619900b95564fb2248dec3102692696c97f23
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3Ms7wRGpj3:vQyiKanX+PN8oF9
TLSH
T19C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 25f4597443c61f6a33542f47e499d682f734a6782887cac5a2259ecb9b144606
MD5 f6059c2c46a28cf5e70f67545dab131a
SHA1 0cc99458da92263d73a72b15f629e9f59d2f7009
SHA512 7e0e3e16baf5a8b3c06fa1c48ad92ae42958e12ebcbce67865f63b91f158377bd191480cf9b00e0f04b6a12caaaebd498761bcbbedacee71d2f7f4a906d095b3
SSDEEP 49152:D68Qg55nhkeWu7PNU3/CsLNiXicJFFRGNzj3:9thTRc/Cs7wRGpj3
TLSH
T1F1B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6dc3a75110f50eb17a1cc9eecf7f6336ff3cd755416dfc6649698ba53f32a26
MD5 edade5821494bf87148503ecde4e1af3
SHA1 e61faa69505a9feaed5d935060cc8aff33f5d63f
SHA512 619394f61f8de39061deb754121c2f286a6eaf1e487ac7ca3d746f148382d948e90ed6f3e505d2db05595828760a1b7cc8a3b74071f65a309e3aa8aede78e3a4
SSDEEP 98304:Jy5112gYy5azzVvU69nLKnhZDs7wRGpj3:kLIHRWhdoF9
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6c9d9d3e3c05add4bbfb7207f2c987b5b097d20220ceb1ebad79d9519e07702
MD5 66b0c10ccdd28f5bbb0fde035c3a4613
SHA1 946c3b27e7cebf31e7a3e0f17093bfa8dca05670
SHA512 d12878b4d667263cee4e4f3130049b08ac90cb202c3c5f1da513d7caa181b4a18875a192198d97a828905e9d7b0010bdc1ee9ade735bf0280377ee193701504c
SSDEEP 49152:IB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLLNiXicJFFRGNzj3:Cu6JmIxd2dL7wRGpj3
TLSH
T1C4D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 344b398f8e1f93e65070df1804fd0f26ec1774901e41e63f0b1c6681658d8257
MD5 7b6650d64d6a9dde2bc42c84378d40c0
SHA1 50e10815513c84e5556b53945d7997dffeaa9499
SHA512 5f70e99ed95deca7ee6ecda8d02b867ad47b75f992cd4debe54379f25a124d562544b486d8cdd97742144b1426251e2dda476534ef414af0488873446b2f0c9e
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4xwsLNiXicJFFRGNzj3:QmifPqRVs7wRGpj3
TLSH
T1EAB5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9d63ebb2c49495e6b38b061543519a2eb079266d7612d770038e3bad861cea38
MD5 463d1087ce015d6bbf93ead9919676af
SHA1 aa75ee22fc5843195beab8976a9b54d5353b40b5
SHA512 9076082f6cb6dc86d59d7c9555b79896344fd7325f374af12842ac0cb3dffd543317d3dab961e590bcb13f7e9d27f66165854c68722318574198c88cb01c8b55
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHqXsLNiXicJFFRGNzj3:z5dKqi61Xs7wRGpj3
TLSH
T10DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 574f0c493041af9dc01e5a4a412b02c18823dada25358c55268c252aa3d5e406
MD5 e4284f3067dc0e4133fa7c9a2d5a25df
SHA1 dc60b2b00c7c46ea10187ce4b2c633367fdbfa89
SHA512 d1bccfa57385087fb4744c6dfc2a6fb43d2abf4f596cd884abea3094ff977d0a8b3456cd27a35c511412ba3ec25071afd06ce78c916f2040a1c0e7162f0b4fbb
SSDEEP 49152:zhtSn8EApI0figjgiDn0AP5w0sLNiXicJFFRGNzj3:yX2iWphRs7wRGpj3
TLSH
T1EF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4271317b222db2f127cec169f71cbc1780d0c027012525a8b9ccf780d85779c7
MD5 dc2bed321d6d456ea6a8d4d548fc3665
SHA1 a9de0c4251830d2fe9a6bb3b3154cd48dd4f00ea
SHA512 43caccd5c5b7ebe8a2f77d2249b069736dc14b401fd68dee99fcf8e0c530726d5d1d345e39ccca598e54040ff79741a9d9c947856e714242c667284d2860aa25
SSDEEP 24576:z7s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3sLNiXicJFFRGNzj3
TLSH
T1085523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f35127ec8d302d1e6f51a7bdc12ca76bdb139db86d7434c10161a672ce25c7ae
MD5 b53f96dfa79abbb0c003beee33038e7b
SHA1 7d86546d1fd5577937480ef9063e7d9b0021dbdf
SHA512 a9daafb249e33ad3c2f885574092522e2500a93b6a2848c8bbff494af7bd52089c9d60608c0f78b9d8f58a02ca55756316917fe769a69ad0fc941ed3caec1950
SSDEEP 24576:e2s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZsLNiXicJFFRGNzj3
TLSH
T1015523D3548955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 17d4ec88c8d7577b14950fcafa69bcce58b0cffe2fbfb43b323ed68979579778
MD5 8560bb0b39f6da2826cc813124092cfc
SHA1 dc14be93290fd239df99a029fa88d6c4ec3acacb
SHA512 e4b56e6126fc0ea85ad2ea2c463050f8859d40e438cafde1c4416204160ce7cac8ca0a6576b41c3459c6e19e8cab75c776931acb357190fa4a7c4ceb21ab2bd7
SSDEEP 24576:4Is/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RsLNiXicJFFRGNzj3
TLSH
T1E15523D3558955B1F6FC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6c5ac599c9cafc41dc107eefd34851169dc0e2f3dc04345af1b63d79d73b9eb8
MD5 6dd6482e4c96c8049c48feea13f22803
SHA1 e787a42f6f64cf7e5e27626eca7833d3d844b54f
SHA512 2ed2aecd92fdd0cafa22f10b59a457ed8bcb218981a59bc15c43a6284c9f8cc8d21bf1790015b48dfa53491063260f7193ac80fa8df38287dc91ac555016b198
SSDEEP 12288:1VVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T190552393168900F1E9B98039C6764428F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3e3e74fa7582147af3633b851883ea5dea9c88371ea80a3ede94a86aae065464
MD5 4fb8e8ebfa3e3db9be830f8c59623135
SHA1 f77578e34be4ebe95c36d51f38b6b6acbb80ac92
SHA512 e0a9beebf83390cdeb0074cda8e96e50c81dfda7723c18f337e90924161ce0ed20c7390b33dbfce3a6cd484daa65abdc20d55edfc0f79da9dbae909ecd165a9d
SSDEEP 24576:E9s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6sLNiXicJFFRGNzj3
TLSH
T1F95523D3548955B1F6BC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 de0aa6cbf44be76897039fa6a1a48c7c77253e8481d51cfdc7a3048a76da28c1
MD5 1c74fffbb6323e1eb88808ad3d527af2
SHA1 c5dd30393f41a338e108ede658abca2d4befe8f5
SHA512 d4d53e329d1b34af5f42c9e959771b61170968b983f181c914a38768c62be43a6749eaa2b0fc568f8bf4a23a3986964844a451a38ae86781720b89c2036ea8b5
SSDEEP 24576:AKs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:psLNiXicJFFRGNzj3
TLSH
T1EC5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 83c1d5755678aa48efeab2e6841f2992e0958aaf4a600d7ec1acbcd8f9d71d01
MD5 ab66ea9ecb8a16d0e638719e853553fc
SHA1 cd3ee653cfaa1873d031b433d99a5677fdeb4a76
SHA512 8eb73d0645d40fe3313b9e5849007cf174a5061bd7ac9217a7a13726e8196306e72f879d95843efb779bf7222add98e3323e14e903e8afde4bd80858027fa578
SSDEEP 24576:U+s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7sLNiXicJFFRGNzj3
TLSH
T1545523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 eea2e6c44cb2b4a556c28f34ab589ca409c3546623832ee42057afa6f19635bd
MD5 2cffe7d661531752569dd6b1b438cd51
SHA1 5d8bca1e7c0626902e6e9c3374664e4237624aab
SHA512 b2f6bcee8caffb5447d282860db7b3d467a418ce38b3029b6edd83d0ef975c7cbf73c0e5fa521bc0dfed11695f22bf0a43c998530588f2e7e77cbfbf4b2212d9
SSDEEP 24576:+ZM3zFVSOWs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ZM3zfasLNiXicJFFRGNzj3
TLSH
T15B750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 46b3564709cbd4575f88a98b1c21c1abebdfcc664113fd5ed725df60f992489d
MD5 3617f0453117549e6a2ea0e2eab198ef
SHA1 956d0ea900cb7f78d68cceafc4befc0343284250
SHA512 30ccc8c7ffcd0e7a213db65a3e4263aa8fa5ee131210caecfc433abc08584334af204eb63609c229388db2c5171bdd70271c09ad9f2a02b701d315bc92d41b0e
SSDEEP 24576:wns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0sLNiXicJFFRGNzj3
TLSH
T1635523D3548955B1FABC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c8679e7a62825a89b3b98960fb8557a8d7949a6ca18499b99606542b58b3b416
MD5 248b7bf4de6da1dcf0fcbe5600a6b320
SHA1 b8002b9b193e998243c82ed12ec211fdb655172c
SHA512 8ab872a93e952a37cc61c883f601e1ea48da436a1b8f128c7612c7dcca2ff946083d46d399e211587dfd90dbbb4b39d9ef23ce4c66bbe8285963919ac869f6f3
SSDEEP 24576:dTs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JsLNiXicJFFRGNzj3
TLSH
T1DE5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ec881cbfea057dde7ddb727dbba26723f0e07e69df88997dfe22d9bb3aa81e30
MD5 9008ba686ca71c4d3bb02304afa1cd0b
SHA1 d1c4bf09914f771a97174640fd6d16ace9153186
SHA512 dc83c176de8c0e27844a7a65a85c6178d0b621fa304ddb4bea80d8e828268e1d0529f76e4d70020518126714cc7c5b37107f6aa70a602be7e9886f05bee7b0cf
SSDEEP 24576:Uzyis/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:URsLNiXicJFFRGNzj3
TLSH
T177650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 affd8d169ec3405f05f6b88cde54e3a09532d6f94d2f637596456ef492c66447
MD5 119b690d040338f5f3331749b5b65f55
SHA1 46aebb08376215a513789149621d12341d3f60e8
SHA512 4ed9188c664c9cebb250e74da96de0608db944b175562d2ef3ae929a4d07d804bdc0876408250e28a7b207c964996de66a5eb6e039099b4e5c3383ab67136df5
SSDEEP 24576:zns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7sLNiXicJFFRGNzj3
TLSH
T19E5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cd91c2116ca1c900cd53c346779ed607e6496893b49bcb5eee56be64557291c7
MD5 8bc8e7bf9b8e9df96f66cfc139e2b455
SHA1 8d943fed32f1d14c187b197a32cdc29a8da37b77
SHA512 873ed7beab4acc820ca96a3f7416f81e126b88ac4ec1b74a69b2444397314e0db0bc014bf7c304346546072a04148bcb7e357ef96b130b122b2a69666e55e245
SSDEEP 24576:Ons/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ysLNiXicJFFRGNzj3
TLSH
T1F85523D3548955B1FABC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 856e847990512ea4e3df3f146f9bf787ef4a802879e6f32b52b6cd293714a8b9
MD5 65702bf3802e83b14ef1f364a17e7b98
SHA1 dea5fc45a5631f4c67568e6b72d0de3cb031184d
SHA512 722d173dc6e106d31534199004d1311edb5e0cfe74d130807ba7f687401430d653c71d53327eaa87d638481b78225be93997bdc4d31ee40015505ceb91beab5b
SSDEEP 24576:yzyis/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yRsLNiXicJFFRGNzj3
TLSH
T179650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 66dbbbb1cd05e74981259d33245769b90282db0af83bbdc27d812e8733dedfcb
MD5 273769c49f86ce1e4b885403196300d3
SHA1 f77e653731a56aec6ac8853c38db0ebb8171d48e
SHA512 192d6dbfca62c2ff8d8e629da76da83bdf9114d87ca569f24f1a0827c1fe844375d39ee090feb297ad0fab6f3a6530cee0091300c3890c266e85a4d12e05bc18
SSDEEP 24576:wT8aLl3z0zD4s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wT7Llj5sLNiXicJFFRGNzj3
TLSH
T16E7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 86f008727462faf938e135887e2ffe2b849e5f521c114414e2e046a8147f506e
MD5 94375d4fcef4784d4ba8a585a0162dbe
SHA1 13eaa7839eae0cf291c418ef7c8bb47eb8cb9d84
SHA512 314b7d1e00a1b800e0440fded4d4802b8bc14d7e3db10ea5715d400bcb4c64e52e1a8778555f658730585f4b547d938348086a0af0d8bcd8eae01bda51242352
SSDEEP 24576:T3rd9CHKy7GZss/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zrd9CHKyaasLNiXicJFFRGNzj3
TLSH
T12985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2b5c4e05f1afd3ac7773220db1f7e8fbf373714ae7491d27f06060d3099dcebe
MD5 ff4640c90b1e6568fc0c6d6298cd486e
SHA1 9089ef8a65b606c007922f923065133e7169f2b1
SHA512 1b260699d1f2b51ecc8b637c2a9d8df0097207acd3e94f0be4c40c96019430a8521c921b693d17c4780f792ebb90638927919c161f9258a769c3fd07fd3d3e4d
SSDEEP 24576:Uos/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9sLNiXicJFFRGNzj3
TLSH
T15B5523D3548955B1FABC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 63a259375e228959c3554efeec3eea38245612dbe08d399f6cf49756d265715d
MD5 27831caad7c1065403f6bfd72b1f57bc
SHA1 03acb9184e6a519fac19ea20f0f406b189043976
SHA512 bd7565e3b7d1dfecb3c7cd67c3b8a5dd6eb12db9f84a026ec6502a3677145f662bd79e17b748fe2a132d0ebbcecb92d70a28ec950780f92aece818cfe87c9267
SSDEEP 24576:ICs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TsLNiXicJFFRGNzj3
TLSH
T18C5523D2558955B1FABC0039867A4428F5882E2DDB5619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cddf15595b88a5bc38e231bfb7c9984131cd663a09f54fb25daf69a48d8563c5
MD5 8c4580043c0412e1272d4c92f0c9f154
SHA1 310f494905f6a1b1f24411723375510505043a1f
SHA512 4b73bb7a813b42efb13a3acca647f2e153e0cdd4a82d0b2d8049f2fe761eaf738e0f1d59ae5b643d9453512c99d305e6dbd5d1ea67e3ad92970c0c11cf87e735
SSDEEP 24576:ehs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YsLNiXicJFFRGNzj3
TLSH
T1A85523D3548955B1FABC0039C6754428F5882E1DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 25efdf7f57b7a79c4774bacd76fbedce16135ead7490de1569d3f3de56e32a1a
MD5 b06360d55fe91945e5db6510958028e4
SHA1 2e01277c936857e5958deb2f70c02cfb6179d68d
SHA512 fdc89a4b5f32670303c8bea60008bad6cb3bbacfeedc0f2bee669853ff513ef1b395b2fdcdb73570694c5fe947773719251f9bbde0811565daf4b7a5ad4f6de8
SSDEEP 24576:cns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IsLNiXicJFFRGNzj3
TLSH
T1115523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 230a39989e768a02155885d8ac292af77130c778b44589f69b895efe03b042eb
MD5 22924c8131bb9f70d9bbc9a5e1b014b3
SHA1 ae983f1cda524d7a0379b92fbec55725530b7ee3
SHA512 0fa643f4f17b5304702613b8aa81ea517427baa05f088bb3cc16b505b0b622c113b3f58218e2c6f052b02f612ae9b08ff918ce04870c6998f92a6ab5a0379740
SSDEEP 24576:Qos/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JsLNiXicJFFRGNzj3
TLSH
T11E5523D3548955B1F6BC0039C6764428F5882E2DEB5619E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 290a7af26cbe7af2f644970e80c2d89c7358897531c570efa4d215f0d230abc4
MD5 8c09b4fff5733ec4fb7fb45b7fe57a1c
SHA1 497514f18868e010c5a9b0b06d148313dd29e4f8
SHA512 95a2a745d930e961b4a614ef2a67c56fd17ce8db2d4f92a223e312608e03a1faa5f0bfe59c57c65f4be6714c90f7d682e3206a22412ebfe912a873d11e0719f0
SSDEEP 24576:Cvs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2sLNiXicJFFRGNzj3
TLSH
T1B15523D3548955B1EABC0039C6754428F5882E2DEB5619E3E3443D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-04_191851_4132-4224.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-04_191851_4132-4224.log
Size 1KB
SHA256 8dfd1ee184234ed0b40071a8642f47e260324f5a9c623f4bc766ef2a08ee7257
MD5 9ca8910561ac5e8b0abe91a0d4db60ad
SHA1 539690ea65096117a75950897cdff12daa6e6b84
SHA512 96a009429742c0d71778c36ee6026e14f050b67f653c8056333a180ad0113f512d5928cca4601e2ebddd5df49a50bb89a94b908022237f2d3ecbff0abcecda9d
TLSH
T1DB21D31A7BD81A06FFFB99C298FA15539E3939912C34C64D00A4434E0932F41EEB432B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5fa682fc3a4630fae0f81f0f1a07a6ed44b83db719ded0290523d4e10121958c
MD5 d350ce84def87027626b32768c9c0630
SHA1 b750d1a4fb8e20b0b2333cdad095aed8f84b19e5
SHA512 9962385b04ede3151dc437c77e672de2f35704a5badd5889ab2ef31faa1c7f7e3c26a2bfd06519086c88314d71aa70114dbe60bdac56d6169a91abeae84b6301
SSDEEP 24576:Gfwvzk9RX6wkyAIjs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VMnYIjsLNiXicJFFRGNzj3
TLSH
T11185DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dc01c4a03fa767fb40225115854116d46a50f167ca805b9b247b542d6f33b4db
MD5 3acbfc7f133a659cb9ad8625a2b2fc40
SHA1 749343a9bdea0d403e0ed7b34f61d39fb26b5bfa
SHA512 6fc11baad24c6db21a778236df2f8db5801b1203ca40ac46de3bea5c05441bc7cf27ef3e83912f38a64394aed96ccc82c801f8c2187c0c18b4d407375f0c2dde
SSDEEP 49152:FYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UsLNiXicJFFRI:0ySzPss7wRGpj3
TLSH
T179066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5647c63a5f1998abdbd5e549928f74d50f143b5e8cc608e7f51a4faacc0f7633
MD5 b8a312a10b299765ffde6264f171df5a
SHA1 0de164ac9d36bd1ec15d19a57ba0574a12c2928d
SHA512 992d4bac15be74b649b1ab877b2bac66f481223296ff67e69049f8f058f22ecd050731f9a0194bf3aaef1465a7aeec138d185eebd1a83fcf5d1de034f3685fe6
SSDEEP 24576:c47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYms/TwSfVcYG3K/cJHlnFR+IGNe8j3w:c47JUQjqirIhCnDHUPfF/ksLNiXicJFc
TLSH
T13665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e716e66ffdd1530f21dae10e4f9142279867cb27ee54adb17077d6989534fd06
MD5 81793ffd6466367b9a90f298b7584467
SHA1 4f1a849b0dde786d746a29358523865a4fd0a30c
SHA512 6541866793efff390d9e27dd4ca3bec193c332a4e9afefc1422ca3657a70fa18f0db13271ac2c4fc94ade877f3bc77d5bdd7b7156127c027fc83201606e533e1
SSDEEP 24576:ZXs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5sLNiXicJFFRGNzj3
TLSH
T13865F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 e8bc1798646e3bc9fa2dfbb11bc0ecc10940bdd6f24234fe5836210b7bdd1421
MD5 00e695ee9a390ae8b545d50417f84027
SHA1 b74993027d943447733ec44e874f035a7424b9e8
SHA512 23c960af4e35635ac6a4b4c415fe3c26cd0894d2d3e57ec539894318f7cfb875105a3fab789a989ab68d3e894f097fa0b172c2baa91e750129a4f7134367c1ea
SSDEEP 12288:i1TjfvIy5KdSU29daOgXikN1J/CvVR+X7xCbBlVIeT5K9ADVkK5Jwo/Y:i1TbImU29wikN1J/CvKkbBceTA+DV3Y
TLSH
T1D9654A41762AD75FC6AD40326E32D2CCA7707D05EE446F0773C88B3F957666CBAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e6a26f9f525370d034a812827205fd7fa31b78305470b69d57f4f505dcdab66d
MD5 68c5026e3f7be9f7da0cb4deb54ee0e4
SHA1 dc96549a60eedfcb20059ec0526e933099f3d532
SHA512 9335f47d797ff22789728e36a71808154b48510e2e29071486617c0c907b2cc3250c1d93c49cf54966f0b1035dd02731833a7dfcab0096b61e19139ea79e0836
SSDEEP 6144:bw34mki5ikN1J/C/Q4gLI0SG6gEZkwubKDexHRbtW3KY7bKDexH12yTf9ZkX1HdV:i4m9ikN1J/CcSG6Lm/e7j2ZlHX
TLSH
T1D765F8816537E38FD1FB503203395A8CA764EC07B7456F267388493AD86A729B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 91226869c9378ed9beb313dfb3c3b56716bb0fd4d6e5fe63715e50ea148f9dfc
MD5 d0ea9f794d395b91aeb900d0fd007d5f
SHA1 9b60e635ae1b833d991e5cbaf73e4681cf5c0f0d
SHA512 1fafc809e19f6fa09f52be26ccf8e8ca4b9cfbf14fdf7202930d51dfd217ad570e2fed66851867dbc147eacafd0a189ba545b54c8341513cfb30b03a764594b5
SSDEEP 24576:6fs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6fsLNiXicJFFRGNzj3
TLSH
T13A552393468C59B1FAFD1039857A8438B5497E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dc0530ea6069b9f67c8b0f7f167c98cc0e84e9f79cae968f04afe61f3121e93b
MD5 a9d89ea952d770fc060f81d80c773db1
SHA1 c0c43c7a4ee3709154620cacaea4cb0f9accb124
SHA512 7cb79e0a55c2c8e9437eecc03cff454ae61cfa02b0b35666668a95bd0eb171ba3c8c9b3e95715a129be47d9ea4e8ce9d1c0a87d1059508d94f6ef399b8e67630
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY5s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0gb4mBIBhGFmsLNiXicJFFRGNzj3
TLSH
T19265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cac696a83192a3d9a3ea0237a562462264f035a73779ff260698b737f1167e2d
MD5 150b615940d6966edd40554a6b3808a7
SHA1 ded0827638111a825b8bcd1a2db0969de6fd55ea
SHA512 afe8d393d3607c1b80bd0d7415ae0b62f5d890aa2c76d90c32c8a8c4709fb2308a6278d211af8113fed890a1b2f7b16288a640bd2c4c888f2090158c662260b5
SSDEEP 24576:dG88u8FpJqH1vzria7/mWs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w7ZFPqVya7/BsLNiXicJFFRGNzj3
TLSH
T1BE85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c1c3d32a00ad1acea69639219a3ac84081a25914410fb4487822e0b7c60242cf
MD5 9ea9596470334635a3cf3b1e1bf62226
SHA1 219f767193b40868351e7fb18e479bb8009a5ec1
SHA512 fa4869a85b240daaf9f6c6fb984f7f9f91ea0a5ef645cf5cc6d61c22a8804b9aaa4ac5115aeba8747e95c01add5d723b04700174002b72a274738e123b9a1b52
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKsLNiXicJFFRGNzj3:4G05lO43bLs7wRGpj3
TLSH
T168D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8a08908017146c1d803f3ee96bd06f3d7ee90af47e876f9f476bd2aff43688a2
MD5 8dd946f99b3e89247de556d3c950aad5
SHA1 1943aca17e99719d0e8623ba8c90113e6e5c8154
SHA512 61f2d1325c36891b5c25b563406fee3958f217e667a3082b102b3f452eedc173342f502618c351a31e4f022b4e04b0e7453962f2c8a1a273be212af73c22840f
SSDEEP 24576:ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnUs/TwSfVcYG3K/cJHlnFR+IGNe8c:2a5POZ3lJt2pasx2+mCsLNiXicJFFRGN
TLSH
T13765BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5ae25f7cfed9c1c523627f065ff8f85e7f6632aae878a1b23e8d172caf1630ee
MD5 99a203b224e2a5e97ee67493cb854ae6
SHA1 cd14fac26cb0e175f7314605f95b72e72f024b73
SHA512 77e280623670e0bafbdfdc20ceffc8f823538ee91eb97c37bee436de69a7e4fe7d5942e9bf7f7e5c83bdee2f75e3bcdd42bbf74d57f8b2706992d5e76782d6b8
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fkus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QNc/zEOVHFhsLNiXicJFFRGNzj3
TLSH
T113858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8eabc32ea1eefc92d47bec0a7af205a827689aaba1a78eaf1ac2122e3e8fb455
MD5 af808527ddcfe4d38d1dcc8fc076d78e
SHA1 acc505856c3d3d4fcb42768cfeba2c80e8df5b8a
SHA512 1826abf02d997327ae4e21bc2120fa496056500fc9f93f8eaf429cde28f201bc52623817b89985757aafc59e5903013e31cb383dc128ba4b77469cb55deecb41
SSDEEP 24576:FzkNvNnaFeYhJNtmZBm3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FzMwBtOm3LNiXicJFFRGNzj3
TLSH
T13455AF6EB6E846E4D1FEC675CD238512E6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ada312c1343ef2447f2704d2025f8561ec38505555b37c7456eb77a024ac503c
MD5 5684567244f80bde0686617522a5e418
SHA1 7fb7283b24cdeeb5eb0535f2f0644c48d06507bf
SHA512 5e5050e9b37c65322f8cdedc00562c9079c058eed095dcef8360f2a7b8feea46e3215134ed5cd8746f4a0956884898a4a33a91671a5037bf24d57433f32691dc
SSDEEP 24576:ePUr+NQas/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJQasLNiXicJFFRGNzj3
TLSH
T12865F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a7acb1a20102351403bee5268e787cef3a9f92bdc46bd897f1a28614c5170c8c
MD5 0ebaa687e594d35d6dcee94d2643d2ab
SHA1 77d2ec0b9b3307ad35e9ef17368eb712fbfcafd2
SHA512 c67acc9b677f8cce2223d031aead81910efc190bb941ccc2ad0ce2fe6f45b34924f5bac528ea919cf73016642dbe127fc00766c9f8096b331fb18bf13bed7cfd
SSDEEP 24576:+D3FHshBIYQgAbs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+DVHeBIAAbsLNiXicJFFRGNzj3
TLSH
T11375E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-104-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/256-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-98-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/256-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-342-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1920-87-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1920-93-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/1920-319-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1920-88-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/2680-337-0x00000195A4B90000-0x00000195A4C81000-memory.dmp

Download

memory/2680-338-0x00000195A4C90000-0x00000195A4E5A000-memory.dmp

Download

memory/2900-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2900-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2900-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2900-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2900-141-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2984-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2984-54-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/2984-47-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/2984-58-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/2984-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3784-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3784-16-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3784-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3784-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4132-41-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/4132-1-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/4132-7-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/4132-8-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/4132-57-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/4132-0-0x0000000140000000-0x000000014046E000-memory.dmp

Download

memory/4424-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4424-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4424-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4424-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5060-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5060-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5060-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5060-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5060-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5276-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5276-71-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5276-289-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5276-64-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5428-130-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5428-322-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5428-122-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5428-124-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5828-116-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5828-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5828-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-324-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5828-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-77-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5880-83-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5880-304-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5880-75-0x0000000140000000-0x0000000140222000-memory.dmp

Download