e44ce48477ce375276eee7fca69d287f683135254fe8cc50b932427f9de68f31

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260808-n4yfvseq4t
SHA256 e44ce48477ce375276eee7fca69d287f683135254fe8cc50b932427f9de68f31
MD5 284a167ac6321b7594b9e874e6071963
SHA1 b9d1dabdf17db375269aec28206511476deb501b
SHA512 f309debb91aa4a98dcb7ad36c559417284ea1f460d784a36c0c9a61a3be90e2b2e7dad1bc732602f2be83f1dc1f66253843b1b9fb02382f0ff7a56ce27150747
SSDEEP 49152:M+D9r1XxKxQUIFFdMm9nq4gaJ6Ag1BXVo/cRAdaCQ5+CTXsLyOQnquMtuR:dzs3aaFo8F8LmMQR
TLSH
T198167B17E2B941E5C0BBD13D8A979657FEB2784A873197CB4390861A5F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3344	elevation_service.exe
3052	elevation_service.exe
3068	maintenanceservice.exe
4208	OSE.EXE
6012	PerceptionSimulationService.exe
2480	perfhost.exe
5032	ReFsDedupSvc.exe
4596	SensorDataService.exe
5052	ssh-agent.exe
4476	AgentService.exe
1612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\91c04b6f763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c434b92a2d27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018081d2b2d27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe629f2b2d27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062f2af2c2d27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000383f4c2a2d27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f18e32b2d27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d04d2e6d2d27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000694e662b2d27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007454f72a2d27dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3344	elevation_service.exe
3344	elevation_service.exe
3344	elevation_service.exe
3344	elevation_service.exe
3344	elevation_service.exe
3344	elevation_service.exe
3344	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6040	2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3344	elevation_service.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4476	AgentService.exe
Token: 33	1612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3344	elevation_service.exe
Token: SeDebugPrivilege	3052	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4940	1612	SearchIndexer.exe	100
PID 1612 wrote to memory of 4632	1612	SearchIndexer.exe	101
PID 1612 wrote to memory of 3196	1612	SearchIndexer.exe	102
PID 1612 wrote to memory of 2772	1612	SearchIndexer.exe	103
PID 1612 wrote to memory of 5648	1612	SearchIndexer.exe	107
PID 1612 wrote to memory of 5464	1612	SearchIndexer.exe	108
PID 1612 wrote to memory of 2448	1612	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_284a167ac6321b7594b9e874e6071963_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6012

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0397433b2ab9e743cc18c1bed9a59b39de9ea2ddd07b8238bf274084d8fc55ac
MD5 f3d539a40ba09a4218bce01fcd7e0a58
SHA1 0c11de8af1ef68ea7ea5ebfbc03a039c0fe372a5
SHA512 4650a2f3e3876720877fd313fb110967419fda78f04f394ae0338f2fbaadbd774bc805e53a6c2d7a9f623b6324abe58e62498d85d0c0f7e073c264fa3f84e87c
SSDEEP 49152:cb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnhQnquMtuR:G3q60jBqmMQR
TLSH
T12DD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 dc5dff69ff99cc622d6b6e78323980f64f639d46328322aee1bd55a47aa21dbe
MD5 adbf673ee08f9dc1c5991b304170869b
SHA1 9f59edf13c872b61b5ace19ee102025396ccb657
SHA512 22cd457f8e55f43890d8cab8a52a4be1c7aae7a8e96f3a65421769bf0a151f196a15ab66ad0d7985cc968d66b0e7cfc215b0135daadd4413115ab301d6701c31
SSDEEP 12288:51XLsswWkxy2lRq2czASUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:XXYfDtczAGcaBGqg+DuIvt8HRS
TLSH
T1D2750129A3D408F9ED67827DC8A1C512E63378554760E7CB03E09A2A5F337D85D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c0def65fb2bf651495c298584430f22a9559f01dc212427f8039a6d082a445dc
MD5 fb8d23e3a357661b0c67abb6f480fb5d
SHA1 2d1d4b427bd9d6b77694dec7998e45ae0f138998
SHA512 6aa7c04b83a3855731bedcd8b40ca38c4ad224d313418c0a2da30b41ab2de3aaa419c62cfdb033078f5ef040421c41f0ceefb2c8828cda08e5361cf2fa241a6e
SSDEEP 12288:NXZNYVLeyUji0h90ZD0wxpGZIVuqrHstUsVclkBYl8+OKthuDDP6WrNwSQIvtlK9:j0Le5ji0hmxNrMNcaBGqg+DuIvt8HRS
TLSH
T1EB95AE16F6748731D073C0B9C5D2A69AE97230865B308ACB4286D77C7F27BE68936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e563a70472269002979d3bd3d31526ab45586769c280d748e29482693ea256a7
MD5 55b193dfea7f31925b595e1f5b04e146
SHA1 c0e3826799cc26c706140f47d89162eab92b545f
SHA512 77be00b3d40c8b1f25d01eb16e2f35126dc48ab35e312012f140016583c59b69098feb5f3a81aa6c30547e54a836a45e49b3dea3e3158c6b35fb52a4ac453f59
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWr6q8wyuHcaBGqg+DuIvt8HRS:y/ezSC6vUzPviHjykQnquMtuR
TLSH
T10F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c2375e3c1d6a2628d5578d2c8b389448b395052b028228a2006d185e9d266f55
MD5 44912f7cc80f220db220b76997694003
SHA1 5a24833569c7c03e13c7ede6a6a1474f3dc1185e
SHA512 0df234619af4306cc0af6d9421c86f870c89a77df296bea6e9e402f03bf6d5b070522a570d1271f273208f1da2ff08377343952da4ec543aa2935abc6913fbac
SSDEEP 12288:JVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98WUsVclkBYl8+OKthuDDP6WrNwSc:JVbqPb88hv/l+b6caBGqg+DuIvt8HRS
TLSH
T16E559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 54c99156117d674a0f382442d08ee2c8e30acd204e887d4ace9e64877fb84b9c
MD5 d0c3e84890da1c9e535288190200f62b
SHA1 06e20a8758d4a23d554d8fcd05d04744b09cedfd
SHA512 2b87f85c82f1ce10964d9aa3af64531f30d4fb16204e6cbd300b923228d48f57950c07e10702d5fdce13911ed7221d9f1dcbacef7ee5054d24c27d550db066b7
SSDEEP 12288:TjRUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:TjBcaBGqg+DuIvt8HRS
TLSH
T10F5523D782045C42EB16ABF765D8F923A3A32D2DA422E55A0170F75ED039F74CC6236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 11065bca7d0bcccbef3a40930d605f228f9b2615a010a0dc52232472f6e2a3a5
MD5 adf3552d5c2427c674f1245f3a9e85b7
SHA1 70bfe00f5ff8e474503a5840c6ac2ea0bd11fb2d
SHA512 a4b16331bad1e083d2c7a76aa2952ab5038e19df7be7c7952ccaf0124f1a9deecc5d7baa0ebe17eee0d18811c6e5bf7c34c9f9ac39e8e7f71f629e5899d9eea9
SSDEEP 12288:ReBNUbTVO86UOUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:RJIUScaBGqg+DuIvt8HRS
TLSH
T17D75CF7BEE28FCD2C27A9DB95A918600D77278314B22A3CBD164C30EDE235E05D76D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8fdda6f7f264dc3a117cd65c88f4df0e892509ee3f068e658959ae1394cc9806
MD5 d73106bcb729a478040eade05c71ee67
SHA1 accb7b5fcfb149690e2a6a6f8a583cda25e1a67e
SHA512 f228fe814050e28fcf9d68944351e41f41e214a462eeed2009d89778dd0fe394c6f602f44a2a735957301520a8183d4ce8a4ec9216a041c9962cc9df8f63c563
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THT:XQvGAdlCEL8c/RRNw5C3mMQR
TLSH
T15D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 d85676953e75d0ebc7a246b9b40642e27da9b1f372c2de48617904434205e692
MD5 c43874311d0fc695262971451738d569
SHA1 51d967154ad4c72a6810dac7bcb5ae1b13251158
SHA512 2b24ad7abb1de17d508bc4981774e645a0d402e832063d1c10d523453806f4a3f411b9559d78df890daeb4f186525c81daee3d2042a9daccf60360bcac388f02
SSDEEP 12288:3AwSfxL/2Dc3DDLLmt0LDQewsAjwUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXH:QSewsAj8caBGqg+DuIvt8HRS
TLSH
T10C85E031FA74E432C37B0DB61B65D716547D79204B621AC3E3E88E8E99302D22776B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 19873140009d5c5a0e5050bd673b1d1bc6063d46605ffa64e749d7e1b9b37cfc
MD5 f738063903f77ec721dd47267892274b
SHA1 e5a4f0102c40d39afe3e97c63b5b2a696cbb933a
SHA512 48b841c1f93f431e33088a35de59d900d2104294b2e1da7ec6218fd68feaf3a1f3b234e0b8eaf53be314c72a9e311821deaec336b77e22da06eed8df360c3587
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH8+:9UEtQevvqc2W1cpV2RI328+
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a92c438d48fb80ab876eee1fd0f000b81a152efced181155b240b6e74fb0e465
MD5 39fbe2d9c40f6df56a42e3fec2a784dc
SHA1 b026fb27d790fc944ede4f1128c93f4b484edd48
SHA512 8f7453b36d867c87517047fb1c852b5ffdae588304a0cd6bae496334f5db5f6dc6567fa2024c99e7f23e40f6f435037b32b1791ea1a6a9e05f422cff1614cb50
SSDEEP 49152:3CbRquA/m2yL5zifFiV+XenmE3/zIQnquMtuR:goqHVjnmjmMQR
TLSH
T1C6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1786993733fff530c5fc1e29318f53a9f84de11f8b6eb709b0495d2cc3e06e10
MD5 b73cb9ff5d2d8456b6f3120b61eff4e9
SHA1 e1c7c8f217ada272b3bef3ee7a37dd15a1c64eb4
SHA512 ffb3ee55c625efa9422704918155a7ebeb9886e1c35e157776176beeba4be8206b69ca76ae2499dba85217f9185a3d0df1787f56e62c57bc6540b2fdd1e9ecf0
SSDEEP 24576:rAhGL2IFoiwtA5l7S53zcaBGqg+DuIvt8HRS:rAM1Foiq5zQnquMtuR
TLSH
T13F35AD81E7F955D4F5B3AAB899B59171EA72BCAA5E31C20F1160D20F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a55ad38e9a71779c1d5adfe12c027e36b439ff04452082449ef55f943164195f
MD5 f6ec26e3fa9ba4f44edce8615367ff3d
SHA1 18f2349daee5a673c94dc18534b02ad870a28100
SHA512 6cef203b1ef7beefe172cde250bc90f088129e32a33d4c3813ab8d0cf42a44d1ebefab06bda73a85afac9684daedbf3757b906bea396e60936b8a2aa37bc6b63
SSDEEP 12288:pmw5HEjsChNSBFgl0WDm+CXUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:kwuXOWocaBGqg+DuIvt8HRS
TLSH
T15075F14663A40CF9EA6796398597D132F7F3B8162A21D71F0360C75B9F37361AC2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 1ec77b4811a4b411e0ac1760346e542f21752a662dfb71d32d2e917fbe691730
MD5 5c85326dc6acec8c423f404360da3a69
SHA1 70068c1e90d731fc52875c6f8c808573b31f3546
SHA512 9d058fd8659ab54407eb43ce4ea525157746162265a71d2a96bd712bc6e83d2a68d092cfc99fe19e088cea168c4d0ef107a2aafc3e390ea30e2df904ac72ca0f
SSDEEP 12288:e/Z1IyAUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:yZuFcaBGqg+DuIvt8HRS
TLSH
T12C65129A139464F6E25397BD98E4A602E3B2346A673293CF0260875E9F37FD15C35323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f823f69097092baf10b734998b378a956d11ec58e8749bb545d5ff1dcfc9ad2
MD5 897366ab481aecfbbe563a30bf4d029e
SHA1 74f7d15fc7527740741479c95fa668a54c8cf18c
SHA512 242afc90fb495abbdf8e8f104a3495763a65915be8cb63842dca4153e19bff105d625fa40615df7fdd9a3ede25571b8839267fc370132494f894c26b1ed1e878
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UH:MQRQyi36YOcPhLvw2gAf+PN3OmMQR
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e8352ae03ab63b5992c94bb89f42cd2c4c0e2896fec4a41c56cfdd8f9612abfa
MD5 7ca84afbb861e0895855050679711e3a
SHA1 983a2373436bb4b8c309ac6708a13e0394dc0989
SHA512 bbaa4b2ccd76f31c2fcbae2140e74b10d7812364fe5badc5fad9a2efa9595bf3df6f08d3c397f10a23fed69e51428089ea8753ac200be8817ab6cd695b953565
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UH:CQRQyi36YOcPhLvw2gAf+PN3OmMQR
TLSH
T19B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ccae979a63a4a6fa475f42aa2132cb6d1c28ff2e15fb8958f648259fb35a9491
MD5 3ccb72a539a0c0183ef1fe0504e742da
SHA1 727cf51cd857367b051a5dc0a6eb8e48fb67045b
SHA512 95083cc69e92ba04e0a13db6563dea116c71448cdd6dd3af6b6f429bfd82ecf3d87d2b1ad3686dd2a7abc4a22163b8f8bfd431a1e9f27d1974dbbffb090ae3d0
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0VcaBGqg+DuIvt8k:k68Qg55nhceWu7PNU3/YQnquMtuR
TLSH
T1AAB54933B2F60099C44DE1769F4A972196D27C758FE1E3DB8111730A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 430ec34295fd028344095377ef1225b99f25a99e1f2c617eae4bf96399670553
MD5 175a25372fc79a2b9ba625be6d0af042
SHA1 1e739069ba2d46a2a8f5d735eb4333c493adbc36
SHA512 a4ffc042149bf71e8b576219e572d2212acada861c043735b6492b26e23392d77386e55827b0290848e4222e9424c0a9ea780f70ec966804e2b13e09ff8f4383
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99B:Py5112gYy5azzVva69nLKnhZ9mMQR
TLSH
T135167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bd7bea8972385e3ae122bbe10edc7dc73dcc13c88b5e0e70f877179d0f4a42be
MD5 39cab40dd428b69e0bb813dafc75fb7e
SHA1 799a8591dc4e60854976fe1219b448b39e15fc19
SHA512 84e55a904c8528ef8f7dff79563bd5d3e12def81ce61831c553ba7c81848835a916f6bfab8702647b8bd0094090e1c5f006e1a399ea7deca9d1a10a75644d8e0
SSDEEP 49152:2B+taZ3usBWOBr4tEG20bqx0z+n217aau1glAQnquMtuR:Eu6JmUxd2dAmMQR
TLSH
T183D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2364b0eb4bc8d15e67fdba71f848cd39da5bc9781546c4dfcdd384b3c549bfbd
MD5 b5427a8f3f4ed7a2112998f3220d9926
SHA1 64a6a747dd2db430d286051fea8a1d8d38372858
SHA512 ae601f7b8842191db2657371737b9f4b1a8132b6c2be4e80085523ed476500c2a6112c48f718ced11482cf08cf2d71824b55ede839510dd332d8400aa428ef29
SSDEEP 49152:W1hpsNoJpF1A6BU44CwH7R4xSQnquMtuR:WmifPkRjmMQR
TLSH
T151B5BD13F29900E8D06ED17887569232EA62BC460B31B6DF0A90B7961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 881c5654cff8a42d1126d91c0aaee246a0eb5a0b935419c0293462f9af792adf
MD5 f844c862550d0178af81400e802074fd
SHA1 78f306cb24e8c45edbb680494a7c4d7986c65341
SHA512 72dd3af22a19cf2d1903331154b27af6475e763db643c765dc0a96717ce15f3cd973f76f410b3983403cb767073bb1cf20044d46a1476ddcdc29a99c75c53126
SSDEEP 49152:QSuZQIY0Be2KNRVtOnks6NMHqxQnquMtuR:K5dKvi61xmMQR
TLSH
T119C5BE13F2E940E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ced3d881e1cf8a8f34b6c011c7d353ee236bbd80413bebd1f47fc862398dbd17
MD5 edf5f4c6960478ff4121e2d8942740a0
SHA1 5fc17138c39901ffe37113bc7af6246708d5060e
SHA512 d8c0322eafd3b28cb214191c0f4b9200d6cd9ab5d09bea9ceb1a537fb32cc9ca897a6709681eeba58c45a446a9a31cdfa50c086ce861edd1b95b082bd3ddebf4
SSDEEP 49152:qhtSn8EApI0figXgiDn0AP5wWQnquMtuR:LX2iyphfmMQR
TLSH
T14F95BE13F2D900E8D05ED179C7468632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 471a1fa15aa6c9c7a7c423652384fd18c57149aada7608429dd16cce8d49821f
MD5 20752e2f5f1ef553a953c21bcfbb81dd
SHA1 9fe05e60958441016aab8577ccde84ef311c55bc
SHA512 49b6d3a90b9a93db309edc9ca151b4a438c123e70b9e06146f1d90ae5b93bbfcf370c9deefd7b7fda17a44b1e71ff2c7f299900ebdd8804c19edbe0845b6287c
SSDEEP 12288:gpUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:gZcaBGqg+DuIvt8HRS
TLSH
T1CC5523D785449C43E701EBF755D8F653E2A2282FF423E19A1260E31ED13AF644C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 23181aeed018426af27de933cfb7c4e3e7f9efe67b711991fb92cee9c896da03
MD5 bce97f0fd30713e4a318aeacd3fd58f5
SHA1 93c736e58712a6a7b5dfd1b4460feecd1b21970f
SHA512 cc76ea2fc222cf3f27dba0641a18e09c7cac72381e7b5d736590401cf0162d0c3217cd47cdf30b13214152845000e913fff95e964b7f265aba2531bb3410c443
SSDEEP 12288:80UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:8wcaBGqg+DuIvt8HRS
TLSH
T1935523D785445C83E701ABF755D8F663E262292FB423E19B1260E70ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 6b59d74d37298f69bd8afe7dbda52fae1a518fa07bfb974fd8b1dbb00884f64f
MD5 07eea708de7b46abbc1c34bb233094de
SHA1 7d48ea18e8bcf17581bc2a96ec41c194826f91f5
SHA512 d9dfe4d931a4d9301f498d572ed4e16707cc0b594355132d1651757293b91fecf8a8429e9612fbf21fd22c99f11acfc13eb0e38214ad89253e1666e09c3ad397
SSDEEP 12288:8GUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:8KcaBGqg+DuIvt8HRS
TLSH
T16C5523D785455C43E701ABF755D8F663E2A2282FB423E19B1260E70ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e0c690116dc0d49023406452ee9b6a82e68994eff2449d6fb1a9294f19ad3771
MD5 cf582b2f223057df1201ca8ee446d796
SHA1 bcadaf9c3bb1c9332513a51d9a2edacab5745680
SHA512 81024034d9733783fec73d9f4b0a224820f493abccd5ccdcb38716ca163a0f9b12be3cbce5ee558bcf89f554c85cbf7da8cf129beb4a9cb3c2fb6cabf7a2f0a8
SSDEEP 12288:pVzUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:/caBGqg+DuIvt8HRS
TLSH
T111652397425848C2DA12E7FA89D4E513E3B23C6EF533E2DF0210970E9936BA45C7176B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 9e4cfc6f23abcdcef8a041e4f220bc128ebfbdad19a0192c8ea0b931973cb7cd
MD5 05e57ff17d2c36bfbffd0680bcda1036
SHA1 739b43ffdb9212b26bd12db71fc18d43bdca44f6
SHA512 4cc145a458576c74cb4af7bf6782827ad9347a1546709dc32dfd579a62fd4e88d908bd3e091f6ef6799e399fd7f8d77aca30b52a5dce2333755fe9048618d203
SSDEEP 12288:p7UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:pbcaBGqg+DuIvt8HRS
TLSH
T18E5523D785455C43E701ABF755D8F663E2A2282FB823E19B1160E31ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 ff4e31ec4654c4121902731215fd34822e9d176029d27905d7400d3f8e1df59c
MD5 3d001099401bc0f5423e8df2f2b93e4a
SHA1 c577b32573c8e3f59ee3d66a62200942ca0a26a9
SHA512 9cc98af31c796a0710341b21f3a94e15756d29c9f3bec39eaeced1272443ee0d6ebf47fe725b47c536e52ed2b04df318c70b7b1d1cc00659c420384fdebd7500
SSDEEP 12288:AoUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:A0caBGqg+DuIvt8HRS
TLSH
T1D45523D785445C43E701ABF755D8F663E262292FB823E19B1260E30ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 a0dcd8c3fcbe38efd345dd75d17154f99ea0aaf99ef7dc9f61ee1ad4083bb059
MD5 7649e64d1e6656d6ffd9104dea71b775
SHA1 1645a874a0b89f661c991873f1e546865fc5f395
SHA512 49bec734f5a91e594fad11867fae3864379a9b5766b8441d1ab2634a53e7a8d2c4107b6d6b32267163658e39e2ecd799637967a4fe7706aa629d38b6b763000d
SSDEEP 12288:ecUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:e4caBGqg+DuIvt8HRS
TLSH
T1E15523D785445C43E701ABF755D8F663D2A2292FB823E19B1260D70EE13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 0ec7103cab66d93d571f024167d195d6be0ce4a4edb01da14d090d54d4c63e47
MD5 bc11adeb7a8b83918d010a1416b59962
SHA1 4fd7be85212402a01c698c5a5643db6edf681850
SHA512 aa4d7e9a73df4a9c0bad8e81f74c93d2a5b7b9f9e41bf82ee54cc46bb2f8986060db3ddca1acc8f1a4e85d8342541fe7d9901c5af8e03954aab81cb0e127ff53
SSDEEP 12288:ViZwbczzFEoS2cPvyUUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:YZMMzFVSOQcaBGqg+DuIvt8HRS
TLSH
T183750195B3501CF4ED63827EC9559916D2B27C2A1A70C65F03A4372B5F337A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 253fa3af1dec97c77679350f92097898bf1d598e8c2ca67fbf03a2e19e845332
MD5 43a929742b053bc6e3e3fd5a47bb49ae
SHA1 6b176d442e2bb3eceddd69541bdfb26c9fed6917
SHA512 120e05b5b8ee9b6867332f5dfdfe8616743011ae10ab0f4176db0ba6081b74e3d4fa280647833de778762745f89cdd607a81bf6383cd9cbb96f2264c1386ee14
SSDEEP 12288:MVUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:M1caBGqg+DuIvt8HRS
TLSH
T1915523D785045C42E701ABFB55D8F663D2A2296FB423E19B1160E70ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 552f19d80c2bf72dd9f6c7510bd8a13e12a2783d9764ec1ea1e217b5dd06e33e
MD5 a53f1e8f80a12d8e94a99eaf88606154
SHA1 07880f43ed81227ba569496d5c39e2ffb54ee3c9
SHA512 74371ce5cdd24a7f2580a946128801e4c16fc974167de2575c0e8f350f97dae9aa2f5007a8cb9779563e05bfc4c984b13bde065abad5a4c23e52089148b68747
SSDEEP 12288:bhUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:bxcaBGqg+DuIvt8HRS
TLSH
T1E05523D785445C82E701ABF755D8F663D2A2292FF423E19B1260D70EE13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 7e41ef3322cd35096a3932c3195aab7a78ad2067c3acd04d9941d0300f75bc85
MD5 d7babd595e194839e10bc168fcc9236b
SHA1 290c0a046849569b24ed677373759fdf33dfaff0
SHA512 7a8b4c89a9d2ad7a11e28b21a728235d5267e9b9114f7ee137088096ec01e11b0353a49e7e78a8380d26d302ebfb493d29067904f3de75c6dc288fdbba4c9c2a
SSDEEP 12288:ZyPz5L8AUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:YzyscaBGqg+DuIvt8HRS
TLSH
T1D0651247639130F9D2269379C8D15A02F372783A5731DAAF13A0477A6E377A09C3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f882a655984c7d2748fe0f8d82d8d0f02ef227734f42f6d14314bf7f7a390f58
MD5 cb74ec82e01ab385d09c9ebcd71ecaee
SHA1 fbe02356003bf015d7552745c9e12401a088ad4c
SHA512 70a573c81597f568390e788cecc0d9fb784bc40c510b158e3d5e30f3415049e0cccff6ace5dec3b74c4503ce5a5b468ede8e56575d1012000f9d1499b7970d73
SSDEEP 12288:WVUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:W1caBGqg+DuIvt8HRS
TLSH
T1435523D785045C42E701ABFB55D8F663D2A6292FB423E19B1260E70ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 0270e6929a9548fcc8f763b36a36bc8baecb64968650d25709e339e62a50e123
MD5 4f6e3a89370043f274154a4bc5310b7d
SHA1 26d3700b91002706d24db80f2a101bbb9454d11f
SHA512 6c9e4c061ff2f7aea877415a6989d2023cb1313a1c0253a4edade18447ba74d8fd97aab47f8dfd3b34462c738f3523da29ee1b49c760a57057f9694d49fe974b
SSDEEP 12288:vVUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:v1caBGqg+DuIvt8HRS
TLSH
T14E5523D785045C82E701ABFB55D8F663D2A6292FB423E19B1160E70ED13AF744C623AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 3a6c623f5346438616fbad932a38c7c6e9ad9ca7aca2a7ed72e33b76bf401848
MD5 fe93780085daa6ef311fa83785709aff
SHA1 12cef43f34edd979d9bae1f64a820e1e42d25c6f
SHA512 c0bc3817fab5ef6eaaf885907b700c710ec467a344706ab18d1e569e25884a6f1a349e10b4dcea9d7109b8e4430d582fd060174cec91019ef01ade50d6643757
SSDEEP 12288:oyPz5L8AUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:pzyscaBGqg+DuIvt8HRS
TLSH
T1A9651247639130F9D2269379C8D15A02F372783A5731DAAF13A0477A6E377A09C3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 fbe372c34dbd38826416c628a1590a5c0c1175efc48dbf7044dff1faee28837b
MD5 90ba1eb114fe51a1f9a91cd285f2e212
SHA1 9912705c15c9300014f2e3107de3349da6e40f16
SHA512 69a9ea02a32c24f36346cde6a9697c20c5020658e850b89b08d2d26e9d0065429617ba3feef6c099ebf794819fda07fe41a628cdb733218afd439c302eeddd0e
SSDEEP 12288:UCd9MWYoaLHF3z0z04PDvh2UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:tT9aLl3z0zDacaBGqg+DuIvt8HRS
TLSH
T14D75F195B3501CF4ED67827EC9559916D2B27C2A0670C65F03A4372B5F337A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 39631c714384779b5fc7712600d5526c9684b78864490b6078feac452121bd4c
MD5 925b97644e8d9cda7c5bf61c819175d5
SHA1 9083e4016cda999e6ab6000e856e4ccf36591063
SHA512 843a1d28406f88931fed308d1c23fff3e2ce877188531249c229730fefc897652450e07c194861dd9e5414eb8b6cd978b8a91df8a05aed90a92c8463fb061a49
SSDEEP 12288:ii4e7oRdTfgwCHKy7GLbbdIv/UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:i3td9CHKy7GZ+caBGqg+DuIvt8HRS
TLSH
T15685DF90F3E414E4F1B3DA3589759512DAB67C6A1B31CA8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 a1a3fe2f352bc403f8f0922ea700ff38415385b2f2e4201aee857f409c7e9eca
MD5 26cc432ec86e4577f3a8e33d686e4e13
SHA1 49b5974cd55e55a3a4cc0a269ad750c9f5178f79
SHA512 0026967ce44bd47831a16cfe5f15d7073e398bd38ab006b4800fd3c5c6e3649212f6915d2d59966b5cf7d84bf56f06b5246fee7102e7335d226f6ebcd89ef177
SSDEEP 12288:KmUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:KqcaBGqg+DuIvt8HRS
TLSH
T13C5523D785055C43E701ABF755D8F663E2A2282FB423E19B1260E71ED13AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 70bb00dc964e23cdd0e2c9457bfd75f497e7a5028b8d86b20114603f05ac940b
MD5 2024cf07b9196220cd73fc03ae70dfb9
SHA1 a103c802aa2434281ddfdfd40f2d8f66d0d1911e
SHA512 ac5b0768c881b132eef8402a76f99b7d875b0aac3443e433a1d22254d849382b27749c7bbbf382f782d4dc389b1153a1a1d6cf1505c0197e4d7891e4a1533888
SSDEEP 12288:9gUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:9McaBGqg+DuIvt8HRS
TLSH
T1515523D785445C83E705ABF755D8F623E2A2392FF423E19A1260D70ED13AF644C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 2d9f6e9e3ea4adba5b133cf5abc905befeb7a1943139c2901f469e6b838738ad
MD5 9f880db10e5420100c53344d3b903b9d
SHA1 c62ffef6cee557af2d4925ca85e20e5068190f26
SHA512 3ed52c63901c90942f44e39c0aa84bba2fb06f76f15da1ab8ec0e1fe03c5bf8c25ecbd66583773fbf5efd2dffa2103be1dd9b3a877bbf09bbf235e11458299ab
SSDEEP 12288:y/UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:yvcaBGqg+DuIvt8HRS
TLSH
T1CC5523D785045C42E701ABFB55D8F663E2A2296FB423E19B1160E70ED13AF744C623AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 2292af11d909eb32fdbd90508899cb52723def4b45ea0e176c285f14f299b24b
MD5 eb4717ec0433ce74d5be14a402499df0
SHA1 4220b4b86ec7b9856160a3268587f072938da46b
SHA512 23ff9986220faf0397d324d3fa2df5a078c1d9fdcc7de63f5bbc40f940cf5698c6a942ea1ecef23974efde6640be233310eed83818b541dd72e4a469f84e4f69
SSDEEP 12288:QVUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:Q1caBGqg+DuIvt8HRS
TLSH
T16E5523D785045C42E701ABFB55D8F663D2A2392FB423E19B1160E70EE53AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 9f1f565280254443ad0f2a5d0c9d28e98659951b988f7bda2725f91a79a5afa4
MD5 91fb23de069a90922f011889637b6173
SHA1 4727c32772c1223675081b246c9e4c61f19d7d18
SHA512 baaf23113d3cd297b21389da7df377131a7b3792478f733c8bc1f605e412f7cecf9cf2c6e7ed45a7d9b5f36a27b830513a06bfe76263fc716701a834cde47d0f
SSDEEP 12288:YmUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:YqcaBGqg+DuIvt8HRS
TLSH
T1B65523D785055C43E701ABF755D8F663E2A2282FB423E19B1260E31ED53AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 d1c0ba9734b77fae1aab3e34daf6357da51b8c6538e9153453ee66745272b5bb
MD5 b51e0dcc221d7209b0a617585f711390
SHA1 2e121a869fbf045fe2b62947cfa0d53a49647377
SHA512 df34fb384d3ab1738171a82f7eff70826ccd9dd3aecd0855def5ced9ee6abb2a737ec068c7c9b2dafd24450e2513dd9131fd5be20b59ca38ea3427a2d1a2d604
SSDEEP 12288:IdUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:IdcaBGqg+DuIvt8HRS
TLSH
T1FE5523D785045C82E701EBF755D8F623D2A6296FB423E19A1260E70ED13AF744C623AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 d186ec59c2265b775f26da86917ad765290be38d1ef66f895a7da9a6435c0220
MD5 374793c02df51051128540f5810e112b
SHA1 ac4229400fcb099ce0ffe9778b9da2c6b18d499d
SHA512 5cd9ac635e302556fa657bdd26b53e2549c34635a4793017c54d593e0024f981a2b28727e94feeca58d7e180db1113b9d068c23420d6443ef47cebd9c69421c4
SSDEEP 12288:g7UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:gbcaBGqg+DuIvt8HRS
TLSH
T12D5523D785055C43E701ABF755D8F663E2A2282FB423E19B1260E70ED53AF744C623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 370d94ec0aa0c66876f616a0235a1e5df96388be32b00df5d532b524957d9400
MD5 0e79055c7ae90542f8794d8652fb54f9
SHA1 f75684ed905d076ea6ab23d18d2f36e92b62e3e3
SHA512 141871191f7df8b079ed4d5b4b954f72a9f08512c3df47e8613677b61cafab0e7632bfe22e3854bd37343c9cf7e260bb0e9969f312c38a7e98047aaea89c6778
SSDEEP 24576:qfwvok9RX6wkyAIhcaBGqg+DuIvt8HRS:eMnYIdQnquMtuR
TLSH
T19D95DF29EBD848E1E177927C89F7460AF2B178691B31C2CF029A536D0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ffe8b5940a7aeb59759b74959eb4c06b09d78f91a9d355ace4cc152e8e361dba
MD5 82eefa6a463d46d514d23b6b954e27c9
SHA1 1909b57db37e13589b26b132a9dd0bb0fd1969ee
SHA512 fdb8fb4bf674790c28ab9cb9fd64b6cb9d5069e05b11ffdb4fa98ca44deb339cad28a630c7bbd3ec3ff902c71691e7a866b8adfe5ac44d0ecf4840064c82ca8d
SSDEEP 49152:1YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02QnquMtuR:jySzPumMQR
TLSH
T14E066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 318d0534adc2270c756f540695fa00f598f9215a011b027ad37e40b5e87718b8
MD5 addbe8750f8832bff99a75fd20dafbec
SHA1 a8b3862287943b7a039caa7a56d02218de2a17ba
SHA512 cbf044a4111a1199fe9f5018cd07e2d7008f10da1529b83b2b7e094d21b749197325ac62115d0e71f75b47f775274af0a921622141e63330dc9a107a24a354c4
SSDEEP 24576:247Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYAcaBGqg+DuIvt8HRS:247JUQj4irIhCnDHUPfF/GQnquMtuR
TLSH
T17465AE1EA3EC01D5E1BAD27885558A1AEA71742E1F32CACF1270837D6F23ED45E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 4381b430d28ba8c04400fa5ca076cf2bd145537c2d238227111575aa685353b8
MD5 7e109a80faca2103bacecad75d2e7996
SHA1 1dcff71790642f1f266ef0a0d605d582f7475c24
SHA512 bd3f6b109cbd1cb4d27fd57dedcf56dd7fffca308593b50cb8f751c7699d451a94a1b0fffc276daf727a1272c65b2152f42db90647a455294f729565674deaf4
SSDEEP 12288:QGsfFUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:gFcaBGqg+DuIvt8HRS
TLSH
T12965015AC25801D5C16EA2BAC7959A41F3333C2997E2D3CB12D0F63E1F366909CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 95d5d3517dc9abe123e2c890051dbe18fe9d50e59958d7e8728d72429c8a8768
MD5 dcb2238ce7dfc959d41d13cfc32fa19b
SHA1 ec0e7a1e0887bf362386113ca5535c265d14c89a
SHA512 9b85ca4620c36299b4925d526e7018e3f6024600833d17414ca01a9d123cd5cb955ffe8590e650ad453f503a497c6c7e787df6db48749ed554f15611fa0b7954
SSDEEP 12288:v+nQRlU3f4lXixgibCPr5OIe2g3RqxHBGTssYu5:2QXUP4liGYCj5OIeZ3RqxHITssY8
TLSH
T1AA250741766AC75FC6A980325E33D1CCAB707D01EE45AF0373C9873FD576668BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 33df006b79c47c456c94b4df67c8a2d8eb67600924ce77b8bd05f237e9fd5144
MD5 8d7c7ba1e8114788f18d695885d097a4
SHA1 1bdb4d26c7af20014d4d8e7b4e62f804ff860351
SHA512 784490c0737c959346166fb100de82fd104f3262b93e37c4add72cd548a5bc36030f12fce185be36a6c48a60a865b5117b9cb263bf5256d9c0d4d3ded490db12
SSDEEP 12288:7B7nyPGSV0nMOE/h1GZUvryIz3dNzkZCru5JpVnmBccPNnmQ3U8uYC:yoMNU8Y
TLSH
T15D65D8815537A3CFD5F76131072A5F4CA7A4EC06B7496F22B3C8453ADC2AB61A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 8f608a7885dce92c0ca892ef6fd65eb6faf68f9539c7f37eb89fe7670f3cd1d1
MD5 609a94c8c2803add54d5b0caf38e0973
SHA1 ef4016868c93069f7c357a3e496fd635c353c833
SHA512 0ebbb8047f87c21b4935b3d8666fe008ea076188b64cf2cddb6240ef9b49e411324bae354d385b9a6a97f41ce88cf90add9c22f9698b7233d4e872bc0dabbc05
SSDEEP 12288:Jz7NUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:RtcaBGqg+DuIvt8HRS
TLSH
T19365239782489C43EB25ABF654DCE532A267393EAB12D0DB5110A35EE035FE08C7275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 500ad3d3a77b69f741d121a8e602c6558cdd150eb4e9c0afba2aa0faa5f6476f
MD5 bf1720aa702f996a29380eb61e01833e
SHA1 a471e822221e53841e158a76af809111462344de
SHA512 4c2cd402cfde8f4b37444c3296fc5d1cacf1a98a7262cd8c7e7bb0db16724183654f28e827f2b20ade6ea0e16c9c3ab8ca44f57c30d2358cf375af27381d6d17
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYHcaBGqg+DuIvt8HRS:8gb4mBIBhGFcQnquMtuR
TLSH
T19B65AE1E22EC02F5E0F5E2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 43c9d85dbf191d13aca16f6ec5268df508ea096c5c806f8ca666b8ded65162d0
MD5 c8c0d80e6895c08d630cb324060ee67c
SHA1 57d4e67040c565db44e2f5907c227eb4f8937a70
SHA512 1acfca3832a4eb7916b3f0be76425d36b00c8a3d30018967733424d1931ca304c197eda836513a79c46c5f2256c8191e7768d93b328cdc121a84c6ec2684bcee
SSDEEP 24576:8G88u8FpJqH1Wzria7/mQcaBGqg+DuIvt8HRS:/7ZFPqVha7/PQnquMtuR
TLSH
T10095F16667E101F1D47BD13889864663F6B2B4251320EBDF07A88B561F23BE44F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 a7b07e43ce6b5583171db8b01c36d62fb1d4eddfcf7ff1f4d98f7b8d3a7897d1
MD5 e3d935d96eb5f9f3ba5eea77a08d748e
SHA1 dafffe9ca77c516c5810ab9c9ea8bef3d17db7cd
SHA512 053184e52dcc07f4bf2710c171772573ecfe8d933fed347daed6334b9372a073a422a917e017c2d243ee7d6350567d2872a71df00ffd36b6a2d062770ad88c7d
SSDEEP 12288:SHvUrBFrEjwaQ4UsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:SPUr+NQkcaBGqg+DuIvt8HRS
TLSH
T1FB75E16F229C1CE5E676E17D89858719F37274661712D2CF02E0827E4E37EE8AC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7e83767b997550a97dcda4dc5dd6edde4d2b871b67f0d8a90a78477e256781ad
MD5 48e054bee78029d3f8e4aebdd77609b0
SHA1 2b0123a3ca143cfa95fabdecc84299b8faebbc93
SHA512 edc0470de7ac01e23b0e36e3afad1a1c031ccd8cc48514242b42b4b65840f471726e3dc1eb124d85f40e07de9bac558f4a633127397dce007aac56e74dc6e231
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAQnquMtuR:4G05lO43blmMQR
TLSH
T126D5CF6A62EC11F9D1BBD17CC9C6860BEBB23425033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e9f0d9897ef1c89749fdc94b2c2e0666f8d24db879a13b6fa9fa32f6d47e067
MD5 55cd2f06f0bec552e18179333b3005c6
SHA1 b3c69eafc4b997831d94ec4079b030754c11b09f
SHA512 917976a589db5aa1f2c6b3db9e1259fe478b80d1dd36cf9c581aabc8b703e6655195e7c34c712ee9db70b98992638e8f4195aacc29b758e16f38f6240b8c07e1
SSDEEP 24576:lfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnmcaBGqg+DuIvt8HRS:la5POZ39Jt2pasx2+mYQnquMtuR
TLSH
T1B165AE5EA6EC00D5D579D17DC583861AF5B2342653329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aa7a416ebcd11f90dda0163f422bb0606a638f9ee0a640be7028f2c3e291e129
MD5 8b2467fd6ab01d74344e33d2e7dee108
SHA1 dd05c44d1271f19f72a5cb80ae73c774fea80483
SHA512 f694d6f21f9b7416bb86f422d1ef53396bf5f440d9f3761808fa82abdf0fb3c15ae2bdc41af0986063e06bc6376d414ece537313635b1ee1621a0a712ac633f8
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkIcaBGqg+DuIvt8HRS:qNc/zEOVHFvQnquMtuR
TLSH
T1D5858B5623E901E4F1BBE1BE89679546FAB17869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0c46c6dc32a2e9fa8f243d4b26d346096d1f41bc83178c44114dbd53d607ece9
MD5 e67fcfdeaf9bdd45aa5bd2325063f137
SHA1 e29c78165fb809e1333efddf99651f509848a641
SHA512 e2cbef0efa8cb384d24654a749cd2823d5d757e7e037c707e0cf31c2e1f70d31808a91cef98f5a5e9d2beff61665420df04cbee98078c95abee4c63df6916b48
SSDEEP 24576:5tkNvNnaFeYhJNtmZBmdacaBGqg+DuIvt8HRS:5tMwBtOm8QnquMtuR
TLSH
T1B255BF6EAAB806E4D1FEC6B5CD238512E6727461173293CF5290C13F4E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 79e04443ab976707b4c112003b8b51f0d95eb31f1c8b3f4fbd169ad87a80be9e
MD5 db09f1f95aba2ebd2df3c2370a42044b
SHA1 5f9c03c3f49d8eb33c237627558c9c0dd4b39c7b
SHA512 aac892dc651b022f035e83dbcd8b45ee15765776c03813db7a12144b195b26f4f2234d865d0ccb6aee29791d2f89102ec4169f0d404df44fa904b5637c340439
SSDEEP 12288:dQcMxWDXN1Dp/fshBItT1IQgAJUsVclkBYl8+OKthuDDP6WrNwSQIvtlKHlnXt4Y:xD3FHshBIYQgA5caBGqg+DuIvt8HRS
TLSH
T1EA85E17ED65C04E4E57BD2BCD6938A06E77138AD032265CB0290C1BA5F2BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1612-325-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/1612-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1612-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1612-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1612-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2480-88-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/2480-319-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/2480-94-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2480-89-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3052-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3052-46-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3052-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3052-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3052-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3068-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3068-50-0x0000000140000000-0x0000000140260000-memory.dmp

Download

memory/3068-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3068-69-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3068-73-0x0000000140000000-0x0000000140260000-memory.dmp

Download

memory/3344-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3344-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3344-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3344-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3344-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4208-288-0x0000000140000000-0x000000014025A000-memory.dmp

Download

memory/4208-71-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4208-62-0x0000000140000000-0x000000014025A000-memory.dmp

Download

memory/4208-63-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4476-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4476-143-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4476-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4476-145-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4476-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4596-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4596-322-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4596-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4596-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5032-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5032-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5032-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5032-340-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5032-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5032-105-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5052-130-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5052-133-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5052-124-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6012-76-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/6012-304-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/6012-84-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6012-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6040-32-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/6040-35-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/6040-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/6040-6-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/6040-9-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download