eaecd0bec3a261f6c45c1c6a72c2fce237ce0ec8edc0f3dc14114814f72e5cec

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260805-se3rhaan8x
SHA256 eaecd0bec3a261f6c45c1c6a72c2fce237ce0ec8edc0f3dc14114814f72e5cec
MD5 f948708edf93a305e73031c05bcefaec
SHA1 51d0cbaf0a0a3fd5e6d8fe8e32773d4d1499f576
SHA512 52adf3a8d8e5ef4f6c7ba78e5b2c6084edb60d11261743bf9b884d8ad3c02edd088f832488daf7946e91fd1911fee1663aa282e20683219637a9b1efeb4385dc
SSDEEP 49152:f474cNEpbt0rjQsM13HbDlKbFZNi4vbkfcdC5r5p3mATY00gLNiXicJFFRGNzj3:zAnQQh00g7wRGpj3
TLSH
T1BF267B17E2B940F5C0BAE1798A579517FAB2781A873297CB4791474A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2728	elevation_service.exe
4860	elevation_service.exe
5096	maintenanceservice.exe
3168	PerceptionSimulationService.exe
1272	perfhost.exe
6048	ReFsDedupSvc.exe
3296	SensorDataService.exe
5672	ssh-agent.exe
2576	AgentService.exe
1152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\968e046fe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090b53997eb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c5d3e196eb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f2a6dd8eb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046967f96eb24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000221efc96eb24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081566f97eb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e20da96eb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9a48597eb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000894f4897eb24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3524	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2728	elevation_service.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2576	AgentService.exe
Token: 33	1152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1152	SearchIndexer.exe
Token: SeDebugPrivilege	2728	elevation_service.exe
Token: SeDebugPrivilege	4860	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2340	3524	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 1152 wrote to memory of 3892	1152	SearchIndexer.exe	101
PID 1152 wrote to memory of 5624	1152	SearchIndexer.exe	102
PID 1152 wrote to memory of 5664	1152	SearchIndexer.exe	103
PID 1152 wrote to memory of 3596	1152	SearchIndexer.exe	104
PID 1152 wrote to memory of 2524	1152	SearchIndexer.exe	106
PID 1152 wrote to memory of 4520	1152	SearchIndexer.exe	107
PID 1152 wrote to memory of 2384	1152	SearchIndexer.exe	108

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_f948708edf93a305e73031c05bcefaec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3524
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3524" "1456" "1328" "1444" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5458da99570d5008996037434fe309076da334930681d61dcc38a0f1ffc743a3
MD5 98a7ca1680164c4fe8b8e1757d499ed3
SHA1 7f9b4996bebb4015890c961ecd4e55a7e86275c8
SHA512 8142395f83f0dc5e233f798dc4c87d738b84d50d1cab0fca264ac436bba1ed65968c079c00f9638e1a104f480fb9e9eb5af795bd1d82b7e5156f73a9ea9c19fb
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxngLNiXicJFFRGNzj3:a3q6mjBX7wRGpj3
TLSH
T1A7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a044d822d32ea652a83ff53c5550551a1c8d0ad3156adbd204cdaf535e243c90
MD5 4507f3a0f3282df37100cbef6eda6481
SHA1 6c62265b29a451f55134c23852622ef2ffc15f07
SHA512 cdd9629c239c5760abcdd3d5e5fb8147aaeba1e9f7b84df3e2a2893fc0d58e0619ee625fe367d9d0550f31e95e37f9f775746dcfcfdf0ec397c235f77babc8a8
SSDEEP 24576:CXYfDtczAD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jtc2LNiXicJFFRGNzj3
TLSH
T1D975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 bfff360425837a1fc5882b81a5423e6cc1ee9099d70444b1c76f33e6853ef2c2
MD5 14e6d08ee769ad4a4a5c3ddd16806ee2
SHA1 c809fa89fae4593e8425ee951f99a485dfb6bf7c
SHA512 c8f481a3cc0bd67b7355056cf5079bb3734b3e867f00ecd352be989d8a8f516ec990b8a6c64941c544ad162c5e122df683d31b2763e529158ce53e43a21d48b8
SSDEEP 24576:Y0Le5ji0hmxhrMB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YPji0AzMLNiXicJFFRGNzj3
TLSH
T1B4859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4f7711b3f6f99fa6aab1f8e238dde59d3c196baaec156b078cb19984c2e4fde4
MD5 72aed8addc4983d20c254ce7f53b6728
SHA1 3046ab264101dee19c51aa987d13b772ae88745a
SHA512 22b9539c46d459cab8cbee1897e87a4755d4f3297761e4b2a2ae860cea66417c9ef2acf3da0b2cf850e0593e4c50bbd8cd05652e19b47c214ae41994930a479a
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+/ezSC6vUzPv+Hjy4LNiXicJFFRGNzj3
TLSH
T151756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 89ef8c5658fec43f6c27abe943e9b34a83d5dca9bd823d8fc42007835030f6d1
MD5 e20cfc2d2272b9994f36125ecbb3412d
SHA1 1950af1a86a8dbdef137600e2fca36be52bfb495
SHA512 b758ffa2da861e91dae8a5c3ba76a56be42992c21cfb311b703e62094dcaabef0c52ba5a643bc3ddcb21d6744120e9e9ffe7ac041a61fc26d9ad80e926a2e7c7
SSDEEP 24576:LVbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LVO88hXl+sLNiXicJFFRGNzj3
TLSH
T1E2559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 241edf68583edcd8bb99e6a3ad16e53c179c73309a1a3050fb482ee6ff307cef
MD5 899b835165e55d4213246f6a8ef79284
SHA1 3ff553ee7eaad9314188d18616142ccb4dabf541
SHA512 6685e26e70060888aa8d86b5a9b6a47a8f0b0560efc4f4d4d7494f0a01da04e31bc9b0d68d3508efca6e003bd730870fb9214a150a899f8e39e56c9c3954bfb1
SSDEEP 24576:4GF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JLNiXicJFFRGNzj3
TLSH
T1BE5523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3ce0a2129eeb54f75a482462477271d0b9816329d011b3390a968ec9ffebc97c
MD5 0e9283bd97c5103f1c927544d902a6c9
SHA1 f9a30eab45486096284ae835ac50fa7153f22e68
SHA512 069179b3c059cc0df97cda413a0eb682c8105655a01e5758f1b95be9b8d6863e8e7f5f4f873a116ff386e76392bbe950571fcca9671835ca91c88ba9cbf1194c
SSDEEP 24576:HJIU6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HJIU6LNiXicJFFRGNzj3
TLSH
T1EC75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f5648a7c059d53d86cc697e34aa56be7b3783825cc6d1877eeb49bb1fd93123f
MD5 5dd60618328bff046b5a3e1c02d622cc
SHA1 fd2ae8c01f2568d96fbec5d5ab6c28de5eeb0d35
SHA512 f23c4f9366eb9789bffd63fe3231c99dcc7d5c90df26fd7dcf9c582baf83673450ea9f042389128536578a6fea71b054a3f3bd0e59b8d594ed0f0eade61bde62
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:NQvGAdlCEL8c/WRNw5CL7wRGpj3
TLSH
T15C266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9aa9a15993292aa6a192f52a2eaee2cbe6fff614bf063fdbd3abbf05cfbd302e
MD5 3c564cad2aa016e9d43c78e27bf07aeb
SHA1 2a7b0a346dc262b0fa1a67b6d48378c05e34fd57
SHA512 50547a6b6b70dfcdd34a57db41d1f393b4dcde9461b5d1852b039209fd7f9d881119402b1c2e84c914a6ed8cbbc8baeb3f9af85297226d650717fa51e5609608
SSDEEP 24576:gfewsAjc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KljcLNiXicJFFRGNzj3
TLSH
T1A075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e11e8804e441315b020bdb982e35d8084b33c7b3e088398663d0f714800d44f3
MD5 1afeb964239c507176b89ecb1a39f399
SHA1 a2d99c78166188256d712145c14c090dd34b4cda
SHA512 ffec54d5e4ae707b2572a398af7a45d62510cf93e82df3fcd420cc5e8fff786a64f42eb8c73cfb694849d26afcff2b8f74eb47d0b048159c891e8499436ce92e
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHQF9:MUEtQevvqc2W1cpV20I32U9
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5c3e41ec98aa8e65308b976140d217854eee5f21760c0002ecc6ba27f9d715cb
MD5 69438293898bd1545682e5ccaf39fdcd
SHA1 1bd8fb5daa08360ec41ba56a4be356114d096497
SHA512 710e03790413575a1dd837281e6ca3cb6feb6b41e82f65992a3335cda0986034f1d5f2d9e513e4d2d0a8baa57861c03cd57a10f7d0fd67bba49f9e365d6a4533
SSDEEP 49152:vCbRquA/m2yL5zLfFiV+XenmE3/z8LNiXicJFFRGNzj3:ooq2VjnmH7wRGpj3
TLSH
T13FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b73bf132d8613fb99bab0398c039bb3e3a1cc3f3faf520d8425c3a0f6a37d615
MD5 b34c08ff9b4f36e1e94bab0fce05e865
SHA1 f4c91c7e164d46966a3f029f00a8a02a0a6c32ba
SHA512 fc05f591fb95100d8f6bc58dfe6eabe5734020146a75204186e11b66102ab3f8420356f39a154f70f0b4d386d08166dfdd28b7fa49bbd602e28d22cc6ee931ca
SSDEEP 24576:RAhGL6IFoiwtA5l7S53n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RAM5Foiq5XLNiXicJFFRGNzj3
TLSH
T106359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8083d711f9f14e2f044976ec1f1892cad07d9038c2b47797d4665120982ca038
MD5 1738a672c6d54b726be78a7647f58fd6
SHA1 c0aae8faaa4f033337f434a1878fa6a1e855c29f
SHA512 15313a9f6158f28fcefcc3915352b64d63ab219a418236a5b522d9d121e1aa8e404df0725702ddb1b7abeb343e0c15e1b561e28cf28409fa36d49f28b1289d4f
SSDEEP 24576:lZu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
TLSH
T13755129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ea614c07342ccae082801ff1d144bbfe8b15460836208899909e77dfb08f0373
MD5 ddc21839fe5c699fccc59b6c4228e494
SHA1 800547d3f529e8a96a08c29fc0333646f44dd666
SHA512 b59128f4b7b1943ca76d1c895bdb15a7e71db4a227fac87a1695bca2175be3e40e96ab938562789a038c15e86a3e7a10c7af6bbb01a4de87b7e68fc5cb5efb7c
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3m7wRGpj3:dQyiKanX+PNaF9
TLSH
T1FF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e3750e79386e339d0ac860f0f4c94fc8e55474cce31711f2108ae91cd54e2fb
MD5 9a5eef94f0ea3e554caef59ac28cec4e
SHA1 db396b91bba087a28e87755a6b0097e69b1872bf
SHA512 301eb320481838a8df4596b60fbb8ac850a5dcb36ef512a72045decbb4e6f76ac08d2f8254f0fe4bb75a0493d8a153e1eeea170050123c4ba48f1c04ae4caabb
SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3m7wRGpj3:hQyiKanX+PNaF9
TLSH
T1CF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a2dea7506c2eb288ed930bc103a872e674dc5eebfef86850f82fee6af2d22a4a
MD5 2e84ee471d436082e7e2428761389303
SHA1 a095583a9e9f01b22974c218e6fc935ea91ed485
SHA512 a5773e4d1ccb85ecca8761e0398ea885bd403c724b786a269556f85cd07b69cb660f5d6b5a0004b5c1d5a255dcf3ddd14b293bc13ecb7372fba183ca6c266d45
SSDEEP 49152:U68Qg55nhkeWu7PNU3/MLNiXicJFFRGNzj3:+thTRc/M7wRGpj3
TLSH
T1DAB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6ad0d27cc8f866470ee9d6a22b2898d08685e168a1f9f8909b49b360886dc599
MD5 d850f6d74adacb53221fa94d505b9b6b
SHA1 ae8ec60c9eb9ec5ac9dbf4ebf360aff2e6c9c8d7
SHA512 fe93c19a49482402151a859287664f8bf28ba9845d18bac9f600e43b8f054a1b15adbc712f878ddb06176a41cbaee07690c4af7f74d849b31fd6547e6603bbc5
SSDEEP 98304:Yy5112gYy5azzVvU69nLKnhZF7wRGpj3:xLIHRWhzF9
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4108d27358e9e57810eac9de5d4701a882c5bf82ab9a72a2b2466ed2da5c9d50
MD5 1502baa03dac04ac354f93d6eb793b7d
SHA1 33be40ac59af050e3ab0f103eb8ecb8b9c71ca56
SHA512 ab471820d01970e4eb67b6cdc2493ecfe62176aeddd36b47cb0136e036efb712dba084ede494fe62da3ba043e3a36553ece3467937e75fda1f237c6a1cf1e964
SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glTLNiXicJFFRGNzj3:nu6JmIxd2dT7wRGpj3
TLSH
T11CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8c0092bd8dfd3c8f0006708ad1509ba00bbb7d0b1b82ce9b73d002aba622e73
MD5 023346b62d0b984b4d43df886407d2be
SHA1 6cd00e0f17fa6dd91d2aeb34d2546278e401edfc
SHA512 ce445170f3e3d7740a3eeff7cf833620afaa03d7461147eeb1539454d5cba3e6da44be60d31372d5c36281b8768d7b9a2a965dfd5aeaa07ddc41a337f68eb2f1
SSDEEP 49152:s1hpsNoJpF1A67U44CwH7R4xaLNiXicJFFRGNzj3:smifPqRH7wRGpj3
TLSH
T196B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 31d17ba37ae53cafe9460079751d2f7920da8faab2c1c0c2127184e7d9a1452a
MD5 b56836e1c883c6c2e19831c847af862e
SHA1 a2e9dbcd299b19c2d5169588f75d19e3de810ee4
SHA512 6a187b8665df63f1003f599f493455b28a4b0972f254ca9e30bc35c975e0c1604fdf0b749ddb5ade24c7f0744dba10ee3f3576e1ef70b8caba5628eb8b48c0c7
SSDEEP 49152:fSuZQIY0Be2KkRVtOnks6NMHq5LNiXicJFFRGNzj3:l5dKqi6157wRGpj3
TLSH
T148C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ded609729695eb10e73866102362d2f0633ed9c79cac7896ccd490f2166979c1
MD5 dc86ace278e50a184fc94d017178f2f3
SHA1 f7281df2f4072b39e9c93852244a219c8fe8ec38
SHA512 d37e213b0ed017785f4e73af8eb51cebb7f68e65627d4b0a1397d0eb44fe1fa1fcd99f51965c59dcd3278031acc996c68033911df378469ef1687f9a2fc2dfe4
SSDEEP 49152:MhtSn8EApI0figjgiDn0AP5wOLNiXicJFFRGNzj3:tX2iWphT7wRGpj3
TLSH
T13295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d40b443be13a272e0b177c4575a7e3fc21f69089aaf1c71a226626863b8985e8
MD5 53a6678210e699cdba0693637bec6bcc
SHA1 655d7d4cb18ce1bb48901d1cc54971bb1e283bc8
SHA512 07a537cc015d8a30edbd5dbc23902b9f9df5b6ebe486aabe594dbdc8f5100743a2ff384256e420af6ad616377167587c22c5853e9512f9faf2ac621d4a671592
SSDEEP 12288:ExiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3558955B1EAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ed28dc0506d901a030007baf3b844a785604d13b01a4b3ab1bb61de977461bff
MD5 cfd7631d1f98d5ecda624b1746b2c650
SHA1 6e8e8b6c740552edb4db6b0d6604612f1b7a8dec
SHA512 c416d9dfde69f36efd3ec0a334c5f7c2ea59a463392cd136fcbd8f9db8df92f17e072bd7dc099393e15ca014aecddd6872d94ab7e689a4502e9d23b3c7b87a0d
SSDEEP 12288:A2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3548955B1EABC0039C6754428F5882E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 200957d1388f91f3c984b6abbd56a767271fa2293e897f0c86e1b3f0c3c5fc5a
MD5 3fa2df3f4079bf52a766ef3a1f13214d
SHA1 e09a96ea7e1d3603b0ec00242e47b3da60d147e6
SHA512 bc2edcd920421e97162572a1446009a27b2f2ef70d39a416954ffafd7f088850aecef7a53497f295120e73cdc92da96665b8a39472a80ca21ab2b93b0260f7de
SSDEEP 12288:FgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D2558955B1E6FC0039C6364428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e9f13f49b82f6f4da48fafe681d67bbe6a7cce43302e2417b5797171f2fffeb3
MD5 1e9dfd954a9a98480eb9a19bd7cd6d19
SHA1 185cb49b8399b24ca342df14ac392f2c77326aef
SHA512 a6a4da39f695c2f36c24bc49b31d38e599d9106d5bb98c59fb084a27c63dd0a155417214399b296e7194ec06bd6b2f752e931520d8287ea96cb540b3df820916
SSDEEP 12288:6VziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F552392168900E1E9FD8039C6764424F2E47D6CDB365AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 81b029acf316c3cf8c81ff3d2b52bc70db9ee0bc0a7f618a9f6e78e6f3257195
MD5 74721920ad66df8b6ddc81408e658bf2
SHA1 6b4f8ed05d3bfa0535dab3c57bf3df166fee47e5
SHA512 370145a27917acaf48266b0ba609a34f2ebcffb3e0246fef525044ad1a869a15d716b9afa8c47ba87a191042bf492939c11622b8eb64a9aa25279d0970ed3177
SSDEEP 12288:kbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 644f7ef87ca51acd913caabde88f53efd8909b654cc4e0702f00a255eeff086c
MD5 97f19b595841760252442ed6d56bc646
SHA1 2ce3d09fef5eeccbf22a09530d29afe227ce3b84
SHA512 63bbf5122db78c9cbe12941c040c40c528474f600a967e77843c1735e0069298c0c0b7599000988cedeb0abc1293e9769ea5dfdef0e7c40712e0b80f442776d9
SSDEEP 12288:+yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3548955B1EABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9635e5d9f5a45de9dd006a00a5092b8da001b71e8da82fa679594b0973acdd1d
MD5 03948cad09dc75e6b35b52b636ffc1d9
SHA1 63cdc7eda7545024847432b8979497770ec1e98e
SHA512 622452bd47884e66438f710d53bfe5fa82edc47bc0f14bb3b29c16e4db09595694021d325112ab714b32c6b792aadf45234211538a50d033dc2afc4a79fda0d7
SSDEEP 12288:x+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3558955B1EBBC003986354428F5882E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3a8f970cc99f2f310f255739cc55f07ad5e8118955d4daa3279e5f57671bac7b
MD5 a68285a68dfe10c5b646d9aad591afe5
SHA1 a3f38f2cfa5031b84cc0e078646b624c5069990e
SHA512 d991cd20a4119eba46eff78e42c82a9ab25bc34f5b0daca1e7d5c0ab2b3818664c10f2a045c3625d77b16b0473a533728b2618c276edd329c9aa407624999602
SSDEEP 24576:sZM3zFVSOg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sZM3zfkLNiXicJFFRGNzj3
TLSH
T1A8750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d302b0b6bd538c1790108b396d9a6ce4d570b83219656be2e0e00071943c3f9a
MD5 2a5e6df78bd19e5aaeae698b70f723a0
SHA1 2b443420cf67f475a4516e268c8d2b0b8c7c728c
SHA512 c75a835a039c103aa6589f4e47785c2a353fca74caf725407ef57200ce50ebffc022e6b03f36c4d51fd9c74eadc5fd77bfa2d01d0bdf0364de9424b2b98828c8
SSDEEP 12288:3FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3558955B1FAFC003D86754428F5882E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5664f7951e40d2e35775ca3e26fa6f8219ea59dba9914cb531759fc4f0591f16
MD5 6b9ad87ec76efce589fce6d6cb6d9804
SHA1 c43c983633ec827e329266709f955167b8eaebe7
SHA512 0242803ef7f2cc1152544b2595728742767f71ae4e29249dba35ef2d652de7ed40f58a0a4e41478695b3ba9412e5e2a03eda7d0dfa78ded4cf22bd5093dc2c3a
SSDEEP 12288:eJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3548955B1EBBC003986754428F5886E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d85d4bf06b2cc3d53ca5639efb0c3013030443ec3c806781264f1a6e7c458435
MD5 9eb22e309612b6e824c598b827e782ee
SHA1 de1fab47eaa8ca4d42f92c456cb9e23a0db30af0
SHA512 76061734fb8b6174328fa9095f10882e443a7c36a9b127b97e08aba9e3d4d0b2ed1d83b145704564b2e29dd71f174eac6f718e48a58a65a4570c389fbcf3ea9b
SSDEEP 24576:lzys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lTLNiXicJFFRGNzj3
TLSH
T1B1650247629530F9D17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 47e1aee12091303dfbced6b51a227733b85ed055efb428513d1da46f4170f60d
MD5 1ac878fd994486f134d029d1b97fb371
SHA1 9d09e51b0ab8fea9f901643ee96216a60dda45a7
SHA512 f934072b556cf7b8ee3fca1c986a9ca371b4598ce6059c32384d8a6cbe6ad05d164e0293d78b0d86968bd7c9c09eede5f59bb99d554ff3cfb3943f9a92dad32b
SSDEEP 12288:uFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523D3548955B1EAFC003986354428F5882E2DEB5659E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6e5b92500bb4a77b12f4d9c21ff3ed97dd43a92d8023d2582eee8a1bd603c455
MD5 25bc82ce3336036ac22ba8d08a9ec62c
SHA1 4d827daa2d08f395952a1452ca528875bfed8fd7
SHA512 74cc9b1ff8827c10ad0222590ffc5a293d4e3532f4a699ef83e13551be41002534c707767bd26674cda0364ab3fe8d201cc2ac79e2d1f4d8300e79f1b3b326cd
SSDEEP 12288:UFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3548955B1EBFC003986754428F5882E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cb302852ea2d09fcca123dca4637cd5e6c5474accad9eeef78a0f8627f8e03f7
MD5 2d19bbd598763d1158ee2f46fcd58169
SHA1 92668e06cf1b861115108d0a3f86d4dc421a2b56
SHA512 2b3ecab0dad65074a5c4e2a4a2d0513f2a497e34a6026be3be066d1b18c5802f6414cb6eeb2995ef71418df71a64e432db110a269af7428e08e406601d28addf
SSDEEP 24576:Ozys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OTLNiXicJFFRGNzj3
TLSH
T145650247629530F9D17A8139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 39d2ec9a526e7100b11394b80f4457ce8b6c159d9047de295840a02fc60b7794
MD5 f2d0f7ea7b24e8f747ae64734ee178dd
SHA1 09a513577395a78268ed46e9b9a6dca81fafb6f1
SHA512 39c9db8ec3bf1fcdc82c3a3ebc601802095fb1b3aa2a516ad8d3b84484fb7fee0a971ad3472eb833f759fb63afafd6e66dffe381b1a6c1ca2041903d3245a2df
SSDEEP 24576:vT8aLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vT7Llj7LNiXicJFFRGNzj3
TLSH
T1CD7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1c24f2a23c022c84521df91b74039b0afdc211a0f4e89ae53167e3826072299d
MD5 ac77fb6de65dc14ec451c6bf2628d8a2
SHA1 aadf5b332f8a54b4bd97570c101db8cf7eb334e0
SHA512 023b45227c60c44f28153e791e7af62bcf220e6d246397ba5d0cec4d3f736a584e0e33cd47da120366df7054dd350bda35ab3329f4cec56c03665e0354412934
SSDEEP 24576:n3rd9CHKy7GZG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3rd9CHKyakLNiXicJFFRGNzj3
TLSH
T1F985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4d450767a8beb2778f52fdce9c90bad742d38a3feda5c837412a387f14f82db5
MD5 3e8abe860a19b060996010de6d673023
SHA1 d97b22f5cf749093abc1c6328d17193392b985c3
SHA512 c7e250a0eb62e86f78cb0eb9ca28351ce472341fb1d65de2cbbd50f871e129389878ce4f5c2db20ea98d734171631038e90f573f8563de2537eea278a37db720
SSDEEP 12288:qAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D2558955B1FAFC0039C6364428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d0b0e9a628ac1a640f943e5e8b533bbe34b4e53d7436cb7813a6d7043459e8ab
MD5 b3e3edc9558f4850e5119d30fc128cc6
SHA1 09eace0b372b7ec69a310eb29a3c7ffe8be51462
SHA512 a9f64a88289cc7413552932c1ed93cd39cca9acb1dd067a26c92a40257de64f091a451d48594a27ea3c168721559ab3b6e3c607cb587c7b96a3aad1331bd03df
SSDEEP 12288:uKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D2558955B1F6BC0039867A4428F5882E2DDB5619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 de235bf96f13f55ae29b2d77ae158403abe8d1f0c66bd3886850e361e8fd1b6e
MD5 9a53bb3e261b3560e2dd0610be49dff6
SHA1 bafc140a8353e31add8d1abb269a25dd8ce9266f
SHA512 4befbd93a11c1ada885e8c3037b83f541a8e5bc7e0d810518c4f7f413c6c4c423bf9088b191c0b2a443f670179c8cb216a44657d995789ae27657540b1ea054f
SSDEEP 12288:rXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F5523D3548955B1EAFC003986354428F5882E2DEB5659E3E2483D1EA27CFEF8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a25d18a3a25c3f58b4cb21beb06866e5c748828788cead95951ede8685ff7a92
MD5 b68d19dded2fa13386109fa4d7f78504
SHA1 47d164adc0699f587850f8f5e69b2c1e6c7c46c8
SHA512 c778bd62a9bfc3461bb741218919fafee92ad89a1f5a13649be0b61ba29d145f7ca66ce104b53c414d1ce8a25fc4a59eacd18a65e62432574122cde3da11b35e
SSDEEP 12288:lFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D3548955B1EBFC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b7adb7d88652681bea53105ad49094835a416d495d4ff96691efccd4804ca740
MD5 65a4743506e6be95c29739c6d46d93fd
SHA1 a45cccf83e19d80b69bb12b5ba79df91e7c70e9d
SHA512 a76a514e120f85967a567069990ec843ce3085dfb5d0a4930eb2f7382af0613afd871f70a341da1172b168731805d584e56fedc82ef0deba09395cd1f826df47
SSDEEP 12288:vAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3558955B1EAFC0039C6754428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f23c47cdc8b7cf5abe6bdd036e503ee615c4c8bc98b4b8c5c7ad200664f5fff1
MD5 392b92e80f30597d794bf469372951c4
SHA1 f1f5ea42d146bda9f7c48bb3a04e2bd0f9ca3945
SHA512 6bc3d79694a911bf823e638af205c4d8c73e2c184dfa5c427af0890536bfe2b1dcd5c1345364fa2b5970622b12a59c53961d580ffb0f7f1f720ea018eace6b61
SSDEEP 12288:TtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D2558955B1EABC003AC6754428F5881E2DEB5659E3E3083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-05_150318_3524-3044.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-05_150318_3524-3044.log
Size 1KB
SHA256 e62a655ac5eb76f0973969e1b9a43a68b7ec83edb4b541e272f7414ef5c21e39
MD5 f6e1c2e07743f14842d42e12c2727cd3
SHA1 0084acc98389684b8095eb26a0327c09845af460
SHA512 2a20a0db73764a7a278f59765e22615fe2816d5c4b8d86d69fb6fd7e71e2696ca6030da4ff0dcbedc8c308ae59746014c934264629d2421494037afa779af19c
TLSH
T18E2172192BD80E05FFF7DD8298FA1043AE3679917830CA1C10A5424D1976F46ED7072B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 802edef66b0b557cd040b24507410e0f4a6f95930ef8488630dfca037bdde0b4
MD5 c56d30ea62612bd13d11ebbf1c1c60ab
SHA1 3b20b08571b387feca4e132b729953c601a54bd9
SHA512 ff3f7c48c8e7ec4af629c86a1ca209d921ad72f1325d12847a5407049598064ef16ad680aa1305ddca24e81238d399d8efab6e22ceb002dff4a7296a1fff3306
SSDEEP 24576:Qfwvzk9RX6wkyAIl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DMnYIlLNiXicJFFRGNzj3
TLSH
T13285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 41b79ed4430f07bbe215406be797052969afe25279e974a41875d76c1b615898
MD5 ca89cb69eac5ae6d2298e88fc519a42a
SHA1 cc45c08eb2e2289fb499af4f3428601c0b6f5747
SHA512 7bd5734f9764597777979e86085c931531327a1742ada0e864af4c7e28bc13ddf1a53e180c01a2a00f72e8b9eb6261dfc75d47305709cc2d5f7ba69d49adf3e5
SSDEEP 49152:kYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uLNiXicJFFRGN:bySzPG7wRGpj3
TLSH
T168066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d7dc9677c69a70c1c4731f12d4815910e8a1fcdec2a4b47db332fa00473458e1
MD5 cc89444fda9d05d29dc3c31b2566eca2
SHA1 2f38bbcc6443b3cb5328a23685a099e75bcabfb3
SHA512 f9cf6c43296459d09904bb55221a9acd98ee1e5e720a91b388c59f5ab461107fdc70e2800fb5822c3a5be922ec7debf937b084ac2fd74b6146fe1b1080fa9bda
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R47JUQjqirIhCnDHUPfF/+LNiXicJFFS
TLSH
T1CB65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fbbae6e78047d349f5c6eaadbc670e134171afc2023d3a6dc5886020f9b6647f
MD5 b24a9edb1726b9e10ead9a8ddeb47471
SHA1 3e684234f0e2da6a54db185a1e17a632afa3df6b
SHA512 c13dd241ab31089db709f5fb992c65720d93a35d487c277ed685e018a867ddcf96374e9b3935478026fcf4ec12f2c34015a00851b518b2751f8f2b05e4340ad8
SSDEEP 12288:kpsfViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:15/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 94a40fa9c6fdbcf44d0a9de8d4763eb13c4092b14d59ec2e85eabca0636f317c
MD5 a02c471553c65b6b94342dd3d9e8b2c5
SHA1 84a80c7966ed1b2e9734a7a374c2dcc791c5abae
SHA512 7d581476bcc19ceee8c95b62f26930f962221d4919cca739b1fe78af26ec3c76bfd5a7efad903cf9612c105c3f9908a6c1f79e9f955729f962b6eccdc69f39a9
SSDEEP 12288:3iQg+rU3fm0qsEN4ziWytS6FQ1naRMlEOZZ/f:3ij8UP8oiHtPFQ1naRMlEIF
TLSH
T1ED251710766AD75FC6AD40321E73C1CCAB707D41EE05AB0372C8972FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 f6985552d13c06e5ac8454fbab7d35e668c531bb0b1bc8854dc6802f8b897738
MD5 815d4150efbc2733e1b60642e0f5371b
SHA1 d19a2ac2dbb0caab86e43971cb410e6afd06fff5
SHA512 313b61bbaf462f783d06644a50c839e56cede948454a8530b1bcb773175eb416cdb9ba56553fb3bcc1e79156a3014e70da2e62813a788468410bc962c575a20e
SSDEEP 6144:h9D8isPe1XKlrBK6B9mI1hI1sI1pI1CofOiL2wDGXaVa7s/rsGLr5Fwy926tMxVv:hdadzB9PKwDaaVa7s/wGLr5FwyinehY
TLSH
T1E455C6816437A3CFD1FB6032076A5B4CA764EC0273095F26A3C4553ED86AB66A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4bb80aef5689a8c98a5837a0be1d70458e669adb00b7cb09dfb89690fbf92c35
MD5 80334355c3078cbe932d3776d9a92d4a
SHA1 113be52ee0743ad4afe64ba7d776120b65662396
SHA512 fc6c60c0303672b8230c02faae90877cbe4b6351263be729279be3eccae93ef6fa927f2d80b45a630e229670023a7070dc412e6ae786c93914b58ac99b9bbe86
SSDEEP 12288:AF79iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F5523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1247d80778ef45b846e339ecd95e47ef3f96fb9e26006aa40d356ce6abfaaffb
MD5 803beeff79eae093c81d2f5e2322ff44
SHA1 dcbe852cc82a2ea4fb6de0fed9e15550026ef1a6
SHA512 667430c48c9f55ea87733785f20076eeebe75acfac86ca0646e42dc0e9623142539baa9985ca6534d5ead9f333bcd0afb1ca1a82ad2284c1b2315899fad25c3c
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bY7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zgb4mBIBhGFwLNiXicJFFRGNzj3
TLSH
T17165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 91be9805a88122eaded4521fcc70d048011d7c16d88795e9aa0892cbc18ab808
MD5 6b77d323b927e50af48b5e4f23577723
SHA1 9802d005a8f3ea620507664e4a5f8d0422f08940
SHA512 f8f34f9fc911c657728ae309b6cf8dc0dc32a6972295253842f7e4cf077b4be10f1ad063fa4a9c48a9564a001ec3b22dcebc1e23535ddf9adceea0c8aa7bb1c6
SSDEEP 24576:AG88u8FpJqH1vzria7/mg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T7ZFPqVya7/DLNiXicJFFRGNzj3
TLSH
T16E85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 35b6a0e6052527f46de7cab9d26b42f942a9744b98e855f07b67054673f51a61
MD5 3baad188336157497745ad1f8ef73ed2
SHA1 440ede603b12af16cb05da2903f0e776df5e84ed
SHA512 c1586ea2c852f1fddc66609c2c786ae7648900d0aacb922d8ad06a1f79f534d57724547891111499ff8487d8aa92d2b8058e5847826396c034ea0c82f7febb01
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjULNiXicJFFRGNzj3:TG05lO43bN7wRGpj3
TLSH
T1FDD5C06E62EC11F5D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd509b757f549478d125ce18ca7b32207e3bbf4303cdfd42373b0a9692737383
MD5 a8923849787503996f6a1b4e836d00f7
SHA1 78025e912337deaac73694a14f912ca901b7ec07
SHA512 58e2eb158cfa8c14723d65753bf4de2b44a67b52c7d2a944f37f2f167ccd834536b8c28bacce964b07c84295d2bc2ab44a603ee45a157413b9d604ae2612acb4
SSDEEP 24576:Ofa5POZ3dpyWVM50JicR2hG0lasx2+47eidnu/TwSfVcYG3K/cJHlnFR+IGNe8jg:Wa5POZ3lJt2pasx2+mMLNiXicJFFRGNf
TLSH
T1DC65BF5EA2FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8715f5d4592a1ce2982ba57ca5fff73fbec0cbe69b3e90ef5be7ad11ec759ebd
MD5 a8f43b1899f9fbc1e529ac5281b40015
SHA1 be959e17f971348efe89e153080978c051702c4e
SHA512 90a29ef54797b4c34be599d53ec5596a5b08b3b8e50dd496c3ae037630cfdf61910dd7b19dae1bdcd892ad4f879c8f0885941b8bb7499364555ced3d033190fa
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FNc/zEOVHFjLNiXicJFFRGNzj3
TLSH
T161858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 541ae79aba5f151d07fddf63c0185d5c6b384a916a5e7df26188c5c1cc94cb96
MD5 b42d3d071c67d655a26786889b4ed493
SHA1 9d862002502c908ddbf152d87b9a3ab01d09a47e
SHA512 24368d98d72cd45855649b75e16eda9b151152b5c6fd7b4fcc827aabc74b9ba00e8d9aaba833d471d42c057c621599ed6271f905d60404b7f8c0e58bbd0d946e
SSDEEP 24576:UzkNvNnaFeYhJNtmZBmP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UzMwBtOmPLNiXicJFFRGNzj3
TLSH
T13A55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9507ecc665402f7e7f012cc2aca594bfe544f8eb5c03b4082a02d56ff14dd9eb
MD5 17680bf1ed9c02cc5cb176deb2a4de34
SHA1 d953628673efb858637333db7545b77b39e2eaaa
SHA512 faad26da40e614e8e9735483c4c30057787263a7662e12cb495c7dc5a349f384361caf749e15f69bd8b094a4f49f65fc18ad20faa414407467b78c8252095587
SSDEEP 24576:aPUr+NQk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJQkLNiXicJFFRGNzj3
TLSH
T15E65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a62fc6863527efd1e1d58057792f6ee8d0029842b366e2078531fe7dc9fa7720
MD5 a061cecec46b5c697c4ba6ac5d75fa10
SHA1 b6435f47f3cdc21e91a2b4b7324048cab2d7aaf2
SHA512 5fe55592c236bb142b230e333305e88c6cb93b2d24728e39c74add34b29791a731ee9839568ef063db0a6c4fe088309feb80158ee4c68f2d8d339302eeba0191
SSDEEP 24576:bD3FHshBIYQgAd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bDVHeBIAAdLNiXicJFFRGNzj3
TLSH
T19175E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 12d3d097577448dba4ee7dbb5316d5e0d050e9f029a33e01f9f0788a61b53290
MD5 aeb2da39407eb7f8846bf0efc04da456
SHA1 2befad4fff1a9aec3d8ea4a4c966a8ed8f8b227a
SHA512 c97c680c01e758aec0361584d67c72021233bc3a10ff8cc18fd82250220ac9d90bd31c123c261acc35fa3d051388bfacecce6d50b0d96169fbcf4d95904ed508
SSDEEP 24576:KwuROWR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KwSO+LNiXicJFFRGNzj3
TLSH
T11B65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1152-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1152-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1272-84-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/1272-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1272-79-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/1272-305-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2576-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2576-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2576-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2576-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2576-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2728-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2728-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2728-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2728-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2728-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3168-288-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3168-74-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3168-68-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3168-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3296-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3296-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3296-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3296-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3296-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3296-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3524-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/3524-52-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/3524-6-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/3524-57-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/3524-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/3524-8-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4860-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4860-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4860-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4860-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4860-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5096-58-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5096-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5096-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5096-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5096-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5672-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5672-310-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5672-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5672-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6048-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6048-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6048-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6048-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6048-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6048-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download