cf99c2671f091c06fdd39de712b41623f3cad5d4db83c599b7c14008d005e8b3

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260808-ns5qssdc75
SHA256 cf99c2671f091c06fdd39de712b41623f3cad5d4db83c599b7c14008d005e8b3
MD5 85c8014601c4b256bef6d1177d174fa8
SHA1 9a81c50e91a50c9f3ae400f92dc74f20d76669b6
SHA512 cad6076cc77a1b2fefc01249445568403aa7bf570a236923f0b42badf413e0c0e75ab49e6e69aed3935f8275e98a9a5c854599d8a2224f5e4ee2d1a1a1ea14cd
SSDEEP 49152:9sdvj/TCkU9+pmsBU7130yAJLPsnon6yPt1zkczQQExfpT5nt2r4PRSEk1ul:Hao+t1/Mt2sEE5
TLSH
T1FF167C07E7B941E5C4BBD13D8A57965BFAB27849877197CB03A0865A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
712	elevation_service.exe
1212	elevation_service.exe
4428	maintenanceservice.exe
2984	OSE.EXE
4652	PerceptionSimulationService.exe
1244	perfhost.exe
2992	ReFsDedupSvc.exe
3652	SensorDataService.exe
4500	ssh-agent.exe
5840	AgentService.exe
2444	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\65f4831e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-08.1140.5752.1.aodl	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f6625082b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000975fc4c72a27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a5572c72a27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000377178c72a27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c54bfc72a27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c56a40c72a27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5752	2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	712	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5840	AgentService.exe
Token: 33	2444	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2444	SearchIndexer.exe
Token: SeBackupPrivilege	2992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2992	ReFsDedupSvc.exe
Token: SeDebugPrivilege	712	elevation_service.exe
Token: SeDebugPrivilege	1212	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4464	2444	SearchIndexer.exe	100
PID 2444 wrote to memory of 3884	2444	SearchIndexer.exe	101
PID 2444 wrote to memory of 5796	2444	SearchIndexer.exe	102
PID 2444 wrote to memory of 3512	2444	SearchIndexer.exe	103
PID 2444 wrote to memory of 5032	2444	SearchIndexer.exe	105
PID 2444 wrote to memory of 1272	2444	SearchIndexer.exe	106
PID 2444 wrote to memory of 5568	2444	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_85c8014601c4b256bef6d1177d174fa8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4428

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0eab53a40c9bc554fb489de9d87b25f97ada24b17705763c630769868c7dd55e
MD5 f3cc0b8eb4debb20fc4b73b2e555b03c
SHA1 177b3cf0b4b3176b716e8f8c0a668a52d59a04ca
SHA512 f03f496e34fce0d2dd72f1e28fbd3afbe52380cc2c44ac6643cfc032c504e0a8a0e30e5d44f2cc7c630eddae07aaf5cc057f32950113bd14014e22b0694f1708
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnct2r4PRSEk1ul:p3q6HjBXt2sEE5
TLSH
T1AFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b28783911a1b7edda6fad813ac58d9fccf650143161d51aa21b3274642fe46ef
MD5 08ac91e45efdbdceebf43d5fb5090216
SHA1 7dae3158afc9d51a4b4748f96be5ca7c33d120c9
SHA512 550b02d1fade2d59acf1a43bd83f5056b64a68438e77eda76ca89b8e80327b0f36153f28667dfddef778b8f832da27fed63af13507fba4078f80a8f5e0004bd1
SSDEEP 12288:71XLsswWkxy2lRq2czA4UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7t:BXYfDtczA4t2rR8FfBhRJUEbDk1ulUI
TLSH
T16805F129B3E408F9ED67827CC8A2C511E6337C4547A0E78B07A499391F336D85E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 216ff5c89cf63de478ec640a05d6921c357a1ef0e214494bb0ef9e21744e867a
MD5 0317ed1f29c17baf7fdd1f4041ce2c24
SHA1 e74ec0fcfcefdc034f5713a1b6c3648c3410e2fc
SHA512 2660b955c4337a7f97dc983be5a117c3ae22c89083fa761a468f74c696625d200ee0b5503c64fa2bfc5d8e9ec9919e9faa51066c349e74be4579cf669deffdcf
SSDEEP 24576:F0Le5ji0hmxirM3t2rR8FfBhRJUEbDk1ulUQ:FPji0AcKt2r4PRSEk1ul
TLSH
T101359F16F6748731D073C0B9C5D2A69AE97230865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 db4b89b5bc16a2c83cb9c125ceca31d6645e7b62cb4dee3eac4a31328890314a
MD5 1b444c155f15f47f2646d5d6a76daa00
SHA1 762c9f2475443b87b1b11c4906b50da8122ebf05
SHA512 bde0661167dde98d3fe1ad89fde63c4e9da600a268bcf8ed3eae0759d8ea15c22a39e891d1754dc07f7a3b7f7ab72dc9bc16d511cea5ed246e2c8430865c2e83
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWE6q8wyuVt2rR8FfBhRJUEbDk1ulUU:l/ezSC6vUzPvxHjyWt2r4PRSEk1ul
TLSH
T1C3755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25a2bfc72e7acb0d9e9dd77a2c05f9d68db358aecb5848a9d1b0ce6419d1f3b5
MD5 e82fdefff1a8f1e325ab22af4445c626
SHA1 9db938d5dc2c5b05f885e1a34eee17abbfca0349
SHA512 8e154bbddbb7985d02f59f2b6f72af72670c5e745948529c6065123733d98c8c2c43652039dcc3ba3df676767a7fb706494db441ba127c44ded7acf2f2ee395e
SSDEEP 24576:aVbqPb88hv/l+6Mt2rR8FfBhRJUEbDk1ulUh:aVO88hXl+Dt2r4PRSEk1ul
TLSH
T1DE559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 440d352d6a878bb1dbe8c00ceabd30a6c0eff92562ac8cf2ea68c8cd9713c2f6
MD5 a415800466ed1e2dd3f8571b116f4259
SHA1 86bf9e03a9a0b9320f5e084765858bf33f9fd486
SHA512 d2269d63e92a84c3f858823ae0dadeecff0926786091af13490fd9f32bda61214f7b8838f1280d58241bd9fb2b9677490b5233b621bae28fa61a826d43507329
SSDEEP 12288:1RbUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3o:1Rbt2rR8FfBhRJUEbDk1ulUY
TLSH
T139C42312F3A848A3F3A74A7478FAD72114122C893FF5AF021D60693E25389E5F5F56D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ced89ec772d61db07353379dbca8021be6ead81147adf5d1deb842eede3aedcd
MD5 6220f1f4e96110b67cabeaefa6c7735f
SHA1 a0b95dd8a43ce4a500dd968a4dbbda156cd13a5c
SHA512 b862d8fd4cc4fd3b63b0e01de3829caa974737380c0f822a9e579d780da80b554dcfe99ced5ae00c2311248a1b73d2cf85260c6dce2613f66f3154d1d3533a7b
SSDEEP 12288:feBNUbTVO86UUUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3O:fJIUUt2rR8FfBhRJUEbDk1ulU+
TLSH
T14305CF3BEE28FCE2C27A8D785A91C700D77278704F62A3CBD165821E9E235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bd2fc569c46d1d01f590a74dce4f5817955f95c7e85d7a5f428ce472965ef4f7
MD5 b8c54a246bf32f2e577cdb16d0d867d4
SHA1 8f2f500ca02d48a2d71e6c699783cc45b2b6fb96
SHA512 c4f831e6fc569a00d8ca5953b2c1ca3146d093020f4a32276902cf6dc6e46a8d4961f451ff3130f85612251ac069c6e2e434c3bdf3d4800ec7145e486988e53b
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:pQvGAdlCEL8c/yRNw5Clt2sEE5
TLSH
T111267C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 aea267ef01da5229c681526423aa135a5c3a842ffd28bd4c198d585a3abb539e
MD5 348eb59f2494e74d4d0528a2af017327
SHA1 f5a030bd18a7b1ffb35e97ed9901608345934a8a
SHA512 c75b7fca0443fbbced2431faba58dced09bb0a31cdf957c5163cb7ba4efdbc0b2cd83177eb85c0c3d3d4f194b6680d082ebb0dd76cb2a571829f6d8457e88510
SSDEEP 12288:lAwSfxL/2Dc34DLLmt0LDQewsAjaUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7U:GdewsAjat2rR8FfBhRJUEbDk1ulU7
TLSH
T16315E031FA74E432D3BB0DB62B76C716142D79204FA11AC3E3E88D9E19302D26776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c62a11f1cddcb5b885d2fd493fd845848169d8c42f1c6cea980861ea0b49bd97
MD5 4faafb06856142e9967dbd16d4c34ff8
SHA1 6c9646dff946158713e1b55408c2c92ea1c9d273
SHA512 4fd187d5c877d394f24857a652f826d9a18190670c9c1546da54687df04e613d9eff7a2a5ac6a12a2a0ac76004447cae4c1b72322b41d7e9640ee1c8a7a13a5b
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSt:zUEtQevvqc2W1cpV2EI32
TLSH
T1B3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 410d5962e68b99593d01577e3964fc61184d9a0ddc66e3d0d1d055a039f66407
MD5 d2bf65d96280aeaa21d79345160e6b7c
SHA1 910a37b4298176ba064ce8b459cc002f302870a5
SHA512 84968f681716a3b140b198cfb397dac4deb48e94b0d9888f2d0201575f22046b2b23434707dbf4e6876e459a82d4f5084ec23db5d152467684ddd5b998e5466c
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/z6t2r4PRSEk1ul:4oq2VjnmRt2sEE5
TLSH
T120D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fb8c814db668af4940a69e851b3c455d97b0575e89a95839aab7a175e2bbd0df
MD5 ef37e20472981f0bef9205d62e5d8bd2
SHA1 f2072975fb616b374d3fcad3e752ee52a509ef2a
SHA512 bea8b8194899889c4874380cc913ad40ea0958d0e1458fb07c01ad6c2150b2e712b86b398bd726acd302f663ea6f5335e5b657c148c48ce7e4d33fae1264509e
SSDEEP 24576:DAhGLJIFoiwtA5l7S53xt2rR8FfBhRJUEbDk1ulUZ:DAMyFoiq5ht2r4PRSEk1ul
TLSH
T1ED35AD81E7F945D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e6b24e74286d4af1edecd43853a8403c15f2da5a850c7da193aedf630505cd8d
MD5 023d1db855cd8039565c5433f29f0e35
SHA1 8571a79f32b440ae69062ae172158867d81e2f23
SHA512 1e973c4f43d79bff4bf401320018dc2fb9d8d9eb7ac6f282327da6134a087e75c45886fd7df5985063cf4bb0a0c2d038e3ddbe7daf5cf28b2a8c1e978628d4a7
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+C1UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rs:qwuoOW2t2rR8FfBhRJUEbDk1ulUM
TLSH
T16705F14673A40CF9E56786388597C136E7B2BC062B61DB1F1760C62B2F37261BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dfb2a59f9cf1bd684becc876cf427d735faa752f0b7b7b4de54e730f396473bd
MD5 a6cacfaa6a4e2ccf6bbc022156c6e43b
SHA1 3262660467fd69aa8bd6974b6be60ebe38abc545
SHA512 efec9abe964eefb9d391113c258ecab1ab55f316b9e29d5ec9343b7dd4a2774a1978d3ea2a35d1cd665180ca6ec37a72797c325e6686327c59b0bce885491459
SSDEEP 12288:QBZ1IyqUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3G:OZu/t2rR8FfBhRJUEbDk1ulUW
TLSH
T17DE4125633E460F6E2A38638D8F58705D3323C462B7297CF1A60463A2F32ED56D79762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a72d4eca8ffcfbfb0b2f702e37ab69d3bdf2a1c5359e3a17bab220094984665c
MD5 eacc0f6b3596e2c21a174937d33d44a1
SHA1 5996d5de6d2d4ff431f58b36240ff8ca53721b57
SHA512 963be20f14d53247b56bed9f0e27f39198de7e83be03fe3302d8bb1494d00fd389e0b30838973dd8c049cb681d807b7b7e146357100af0ef38b8c1d824eb93ac
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:+QRQyi36YOcPQLvw2gAf+PN3gt2sEE5
TLSH
T1D1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 541edb673d136c254d9cc5388380d52b879e66d308568c56f3499435b02d0a92
MD5 131deee5715a2e99ca6f401110f8a804
SHA1 70c90a3e2668034d8d18a162bdf124b307f7c964
SHA512 564e09f2969fe740f2513369076062479015bb6cfb24a986088b0cf5ba19ce0cb71d0fb9fdccc45e469b9afc8b495f75a21f147f71983f3136bf5b7b632ac81c
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:yQRQyi36YOcPQLvw2gAf+PN3gt2sEE5
TLSH
T155666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fdf6f1448ab31a12cd2c9a99b44e1ae395a192191b8c06a4c493fcd016f1003c
MD5 ab0639164b64839a448d67fba58cf32f
SHA1 172f4de53ebe72759288018e1224972fc4e00abe
SHA512 6703157e505fdca2cd11966a5f94bc58cc1135d329ada400adfa9c4695ec4d9b8d449392d1ad348a52298e00674da95527733f6e04675c8c5563a2cdd107a899
SSDEEP 49152:T68Qg55nhheWu7PNU3/Kt2r4PRSEk1ul:NthWRc/Kt2sEE5
TLSH
T183B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0994f6f762c9f8558a42b78541f49076629dd31100fea29c602ba7cf0ae520b9
MD5 4dc3fc56e1e511ca58828c62ffc5d8f2
SHA1 e6c8aec0c128df05060f362d924a88c4434b110d
SHA512 b3eee4d3792c43df34d20cc29e045977a4ce77c353d365cb0a30b6af26f6b5f6d85bc51a36bf538f31d4cac0d00669b6c92ee2c307d850f3617391f651a1c769
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99q:my5112gYy5azzVvL69nLKnhZbt2sEE5
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 60ce31f813d5303d0c68a45a20b706aff238eb8f9ff4c9f3e39b22c857bb8222
MD5 3e67970ad2b59522ff34e892aeb69e56
SHA1 033948579733a94db638478aebdef9f51778e15d
SHA512 8ebd221402f469b4818104a776bdc7f2610fe1970416aad0d62abfccc77bdedfc29705da8b7986281e266cef03013935b1f726670df7ddd0653287b5997aba67
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbt2r4PRSEk1ul:vu6JmVxd2dbt2sEE5
TLSH
T1D7D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 edb329a1af96b0f405467e606155a737d62da18ef5a9e0c56042fde732426b24
MD5 d9d68490b0d40c7d98f3b9f7d3ea19d1
SHA1 dfcc092259a98d96073cf461a4b989126fdc8184
SHA512 ca08c51b4444568c8e825e321b178fda4449aa74225cc9aafcfe9aa1d04715954d6eca739a22721439c8a246938798521caff8d3df095444507f5fe96739611e
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4x0t2r4PRSEk1ul:OmifPbRRt2sEE5
TLSH
T1AEB5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9caf557cd8e310abcb3dc3a6ed41ff823d79d8ce286c910b519efb1a7bc8ae19
MD5 8b74054e53152c102a8c36fb3109cc38
SHA1 5ffdb7277bca12a81f6197ec3c3c6b9ce018d123
SHA512 6e751a0086b316f9dc14056e1a016607ae64226822f6eb4f49dc92ac440be050eadfb74510af02ba2b19babefbb43f85d20f6a9d2aa3bdb425242cd4b83c904b
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHq/t2r4PRSEk1ul:m5dKTi61/t2sEE5
TLSH
T1E9C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6827048991e0af3f32b440828e40cfe355a15381dcd0093e67252f42e00d0d70
MD5 1ab0c46d001213080db68333499df5d0
SHA1 e51f9a31103125296b5c979a08f016f9bec21b53
SHA512 798e58275a6c9dc54984ae0db131ba91f83b1b63d8b2832766a73d1fcb649124feef71d6403bc09989e48568e60475a7b9cbef8c8dd9563d55fa24e1927760da
SSDEEP 49152:7htSn8EApI0figngiDn0AP5w4t2r4PRSEk1ul:aX2iyphdt2sEE5
TLSH
T10695BE13F2D900E8D05ED178C7568632E962BC060B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 48c1bdce4892c0079ef962bb35a9e003c0d1fb0f7d01c33b7ed2c8d03c8993bb
MD5 3fd2e14b153a3adc0ad551c0a025362e
SHA1 cf1220a3a60a56a8265d0b2e556cf510350a3495
SHA512 3d2053d45b68875f46d77b73d493bc76c1bc54125285aafff223f67ad1bedf7c9a5e07cfdcad5cb18f727f0c7ccfd92bbb6b8582c8406c5359b768dfb8c5dea1
SSDEEP 12288:GDUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3N:GDt2rR8FfBhRJUEbDk1ulU9
TLSH
T1DFC42312F3A848A3F2578A74B8F6C31154122C8E7FF6AB032E64143A3635DE575FA6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 3a6391b28144624b8ee54b02c63b13eb49ecf07e64366e4990cc68dd6717a7bd
MD5 1f858df16acc64bad89dec5b49e7f9f7
SHA1 f265abb03327608bc67fb86c57a6b37d4a70293d
SHA512 6c2ab7acbea398e4707defd74b92891b4c533eb488b5818e161a310ba09b3a81297274cbc1f83b1bfdf46c49aaec67ddcca4170251bc9773c9d3c1d2ab7834eb
SSDEEP 12288:yOUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3N:yOt2rR8FfBhRJUEbDk1ulU9
TLSH
T180C42312F2A848A3F2578A74B8F5C31154122C8F7FF2AB032E64583A3635DE575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1e883ee0bf8f8eb6de6853298029d2f6444882e368ed1d5e8a23a72342dfa11f
MD5 c65e22787f4e4b9af43d58bc08d9b55c
SHA1 b0b599abe32d9fe4229304b3ebdac613fedf63a3
SHA512 962f452041e0a401011d6b6326828b2ffd2e859dafdd5970241f12375221eb9a868ebb6b99f794b7c6ff1c0887b616d5eedd0119e9ff38af65e1f645e2bea99a
SSDEEP 12288:W8UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3b:W8t2rR8FfBhRJUEbDk1ulUr
TLSH
T1E3C42312F3A848A3F2578A74B8F6C32154122C8E7FF6AB032E6418393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3bbbd3aa01f8a2b761c2c7a2188a3acee0097e05301f2fb50670c5cb8da95dcb
MD5 50092f4cf48bf2ea1047ca74cbc6a3d0
SHA1 21df4867567d385f39454c7281e90a766300346f
SHA512 27aecaf40c2c18a0ab09dd50a255fcd1a1cce02c6b9cd16bb83c172503fb5b18b830127b9c03276b751d977b6e8794633dd23f95af41f72f0d3fedef8baa2301
SSDEEP 12288:FVRUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3O:Rt2rR8FfBhRJUEbDk1ulUe
TLSH
T149D42312B3A844E2F567D674E8F6C31191327C8A7FB29B4B1E50083E1E31AE479B5BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8467e5d8c16f5a53b094367dbb6b2994536ce930e6fe03e66971e115dd200598
MD5 106d31c7ce8e81d99249d763ee742c81
SHA1 9a3b0e4966d91628ddc884bf1edbdc2741a3ea90
SHA512 275fb6d0ca2dc764835f1c96e698fe226a6c42145cb051dfda525ce2178bbb6e3d6178f4184e137fdec2398da82437c8f80b05ce443b7d472783ee7171847c32
SSDEEP 12288:lpUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3b:lpt2rR8FfBhRJUEbDk1ulUr
TLSH
T1FCC42312F2A848A3F2578A74B8F6C32154122C8F7FF6AB432E6414393635DE579F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c10cf6765fba2a5f5803ac8d9b677a30d4620d366016949a65cb98f666dfbaea
MD5 2468abde5c4416ec7c42a1fe3bb04720
SHA1 feb64f3028dee02015f776dd87cd6fabe53e8299
SHA512 f8d116289b588dbdd02aeefc6b258c1917bac3661ab9e95806a87315f5569298f90c52d68f6742041f0bd7da7f95d3b92ece8f89f96905f1cd6578a0982adff0
SSDEEP 12288:JiUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3b:Jit2rR8FfBhRJUEbDk1ulUr
TLSH
T103C42312F3A848A3F2578A74B8F5C32154122C8E7FF2AB032E64583A3635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ed97ae29b5a4db646cea7f68b2435aaf0620672f115300613adaae3bac2292b1
MD5 277cbfd24c968ea7bdf1d092686cd195
SHA1 e5b82b462f47fa30a8c19515775ed5b824c7efdc
SHA512 83918e0e5d69440f58fe1bb40e3454e0f3009e780532e8bd1772dd68ba0f64d8ad510712c5ee9d66dfe1a0cfcd0dfd6ba3e90fb040778e43a58bbafbeaee28ec
SSDEEP 12288:fmUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3L:fmt2rR8FfBhRJUEbDk1ulUb
TLSH
T1EFC42312F3A848A3F2578A74B8F5C32144122C8E7FF6AB032E6454393635DA575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e2d6ab2ccc8eae9dae41717e6fde13c6007463888de2393a1721231633788de6
MD5 97cf500738d80b6ff3716995468ece40
SHA1 775949ce8213807c48ef0ee2c3bc3542d4b82fb1
SHA512 54bed2815a169fb4686200ea86b6b5be3cfefca6266af44aefba44635ae652db88331731793ffa86309dbe0b4033808220dd322f55afa219733e88f8884485c2
SSDEEP 12288:HiZwb6zzFEoS2cPvyuUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3d:CZMSzFVSOut2rR8FfBhRJUEbDk1ulUN
TLSH
T1E4050195B39018F5ED67823DC8658916D2B27C5A1BB0CB0F17A4362B1F337A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c4cb9956f46287ef00fc387584ebe1fba129dc2e80ea2ca4dc3aa2870961830e
MD5 7b86014f2ad4fa5344dd5942bfb713c7
SHA1 f41505063d867f5edd3abc95a1c051d91344df58
SHA512 ba285bb8f0a6a3a292015699ef1bdf4f2a8d73456869e11a1513fb67febc9a7ba3d7304bb582b90385c29bb8da5e75e81e769a475937077de329add27fe84d16
SSDEEP 12288:IPUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3y:IPt2rR8FfBhRJUEbDk1ulUi
TLSH
T17EC42312F3A848A3F2578A74B8F6C31144122C8E7FF2AB432E6458393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3f2ef9ce93c43fb624589768c456de270ed4a3f626989d4926534c7c058e1f1a
MD5 02321ea41f46691d0a8d85e55a74043b
SHA1 5615ff9f0e1c9bfdc89475acc4c4f6ca273990fb
SHA512 4de9a5efa87b0cc35ef8f1e987b5afe887e9445784a13a4fd5e5dcc6eea2b3db441722321ead1cfae4671797f9ea5cd5d97d6929eebf189f1715eba513d2e093
SSDEEP 12288:yrUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3y:yrt2rR8FfBhRJUEbDk1ulUi
TLSH
T134C42312F3A848A3F2578A74B8F5C32144122C8F7FF2AB432E6458393635DA579F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0df40bbad954ec04bb0cbd96439b1c5b5371dd65b477e1df690deb57841f35b4
MD5 cae2d4cbb2c8cd394401d9c7881f714d
SHA1 031019caee31fa189dfc28c8ee40c278d11afbd6
SHA512 ccc6f747311941b7a6b4e00ba20b849558f3e5736f4cfe8b43ab80592f0d6c51fcd3f6de3a2f985d8358227b9b0bcfc210cec318224831566b78ded6abe68a45
SSDEEP 12288:hyPz5L8qUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3J:wzyqt2rR8FfBhRJUEbDk1ulU5
TLSH
T182F4021773A420F5E1678238C8A25A11F3727C761B719F9F1764063A2F376E0AD7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7909161ba71e8dd8e00978adfa69815df45d06c72bcc7065898b9a16dacb8478
MD5 2613f5d2ef59a80c0c1e3c38089563cd
SHA1 cbcf1dc79ea97518b138785dd88871870bb6e1f1
SHA512 f99ddbe12a30cb7f715835e6786034512f1fc75d9399a04d609750f3a1967d46b5205f56cba0edd1c8bf56519f96689c8a32ad215135a4eb1493616f25a6a876
SSDEEP 12288:9PUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3H:9Pt2rR8FfBhRJUEbDk1ulUX
TLSH
T11CC42312F2A848A3F2578A74B8F6C32144122C8F7FF2AB432E6458393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bbc96c7ceba7e8082365d1d77811035314725f1998802543a5265b8137a45f34
MD5 04c3705b3c7d7624985dda8988933dae
SHA1 eaa526be3d95839dbd69a6e0ae57f4ebeec9e56d
SHA512 7ee4419863237a487a92bdacefc2a17ef67610ae4be8902d0637aaa6f380c26ec197e994ef740987bb73ee8caf3c0080a04f338218ba2568a7d35dfad1949de8
SSDEEP 12288:0PUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3H:0Pt2rR8FfBhRJUEbDk1ulUX
TLSH
T1C4C42312F2A848A3F2578A74B8F5C32144122C8F7FF2AB432E6518393635DA975F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 349637780ac95d8544ef411d6eead446c55499a72620373737c2f67c0523686c
MD5 2753de3390ae1f84998d1728e2e0ca8a
SHA1 958a2d143cf8dc305788814dc544315b4a2c18ca
SHA512 7db0448b34eb1cb175d10be5b03ea94301a2976dd898a71c7edd6168eb951a3f0118c29a813d67692d22763383526f1c1795f15e53534ae1c654996a53f71c16
SSDEEP 12288:CyPz5L8qUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3S:fzyqt2rR8FfBhRJUEbDk1ulUi
TLSH
T16CF4021773A420F5E1678238C8A25A11F3727C761B719F9F1764063A2F376E0AD7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 2b0642d0f707baa18b34ca74ab70f96a82d76b45592b8b524872b46079440d8b
MD5 4760b396d2d2e2048cf54ea88d6966ed
SHA1 4c33acdec87f18c383abd25362591efacc452be2
SHA512 356aabd3d848d62098e321855fa162f252b48b5c97f56a32a4b5d5f97b80bdf5be445316a3f15c0459f5439e5c0a045d78dd4cd932ba85b895f9e7c6437d4ac1
SSDEEP 24576:pTHaLl3z0zDst2rR8FfBhRJUEbDk1ulUu:pT6LljVt2r4PRSEk1ul
TLSH
T114050195B39018F5ED67823EC8658916D2B27C5A1BB0CB1F07A4362B1F333A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1f3c32e118661a63615ea1c68040c3fe64ff41b1022f60d0fd0f628e41456d57
MD5 36aba2a1ee6b3127c07b35b99a3a560d
SHA1 1e5550bd81e4a473646b150fe62e8f9acce96c47
SHA512 f23924c39ba8c14568fc3bd16db2a1b3e44327dd74d6edf2875b6a4f2034a49d4beee96875b39787951ca10ec977cef008f595c3bafd6838a08c03ea264a2cd7
SSDEEP 24576:r37d9CHKy7GZAt2rR8FfBhRJUEbDk1ulUe:L7d9CHKyayt2r4PRSEk1ul
TLSH
T1E825CF90F3E414E4F1B78A358D768611DA767C9A1B71DE8F03A4252A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e65285de668a836a7b1eade239ae73938e5722773b8740ba8c03d6a8c306e7a4
MD5 9e2f7a2085afc9d537332a33379202b1
SHA1 fe088b0382f64f2e30e1bcf2dd17f610d6c4a719
SHA512 59b990aefa9f1d65b9e395b9373df378cb391e30aa5e49b0ce236699085679159b9906f6286359629010af8f1e8f23caa395f692bbc1444b4300ad3a0de9b2d7
SSDEEP 12288:3cUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3S:3ct2rR8FfBhRJUEbDk1ulUi
TLSH
T115C42312F2A848A3F2578A74B8F6C32154122C8E7FF2AB072E6414393635DE575FA6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 bc93683cb1493da94bd70e2882f90f16845eaf0b1c99831a3cde19c263b4abfb
MD5 8825d09b8af6d84cb3aadd27cf3493a5
SHA1 d06a15cee674c9ebd72a44d8fc354e4b66436e32
SHA512 5f447ecf8ea57a0d9b2de8b38b72b016c473f9545f482e024338831cf2dbe18d804225f920566fa029e07d4061a1e6531887bbc82c3f34ecd6d29049d8c80526
SSDEEP 12288:FKUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3E:FKt2rR8FfBhRJUEbDk1ulU0
TLSH
T1B7C42312F3A848A3F2578A74B8F6C31154122C8E7FF6AB032E64183A2635DE579F56D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e1cf5471ec559b7902b9c8cbd194329d803068e5807596e02d47019e5ac165c1
MD5 dc3c1955ad0b7952e9bd57a137c61cb0
SHA1 747ceadd55a070533967795c228d3dbbbfa77a46
SHA512 b74422abb43dd350303c9e6e3507040cf3823c16803016168f0b7122448637c861efa4fe6b0ea671d78f6802d0c3d32fdbdc2bc220fbf25098cf29fdfc57273d
SSDEEP 12288:TtUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U34:Ttt2rR8FfBhRJUEbDk1ulUo
TLSH
T17FC42312F2A848A3F2578A74B8F6C32154122C8F7FF2AB032E6518393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a0dc2c3ba1f623828226e0fc08cbed88640097c1a98e4d322e1dcc25e9e4a9e0
MD5 30539e69a917845f502405448dc0213e
SHA1 47c6b6a1f0dac3699a7feb7140e1703044629682
SHA512 fcde18e2a38fe7265eeba0e7bd575677978aeef8ba22da34931bdbfc4d8c85724ae66639c04439c066731e8a5491c4922ebd1e9e8e30d074edca514a8106a960
SSDEEP 12288:lPUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U34:lPt2rR8FfBhRJUEbDk1ulUo
TLSH
T14DC42312F3A848A3F2578A74B8F6C32144122C8F7FF2AB432E6518393635DA575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f355b38dcd0e30ec27a0ccfe3d15202e1fe4bfb2d7a5a112f55a16c3bda45aad
MD5 493b2d74eccb608d454fbbc7c966573b
SHA1 9b18cc0b0c632d7f40b91a203bdbdd8eca30272a
SHA512 c7eb5d095a84b875b539953bab7e74a6ac7aabc8bd5177f7d1d973baaace18d7b2bbab8db2514768071f2d0d5b66f9e45599568981c56d67115d0686b51f127a
SSDEEP 12288:ucUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3B:uct2rR8FfBhRJUEbDk1ulUx
TLSH
T158C42312F2A848A3F2578A74B8F6C32154122C8F7FF6AB072E6414393635DE579F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 32727a798c9b683207093dd346bca13dc2aeafb58414f20cb646f5477d4b48f9
MD5 24425463c3eff963f3fedd9456d67801
SHA1 1b8045680eb08ddc58df0f6fd4dd98e9b5a33765
SHA512 ebf4a86936df6dcdf9679b5e705f3690d693491424fd62a6f6d88dd57f80375e4ef1f6adba2c4de8f92a030f416e8c1c0f85b7f2803a330be60527b08de45a93
SSDEEP 12288:QnUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3l:Qnt2rR8FfBhRJUEbDk1ulUV
TLSH
T1ACC42312F3A848A3F2578A74B8F6C32144162C8E7FF2AB032E6518393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 82c750d081a817764c65cbbdf7817d8f1c9f363c2bd0b4b56a115b0d6828de2f
MD5 6eb3bc5b36bba29ea7e3d1ab3e4cfd91
SHA1 e9171f28cc102fcf28d4987ba1be7c266bbb5530
SHA512 63f4a97504dabede4ea01ffb76b979dbcbbb623af0d343b31d5c408d65b92e7cc159dee3beea13953c18c47058d37cf40f5d5dd0f594b9e702ba3f9067472c0a
SSDEEP 12288:NpUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3B:Npt2rR8FfBhRJUEbDk1ulUx
TLSH
T181C42312F2A848A3F2578A74B8F6C32154122C8F7FF6AB032E6418393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 fabbbf33a046287d0402f8caaf4efdd1644f421c6200344cfccfb8df627fa008
MD5 e199c520eb92be871c947d2caaae7522
SHA1 95af9feb962304fe90e265bf4b50917897efad4d
SHA512 a8e8d0c429fa8cc0fcbaa49df1bf4545607c1a692bdc9f2e4e49291c0f8ed581ea2f71e75a9b4da0d81ef1850f2ebe2b839db1969d91bba5e6bc3201f82989a3
SSDEEP 24576:5fwvok9RX6wkyAI7t2rR8FfBhRJUEbDk1ulU9:fMnYI7t2r4PRSEk1ul
TLSH
T19535DF29EBDC44E1E1B7923C99B7460AF2B178591B31C6CF029A536D0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5bad1228ba1b276673e2ab3000bcd313f5dc486263970f1cc29ce632958e6151
MD5 5cdb4eef54d81d22b588d6acf322c8d2
SHA1 c53a5689cd4f84d91d4d0bc6c251d3186ff436c1
SHA512 6cfeae30dc9479cbfb013daafb98180ccb542f6c9a0fe5b44a08757b932e4f601ec324e773d4baf4d4c90740a0cd2d9fcac967f69a83a2e25540fc9722c797b2
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Yt2r4PRSEk1ul:7ySzPAt2sEE5
TLSH
T19C066C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9782b6498559bd68a9749e38f483ccba2ee9e5b6a3926dc797a9c801633f7ca8
MD5 3cc1e44f3acc2de97b56849e49fc4f8a
SHA1 d07efc38c0659592c04672e9c77efe4f85d8cd91
SHA512 87b126bc61b7457b87f7ff864cd4aff9e9c14bb452d4c4e420fbcb9b00a98b90c78e6da5bd8c9f3da814a42606d44d6d4a8cfa7047a95a3e881bc5690bf525ba
SSDEEP 24576:847Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+t2rR8FfBhRJUEbDk1ulU2:847JUQj1irIhCnDHUPfF/ot2r4PRSEkI
TLSH
T12565AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3a9f1f890093abb45aa90d67629b5fec3a0359dd3424bb289acb490c0e3eb228
MD5 c025bf5e2ef555888c0b0d2cb544ef86
SHA1 c62ce1d4da230fdb0e039f7fac33d275d16e1838
SHA512 f036f7376af57928b10000fd4b386e9b0f511a91098b8ed8423d1155eca18882dbda4d4a126c27a5532a223b3be0b2d9009549a813c38e5403c4e31cb44f3e9a
SSDEEP 12288:pNsf/UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3m:u/t2rR8FfBhRJUEbDk1ulU2
TLSH
T1F7E4F11AE29801E9D06E5278DBA68601B3233C5557F1D7CB16D0F43E1F36A90ADFAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 972KB
SHA256 6940d544abd867fd5894811642291316af363c0c198f360a10e5dae4608141aa
MD5 4c6a4c0c3614a3065544fd1ae53961cd
SHA1 925c561fb62507f297025c178f51b4a53952d14b
SHA512 c96b0df90f0f1d9f75342e72140b006bbeb084da3594a1a65388cf1c0fec75f754c104ea1e7e7187f5172363139ff5a3203d1f54c31c11ce59a4537abf386ac6
SSDEEP 6144:PEsBC2nas2CZt9D+GUAEEz2CotMxgGWMU3ftkRgEp+U1+C1x62dSjoa2Bxnn+FUv:PNXt+iU3f3mnXQgnnuUUOgL3eczPOH
TLSH
T1D5252810766AD75FC6AD40321E33C2CCA7707D41EE05AB0372C9872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 01982d8cf2bf4dbfc9ce2ad03ecec0ca2b58cb8282d2548a5a7f4d5ba35b37da
MD5 83008291e195432f58b89c6ffde7cea6
SHA1 6b000889991465d5ffda25e82ca61be02ec5c54f
SHA512 f8134930e24f1af8697d21a50c12661ae205e12b2cc55d2c41b1b5e937be7d7203868d1055197f0e00196b7892f29dac12ee738a9c10f506c4978a53671a7738
SSDEEP 12288:Hhr+2BIOe3rl9lWRRbge6h9KF+JYD8FXXHd3:Br+mId3rl9lWRRbge6h9KF+JYD8FXX93
TLSH
T1FE55A5815537A3CBD1FB2132072A5B4CA764EC0777496F2663C8453ED82BB26A1BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4518f5b9c9f4082e6cb4282360098456d9cf156e07e963df64422e83d17fb8dd
MD5 777cbe821f2984c2dfce16934707d23d
SHA1 a39bd06113a91f0073d3a55d999969fddd5e31f9
SHA512 e1a5d33f1ae02a5f87a13a13e7752b6a1e5b58d539508d21bb469d490bb891ae7a968be68d7de0dd50440867de7fb1830abc8cefa8b8eb705baf11a8de1c9141
SSDEEP 12288:0F7XUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3H:IXt2rR8FfBhRJUEbDk1ulU3
TLSH
T103D42312F3A88863F2B79A7468FAC32011177C892FA1DBC32D54153A3534DE4ADF5AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c66faf6c372d4741fceb1f1d5e894efacc1cb61485f86b5b30df2661c393818c
MD5 b886c74139f9f0abe812bfa44967e113
SHA1 84d1d5518838910e188d03f993e3ed4c4771a34e
SHA512 8f99563d6abcb2fbae892ce027250ad5d22d9e9fa1b999f5e4a4c817089fdf2a2f9c1624c30268834a250180e07d8c4ec4a3d5751368d94a07c583a4516d3d7e
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYVt2rR8FfBhRJUEbDk1ulUP:fgb4mBIBhGF+t2r4PRSEk1ul
TLSH
T1EC659E1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fdc20bf437544346c5c62b9614cfd8a4e33f0e54b3bf51e50edc0fdbebadae79
MD5 b34e18ebe5eb01a1b086e32d7633e0c1
SHA1 ecc84d0ab2be269e8fb32db37d197e5a76dd8848
SHA512 9ed354582506ab59b5379408cf03d833a0cb4b6a73bcd38e341036b45ad4dbbc598b817c51f8e6f9e55d4e32157c8114df2af41503e041863154fd11638bf571
SSDEEP 24576:zG88u8FpJqH1bzria7/mut2rR8FfBhRJUEbDk1ulUI:C7ZFPqVea7/Nt2r4PRSEk1ul
TLSH
T196350165B3E001F1D477D13889824663F6B2B8151374EFDF0BA88A651F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 be97f3f6eaa2001a034d7ffd98dcd5be3bbc36f88c259447fba8f9c5b80ae580
MD5 f0d5215dfda0bb0d0272784a8faf4181
SHA1 b4789ea189add70b0255f4254611b9db6200d537
SHA512 9700506e92c27cb53aa37b88f23e182b1fd9ab4dc97ebdcadd8f25269fbb40e7a7995f92abed32dc079c7038693296b25a3ccde9ff2af4900479504587d6539e
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjit2r4PRSEk1ul:4G05lO43bTt2sEE5
TLSH
T1A1D5C06A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95f64255aaee7a0d511453b7014bd487199a61a121f2680a98f3663817cf0a4a
MD5 3bd8ab0d43d9bdcf1bca14009d273fe7
SHA1 c2758555e8cb9cb7fd778ee129c33a672e3dade5
SHA512 a21f6697c676bea5882e7f88d0e6c276cb3d063f3135dcf3a573e094ca3508ed611aa2ca8e349ee94830d9f2008bd64cf63a5cede5377e1440984b0d9dbf1522
SSDEEP 24576:Wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYt2rR8FfBhRJUEbDk1ulUz:Oa5POZ3+Jt2pasx2+mKt2r4PRSEk1ul
TLSH
T1CF65AF5EA3FC01D5E179D17DC583861AE5B1342653319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d69a15515ab7a6f40bdf62c6e3c46c862a253149636afe43cd92be782f560fdf
MD5 eca81ab264389ce1af6c0b040be16560
SHA1 a06ea5da720d628e418ae965be0a97f5705cb604
SHA512 a2d651949a5b5cc95013c75b3ce7514862f72e22a435f2b51654ab9ec98e44c3c3718914e6e6f385158c69888735df28d0d8c01f19a14df858b927845c8797d4
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkWt2rR8FfBhRJUEbDk1ulU6:CNc/zEOVHFtt2r4PRSEk1ul
TLSH
T161857B1623E901E4F1BBE1BE89779546FA71786917308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 15cd44aa06e947dc30110bd63b92ea959d829de457b065c99961c9310c88dd27
MD5 4acb003a5e6b7c17270ee5b518231180
SHA1 21c1ddf0d9cd303f60aa5ef358570da640dd9f96
SHA512 b6746828bce28af64cd60295fc9538713a5720b617e4857ecf5bc94a506b5880f1520d92b9d3d485a4106c8e86f68f4dcbb8f2b5d83c97ff5f5b9ffe0cdf0aaa
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmPt2rR8FfBhRJUEbDk1ulUT:G8MwBtOmPt2r4PRSEk1ul
TLSH
T10B55AF2EB6F846E4E1FAC6B4CD238512E6727851173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 3caa8b5582387adfdb549fdf5ba3e5d69257d25deabf8934e4e5769718d4f50c
MD5 5921fa4ef640e334f97db374555d7ca8
SHA1 c20307315a07b89c076e1eb29e788afe88d90b73
SHA512 87c46d21748199fceaf9ab4018c0dc17c8135c800fc6896443b10e9fec505b87015c31c0e78f39ffd7cf95063e417c9c227229f81eebdea43aa92957c563b1a0
SSDEEP 12288:GHvUrBFrEjwaQyUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U35:GPUr+NQyt2rR8FfBhRJUEbDk1ulUJ
TLSH
T19805E12F62AC18E5F676A17C89828719E77278561712D6CF02E0813E1F27DE8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 325b76cd8188143ae05b217e18bb327c039463f4cfcfb99313f2aebd34fca8fa
MD5 5eba18ec102b9d99e2c4a6433361b3ee
SHA1 3c0bf193d54eca97fa13a9021438ea454a5befbf
SHA512 aa66e9d35b68a017ac6eeed300c0e98de84f970afd92993950c7e3c8c9c11821193a60533d145939b8361d69f85fd8a0fd8445e8ba1c9008c1b775e51313d76e
SSDEEP 24576:4D3FHshBIYQgAjt2rR8FfBhRJUEbDk1ulUW:4DVHeBIAAjt2r4PRSEk1ul
TLSH
T1D325E13EE79C04E4E57BC1BCD9A38606E67138A9073256CB0694817A1F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-313-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/712-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/712-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/712-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/712-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1212-314-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1212-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1212-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1212-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1212-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1244-160-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1244-89-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/1244-84-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2444-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2444-165-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2444-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2444-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2984-63-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/2984-69-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/2984-166-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2992-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2992-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2992-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2992-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2992-333-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2992-161-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3652-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3652-162-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3652-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3652-315-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3652-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4428-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4428-317-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4428-158-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4428-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4428-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4500-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4500-164-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4500-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4652-159-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4652-74-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4652-80-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5752-0-0x0000000140000000-0x0000000140409000-memory.dmp

Download

memory/5752-38-0x0000000140000000-0x0000000140409000-memory.dmp

Download

memory/5752-33-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5752-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5752-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5752-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5840-132-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5840-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5840-126-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5840-137-0x0000000000780000-0x00000000007E0000-memory.dmp

Download